Edit tour

Windows Analysis Report
1w3BDu68Sg.dll

Overview

General Information

Sample name:	1w3BDu68Sg.dll renamed because original name is a hash value
Original sample name:	c05e2dab77349cd639aa837e7e121710b8a0718d8fc93fb4cc6458ae90e5c597.dll
Analysis ID:	1453819
MD5:	ae12bb54af31227017feffd9598a6f5e
SHA1:	f597a1cc16d42b7f02e077696e067cd3030a06d9
SHA256:	c05e2dab77349cd639aa837e7e121710b8a0718d8fc93fb4cc6458ae90e5c597
Infos:

Detection

Wannacry

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to download HTTP data from a sinkholed server

Yara detected Wannacry ransomware

Connects to many IPs within the same subnet mask (likely port scanning)

Connects to many different private IPs (likely to spread or exploit)

Connects to many different private IPs via SMB (likely to spread or exploit)

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

HTTP GET or POST without a user agent

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 4596 cmdline: loaddll32.exe "C:\Users\user\Desktop\1w3BDu68Sg.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 5064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5256 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\1w3BDu68Sg.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 4544 cmdline: rundll32.exe "C:\Users\user\Desktop\1w3BDu68Sg.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4892 cmdline: rundll32.exe C:\Users\user\Desktop\1w3BDu68Sg.dll,PlayGame MD5: 889B99C52A60DD49227C5E485A016679)

mssecsvc.exe (PID: 3192 cmdline: C:\WINDOWS\mssecsvc.exe MD5: 0C694193CEAC8BFB016491FFB534EB7C)

tasksche.exe (PID: 3748 cmdline: C:\WINDOWS\tasksche.exe /i MD5: 7F7CCAA16FB15EB1C7399D422F8363E8)

rundll32.exe (PID: 5252 cmdline: rundll32.exe "C:\Users\user\Desktop\1w3BDu68Sg.dll",PlayGame MD5: 889B99C52A60DD49227C5E485A016679)

mssecsvc.exe (PID: 1036 cmdline: C:\WINDOWS\mssecsvc.exe MD5: 0C694193CEAC8BFB016491FFB534EB7C)

tasksche.exe (PID: 5008 cmdline: C:\WINDOWS\tasksche.exe /i MD5: 7F7CCAA16FB15EB1C7399D422F8363E8)

mssecsvc.exe (PID: 2924 cmdline: C:\WINDOWS\mssecsvc.exe -m security MD5: 0C694193CEAC8BFB016491FFB534EB7C)

svchost.exe (PID: 3664 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
WannaCryptor, WannaCry, WannaCrypt		Lazarus Group	http://blog.emsisoft.com/2017/05/12/wcry-ransomware-outbreak/ http://www.independent.co.uk/news/uk/home-news/wannacry-malware-hack-nhs-report-cybercrime-north-korea-uk-ben-wallace-a8022491.html https://baesystemsai.blogspot.de/2017/05/wanacrypt0r-ransomworm.html https://blog.avast.com/ransomware-that-infected-telefonica-and-nhs-hospitals-is-spreading-aggressively-with-over-50000-attacks-so-far-today https://blog.comae.io/wannacry-decrypting-files-with-wanakiwi-demo-86bafb81112d	https://malpedia.caad.fkie.fraunhofer.de/details/win.wannacryptor

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
1w3BDu68Sg.dll	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
1w3BDu68Sg.dll	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x45604:$x1: icacls . /grant Everyone:F /T /C /Q 0x353d0:$x3: tasksche.exe 0x455e0:$x3: tasksche.exe 0x455bc:$x4: Global\MsWinZonesCacheCounterMutexA 0x45634:$x5: WNcry@2ol7 0x3543b:$x6: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com 0x3028:$x7: mssecsvc.exe 0x120ac:$x7: mssecsvc.exe 0x1b3b4:$x7: mssecsvc.exe 0x353a8:$x8: C:\%s\qeriuwjhrf 0x45604:$x9: icacls . /grant Everyone:F /T /C /Q 0x3014:$s1: C:\%s\%s 0x12098:$s1: C:\%s\%s 0x1b39c:$s1: C:\%s\%s 0x353bc:$s1: C:\%s\%s 0x45534:$s3: cmd.exe /c "%s" 0x77a88:$s4: msg/m_portuguese.wnry 0x326f0:$s5: \\192.168.56.20\IPC$ 0x1fae5:$s6: \\172.16.99.5\IPC$ 0xd195:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x78da:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44
1w3BDu68Sg.dll	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x455e0:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x45608:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\tasksche.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Windows\tasksche.exe	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
C:\Windows\tasksche.exe	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
C:\Windows\tasksche.exe	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.2781831927.000000000042E000.00000004.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000002.2147501078.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000009.00000002.2146717318.000000000040E000.00000008.00000001.01000000.00000007.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000009.00000000.2146308029.000000000040E000.00000008.00000001.01000000.00000007.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
0000000B.00000000.2152432616.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000008.00000000.2138160510.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000C.00000002.2161927625.000000000040E000.00000008.00000001.01000000.00000007.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
0000000C.00000000.2161380343.000000000040E000.00000008.00000001.01000000.00000007.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000006.00000000.2124091676.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000B.00000002.2162442573.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000008.00000002.2783198767.00000000023DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000008.00000002.2783198767.00000000023DC000.00000004.00000020.00020000.00000000.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x32e44:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x32e6c:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000006.00000002.2147653704.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000002.2147653704.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000008.00000000.2138279487.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000008.00000000.2138279487.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
0000000B.00000002.2162585695.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000B.00000002.2162585695.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000008.00000002.2781957161.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000008.00000002.2781957161.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000008.00000002.2782901909.0000000001EB9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000008.00000002.2782901909.0000000001EB9000.00000004.00000020.00020000.00000000.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x32600:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x32628:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
0000000B.00000000.2152554456.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000B.00000000.2152554456.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000006.00000000.2124227009.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.2124227009.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
Process Memory Space: mssecsvc.exe PID: 3192	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvc.exe PID: 2924	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvc.exe PID: 1036	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 24 entries

Sigma Signatures

System Summary

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, ProcessId: 3664, ProcessName: svchost.exe

Snort Signatures

ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 - Source IP: 192.168.2.6 - Destination IP: 104.16.166.228

Timestamp:	06/07/24-19:17:54.665875
SID:	2024298
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Kryptos Logic - Source IP: 104.16.166.228 - Destination IP: 192.168.2.6

Timestamp:	06/07/24-19:17:57.559210
SID:	2031515
Source Port:	80
Destination Port:	49729
Protocol:	TCP
Classtype:	Misc activity

ET TROJAN Known Sinkhole Response Kryptos Logic - Source IP: 104.16.166.228 - Destination IP: 192.168.2.6

Timestamp:	06/07/24-19:17:55.318490
SID:	2031515
Source Port:	80
Destination Port:	49711
Protocol:	TCP
Classtype:	Misc activity

ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 - Source IP: 192.168.2.6 - Destination IP: 104.16.166.228

Timestamp:	06/07/24-19:20:00.749879
SID:	2024298
Source Port:	50477
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 - Source IP: 192.168.2.6 - Destination IP: 104.16.166.228

Timestamp:	06/07/24-19:17:55.463710
SID:	2024298
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 - Source IP: 192.168.2.6 - Destination IP: 104.16.166.228

Timestamp:	06/07/24-19:17:56.918211
SID:	2024298
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible WannaCry DNS Lookup 1 - Source IP: 192.168.2.6 - Destination IP: 1.1.1.1

Timestamp:	06/07/24-19:17:54.642321
SID:	2024291
Source Port:	54007
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Kryptos Logic - Source IP: 104.16.166.228 - Destination IP: 192.168.2.6

Timestamp:	06/07/24-19:17:56.092110
SID:	2031515
Source Port:	80
Destination Port:	49712
Protocol:	TCP
Classtype:	Misc activity

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 1w3BDu68Sg.dll

Avira: detected

Antivirus detection for URL or domain

Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/7	Avira URL Cloud: Label: phishing
Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	Avira URL Cloud: Label: phishing
Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/34	Avira URL Cloud: Label: phishing
Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/x	Avira URL Cloud: Label: phishing
Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Windows\tasksche.exe

Avira: detection malicious, Label: TR/AD.WannaCry.sewvt

Multi AV Scanner detection for dropped file

Source: C:\WINDOWS\qeriuwjhrf (copy)	ReversingLabs: Detection: 100%
Source: C:\Windows\tasksche.exe	ReversingLabs: Detection: 100%

Multi AV Scanner detection for submitted file

Source: 1w3BDu68Sg.dll

ReversingLabs: Detection: 91%

Machine Learning detection for dropped file

Source: C:\Windows\tasksche.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 1w3BDu68Sg.dll

Joe Sandbox ML: detected

Exploits

Connects to many different private IPs (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior

Connects to many different private IPs via SMB (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior

Source: 1w3BDu68Sg.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.6:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.6:50159 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50475 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50476 version: TLS 1.2

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2024291 ET TROJAN Possible WannaCry DNS Lookup 1 192.168.2.6:54007 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2024298 ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 192.168.2.6:49711 -> 104.16.166.228:80
Source: Traffic	Snort IDS: 2031515 ET TROJAN Known Sinkhole Response Kryptos Logic 104.16.166.228:80 -> 192.168.2.6:49711
Source: Traffic	Snort IDS: 2024298 ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 192.168.2.6:49712 -> 104.16.166.228:80
Source: Traffic	Snort IDS: 2031515 ET TROJAN Known Sinkhole Response Kryptos Logic 104.16.166.228:80 -> 192.168.2.6:49712
Source: Traffic	Snort IDS: 2024298 ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 192.168.2.6:49729 -> 104.16.166.228:80
Source: Traffic	Snort IDS: 2031515 ET TROJAN Known Sinkhole Response Kryptos Logic 104.16.166.228:80 -> 192.168.2.6:49729
Source: Traffic	Snort IDS: 2024298 ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 192.168.2.6:50477 -> 104.16.166.228:80

Tries to download HTTP data from a sinkholed server

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Jun 2024 17:17:55 GMTContent-Type: text/htmlContent-Length: 607Connection: closeServer: cloudflareCF-RAY: 89024c642f716b13-DFWData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Jun 2024 17:17:56 GMTContent-Type: text/htmlContent-Length: 607Connection: closeServer: cloudflareCF-RAY: 89024c690e4c2857-DFWData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Jun 2024 17:17:57 GMTContent-Type: text/htmlContent-Length: 607Connection: closeServer: cloudflareCF-RAY: 89024c723ec02e18-DFWData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>

Connects to many IPs within the same subnet mask (likely port scanning)

Source: global traffic

TCP traffic: Count: 11 IPs: 199.164.60.2,199.164.60.3,199.164.60.1,199.164.60.6,199.164.60.145,199.164.60.7,199.164.60.4,199.164.60.5,199.164.60.8,199.164.60.9,199.164.60.10

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 196.22.85.250
Source: unknown	TCP traffic detected without corresponding DNS query: 196.22.85.250
Source: unknown	TCP traffic detected without corresponding DNS query: 196.22.85.250
Source: unknown	TCP traffic detected without corresponding DNS query: 196.22.85.1
Source: unknown	TCP traffic detected without corresponding DNS query: 196.22.85.1
Source: unknown	TCP traffic detected without corresponding DNS query: 196.22.85.1
Source: unknown	TCP traffic detected without corresponding DNS query: 196.22.85.250
Source: unknown	TCP traffic detected without corresponding DNS query: 196.22.85.1
Source: unknown	TCP traffic detected without corresponding DNS query: 196.22.85.1
Source: unknown	TCP traffic detected without corresponding DNS query: 196.22.85.1
Source: unknown	TCP traffic detected without corresponding DNS query: 196.22.85.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 38.185.73.96
Source: unknown	TCP traffic detected without corresponding DNS query: 38.185.73.96
Source: unknown	TCP traffic detected without corresponding DNS query: 38.185.73.96
Source: unknown	TCP traffic detected without corresponding DNS query: 38.185.73.1
Source: unknown	TCP traffic detected without corresponding DNS query: 38.185.73.1
Source: unknown	TCP traffic detected without corresponding DNS query: 38.185.73.1
Source: unknown	TCP traffic detected without corresponding DNS query: 38.185.73.1
Source: unknown	TCP traffic detected without corresponding DNS query: 38.185.73.1
Source: unknown	TCP traffic detected without corresponding DNS query: 38.185.73.1
Source: unknown	TCP traffic detected without corresponding DNS query: 38.185.73.96
Source: unknown	TCP traffic detected without corresponding DNS query: 38.185.73.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ruKz3o3T4HPhkZC&MD=wdey9Y6v HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ruKz3o3T4HPhkZC&MD=wdey9Y6v HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

Source: 1w3BDu68Sg.dll	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Source: mssecsvc.exe, 00000006.00000002.2148109092.0000000000DF8000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 00000008.00000002.2782432040.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 0000000B.00000002.2163020410.0000000000D20000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 0000000B.00000002.2163020410.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
Source: mssecsvc.exe, 00000008.00000002.2782432040.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/34
Source: mssecsvc.exe, 00000006.00000002.2148109092.0000000000DF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/7
Source: mssecsvc.exe, 00000006.00000002.2148109092.0000000000DF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/x
Source: mssecsvc.exe, 00000008.00000002.2781689854.000000000019D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJ
Source: mssecsvc.exe, 00000006.00000002.2148109092.0000000000DAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comr
Source: mssecsvc.exe, 00000008.00000002.2782432040.0000000000DB0000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 0000000B.00000002.2163020410.0000000000D53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.kryptoslogic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50476
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50475
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50159
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50475 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 50476 -> 443

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.6:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.6:50159 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50475 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50476 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Yara detected Wannacry ransomware

Source: Yara match	File source: 1w3BDu68Sg.dll, type: SAMPLE
Source: Yara match	File source: 00000008.00000002.2781831927.000000000042E000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2147501078.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.2152432616.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.2138160510.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.2124091676.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2162442573.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2783198767.00000000023DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2147653704.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.2138279487.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2162585695.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2781957161.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2782901909.0000000001EB9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.2152554456.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.2124227009.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 3192, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 2924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 1036, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\tasksche.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: 1w3BDu68Sg.dll, type: SAMPLE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 1w3BDu68Sg.dll, type: SAMPLE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000009.00000002.2146717318.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000009.00000000.2146308029.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 0000000C.00000002.2161927625.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 0000000C.00000000.2161380343.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000008.00000002.2783198767.00000000023DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000006.00000002.2147653704.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000008.00000000.2138279487.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 0000000B.00000002.2162585695.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000008.00000002.2781957161.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000008.00000002.2782901909.0000000001EB9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 0000000B.00000000.2152554456.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000006.00000000.2124227009.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\WINDOWS\mssecsvc.exe	Jump to behavior
Source: C:\Windows\mssecsvc.exe	File created: C:\WINDOWS\tasksche.exe	Jump to behavior
Source: C:\Windows\mssecsvc.exe	File created: C:\WINDOWS\tasksche.exe	Jump to behavior

Source: Joe Sandbox View	Dropped File: C:\WINDOWS\qeriuwjhrf (copy) 2584E1521065E45EC3C17767C065429038FC6291C091097EA8B22C8A502C41DD
Source: Joe Sandbox View	Dropped File: C:\Windows\tasksche.exe 2584E1521065E45EC3C17767C065429038FC6291C091097EA8B22C8A502C41DD

Source: tasksche.exe.6.dr

Static PE information: Resource name: XIA type: Zip archive data, at least v2.0 to extract, compression method=deflate

Source: 1w3BDu68Sg.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: 1w3BDu68Sg.dll, type: SAMPLE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 1w3BDu68Sg.dll, type: SAMPLE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000009.00000002.2146717318.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000009.00000000.2146308029.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 0000000C.00000002.2161927625.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 0000000C.00000000.2161380343.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000008.00000002.2783198767.00000000023DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000006.00000002.2147653704.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000008.00000000.2138279487.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 0000000B.00000002.2162585695.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000008.00000002.2781957161.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000008.00000002.2782901909.0000000001EB9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 0000000B.00000000.2152554456.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000006.00000000.2124227009.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware

Source: tasksche.exe, 00000009.00000002.2146717318.000000000040E000.00000008.00000001.01000000.00000007.sdmp, tasksche.exe, 0000000C.00000002.2161927625.000000000040E000.00000008.00000001.01000000.00000007.sdmp, 1w3BDu68Sg.dll, tasksche.exe.6.dr

Binary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll

Source: classification engine

Classification label: mal100.rans.troj.expl.evad.winDLL@21/2@1/100

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5064:120:WilError_03

Source: 1w3BDu68Sg.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\1w3BDu68Sg.dll,PlayGame

Source: 1w3BDu68Sg.dll

ReversingLabs: Detection: 91%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\1w3BDu68Sg.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\1w3BDu68Sg.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\1w3BDu68Sg.dll,PlayGame
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\1w3BDu68Sg.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
Source: unknown	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe -m security
Source: C:\Windows\mssecsvc.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\1w3BDu68Sg.dll",PlayGame
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
Source: C:\Windows\mssecsvc.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\1w3BDu68Sg.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\1w3BDu68Sg.dll,PlayGame	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\1w3BDu68Sg.dll",PlayGame	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\1w3BDu68Sg.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Windows\mssecsvc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: 1w3BDu68Sg.dll

Static file information: File size 5267459 > 1048576

Source: 1w3BDu68Sg.dll

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x501000

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\rundll32.exe	Executable created and started: C:\WINDOWS\mssecsvc.exe			Jump to behavior
Source: C:\Windows\mssecsvc.exe	Executable created and started: C:\WINDOWS\tasksche.exe			Jump to behavior

Source: C:\Windows\mssecsvc.exe	File created: C:\WINDOWS\qeriuwjhrf (copy)			Jump to dropped file
Source: C:\Windows\mssecsvc.exe	File created: C:\Windows\tasksche.exe			Jump to dropped file

Source: C:\Windows\mssecsvc.exe	File created: C:\WINDOWS\qeriuwjhrf (copy)			Jump to dropped file
Source: C:\Windows\mssecsvc.exe	File created: C:\Windows\tasksche.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\mssecsvc.exe

Thread delayed: delay time: 86400000

Jump to behavior

Source: C:\Windows\mssecsvc.exe TID: 2960	Thread sleep count: 91 > 30	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 2960	Thread sleep time: -182000s >= -30000s	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 3080	Thread sleep count: 116 > 30	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 3080	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 2960	Thread sleep time: -86400000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\mssecsvc.exe	Thread delayed: delay time: 86400000			Jump to behavior

Source: mssecsvc.exe, 00000006.00000002.2148109092.0000000000DAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3VmciM
Source: mssecsvc.exe, 00000006.00000002.2148109092.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 00000006.00000002.2148109092.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 00000008.00000002.2782432040.0000000000D67000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 00000008.00000002.2782432040.0000000000DB0000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 0000000B.00000002.2163020410.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 0000000B.00000002.2163020410.0000000000D4D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\1w3BDu68Sg.dll",#1

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	12 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Rundll32	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 System Information Discovery	Distributed Component Object Model	Input Capture	11 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
1w3BDu68Sg.dll	91%	ReversingLabs	Win32.Ransomware.WannaCry
1w3BDu68Sg.dll	100%	Avira	TR/AD.WannaCry.zbqny
1w3BDu68Sg.dll	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\tasksche.exe	100%	Avira	TR/AD.WannaCry.sewvt
C:\Windows\tasksche.exe	100%	Joe Sandbox ML
C:\WINDOWS\qeriuwjhrf (copy)	100%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Windows\tasksche.exe	100%	ReversingLabs	Win32.Ransomware.WannaCry

Source	Detection	Scanner	Label
https://ipinfo.io/	0%	URL Reputation	safe
https://www.kryptoslogic.com	0%	Avira URL Cloud	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/7	100%	Avira URL Cloud	phishing
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comr	0%	Avira URL Cloud	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	100%	Avira URL Cloud	phishing
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/34	100%	Avira URL Cloud	phishing
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/x	100%	Avira URL Cloud	phishing
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJ	0%	Avira URL Cloud	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	104.16.166.228	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/	true	Avira URL Cloud: phishing	unknown
https://ipinfo.io/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	1w3BDu68Sg.dll	false	Avira URL Cloud: phishing	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/34	mssecsvc.exe, 00000008.00000002.2782432040.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.kryptoslogic.com	mssecsvc.exe, 00000008.00000002.2782432040.0000000000DB0000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 0000000B.00000002.2163020410.0000000000D53000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comr	mssecsvc.exe, 00000006.00000002.2148109092.0000000000DAE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/x	mssecsvc.exe, 00000006.00000002.2148109092.0000000000DF8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/7	mssecsvc.exe, 00000006.00000002.2148109092.0000000000DF8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJ	mssecsvc.exe, 00000008.00000002.2781689854.000000000019D000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.235.245.131	unknown	Estonia	8728	InfonetEE	false
31.163.218.91	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
20.161.184.153	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
196.22.85.250	unknown	South Africa	16637	MTNNS-ASZA	false
129.100.47.3	unknown	Canada	823	UWO-ASCA	false
122.155.26.1	unknown	Thailand	9335	CAT-CLOUD-APCATTelecomPublicCompanyLimitedTH	false
129.100.47.2	unknown	Canada	823	UWO-ASCA	false
129.100.47.1	unknown	Canada	823	UWO-ASCA	false
122.155.26.2	unknown	Thailand	9335	CAT-CLOUD-APCATTelecomPublicCompanyLimitedTH	false
205.139.6.1	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
205.139.6.2	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
143.112.228.92	unknown	United States	10599	MCKESSONUS	false
71.243.85.1	unknown	United States	701	UUNETUS	false
71.243.85.2	unknown	United States	701	UUNETUS	false
99.28.220.1	unknown	United States	7018	ATT-INTERNET4US	false
65.79.232.2	unknown	United States	7029	WINDSTREAMUS	false
196.22.85.3	unknown	South Africa	16637	MTNNS-ASZA	false
196.22.85.4	unknown	South Africa	16637	MTNNS-ASZA	false
65.79.232.1	unknown	United States	7029	WINDSTREAMUS	false
213.153.200.2	unknown	Turkey	34984	TELLCOM-ASTR	false
213.153.200.1	unknown	Turkey	34984	TELLCOM-ASTR	false
156.45.127.2	unknown	United States	3527	NIH-NETUS	false
156.45.127.1	unknown	United States	3527	NIH-NETUS	false
213.153.200.3	unknown	Turkey	34984	TELLCOM-ASTR	false
196.22.85.1	unknown	South Africa	16637	MTNNS-ASZA	false
196.22.85.2	unknown	South Africa	16637	MTNNS-ASZA	false
199.164.60.2	unknown	United States	25753	CALPERSUS	true
199.164.60.3	unknown	United States	25753	CALPERSUS	true
130.209.93.74	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
199.164.60.1	unknown	United States	25753	CALPERSUS	true
199.164.60.6	unknown	United States	25753	CALPERSUS	true
199.164.60.7	unknown	United States	25753	CALPERSUS	true
199.164.60.4	unknown	United States	25753	CALPERSUS	true
199.164.60.5	unknown	United States	25753	CALPERSUS	true
217.179.3.1	unknown	United Kingdom	5503	RMIFLGB	false

Private

IP
192.168.2.148
192.168.2.149
192.168.2.146
192.168.2.147
192.168.2.140
192.168.2.141
192.168.2.144
192.168.2.145
192.168.2.142
192.168.2.143
192.168.2.159
192.168.2.157
192.168.2.158
192.168.2.151
192.168.2.152
192.168.2.150
192.168.2.155
192.168.2.156
192.168.2.153
192.168.2.154
192.168.2.126
192.168.2.247
192.168.2.127
192.168.2.248
192.168.2.124
192.168.2.245
192.168.2.125
192.168.2.246
192.168.2.128
192.168.2.249
192.168.2.129
192.168.2.240
192.168.2.122
192.168.2.243
192.168.2.123
192.168.2.244
192.168.2.120
192.168.2.241
192.168.2.121
192.168.2.242
192.168.2.97
192.168.2.137
192.168.2.96
192.168.2.138
192.168.2.99
192.168.2.135
192.168.2.98
192.168.2.136
192.168.2.139
192.168.2.250
192.168.2.130
192.168.2.251
192.168.2.91
192.168.2.90
192.168.2.93
192.168.2.133
192.168.2.254
192.168.2.92
192.168.2.134
192.168.2.95
192.168.2.131
192.168.2.252
192.168.2.94
192.168.2.132
192.168.2.253

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1453819
Start date and time:	2024-06-07 19:17:02 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1w3BDu68Sg.dll renamed because original name is a hash value
Original Sample Name:	c05e2dab77349cd639aa837e7e121710b8a0718d8fc93fb4cc6458ae90e5c597.dll
Detection:	MAL
Classification:	mal100.rans.troj.expl.evad.winDLL@21/2@1/100
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 93.184.221.240
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 1w3BDu68Sg.dll

Simulations

Behavior and APIs

Time	Type	Description
13:17:55	API Interceptor	1x Sleep call for process: loaddll32.exe modified
13:18:29	API Interceptor	112x Sleep call for process: mssecsvc.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	Get hash	malicious	Unknown	Browse	104.16.167.228
	qCc1a4w5YZ.exe	Get hash	malicious	Wannacry	Browse	104.17.244.81
	http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	Get hash	malicious	Unknown	Browse	104.17.244.81
	http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	Get hash	malicious	Unknown	Browse	104.16.173.80
	02353699.exe	Get hash	malicious	Wannacry	Browse	104.16.173.80
	05894899.exe	Get hash	malicious	Wannacry	Browse	104.17.244.81
	dNDbcC4Trx.exe	Get hash	malicious	Wannacry	Browse	104.17.244.81
	tk6uE0LqBo.exe	Get hash	malicious	Wannacry	Browse	104.17.244.81
	lioUeojCW0.exe	Get hash	malicious	Wannacry	Browse	104.17.244.81
	hCg5azGZ3S.exe	Get hash	malicious	Wannacry	Browse	104.17.244.81

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://woodcraftgroup-my.sharepoint.com/:b:/p/david/ESHcc6v6g6ZOmpHE3qcIrRIBJc4-xwRJet3VYbaBQGisHQ?e=4%3albftOC&at=9	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	https://www.tcsfuel.com	Get hash	malicious	Unknown	Browse	13.107.246.44
	http://signatureanalytics.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://page-best221.jimdosite.com/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	aph.arm.elf	Get hash	malicious	Unknown	Browse	40.105.144.167
	http://officedoumi.com/85e693bb-be07-4adc-b224-d827da274af4/EhYMalr0gLeRTm05DClQXZ5IMsMlm0-uPNNXQ8DYEoPDmKWD7EX1xwgJk9qVWeAh=Kz5kg9me1K0ogoXR4ijtoTS=kJi5pjgBCpE	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://lovechloe-my.sharepoint.com/:b:/g/personal/heidi_lovechloe_org/EcawKiHvvl5PpCtvIDebR_IBPC8eGOn9GDpMZtPOiwMQdw?e=jN2Hh6	Get hash	malicious	Unknown	Browse	20.44.10.123
	QPT 8.9 for PowerPoint.exe	Get hash	malicious	Unknown	Browse	40.126.32.136
	https://cloud.letsignit.com/collect/bc/5bfd359868d093000f1724d4?p=OjfPT7lREiUDLQp6d36aSXQolbQ31LL303XXq73c0LgCPRp2orT9jnqhLprOLL90LfaIzvzkFLCd3-2924eBGaNnzzdb2z0VcZL3eza6pD7Lvwp-E0If3Kq_h3YGcTVhXX2GI1pL-hkiu7mMH-yy75YxV9nV22St1NoGiNeS-tjQes1EnWyZmb0_ire_H49FkAZlEGymj26OM6lYK79N4IfrGmCp5RaRwlcheqD0ZmFFLI1wiOhSqY7FOlglJw6xKO41vhrU_fidhrZzJoidCJoMIgvxMPMA7LINAk83kzo=	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	20.74.79.194
	https://www.dropbox.com/l/AACUzblEiF1t5WZvAlLKyT3qXow1xVBTwNQ	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.107.42.14
ROSTELECOM-ASRU	arm.elf	Get hash	malicious	Mirai	Browse	94.78.230.57
	x86.elf	Get hash	malicious	Mirai	Browse	94.78.230.67
	skid.mips.elf	Get hash	malicious	Mirai, Moobot	Browse	2.63.171.174
	Ep3pKtF7kg.elf	Get hash	malicious	Mirai	Browse	92.100.95.83
	R0KZjqu0OA.elf	Get hash	malicious	Mirai	Browse	92.100.125.47
	arm.elf	Get hash	malicious	Mirai	Browse	2.61.16.226
	41XX8Kwk8K.elf	Get hash	malicious	Mirai	Browse	92.126.10.127
	y4YCgjlv0U.elf	Get hash	malicious	Mirai	Browse	95.106.79.100
	ls0PnGaKLG.elf	Get hash	malicious	Unknown	Browse	95.32.32.28
	Lt9n9tfJhl.elf	Get hash	malicious	Unknown	Browse	178.34.104.160
InfonetEE	X7xw44e4Ob.elf	Get hash	malicious	Mirai	Browse	82.147.174.243
	I9k2Q7HKfO.elf	Get hash	malicious	Mirai, Gafgyt	Browse	82.147.174.244
	usCv5xTgmC.elf	Get hash	malicious	Unknown	Browse	82.147.174.210
	LsgqN88sQ4.elf	Get hash	malicious	Mirai	Browse	89.235.255.175
	vttB6D4E29.elf	Get hash	malicious	Mirai	Browse	84.52.56.211
	6KdBhFhggb.elf	Get hash	malicious	Mirai	Browse	82.147.174.212
	GPGsKPOqUV.elf	Get hash	malicious	Mirai	Browse	82.147.174.224
	cta.x86.elf	Get hash	malicious	Mirai	Browse	84.52.56.218
	5eFmWG76zz.elf	Get hash	malicious	Mirai	Browse	82.147.174.234
	3FKykOcbPa.elf	Get hash	malicious	Mirai	Browse	89.235.255.150
MTNNS-ASZA	arm.elf	Get hash	malicious	Mirai	Browse	41.126.84.4
	x86.elf	Get hash	malicious	Mirai	Browse	41.122.213.76
	arm7.elf	Get hash	malicious	Mirai	Browse	41.113.157.249
	c5v0GdZbbM.elf	Get hash	malicious	Mirai, Moobot	Browse	197.67.5.181
	HRJiIRr1Hp.elf	Get hash	malicious	Unknown	Browse	41.116.198.180
	oWWFhzvYZa.elf	Get hash	malicious	Mirai	Browse	197.76.213.135
	lMIVD0KqYQ.elf	Get hash	malicious	Mirai	Browse	41.117.250.86
	gI7kdes69D.elf	Get hash	malicious	Mirai	Browse	41.113.110.213
	y4YCgjlv0U.elf	Get hash	malicious	Mirai	Browse	41.127.111.251
	TsqgzNktKo.elf	Get hash	malicious	Unknown	Browse	197.69.35.20

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://xtrfr.com/t/1/m3WHCF?p=1kpU6NUBF-6AZQCXRW_1kpU72q8p-6BdU97to	Get hash	malicious	Unknown	Browse	52.165.165.26
	http://myworkspace2f139.myclickfunnels.com/onlinereviews?preview=true	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	52.165.165.26
	https://cloud.letsignit.com/collect/bc/5e8451ea469b88b5cea97417?p=OjfPT7lREiUDLQp6d36aSXQolbQ31LL303XXq73c0LgCPRp2orT9jnqhLprOLL90LfaIzvzkFLCd3-2924eBGaNnzzdb2z0VcZL3eza6pD7Lvwp-E0If3Kq_h3YGcTVhXX2GI1pL-hkiu7mMH-yy70unDaTgV2kM4DQ-HStdqgkF7zy0WhQyMck9ofym3AGicaSsvd1nX6vBxj3Gigg-Jk5WTk6QhcYqtI7diLh8ciaTnz7P5Co45mD3SSBKwruGP56kB0EhGHeljKZvuOLe6ppx9ZBLT3k3gvWvTcJPtdA=	Get hash	malicious	Unknown	Browse	52.165.165.26
	http://norauto-dreux.myfreesites.net	Get hash	malicious	Unknown	Browse	52.165.165.26
	https://www.hsbcqh.com.cn/	Get hash	malicious	Unknown	Browse	52.165.165.26
	https://www.tcsfuel.com	Get hash	malicious	Unknown	Browse	52.165.165.26
	https://ykmm2k9z.r.us-west-1.awstrack.me/L0/https:%2F%2Fatpscan.global.hornetsecurity.com%2Findex.php%3Fatp_str=am_k8LOPbUbePsfY-hKWBmPaLDazKPnHG4jgTUQirWpga72hak_a5NKRFGbXRT_nnpgzPYdx0w8exXS55Fcp8WGYFJ9rF7NbP9YDx5XhnQonunOobszh2UUrWZZnge2pJMarfaiZAqQcCAma3qVy7myZYfRUSoSvz6VKZBX_08i44Tp25Hl13pzKSAeJxY4zGA5QdKIZ6jauqCQUDLNdxAOgf31Ce4RI2rjyAwtDmNxG7pu00VIybu_gNwipmx4F5IFfSxz7VEOKyp3CucZ5M5iqrPYqvlDRcg8jOjojL_P6Wr3_SQCB2Z0bIzo6I_ei1xQj27Yk9qwRXKzsKMs/1/0111018fef761e90-05d92175-04ab-45dc-b869-d508a2bdcd27-000000/Em26ZPrClpDT_ZVT_bHsu3LhDrM=162	Get hash	malicious	Unknown	Browse	52.165.165.26
	https://capitalaitechlab.pro/index.php?products=investgeniusaide&eng_click=297dc4e0ac4544d4a012eea865a19727&eng_website=238723&eng_creative=1029836897&eng_widget=228333&pixelid=240455&key=griss&eng_source=238723&eng_subid=null&eng_click=297dc4e0ac4544d4a012eea865a19727	Get hash	malicious	Unknown	Browse	52.165.165.26
	http://signatureanalytics.com	Get hash	malicious	Unknown	Browse	52.165.165.26
	https://page-best221.jimdosite.com/	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26
3b5074b1b5d032e5620f69f9f700ff0e	SecuriteInfo.com.Win32.PWSX-gen.26916.23346.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	40.115.3.253
	http://norauto-dreux.myfreesites.net	Get hash	malicious	Unknown	Browse	40.115.3.253
	file.exe	Get hash	malicious	Unknown	Browse	40.115.3.253
	file.exe	Get hash	malicious	Unknown	Browse	40.115.3.253
	Update.js	Get hash	malicious	SocGholish	Browse	40.115.3.253
	SR5QAXUqyO.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	40.115.3.253
	CV Elena Alba Garcia.exe	Get hash	malicious	AgentTesla	Browse	40.115.3.253
	rRevisedQuotation.exe	Get hash	malicious	AgentTesla	Browse	40.115.3.253
	https://johnuserag.info/?utm_campaign=yOrsMyowMImIDv9DTSX69oig88PrjKrJ9agQ3DpV-911&t=sec	Get hash	malicious	Unknown	Browse	40.115.3.253
	f4d52887857284d73d4221c3c326388ef93966b74180a044906c0c36ce503e4a_dump.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	40.115.3.253

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\WINDOWS\qeriuwjhrf (copy)	qCc1a4w5YZ.exe	Get hash	malicious	Wannacry	Browse
	stN592INV6.exe	Get hash	malicious	Wannacry	Browse
	onq54JS79W.exe	Get hash	malicious	Wannacry	Browse
	MSNRf9dZ63.exe	Get hash	malicious	Wannacry	Browse
	7Qu8thR7WW.dll	Get hash	malicious	Wannacry, Virut	Browse
	MSmReFKunQ.dll	Get hash	malicious	Wannacry	Browse
	kXpnLUmuU2.dll	Get hash	malicious	Wannacry	Browse
	TigrxMihsc.dll	Get hash	malicious	Wannacry	Browse
	iTQzi9bir4.dll	Get hash	malicious	Wannacry	Browse
C:\Windows\tasksche.exe	qCc1a4w5YZ.exe	Get hash	malicious	Wannacry	Browse
	stN592INV6.exe	Get hash	malicious	Wannacry	Browse
	onq54JS79W.exe	Get hash	malicious	Wannacry	Browse
	MSNRf9dZ63.exe	Get hash	malicious	Wannacry	Browse
	7Qu8thR7WW.dll	Get hash	malicious	Wannacry, Virut	Browse
	MSmReFKunQ.dll	Get hash	malicious	Wannacry	Browse
	kXpnLUmuU2.dll	Get hash	malicious	Wannacry	Browse
	TigrxMihsc.dll	Get hash	malicious	Wannacry	Browse
	iTQzi9bir4.dll	Get hash	malicious	Wannacry	Browse

Created / dropped Files

C:\WINDOWS\qeriuwjhrf (copy)

Download File

Process:	C:\Windows\mssecsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3514368
Entropy (8bit):	7.996072890929898
Encrypted:	true
SSDEEP:	98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hj:QqPe1Cxcxk3ZAEUadzR8yc4Hj
MD5:	7F7CCAA16FB15EB1C7399D422F8363E8
SHA1:	BD44D0AB543BF814D93B719C24E90D8DD7111234
SHA-256:	2584E1521065E45EC3C17767C065429038FC6291C091097EA8B22C8A502C41DD
SHA-512:	83E334B80DE08903CFA9891A3FA349C1ECE7E19F8E62B74A017512FA9A7989A0FD31929BF1FC13847BEE04F2DA3DACF6BC3F5EE58F0E4B9D495F4B9AF12ED2B7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Joe Sandbox View:	Filename: qCc1a4w5YZ.exe, Detection: malicious, Browse Filename: stN592INV6.exe, Detection: malicious, Browse Filename: onq54JS79W.exe, Detection: malicious, Browse Filename: MSNRf9dZ63.exe, Detection: malicious, Browse Filename: 7Qu8thR7WW.dll, Detection: malicious, Browse Filename: MSmReFKunQ.dll, Detection: malicious, Browse Filename: kXpnLUmuU2.dll, Detection: malicious, Browse Filename: TigrxMihsc.dll, Detection: malicious, Browse Filename: iTQzi9bir4.dll, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..T...T...T..X...T.._...T.'.Z...T..^...T..P...T.g.....T...U...T..._...T.c.R...T.Rich..T.........................PE..L...A..L.................p... 5......w............@...........................5.................................................d.........4..........................................................................................................text....i.......p.................. ..`.rdata..p_.......`..................@..@.data...X........ ..................@....rsrc.....4.......4.................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\tasksche.exe

Download File

Process:	C:\Windows\mssecsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3514368
Entropy (8bit):	7.996072890929898
Encrypted:	true
SSDEEP:	98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hj:QqPe1Cxcxk3ZAEUadzR8yc4Hj
MD5:	7F7CCAA16FB15EB1C7399D422F8363E8
SHA1:	BD44D0AB543BF814D93B719C24E90D8DD7111234
SHA-256:	2584E1521065E45EC3C17767C065429038FC6291C091097EA8B22C8A502C41DD
SHA-512:	83E334B80DE08903CFA9891A3FA349C1ECE7E19F8E62B74A017512FA9A7989A0FD31929BF1FC13847BEE04F2DA3DACF6BC3F5EE58F0E4B9D495F4B9AF12ED2B7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\tasksche.exe, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\tasksche.exe, Author: ReversingLabs
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Joe Sandbox View:	Filename: qCc1a4w5YZ.exe, Detection: malicious, Browse Filename: stN592INV6.exe, Detection: malicious, Browse Filename: onq54JS79W.exe, Detection: malicious, Browse Filename: MSNRf9dZ63.exe, Detection: malicious, Browse Filename: 7Qu8thR7WW.dll, Detection: malicious, Browse Filename: MSmReFKunQ.dll, Detection: malicious, Browse Filename: kXpnLUmuU2.dll, Detection: malicious, Browse Filename: TigrxMihsc.dll, Detection: malicious, Browse Filename: iTQzi9bir4.dll, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..T...T...T..X...T.._...T.'.Z...T..^...T..P...T.g.....T...U...T..._...T.c.R...T.Rich..T.........................PE..L...A..L.................p... 5......w............@...........................5.................................................d.........4..........................................................................................................text....i.......p.................. ..`.rdata..p_.......`..................@..@.data...X........ ..................@....rsrc.....4.......4.................@..@........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.412630716402947
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	1w3BDu68Sg.dll
File size:	5'267'459 bytes
MD5:	ae12bb54af31227017feffd9598a6f5e
SHA1:	f597a1cc16d42b7f02e077696e067cd3030a06d9
SHA256:	c05e2dab77349cd639aa837e7e121710b8a0718d8fc93fb4cc6458ae90e5c597
SHA512:	a80b1cc70cafff3b8edb2e732fa2360436cc7556ba91977ab1fa505ad7c6e184c465839d1584f827be17ccb751240432348debe69eed4e006321d9af4334621b
SSDEEP:	98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:+DqPe1Cxcxk3ZAEUadzR8yc4H
TLSH:	92363394622CB2FCF0440EB44463896BB7B33C6967BA5E1F8BC086670D43B5BAFD0641
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.r_9...9...9.......=...9...6.....A.:.......8.......8.......:...Rich9...........................PE..L...QW.Y...........!.......

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x100011e9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x59145751 [Thu May 11 12:21:37 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2e5708ae5fed0403e8117c645fb23e5b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ebx
mov ebx, dword ptr [ebp+08h]
push esi
mov esi, dword ptr [ebp+0Ch]
push edi
mov edi, dword ptr [ebp+10h]
test esi, esi
jne 00007F8540842B8Bh
cmp dword ptr [10003140h], 00000000h
jmp 00007F8540842BA8h
cmp esi, 01h
je 00007F8540842B87h
cmp esi, 02h
jne 00007F8540842BA4h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F8540842B8Bh
push edi
push esi
push ebx
call eax
test eax, eax
je 00007F8540842B8Eh
push edi
push esi
push ebx
call 00007F8540842A9Ah
test eax, eax
jne 00007F8540842B86h
xor eax, eax
jmp 00007F8540842BD0h
push edi
push esi
push ebx
call 00007F854084294Ch
cmp esi, 01h
mov dword ptr [ebp+0Ch], eax
jne 00007F8540842B8Eh
test eax, eax
jne 00007F8540842BB9h
push edi
push eax
push ebx
call 00007F8540842A76h
test esi, esi
je 00007F8540842B87h
cmp esi, 03h
jne 00007F8540842BA8h
push edi
push esi
push ebx
call 00007F8540842A65h
test eax, eax
jne 00007F8540842B85h
and dword ptr [ebp+0Ch], eax
cmp dword ptr [ebp+0Ch], 00000000h
je 00007F8540842B93h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F8540842B8Ah
push edi
push esi
push ebx
call eax
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
pop esi
pop ebx
pop ebp
retn 000Ch
jmp dword ptr [10002028h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[C++] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2190	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x203c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x500060	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x505000	0x5c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28c	0x1000	8de9a2cb31e4c74bd008b871d14bfafc	False	0.13037109375	data	1.4429971244731552	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x1d8	0x1000	3dd394f95ab218593f2bc8eb65184db4	False	0.072509765625	data	0.7346018133622799	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x154	0x1000	fe5022c5b5d015ad38b2b77fc437a5cb	False	0.016845703125	Matlab v4 mat-file (little endian) C:\%s\%s, numeric, rows 0, columns 0	0.085238686413312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x500060	0x501000	d0fa4e97f2da8d58667c85e5416426e6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x505000	0x2ac	0x1000	620f0b67a91f7f74151bc5be745b7110	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
W	0x4060	0x500000	data	English	United States	0.8770942687988281

Imports

DLL	Import
KERNEL32.dll	CloseHandle, WriteFile, CreateFileA, SizeofResource, LockResource, LoadResource, FindResourceA, CreateProcessA
MSVCRT.dll	free, _initterm, malloc, _adjust_fdiv, sprintf

Exports

Name	Ordinal	Address
PlayGame	1	0x10001114

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/07/24-19:17:54.665875	TCP	2024298	ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1	49711	80	192.168.2.6	104.16.166.228
06/07/24-19:17:57.559210	TCP	2031515	ET TROJAN Known Sinkhole Response Kryptos Logic	80	49729	104.16.166.228	192.168.2.6
06/07/24-19:17:55.318490	TCP	2031515	ET TROJAN Known Sinkhole Response Kryptos Logic	80	49711	104.16.166.228	192.168.2.6
06/07/24-19:20:00.749879	TCP	2024298	ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1	50477	80	192.168.2.6	104.16.166.228
06/07/24-19:17:55.463710	TCP	2024298	ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1	49712	80	192.168.2.6	104.16.166.228
06/07/24-19:17:56.918211	TCP	2024298	ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1	49729	80	192.168.2.6	104.16.166.228
06/07/24-19:17:54.642321	UDP	2024291	ET TROJAN Possible WannaCry DNS Lookup 1	54007	53	192.168.2.6	1.1.1.1
06/07/24-19:17:56.092110	TCP	2031515	ET TROJAN Known Sinkhole Response Kryptos Logic	80	49712	104.16.166.228	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 7, 2024 19:17:48.649837971 CEST	49674	443	192.168.2.6	173.222.162.64
Jun 7, 2024 19:17:48.649837971 CEST	49673	443	192.168.2.6	173.222.162.64
Jun 7, 2024 19:17:48.931150913 CEST	49672	443	192.168.2.6	173.222.162.64
Jun 7, 2024 19:17:52.718602896 CEST	49710	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:52.718635082 CEST	443	49710	40.115.3.253	192.168.2.6
Jun 7, 2024 19:17:52.718703032 CEST	49710	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:52.719508886 CEST	49710	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:52.719546080 CEST	443	49710	40.115.3.253	192.168.2.6
Jun 7, 2024 19:17:53.848004103 CEST	443	49710	40.115.3.253	192.168.2.6
Jun 7, 2024 19:17:53.848093987 CEST	49710	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:53.855253935 CEST	49710	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:53.855273962 CEST	443	49710	40.115.3.253	192.168.2.6
Jun 7, 2024 19:17:53.855710030 CEST	443	49710	40.115.3.253	192.168.2.6
Jun 7, 2024 19:17:53.861567974 CEST	49710	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:53.861633062 CEST	49710	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:53.861644030 CEST	443	49710	40.115.3.253	192.168.2.6
Jun 7, 2024 19:17:53.861845970 CEST	49710	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:53.908505917 CEST	443	49710	40.115.3.253	192.168.2.6
Jun 7, 2024 19:17:54.107476950 CEST	443	49710	40.115.3.253	192.168.2.6
Jun 7, 2024 19:17:54.108562946 CEST	49710	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:54.108594894 CEST	443	49710	40.115.3.253	192.168.2.6
Jun 7, 2024 19:17:54.108616114 CEST	49710	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:54.108656883 CEST	49710	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:54.659004927 CEST	49711	80	192.168.2.6	104.16.166.228
Jun 7, 2024 19:17:54.664877892 CEST	80	49711	104.16.166.228	192.168.2.6
Jun 7, 2024 19:17:54.664964914 CEST	49711	80	192.168.2.6	104.16.166.228
Jun 7, 2024 19:17:54.665874958 CEST	49711	80	192.168.2.6	104.16.166.228
Jun 7, 2024 19:17:54.670734882 CEST	80	49711	104.16.166.228	192.168.2.6
Jun 7, 2024 19:17:55.318490028 CEST	80	49711	104.16.166.228	192.168.2.6
Jun 7, 2024 19:17:55.318707943 CEST	49711	80	192.168.2.6	104.16.166.228
Jun 7, 2024 19:17:55.318802118 CEST	49711	80	192.168.2.6	104.16.166.228
Jun 7, 2024 19:17:55.321067095 CEST	80	49711	104.16.166.228	192.168.2.6
Jun 7, 2024 19:17:55.321131945 CEST	49711	80	192.168.2.6	104.16.166.228
Jun 7, 2024 19:17:55.323771000 CEST	80	49711	104.16.166.228	192.168.2.6
Jun 7, 2024 19:17:55.457947969 CEST	49712	80	192.168.2.6	104.16.166.228
Jun 7, 2024 19:17:55.463481903 CEST	80	49712	104.16.166.228	192.168.2.6
Jun 7, 2024 19:17:55.463710070 CEST	49712	80	192.168.2.6	104.16.166.228
Jun 7, 2024 19:17:55.463710070 CEST	49712	80	192.168.2.6	104.16.166.228
Jun 7, 2024 19:17:55.468652964 CEST	80	49712	104.16.166.228	192.168.2.6
Jun 7, 2024 19:17:56.092109919 CEST	80	49712	104.16.166.228	192.168.2.6
Jun 7, 2024 19:17:56.092268944 CEST	49712	80	192.168.2.6	104.16.166.228
Jun 7, 2024 19:17:56.092514992 CEST	49712	80	192.168.2.6	104.16.166.228
Jun 7, 2024 19:17:56.094218969 CEST	80	49712	104.16.166.228	192.168.2.6
Jun 7, 2024 19:17:56.094331026 CEST	49712	80	192.168.2.6	104.16.166.228
Jun 7, 2024 19:17:56.097390890 CEST	80	49712	104.16.166.228	192.168.2.6
Jun 7, 2024 19:17:56.125617981 CEST	49713	445	192.168.2.6	196.22.85.250
Jun 7, 2024 19:17:56.130631924 CEST	445	49713	196.22.85.250	192.168.2.6
Jun 7, 2024 19:17:56.131017923 CEST	49713	445	192.168.2.6	196.22.85.250
Jun 7, 2024 19:17:56.131017923 CEST	49713	445	192.168.2.6	196.22.85.250
Jun 7, 2024 19:17:56.131386995 CEST	49714	445	192.168.2.6	196.22.85.1
Jun 7, 2024 19:17:56.136369944 CEST	445	49714	196.22.85.1	192.168.2.6
Jun 7, 2024 19:17:56.136590958 CEST	445	49713	196.22.85.250	192.168.2.6
Jun 7, 2024 19:17:56.136599064 CEST	49714	445	192.168.2.6	196.22.85.1
Jun 7, 2024 19:17:56.136599064 CEST	49714	445	192.168.2.6	196.22.85.1
Jun 7, 2024 19:17:56.137106895 CEST	445	49713	196.22.85.250	192.168.2.6
Jun 7, 2024 19:17:56.137175083 CEST	49713	445	192.168.2.6	196.22.85.250
Jun 7, 2024 19:17:56.137649059 CEST	49717	445	192.168.2.6	196.22.85.1
Jun 7, 2024 19:17:56.141896009 CEST	445	49714	196.22.85.1	192.168.2.6
Jun 7, 2024 19:17:56.142312050 CEST	49714	445	192.168.2.6	196.22.85.1
Jun 7, 2024 19:17:56.142559052 CEST	445	49717	196.22.85.1	192.168.2.6
Jun 7, 2024 19:17:56.142637968 CEST	49717	445	192.168.2.6	196.22.85.1
Jun 7, 2024 19:17:56.142705917 CEST	49717	445	192.168.2.6	196.22.85.1
Jun 7, 2024 19:17:56.147697926 CEST	445	49717	196.22.85.1	192.168.2.6
Jun 7, 2024 19:17:56.912786007 CEST	49729	80	192.168.2.6	104.16.166.228
Jun 7, 2024 19:17:56.917968988 CEST	80	49729	104.16.166.228	192.168.2.6
Jun 7, 2024 19:17:56.918066978 CEST	49729	80	192.168.2.6	104.16.166.228
Jun 7, 2024 19:17:56.918210983 CEST	49729	80	192.168.2.6	104.16.166.228
Jun 7, 2024 19:17:56.923084974 CEST	80	49729	104.16.166.228	192.168.2.6
Jun 7, 2024 19:17:57.021959066 CEST	49730	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:57.022003889 CEST	443	49730	40.115.3.253	192.168.2.6
Jun 7, 2024 19:17:57.022067070 CEST	49730	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:57.022748947 CEST	49730	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:57.022759914 CEST	443	49730	40.115.3.253	192.168.2.6
Jun 7, 2024 19:17:57.559210062 CEST	80	49729	104.16.166.228	192.168.2.6
Jun 7, 2024 19:17:57.559278011 CEST	49729	80	192.168.2.6	104.16.166.228
Jun 7, 2024 19:17:57.559456110 CEST	49729	80	192.168.2.6	104.16.166.228
Jun 7, 2024 19:17:57.561228991 CEST	80	49729	104.16.166.228	192.168.2.6
Jun 7, 2024 19:17:57.561281919 CEST	49729	80	192.168.2.6	104.16.166.228
Jun 7, 2024 19:17:57.564263105 CEST	80	49729	104.16.166.228	192.168.2.6
Jun 7, 2024 19:17:58.135659933 CEST	49740	445	192.168.2.6	38.185.73.96
Jun 7, 2024 19:17:58.140768051 CEST	445	49740	38.185.73.96	192.168.2.6
Jun 7, 2024 19:17:58.140853882 CEST	49740	445	192.168.2.6	38.185.73.96
Jun 7, 2024 19:17:58.140897036 CEST	49740	445	192.168.2.6	38.185.73.96
Jun 7, 2024 19:17:58.141113997 CEST	49741	445	192.168.2.6	38.185.73.1
Jun 7, 2024 19:17:58.146471024 CEST	445	49741	38.185.73.1	192.168.2.6
Jun 7, 2024 19:17:58.146542072 CEST	49741	445	192.168.2.6	38.185.73.1
Jun 7, 2024 19:17:58.146574020 CEST	49741	445	192.168.2.6	38.185.73.1
Jun 7, 2024 19:17:58.147819996 CEST	49742	445	192.168.2.6	38.185.73.1
Jun 7, 2024 19:17:58.152621984 CEST	445	49741	38.185.73.1	192.168.2.6
Jun 7, 2024 19:17:58.152636051 CEST	445	49740	38.185.73.96	192.168.2.6
Jun 7, 2024 19:17:58.152647972 CEST	445	49742	38.185.73.1	192.168.2.6
Jun 7, 2024 19:17:58.152715921 CEST	49742	445	192.168.2.6	38.185.73.1
Jun 7, 2024 19:17:58.152791023 CEST	49742	445	192.168.2.6	38.185.73.1
Jun 7, 2024 19:17:58.157594919 CEST	445	49742	38.185.73.1	192.168.2.6
Jun 7, 2024 19:17:58.169477940 CEST	445	49740	38.185.73.96	192.168.2.6
Jun 7, 2024 19:17:58.169533968 CEST	49740	445	192.168.2.6	38.185.73.96
Jun 7, 2024 19:17:58.170727015 CEST	445	49741	38.185.73.1	192.168.2.6
Jun 7, 2024 19:17:58.170778036 CEST	49741	445	192.168.2.6	38.185.73.1
Jun 7, 2024 19:17:58.171920061 CEST	443	49730	40.115.3.253	192.168.2.6
Jun 7, 2024 19:17:58.171994925 CEST	49730	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:58.173978090 CEST	49730	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:58.174000025 CEST	443	49730	40.115.3.253	192.168.2.6
Jun 7, 2024 19:17:58.174351931 CEST	443	49730	40.115.3.253	192.168.2.6
Jun 7, 2024 19:17:58.176254988 CEST	49730	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:58.176403046 CEST	49730	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:58.176410913 CEST	443	49730	40.115.3.253	192.168.2.6
Jun 7, 2024 19:17:58.176577091 CEST	49730	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:58.224498987 CEST	443	49730	40.115.3.253	192.168.2.6
Jun 7, 2024 19:17:58.259175062 CEST	49674	443	192.168.2.6	173.222.162.64
Jun 7, 2024 19:17:58.259175062 CEST	49673	443	192.168.2.6	173.222.162.64
Jun 7, 2024 19:17:58.420680046 CEST	443	49730	40.115.3.253	192.168.2.6
Jun 7, 2024 19:17:58.421308994 CEST	49730	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:58.421343088 CEST	443	49730	40.115.3.253	192.168.2.6
Jun 7, 2024 19:17:58.421363115 CEST	49730	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:58.421544075 CEST	49730	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:17:58.540508986 CEST	49672	443	192.168.2.6	173.222.162.64
Jun 7, 2024 19:18:00.151432037 CEST	49765	445	192.168.2.6	35.130.55.36
Jun 7, 2024 19:18:00.156328917 CEST	445	49765	35.130.55.36	192.168.2.6
Jun 7, 2024 19:18:00.156404018 CEST	49765	445	192.168.2.6	35.130.55.36
Jun 7, 2024 19:18:00.156469107 CEST	49765	445	192.168.2.6	35.130.55.36
Jun 7, 2024 19:18:00.156687021 CEST	49766	445	192.168.2.6	35.130.55.1
Jun 7, 2024 19:18:00.161536932 CEST	445	49766	35.130.55.1	192.168.2.6
Jun 7, 2024 19:18:00.161592960 CEST	49766	445	192.168.2.6	35.130.55.1
Jun 7, 2024 19:18:00.161624908 CEST	49766	445	192.168.2.6	35.130.55.1
Jun 7, 2024 19:18:00.162825108 CEST	49767	445	192.168.2.6	35.130.55.1
Jun 7, 2024 19:18:00.164526939 CEST	445	49765	35.130.55.36	192.168.2.6
Jun 7, 2024 19:18:00.167634964 CEST	445	49767	35.130.55.1	192.168.2.6
Jun 7, 2024 19:18:00.167690039 CEST	49767	445	192.168.2.6	35.130.55.1
Jun 7, 2024 19:18:00.167733908 CEST	49767	445	192.168.2.6	35.130.55.1
Jun 7, 2024 19:18:00.167937040 CEST	445	49765	35.130.55.36	192.168.2.6
Jun 7, 2024 19:18:00.167978048 CEST	49765	445	192.168.2.6	35.130.55.36
Jun 7, 2024 19:18:00.168256998 CEST	445	49766	35.130.55.1	192.168.2.6
Jun 7, 2024 19:18:00.168292046 CEST	49766	445	192.168.2.6	35.130.55.1
Jun 7, 2024 19:18:00.172518969 CEST	445	49767	35.130.55.1	192.168.2.6
Jun 7, 2024 19:18:00.390796900 CEST	443	49704	173.222.162.64	192.168.2.6
Jun 7, 2024 19:18:00.390914917 CEST	49704	443	192.168.2.6	173.222.162.64
Jun 7, 2024 19:18:02.166918039 CEST	49790	445	192.168.2.6	217.179.3.49
Jun 7, 2024 19:18:02.171977043 CEST	445	49790	217.179.3.49	192.168.2.6
Jun 7, 2024 19:18:02.172125101 CEST	49790	445	192.168.2.6	217.179.3.49
Jun 7, 2024 19:18:02.175679922 CEST	49790	445	192.168.2.6	217.179.3.49
Jun 7, 2024 19:18:02.176002026 CEST	49791	445	192.168.2.6	217.179.3.1
Jun 7, 2024 19:18:02.181121111 CEST	445	49790	217.179.3.49	192.168.2.6
Jun 7, 2024 19:18:02.181186914 CEST	445	49791	217.179.3.1	192.168.2.6
Jun 7, 2024 19:18:02.181220055 CEST	49790	445	192.168.2.6	217.179.3.49
Jun 7, 2024 19:18:02.181272984 CEST	49791	445	192.168.2.6	217.179.3.1
Jun 7, 2024 19:18:02.181335926 CEST	49791	445	192.168.2.6	217.179.3.1
Jun 7, 2024 19:18:02.182774067 CEST	49792	445	192.168.2.6	217.179.3.1
Jun 7, 2024 19:18:02.187128067 CEST	445	49791	217.179.3.1	192.168.2.6
Jun 7, 2024 19:18:02.187237978 CEST	49791	445	192.168.2.6	217.179.3.1
Jun 7, 2024 19:18:02.187808990 CEST	445	49792	217.179.3.1	192.168.2.6
Jun 7, 2024 19:18:02.187882900 CEST	49792	445	192.168.2.6	217.179.3.1
Jun 7, 2024 19:18:02.187926054 CEST	49792	445	192.168.2.6	217.179.3.1
Jun 7, 2024 19:18:02.192840099 CEST	445	49792	217.179.3.1	192.168.2.6
Jun 7, 2024 19:18:04.182214022 CEST	49813	445	192.168.2.6	20.161.184.153
Jun 7, 2024 19:18:04.187511921 CEST	445	49813	20.161.184.153	192.168.2.6
Jun 7, 2024 19:18:04.187607050 CEST	49813	445	192.168.2.6	20.161.184.153
Jun 7, 2024 19:18:04.187659025 CEST	49813	445	192.168.2.6	20.161.184.153
Jun 7, 2024 19:18:04.187840939 CEST	49814	445	192.168.2.6	20.161.184.1
Jun 7, 2024 19:18:04.192837954 CEST	445	49814	20.161.184.1	192.168.2.6
Jun 7, 2024 19:18:04.192893028 CEST	445	49813	20.161.184.153	192.168.2.6
Jun 7, 2024 19:18:04.192922115 CEST	49814	445	192.168.2.6	20.161.184.1
Jun 7, 2024 19:18:04.192960024 CEST	49813	445	192.168.2.6	20.161.184.153
Jun 7, 2024 19:18:04.193036079 CEST	49814	445	192.168.2.6	20.161.184.1
Jun 7, 2024 19:18:04.194029093 CEST	49815	445	192.168.2.6	20.161.184.1
Jun 7, 2024 19:18:04.198175907 CEST	445	49814	20.161.184.1	192.168.2.6
Jun 7, 2024 19:18:04.198235035 CEST	49814	445	192.168.2.6	20.161.184.1
Jun 7, 2024 19:18:04.198950052 CEST	445	49815	20.161.184.1	192.168.2.6
Jun 7, 2024 19:18:04.199009895 CEST	49815	445	192.168.2.6	20.161.184.1
Jun 7, 2024 19:18:04.199182034 CEST	49815	445	192.168.2.6	20.161.184.1
Jun 7, 2024 19:18:04.204061985 CEST	445	49815	20.161.184.1	192.168.2.6
Jun 7, 2024 19:18:04.658521891 CEST	445	49717	196.22.85.1	192.168.2.6
Jun 7, 2024 19:18:04.658660889 CEST	49717	445	192.168.2.6	196.22.85.1
Jun 7, 2024 19:18:04.658709049 CEST	49717	445	192.168.2.6	196.22.85.1
Jun 7, 2024 19:18:04.658781052 CEST	49717	445	192.168.2.6	196.22.85.1
Jun 7, 2024 19:18:04.663700104 CEST	445	49717	196.22.85.1	192.168.2.6
Jun 7, 2024 19:18:04.663748026 CEST	445	49717	196.22.85.1	192.168.2.6
Jun 7, 2024 19:18:06.197918892 CEST	49836	445	192.168.2.6	123.63.163.57
Jun 7, 2024 19:18:06.203205109 CEST	445	49836	123.63.163.57	192.168.2.6
Jun 7, 2024 19:18:06.203310013 CEST	49836	445	192.168.2.6	123.63.163.57
Jun 7, 2024 19:18:06.203376055 CEST	49836	445	192.168.2.6	123.63.163.57
Jun 7, 2024 19:18:06.203617096 CEST	49837	445	192.168.2.6	123.63.163.1
Jun 7, 2024 19:18:06.208622932 CEST	445	49836	123.63.163.57	192.168.2.6
Jun 7, 2024 19:18:06.208658934 CEST	445	49837	123.63.163.1	192.168.2.6
Jun 7, 2024 19:18:06.208693027 CEST	49836	445	192.168.2.6	123.63.163.57
Jun 7, 2024 19:18:06.208730936 CEST	49837	445	192.168.2.6	123.63.163.1
Jun 7, 2024 19:18:06.208765984 CEST	49837	445	192.168.2.6	123.63.163.1
Jun 7, 2024 19:18:06.209903002 CEST	49838	445	192.168.2.6	123.63.163.1
Jun 7, 2024 19:18:06.215087891 CEST	445	49837	123.63.163.1	192.168.2.6
Jun 7, 2024 19:18:06.215156078 CEST	49837	445	192.168.2.6	123.63.163.1
Jun 7, 2024 19:18:06.215797901 CEST	445	49838	123.63.163.1	192.168.2.6
Jun 7, 2024 19:18:06.215965986 CEST	49838	445	192.168.2.6	123.63.163.1
Jun 7, 2024 19:18:06.216036081 CEST	49838	445	192.168.2.6	123.63.163.1
Jun 7, 2024 19:18:06.220890045 CEST	445	49838	123.63.163.1	192.168.2.6
Jun 7, 2024 19:18:06.654126883 CEST	445	49742	38.185.73.1	192.168.2.6
Jun 7, 2024 19:18:06.654256105 CEST	49742	445	192.168.2.6	38.185.73.1
Jun 7, 2024 19:18:06.654361010 CEST	49742	445	192.168.2.6	38.185.73.1
Jun 7, 2024 19:18:06.654388905 CEST	49742	445	192.168.2.6	38.185.73.1
Jun 7, 2024 19:18:06.659348965 CEST	445	49742	38.185.73.1	192.168.2.6
Jun 7, 2024 19:18:06.659379005 CEST	445	49742	38.185.73.1	192.168.2.6
Jun 7, 2024 19:18:07.667066097 CEST	49857	445	192.168.2.6	196.22.85.1
Jun 7, 2024 19:18:07.672319889 CEST	445	49857	196.22.85.1	192.168.2.6
Jun 7, 2024 19:18:07.672583103 CEST	49857	445	192.168.2.6	196.22.85.1
Jun 7, 2024 19:18:07.672583103 CEST	49857	445	192.168.2.6	196.22.85.1
Jun 7, 2024 19:18:07.677604914 CEST	445	49857	196.22.85.1	192.168.2.6
Jun 7, 2024 19:18:08.212985039 CEST	49862	445	192.168.2.6	129.100.47.122
Jun 7, 2024 19:18:08.218244076 CEST	445	49862	129.100.47.122	192.168.2.6
Jun 7, 2024 19:18:08.218339920 CEST	49862	445	192.168.2.6	129.100.47.122
Jun 7, 2024 19:18:08.218441010 CEST	49862	445	192.168.2.6	129.100.47.122
Jun 7, 2024 19:18:08.218688011 CEST	49863	445	192.168.2.6	129.100.47.1
Jun 7, 2024 19:18:08.223607063 CEST	445	49862	129.100.47.122	192.168.2.6
Jun 7, 2024 19:18:08.223671913 CEST	445	49863	129.100.47.1	192.168.2.6
Jun 7, 2024 19:18:08.223690033 CEST	49862	445	192.168.2.6	129.100.47.122
Jun 7, 2024 19:18:08.223813057 CEST	49863	445	192.168.2.6	129.100.47.1
Jun 7, 2024 19:18:08.223927975 CEST	49863	445	192.168.2.6	129.100.47.1
Jun 7, 2024 19:18:08.224381924 CEST	49864	445	192.168.2.6	129.100.47.1
Jun 7, 2024 19:18:08.228970051 CEST	445	49863	129.100.47.1	192.168.2.6
Jun 7, 2024 19:18:08.229054928 CEST	49863	445	192.168.2.6	129.100.47.1
Jun 7, 2024 19:18:08.229234934 CEST	445	49864	129.100.47.1	192.168.2.6
Jun 7, 2024 19:18:08.229296923 CEST	49864	445	192.168.2.6	129.100.47.1
Jun 7, 2024 19:18:08.229329109 CEST	49864	445	192.168.2.6	129.100.47.1
Jun 7, 2024 19:18:08.234570026 CEST	445	49864	129.100.47.1	192.168.2.6
Jun 7, 2024 19:18:08.666071892 CEST	445	49767	35.130.55.1	192.168.2.6
Jun 7, 2024 19:18:08.666167974 CEST	49767	445	192.168.2.6	35.130.55.1
Jun 7, 2024 19:18:08.666254997 CEST	49767	445	192.168.2.6	35.130.55.1
Jun 7, 2024 19:18:08.666361094 CEST	49767	445	192.168.2.6	35.130.55.1
Jun 7, 2024 19:18:08.671166897 CEST	445	49767	35.130.55.1	192.168.2.6
Jun 7, 2024 19:18:08.671246052 CEST	445	49767	35.130.55.1	192.168.2.6
Jun 7, 2024 19:18:08.935090065 CEST	49873	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:08.935129881 CEST	443	49873	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:08.935301065 CEST	49873	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:08.945810080 CEST	49873	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:08.945831060 CEST	443	49873	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:09.665810108 CEST	49883	445	192.168.2.6	38.185.73.1
Jun 7, 2024 19:18:09.671165943 CEST	445	49883	38.185.73.1	192.168.2.6
Jun 7, 2024 19:18:09.671341896 CEST	49883	445	192.168.2.6	38.185.73.1
Jun 7, 2024 19:18:09.671390057 CEST	49883	445	192.168.2.6	38.185.73.1
Jun 7, 2024 19:18:09.676518917 CEST	445	49883	38.185.73.1	192.168.2.6
Jun 7, 2024 19:18:09.744446993 CEST	443	49873	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:09.744692087 CEST	49873	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:09.758604050 CEST	49873	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:09.758635998 CEST	443	49873	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:09.759295940 CEST	443	49873	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:09.806093931 CEST	49873	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:09.821281910 CEST	49873	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:09.868500948 CEST	443	49873	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:10.083089113 CEST	443	49873	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:10.083154917 CEST	443	49873	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:10.083177090 CEST	443	49873	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:10.083245039 CEST	443	49873	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:10.083311081 CEST	443	49873	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:10.083318949 CEST	49873	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:10.083318949 CEST	49873	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:10.083318949 CEST	49873	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:10.083359003 CEST	443	49873	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:10.083379030 CEST	443	49873	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:10.083440065 CEST	49873	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:10.083440065 CEST	49873	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:10.083440065 CEST	49873	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:10.083539009 CEST	443	49873	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:10.083667994 CEST	443	49873	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:10.083738089 CEST	49873	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:10.117593050 CEST	49873	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:10.117593050 CEST	49873	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:10.117630005 CEST	443	49873	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:10.117645025 CEST	443	49873	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:10.228988886 CEST	49891	445	192.168.2.6	219.1.165.237
Jun 7, 2024 19:18:10.234230995 CEST	445	49891	219.1.165.237	192.168.2.6
Jun 7, 2024 19:18:10.234302044 CEST	49891	445	192.168.2.6	219.1.165.237
Jun 7, 2024 19:18:10.234420061 CEST	49891	445	192.168.2.6	219.1.165.237
Jun 7, 2024 19:18:10.234611988 CEST	49892	445	192.168.2.6	219.1.165.1
Jun 7, 2024 19:18:10.239700079 CEST	445	49891	219.1.165.237	192.168.2.6
Jun 7, 2024 19:18:10.239757061 CEST	49891	445	192.168.2.6	219.1.165.237
Jun 7, 2024 19:18:10.239767075 CEST	445	49892	219.1.165.1	192.168.2.6
Jun 7, 2024 19:18:10.239829063 CEST	49892	445	192.168.2.6	219.1.165.1
Jun 7, 2024 19:18:10.239898920 CEST	49892	445	192.168.2.6	219.1.165.1
Jun 7, 2024 19:18:10.240227938 CEST	49893	445	192.168.2.6	219.1.165.1
Jun 7, 2024 19:18:10.245192051 CEST	445	49892	219.1.165.1	192.168.2.6
Jun 7, 2024 19:18:10.245223045 CEST	445	49893	219.1.165.1	192.168.2.6
Jun 7, 2024 19:18:10.245248079 CEST	49892	445	192.168.2.6	219.1.165.1
Jun 7, 2024 19:18:10.245292902 CEST	49893	445	192.168.2.6	219.1.165.1
Jun 7, 2024 19:18:10.245331049 CEST	49893	445	192.168.2.6	219.1.165.1
Jun 7, 2024 19:18:10.250345945 CEST	445	49893	219.1.165.1	192.168.2.6
Jun 7, 2024 19:18:10.679181099 CEST	445	49792	217.179.3.1	192.168.2.6
Jun 7, 2024 19:18:10.679240942 CEST	49792	445	192.168.2.6	217.179.3.1
Jun 7, 2024 19:18:10.679302931 CEST	49792	445	192.168.2.6	217.179.3.1
Jun 7, 2024 19:18:10.679375887 CEST	49792	445	192.168.2.6	217.179.3.1
Jun 7, 2024 19:18:10.684281111 CEST	445	49792	217.179.3.1	192.168.2.6
Jun 7, 2024 19:18:10.684386969 CEST	445	49792	217.179.3.1	192.168.2.6
Jun 7, 2024 19:18:11.681751966 CEST	49909	445	192.168.2.6	35.130.55.1
Jun 7, 2024 19:18:11.686988115 CEST	445	49909	35.130.55.1	192.168.2.6
Jun 7, 2024 19:18:11.687082052 CEST	49909	445	192.168.2.6	35.130.55.1
Jun 7, 2024 19:18:11.687299967 CEST	49909	445	192.168.2.6	35.130.55.1
Jun 7, 2024 19:18:11.692351103 CEST	445	49909	35.130.55.1	192.168.2.6
Jun 7, 2024 19:18:12.245233059 CEST	49917	445	192.168.2.6	31.163.218.91
Jun 7, 2024 19:18:12.250231981 CEST	445	49917	31.163.218.91	192.168.2.6
Jun 7, 2024 19:18:12.250302076 CEST	49917	445	192.168.2.6	31.163.218.91
Jun 7, 2024 19:18:12.250360966 CEST	49917	445	192.168.2.6	31.163.218.91
Jun 7, 2024 19:18:12.250509977 CEST	49918	445	192.168.2.6	31.163.218.1
Jun 7, 2024 19:18:12.255713940 CEST	445	49917	31.163.218.91	192.168.2.6
Jun 7, 2024 19:18:12.255744934 CEST	445	49918	31.163.218.1	192.168.2.6
Jun 7, 2024 19:18:12.255770922 CEST	49917	445	192.168.2.6	31.163.218.91
Jun 7, 2024 19:18:12.255817890 CEST	49918	445	192.168.2.6	31.163.218.1
Jun 7, 2024 19:18:12.255861998 CEST	49918	445	192.168.2.6	31.163.218.1
Jun 7, 2024 19:18:12.256170034 CEST	49919	445	192.168.2.6	31.163.218.1
Jun 7, 2024 19:18:12.261445999 CEST	445	49918	31.163.218.1	192.168.2.6
Jun 7, 2024 19:18:12.261496067 CEST	49918	445	192.168.2.6	31.163.218.1
Jun 7, 2024 19:18:12.261629105 CEST	445	49919	31.163.218.1	192.168.2.6
Jun 7, 2024 19:18:12.261686087 CEST	49919	445	192.168.2.6	31.163.218.1
Jun 7, 2024 19:18:12.261708021 CEST	49919	445	192.168.2.6	31.163.218.1
Jun 7, 2024 19:18:12.266633987 CEST	445	49919	31.163.218.1	192.168.2.6
Jun 7, 2024 19:18:12.687491894 CEST	445	49815	20.161.184.1	192.168.2.6
Jun 7, 2024 19:18:12.687566042 CEST	49815	445	192.168.2.6	20.161.184.1
Jun 7, 2024 19:18:12.687614918 CEST	49815	445	192.168.2.6	20.161.184.1
Jun 7, 2024 19:18:12.687732935 CEST	49815	445	192.168.2.6	20.161.184.1
Jun 7, 2024 19:18:12.692840099 CEST	445	49815	20.161.184.1	192.168.2.6
Jun 7, 2024 19:18:12.692897081 CEST	445	49815	20.161.184.1	192.168.2.6
Jun 7, 2024 19:18:13.681330919 CEST	49934	445	192.168.2.6	217.179.3.1
Jun 7, 2024 19:18:13.686564922 CEST	445	49934	217.179.3.1	192.168.2.6
Jun 7, 2024 19:18:13.687705994 CEST	49934	445	192.168.2.6	217.179.3.1
Jun 7, 2024 19:18:13.687705994 CEST	49934	445	192.168.2.6	217.179.3.1
Jun 7, 2024 19:18:13.692907095 CEST	445	49934	217.179.3.1	192.168.2.6
Jun 7, 2024 19:18:14.259905100 CEST	49942	445	192.168.2.6	149.97.149.38
Jun 7, 2024 19:18:14.265057087 CEST	445	49942	149.97.149.38	192.168.2.6
Jun 7, 2024 19:18:14.265161991 CEST	49942	445	192.168.2.6	149.97.149.38
Jun 7, 2024 19:18:14.265191078 CEST	49942	445	192.168.2.6	149.97.149.38
Jun 7, 2024 19:18:14.265347004 CEST	49944	445	192.168.2.6	149.97.149.1
Jun 7, 2024 19:18:14.270333052 CEST	445	49944	149.97.149.1	192.168.2.6
Jun 7, 2024 19:18:14.270428896 CEST	49944	445	192.168.2.6	149.97.149.1
Jun 7, 2024 19:18:14.270428896 CEST	49944	445	192.168.2.6	149.97.149.1
Jun 7, 2024 19:18:14.270621061 CEST	445	49942	149.97.149.38	192.168.2.6
Jun 7, 2024 19:18:14.270662069 CEST	49942	445	192.168.2.6	149.97.149.38
Jun 7, 2024 19:18:14.270715952 CEST	49945	445	192.168.2.6	149.97.149.1
Jun 7, 2024 19:18:14.275708914 CEST	445	49945	149.97.149.1	192.168.2.6
Jun 7, 2024 19:18:14.275760889 CEST	49945	445	192.168.2.6	149.97.149.1
Jun 7, 2024 19:18:14.275799036 CEST	49945	445	192.168.2.6	149.97.149.1
Jun 7, 2024 19:18:14.275871038 CEST	445	49944	149.97.149.1	192.168.2.6
Jun 7, 2024 19:18:14.275918961 CEST	49944	445	192.168.2.6	149.97.149.1
Jun 7, 2024 19:18:14.280869007 CEST	445	49945	149.97.149.1	192.168.2.6
Jun 7, 2024 19:18:14.714590073 CEST	445	49838	123.63.163.1	192.168.2.6
Jun 7, 2024 19:18:14.716609955 CEST	49838	445	192.168.2.6	123.63.163.1
Jun 7, 2024 19:18:14.724201918 CEST	49838	445	192.168.2.6	123.63.163.1
Jun 7, 2024 19:18:14.724395990 CEST	49838	445	192.168.2.6	123.63.163.1
Jun 7, 2024 19:18:14.729096889 CEST	445	49838	123.63.163.1	192.168.2.6
Jun 7, 2024 19:18:14.729266882 CEST	445	49838	123.63.163.1	192.168.2.6
Jun 7, 2024 19:18:15.697134018 CEST	49959	445	192.168.2.6	20.161.184.1
Jun 7, 2024 19:18:15.931579113 CEST	445	49959	20.161.184.1	192.168.2.6
Jun 7, 2024 19:18:15.931703091 CEST	49959	445	192.168.2.6	20.161.184.1
Jun 7, 2024 19:18:15.931785107 CEST	49959	445	192.168.2.6	20.161.184.1
Jun 7, 2024 19:18:15.936712980 CEST	445	49959	20.161.184.1	192.168.2.6
Jun 7, 2024 19:18:16.164830923 CEST	445	49857	196.22.85.1	192.168.2.6
Jun 7, 2024 19:18:16.164947033 CEST	49857	445	192.168.2.6	196.22.85.1
Jun 7, 2024 19:18:16.165046930 CEST	49857	445	192.168.2.6	196.22.85.1
Jun 7, 2024 19:18:16.165165901 CEST	49857	445	192.168.2.6	196.22.85.1
Jun 7, 2024 19:18:16.169987917 CEST	445	49857	196.22.85.1	192.168.2.6
Jun 7, 2024 19:18:16.170228958 CEST	445	49857	196.22.85.1	192.168.2.6
Jun 7, 2024 19:18:16.228285074 CEST	49967	445	192.168.2.6	196.22.85.2
Jun 7, 2024 19:18:16.233450890 CEST	445	49967	196.22.85.2	192.168.2.6
Jun 7, 2024 19:18:16.233542919 CEST	49967	445	192.168.2.6	196.22.85.2
Jun 7, 2024 19:18:16.233623028 CEST	49967	445	192.168.2.6	196.22.85.2
Jun 7, 2024 19:18:16.234006882 CEST	49968	445	192.168.2.6	196.22.85.2
Jun 7, 2024 19:18:16.238964081 CEST	445	49967	196.22.85.2	192.168.2.6
Jun 7, 2024 19:18:16.239032030 CEST	49967	445	192.168.2.6	196.22.85.2
Jun 7, 2024 19:18:16.239134073 CEST	445	49968	196.22.85.2	192.168.2.6
Jun 7, 2024 19:18:16.239201069 CEST	49968	445	192.168.2.6	196.22.85.2
Jun 7, 2024 19:18:16.239231110 CEST	49968	445	192.168.2.6	196.22.85.2
Jun 7, 2024 19:18:16.244370937 CEST	445	49968	196.22.85.2	192.168.2.6
Jun 7, 2024 19:18:16.276077986 CEST	49969	445	192.168.2.6	59.20.234.6
Jun 7, 2024 19:18:16.281362057 CEST	445	49969	59.20.234.6	192.168.2.6
Jun 7, 2024 19:18:16.281459093 CEST	49969	445	192.168.2.6	59.20.234.6
Jun 7, 2024 19:18:16.281532049 CEST	49969	445	192.168.2.6	59.20.234.6
Jun 7, 2024 19:18:16.281660080 CEST	49971	445	192.168.2.6	59.20.234.1
Jun 7, 2024 19:18:16.286849976 CEST	445	49971	59.20.234.1	192.168.2.6
Jun 7, 2024 19:18:16.286937952 CEST	49971	445	192.168.2.6	59.20.234.1
Jun 7, 2024 19:18:16.287039995 CEST	49971	445	192.168.2.6	59.20.234.1
Jun 7, 2024 19:18:16.287364960 CEST	49972	445	192.168.2.6	59.20.234.1
Jun 7, 2024 19:18:16.287651062 CEST	445	49969	59.20.234.6	192.168.2.6
Jun 7, 2024 19:18:16.287723064 CEST	49969	445	192.168.2.6	59.20.234.6
Jun 7, 2024 19:18:16.292352915 CEST	445	49971	59.20.234.1	192.168.2.6
Jun 7, 2024 19:18:16.292432070 CEST	49971	445	192.168.2.6	59.20.234.1
Jun 7, 2024 19:18:16.292702913 CEST	445	49972	59.20.234.1	192.168.2.6
Jun 7, 2024 19:18:16.292781115 CEST	49972	445	192.168.2.6	59.20.234.1
Jun 7, 2024 19:18:16.292834044 CEST	49972	445	192.168.2.6	59.20.234.1
Jun 7, 2024 19:18:16.298156977 CEST	445	49972	59.20.234.1	192.168.2.6
Jun 7, 2024 19:18:16.723072052 CEST	445	49864	129.100.47.1	192.168.2.6
Jun 7, 2024 19:18:16.723223925 CEST	49864	445	192.168.2.6	129.100.47.1
Jun 7, 2024 19:18:16.723321915 CEST	49864	445	192.168.2.6	129.100.47.1
Jun 7, 2024 19:18:16.723321915 CEST	49864	445	192.168.2.6	129.100.47.1
Jun 7, 2024 19:18:16.728346109 CEST	445	49864	129.100.47.1	192.168.2.6
Jun 7, 2024 19:18:16.728676081 CEST	445	49864	129.100.47.1	192.168.2.6
Jun 7, 2024 19:18:17.728353977 CEST	49986	445	192.168.2.6	123.63.163.1
Jun 7, 2024 19:18:17.733458996 CEST	445	49986	123.63.163.1	192.168.2.6
Jun 7, 2024 19:18:17.733576059 CEST	49986	445	192.168.2.6	123.63.163.1
Jun 7, 2024 19:18:17.733747959 CEST	49986	445	192.168.2.6	123.63.163.1
Jun 7, 2024 19:18:17.738720894 CEST	445	49986	123.63.163.1	192.168.2.6
Jun 7, 2024 19:18:18.171864986 CEST	445	49883	38.185.73.1	192.168.2.6
Jun 7, 2024 19:18:18.171966076 CEST	49883	445	192.168.2.6	38.185.73.1
Jun 7, 2024 19:18:18.172051907 CEST	49883	445	192.168.2.6	38.185.73.1
Jun 7, 2024 19:18:18.172121048 CEST	49883	445	192.168.2.6	38.185.73.1
Jun 7, 2024 19:18:18.177016020 CEST	445	49883	38.185.73.1	192.168.2.6
Jun 7, 2024 19:18:18.177073002 CEST	445	49883	38.185.73.1	192.168.2.6
Jun 7, 2024 19:18:18.228751898 CEST	49993	445	192.168.2.6	38.185.73.2
Jun 7, 2024 19:18:18.236454010 CEST	445	49993	38.185.73.2	192.168.2.6
Jun 7, 2024 19:18:18.236561060 CEST	49993	445	192.168.2.6	38.185.73.2
Jun 7, 2024 19:18:18.236613989 CEST	49993	445	192.168.2.6	38.185.73.2
Jun 7, 2024 19:18:18.236927986 CEST	49994	445	192.168.2.6	38.185.73.2
Jun 7, 2024 19:18:18.243150949 CEST	445	49994	38.185.73.2	192.168.2.6
Jun 7, 2024 19:18:18.243236065 CEST	49994	445	192.168.2.6	38.185.73.2
Jun 7, 2024 19:18:18.243294954 CEST	49994	445	192.168.2.6	38.185.73.2
Jun 7, 2024 19:18:18.243501902 CEST	445	49993	38.185.73.2	192.168.2.6
Jun 7, 2024 19:18:18.243572950 CEST	49993	445	192.168.2.6	38.185.73.2
Jun 7, 2024 19:18:18.249754906 CEST	445	49994	38.185.73.2	192.168.2.6
Jun 7, 2024 19:18:18.291980028 CEST	49996	445	192.168.2.6	199.164.60.145
Jun 7, 2024 19:18:18.299402952 CEST	445	49996	199.164.60.145	192.168.2.6
Jun 7, 2024 19:18:18.299736023 CEST	49996	445	192.168.2.6	199.164.60.145
Jun 7, 2024 19:18:18.299894094 CEST	49996	445	192.168.2.6	199.164.60.145
Jun 7, 2024 19:18:18.299896955 CEST	49997	445	192.168.2.6	199.164.60.1
Jun 7, 2024 19:18:18.304945946 CEST	445	49997	199.164.60.1	192.168.2.6
Jun 7, 2024 19:18:18.305042982 CEST	445	49996	199.164.60.145	192.168.2.6
Jun 7, 2024 19:18:18.305042028 CEST	49997	445	192.168.2.6	199.164.60.1
Jun 7, 2024 19:18:18.305104017 CEST	49996	445	192.168.2.6	199.164.60.145
Jun 7, 2024 19:18:18.305166006 CEST	49997	445	192.168.2.6	199.164.60.1
Jun 7, 2024 19:18:18.305480003 CEST	49998	445	192.168.2.6	199.164.60.1
Jun 7, 2024 19:18:18.310348988 CEST	445	49997	199.164.60.1	192.168.2.6
Jun 7, 2024 19:18:18.310420990 CEST	49997	445	192.168.2.6	199.164.60.1
Jun 7, 2024 19:18:18.310422897 CEST	445	49998	199.164.60.1	192.168.2.6
Jun 7, 2024 19:18:18.310483932 CEST	49998	445	192.168.2.6	199.164.60.1
Jun 7, 2024 19:18:18.310518980 CEST	49998	445	192.168.2.6	199.164.60.1
Jun 7, 2024 19:18:18.315402031 CEST	445	49998	199.164.60.1	192.168.2.6
Jun 7, 2024 19:18:18.732677937 CEST	445	49893	219.1.165.1	192.168.2.6
Jun 7, 2024 19:18:18.732767105 CEST	49893	445	192.168.2.6	219.1.165.1
Jun 7, 2024 19:18:18.732812881 CEST	49893	445	192.168.2.6	219.1.165.1
Jun 7, 2024 19:18:18.732844114 CEST	49893	445	192.168.2.6	219.1.165.1
Jun 7, 2024 19:18:18.737823009 CEST	445	49893	219.1.165.1	192.168.2.6
Jun 7, 2024 19:18:18.737849951 CEST	445	49893	219.1.165.1	192.168.2.6
Jun 7, 2024 19:18:18.847779036 CEST	445	49998	199.164.60.1	192.168.2.6
Jun 7, 2024 19:18:18.847950935 CEST	49998	445	192.168.2.6	199.164.60.1
Jun 7, 2024 19:18:18.848026037 CEST	49998	445	192.168.2.6	199.164.60.1
Jun 7, 2024 19:18:18.848026037 CEST	49998	445	192.168.2.6	199.164.60.1
Jun 7, 2024 19:18:18.853034973 CEST	445	49998	199.164.60.1	192.168.2.6
Jun 7, 2024 19:18:18.853142023 CEST	445	49998	199.164.60.1	192.168.2.6
Jun 7, 2024 19:18:19.728136063 CEST	50014	445	192.168.2.6	129.100.47.1
Jun 7, 2024 19:18:19.733150005 CEST	445	50014	129.100.47.1	192.168.2.6
Jun 7, 2024 19:18:19.733309984 CEST	50014	445	192.168.2.6	129.100.47.1
Jun 7, 2024 19:18:19.733375072 CEST	50014	445	192.168.2.6	129.100.47.1
Jun 7, 2024 19:18:19.738253117 CEST	445	50014	129.100.47.1	192.168.2.6
Jun 7, 2024 19:18:20.185785055 CEST	445	49909	35.130.55.1	192.168.2.6
Jun 7, 2024 19:18:20.185878038 CEST	49909	445	192.168.2.6	35.130.55.1
Jun 7, 2024 19:18:20.185940027 CEST	49909	445	192.168.2.6	35.130.55.1
Jun 7, 2024 19:18:20.186038017 CEST	49909	445	192.168.2.6	35.130.55.1
Jun 7, 2024 19:18:20.190835953 CEST	445	49909	35.130.55.1	192.168.2.6
Jun 7, 2024 19:18:20.190895081 CEST	445	49909	35.130.55.1	192.168.2.6
Jun 7, 2024 19:18:20.243952990 CEST	50019	445	192.168.2.6	35.130.55.2
Jun 7, 2024 19:18:20.248939991 CEST	445	50019	35.130.55.2	192.168.2.6
Jun 7, 2024 19:18:20.249038935 CEST	50019	445	192.168.2.6	35.130.55.2
Jun 7, 2024 19:18:20.249110937 CEST	50019	445	192.168.2.6	35.130.55.2
Jun 7, 2024 19:18:20.249403000 CEST	50020	445	192.168.2.6	35.130.55.2
Jun 7, 2024 19:18:20.254312038 CEST	445	50019	35.130.55.2	192.168.2.6
Jun 7, 2024 19:18:20.254367113 CEST	445	50020	35.130.55.2	192.168.2.6
Jun 7, 2024 19:18:20.254385948 CEST	50019	445	192.168.2.6	35.130.55.2
Jun 7, 2024 19:18:20.254431963 CEST	50020	445	192.168.2.6	35.130.55.2
Jun 7, 2024 19:18:20.254451990 CEST	50020	445	192.168.2.6	35.130.55.2
Jun 7, 2024 19:18:20.259296894 CEST	445	50020	35.130.55.2	192.168.2.6
Jun 7, 2024 19:18:20.306452990 CEST	50022	445	192.168.2.6	122.155.26.16
Jun 7, 2024 19:18:20.311527967 CEST	445	50022	122.155.26.16	192.168.2.6
Jun 7, 2024 19:18:20.311630011 CEST	50022	445	192.168.2.6	122.155.26.16
Jun 7, 2024 19:18:20.311669111 CEST	50022	445	192.168.2.6	122.155.26.16
Jun 7, 2024 19:18:20.311791897 CEST	50023	445	192.168.2.6	122.155.26.1
Jun 7, 2024 19:18:20.316749096 CEST	445	50023	122.155.26.1	192.168.2.6
Jun 7, 2024 19:18:20.316832066 CEST	50023	445	192.168.2.6	122.155.26.1
Jun 7, 2024 19:18:20.316843033 CEST	50023	445	192.168.2.6	122.155.26.1
Jun 7, 2024 19:18:20.316869020 CEST	445	50022	122.155.26.16	192.168.2.6
Jun 7, 2024 19:18:20.316930056 CEST	50022	445	192.168.2.6	122.155.26.16
Jun 7, 2024 19:18:20.317076921 CEST	50024	445	192.168.2.6	122.155.26.1
Jun 7, 2024 19:18:20.321948051 CEST	445	50023	122.155.26.1	192.168.2.6
Jun 7, 2024 19:18:20.321999073 CEST	445	50024	122.155.26.1	192.168.2.6
Jun 7, 2024 19:18:20.322007895 CEST	50023	445	192.168.2.6	122.155.26.1
Jun 7, 2024 19:18:20.322082996 CEST	50024	445	192.168.2.6	122.155.26.1
Jun 7, 2024 19:18:20.322097063 CEST	50024	445	192.168.2.6	122.155.26.1
Jun 7, 2024 19:18:20.327045918 CEST	445	50024	122.155.26.1	192.168.2.6
Jun 7, 2024 19:18:20.750869989 CEST	445	49919	31.163.218.1	192.168.2.6
Jun 7, 2024 19:18:20.751008034 CEST	49919	445	192.168.2.6	31.163.218.1
Jun 7, 2024 19:18:20.751070976 CEST	49919	445	192.168.2.6	31.163.218.1
Jun 7, 2024 19:18:20.751128912 CEST	49919	445	192.168.2.6	31.163.218.1
Jun 7, 2024 19:18:20.755938053 CEST	445	49919	31.163.218.1	192.168.2.6
Jun 7, 2024 19:18:20.756007910 CEST	445	49919	31.163.218.1	192.168.2.6
Jun 7, 2024 19:18:21.743882895 CEST	50029	445	192.168.2.6	219.1.165.1
Jun 7, 2024 19:18:21.749053955 CEST	445	50029	219.1.165.1	192.168.2.6
Jun 7, 2024 19:18:21.749159098 CEST	50029	445	192.168.2.6	219.1.165.1
Jun 7, 2024 19:18:21.749208927 CEST	50029	445	192.168.2.6	219.1.165.1
Jun 7, 2024 19:18:21.754026890 CEST	445	50029	219.1.165.1	192.168.2.6
Jun 7, 2024 19:18:21.853276968 CEST	50030	445	192.168.2.6	199.164.60.1
Jun 7, 2024 19:18:21.858275890 CEST	445	50030	199.164.60.1	192.168.2.6
Jun 7, 2024 19:18:21.858371973 CEST	50030	445	192.168.2.6	199.164.60.1
Jun 7, 2024 19:18:21.858405113 CEST	50030	445	192.168.2.6	199.164.60.1
Jun 7, 2024 19:18:21.863264084 CEST	445	50030	199.164.60.1	192.168.2.6
Jun 7, 2024 19:18:21.909817934 CEST	50031	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:21.909854889 CEST	443	50031	40.115.3.253	192.168.2.6
Jun 7, 2024 19:18:21.909965038 CEST	50031	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:21.910936117 CEST	50031	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:21.910978079 CEST	443	50031	40.115.3.253	192.168.2.6
Jun 7, 2024 19:18:22.177756071 CEST	445	49934	217.179.3.1	192.168.2.6
Jun 7, 2024 19:18:22.177932024 CEST	49934	445	192.168.2.6	217.179.3.1
Jun 7, 2024 19:18:22.187238932 CEST	49934	445	192.168.2.6	217.179.3.1
Jun 7, 2024 19:18:22.187238932 CEST	49934	445	192.168.2.6	217.179.3.1
Jun 7, 2024 19:18:22.192217112 CEST	445	49934	217.179.3.1	192.168.2.6
Jun 7, 2024 19:18:22.192246914 CEST	445	49934	217.179.3.1	192.168.2.6
Jun 7, 2024 19:18:22.244200945 CEST	50032	445	192.168.2.6	217.179.3.2
Jun 7, 2024 19:18:22.250530005 CEST	445	50032	217.179.3.2	192.168.2.6
Jun 7, 2024 19:18:22.250613928 CEST	50032	445	192.168.2.6	217.179.3.2
Jun 7, 2024 19:18:22.250643015 CEST	50032	445	192.168.2.6	217.179.3.2
Jun 7, 2024 19:18:22.251044989 CEST	50033	445	192.168.2.6	217.179.3.2
Jun 7, 2024 19:18:22.256371021 CEST	445	50032	217.179.3.2	192.168.2.6
Jun 7, 2024 19:18:22.256422997 CEST	50032	445	192.168.2.6	217.179.3.2
Jun 7, 2024 19:18:22.256923914 CEST	445	50033	217.179.3.2	192.168.2.6
Jun 7, 2024 19:18:22.257003069 CEST	50033	445	192.168.2.6	217.179.3.2
Jun 7, 2024 19:18:22.257060051 CEST	50033	445	192.168.2.6	217.179.3.2
Jun 7, 2024 19:18:22.262734890 CEST	445	50033	217.179.3.2	192.168.2.6
Jun 7, 2024 19:18:22.322091103 CEST	50034	445	192.168.2.6	71.243.85.253
Jun 7, 2024 19:18:22.327086926 CEST	445	50034	71.243.85.253	192.168.2.6
Jun 7, 2024 19:18:22.327200890 CEST	50034	445	192.168.2.6	71.243.85.253
Jun 7, 2024 19:18:22.327200890 CEST	50034	445	192.168.2.6	71.243.85.253
Jun 7, 2024 19:18:22.327332973 CEST	50035	445	192.168.2.6	71.243.85.1
Jun 7, 2024 19:18:22.332380056 CEST	445	50035	71.243.85.1	192.168.2.6
Jun 7, 2024 19:18:22.332441092 CEST	50035	445	192.168.2.6	71.243.85.1
Jun 7, 2024 19:18:22.332470894 CEST	50035	445	192.168.2.6	71.243.85.1
Jun 7, 2024 19:18:22.332585096 CEST	445	50034	71.243.85.253	192.168.2.6
Jun 7, 2024 19:18:22.332745075 CEST	50036	445	192.168.2.6	71.243.85.1
Jun 7, 2024 19:18:22.333518982 CEST	445	50034	71.243.85.253	192.168.2.6
Jun 7, 2024 19:18:22.333579063 CEST	50034	445	192.168.2.6	71.243.85.253
Jun 7, 2024 19:18:22.337800026 CEST	445	50036	71.243.85.1	192.168.2.6
Jun 7, 2024 19:18:22.337884903 CEST	50036	445	192.168.2.6	71.243.85.1
Jun 7, 2024 19:18:22.337958097 CEST	50036	445	192.168.2.6	71.243.85.1
Jun 7, 2024 19:18:22.337975979 CEST	445	50035	71.243.85.1	192.168.2.6
Jun 7, 2024 19:18:22.338020086 CEST	50035	445	192.168.2.6	71.243.85.1
Jun 7, 2024 19:18:22.343035936 CEST	445	50036	71.243.85.1	192.168.2.6
Jun 7, 2024 19:18:22.393865108 CEST	445	50030	199.164.60.1	192.168.2.6
Jun 7, 2024 19:18:22.393937111 CEST	50030	445	192.168.2.6	199.164.60.1
Jun 7, 2024 19:18:22.393975973 CEST	50030	445	192.168.2.6	199.164.60.1
Jun 7, 2024 19:18:22.394025087 CEST	50030	445	192.168.2.6	199.164.60.1
Jun 7, 2024 19:18:22.398931980 CEST	445	50030	199.164.60.1	192.168.2.6
Jun 7, 2024 19:18:22.398960114 CEST	445	50030	199.164.60.1	192.168.2.6
Jun 7, 2024 19:18:22.446849108 CEST	50037	445	192.168.2.6	199.164.60.2
Jun 7, 2024 19:18:22.451805115 CEST	445	50037	199.164.60.2	192.168.2.6
Jun 7, 2024 19:18:22.451879978 CEST	50037	445	192.168.2.6	199.164.60.2
Jun 7, 2024 19:18:22.451904058 CEST	50037	445	192.168.2.6	199.164.60.2
Jun 7, 2024 19:18:22.452255964 CEST	50038	445	192.168.2.6	199.164.60.2
Jun 7, 2024 19:18:22.457087994 CEST	445	50038	199.164.60.2	192.168.2.6
Jun 7, 2024 19:18:22.457150936 CEST	50038	445	192.168.2.6	199.164.60.2
Jun 7, 2024 19:18:22.457173109 CEST	50038	445	192.168.2.6	199.164.60.2
Jun 7, 2024 19:18:22.457391977 CEST	445	50037	199.164.60.2	192.168.2.6
Jun 7, 2024 19:18:22.457442999 CEST	50037	445	192.168.2.6	199.164.60.2
Jun 7, 2024 19:18:22.462053061 CEST	445	50038	199.164.60.2	192.168.2.6
Jun 7, 2024 19:18:22.762542963 CEST	445	49945	149.97.149.1	192.168.2.6
Jun 7, 2024 19:18:22.762609005 CEST	49945	445	192.168.2.6	149.97.149.1
Jun 7, 2024 19:18:22.762654066 CEST	49945	445	192.168.2.6	149.97.149.1
Jun 7, 2024 19:18:22.762685061 CEST	49945	445	192.168.2.6	149.97.149.1
Jun 7, 2024 19:18:22.767626047 CEST	445	49945	149.97.149.1	192.168.2.6
Jun 7, 2024 19:18:22.767654896 CEST	445	49945	149.97.149.1	192.168.2.6
Jun 7, 2024 19:18:22.989835978 CEST	445	50038	199.164.60.2	192.168.2.6
Jun 7, 2024 19:18:22.990046978 CEST	50038	445	192.168.2.6	199.164.60.2
Jun 7, 2024 19:18:22.990046978 CEST	50038	445	192.168.2.6	199.164.60.2
Jun 7, 2024 19:18:22.990143061 CEST	50038	445	192.168.2.6	199.164.60.2
Jun 7, 2024 19:18:22.995031118 CEST	445	50038	199.164.60.2	192.168.2.6
Jun 7, 2024 19:18:22.995085001 CEST	445	50038	199.164.60.2	192.168.2.6
Jun 7, 2024 19:18:23.028301954 CEST	443	50031	40.115.3.253	192.168.2.6
Jun 7, 2024 19:18:23.028387070 CEST	50031	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:23.036164999 CEST	50031	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:23.036185980 CEST	443	50031	40.115.3.253	192.168.2.6
Jun 7, 2024 19:18:23.037012100 CEST	443	50031	40.115.3.253	192.168.2.6
Jun 7, 2024 19:18:23.039459944 CEST	50031	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:23.039516926 CEST	50031	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:23.039525986 CEST	443	50031	40.115.3.253	192.168.2.6
Jun 7, 2024 19:18:23.039710999 CEST	50031	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:23.084503889 CEST	443	50031	40.115.3.253	192.168.2.6
Jun 7, 2024 19:18:23.285551071 CEST	443	50031	40.115.3.253	192.168.2.6
Jun 7, 2024 19:18:23.286389112 CEST	50031	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:23.286427975 CEST	443	50031	40.115.3.253	192.168.2.6
Jun 7, 2024 19:18:23.286453009 CEST	50031	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:23.286680937 CEST	50031	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:23.759473085 CEST	50039	445	192.168.2.6	31.163.218.1
Jun 7, 2024 19:18:23.764849901 CEST	445	50039	31.163.218.1	192.168.2.6
Jun 7, 2024 19:18:23.765084028 CEST	50039	445	192.168.2.6	31.163.218.1
Jun 7, 2024 19:18:23.765084028 CEST	50039	445	192.168.2.6	31.163.218.1
Jun 7, 2024 19:18:23.770126104 CEST	445	50039	31.163.218.1	192.168.2.6
Jun 7, 2024 19:18:24.337915897 CEST	50040	445	192.168.2.6	213.153.200.32
Jun 7, 2024 19:18:24.342906952 CEST	445	50040	213.153.200.32	192.168.2.6
Jun 7, 2024 19:18:24.342999935 CEST	50040	445	192.168.2.6	213.153.200.32
Jun 7, 2024 19:18:24.343127966 CEST	50040	445	192.168.2.6	213.153.200.32
Jun 7, 2024 19:18:24.343249083 CEST	50041	445	192.168.2.6	213.153.200.1
Jun 7, 2024 19:18:24.348148108 CEST	445	50041	213.153.200.1	192.168.2.6
Jun 7, 2024 19:18:24.348217964 CEST	50041	445	192.168.2.6	213.153.200.1
Jun 7, 2024 19:18:24.348236084 CEST	50041	445	192.168.2.6	213.153.200.1
Jun 7, 2024 19:18:24.348459005 CEST	445	50040	213.153.200.32	192.168.2.6
Jun 7, 2024 19:18:24.348525047 CEST	50040	445	192.168.2.6	213.153.200.32
Jun 7, 2024 19:18:24.348594904 CEST	50042	445	192.168.2.6	213.153.200.1
Jun 7, 2024 19:18:24.353435040 CEST	445	50042	213.153.200.1	192.168.2.6
Jun 7, 2024 19:18:24.353693962 CEST	50042	445	192.168.2.6	213.153.200.1
Jun 7, 2024 19:18:24.353737116 CEST	50042	445	192.168.2.6	213.153.200.1
Jun 7, 2024 19:18:24.353765011 CEST	445	50041	213.153.200.1	192.168.2.6
Jun 7, 2024 19:18:24.353820086 CEST	50041	445	192.168.2.6	213.153.200.1
Jun 7, 2024 19:18:24.358767033 CEST	445	50042	213.153.200.1	192.168.2.6
Jun 7, 2024 19:18:24.429629087 CEST	445	49959	20.161.184.1	192.168.2.6
Jun 7, 2024 19:18:24.429842949 CEST	49959	445	192.168.2.6	20.161.184.1
Jun 7, 2024 19:18:24.429842949 CEST	49959	445	192.168.2.6	20.161.184.1
Jun 7, 2024 19:18:24.429842949 CEST	49959	445	192.168.2.6	20.161.184.1
Jun 7, 2024 19:18:24.434911013 CEST	445	49959	20.161.184.1	192.168.2.6
Jun 7, 2024 19:18:24.434941053 CEST	445	49959	20.161.184.1	192.168.2.6
Jun 7, 2024 19:18:24.493911982 CEST	50043	445	192.168.2.6	20.161.184.2
Jun 7, 2024 19:18:24.498930931 CEST	445	50043	20.161.184.2	192.168.2.6
Jun 7, 2024 19:18:24.499089003 CEST	50043	445	192.168.2.6	20.161.184.2
Jun 7, 2024 19:18:24.499089956 CEST	50043	445	192.168.2.6	20.161.184.2
Jun 7, 2024 19:18:24.499381065 CEST	50044	445	192.168.2.6	20.161.184.2
Jun 7, 2024 19:18:24.504235983 CEST	445	50043	20.161.184.2	192.168.2.6
Jun 7, 2024 19:18:24.504292011 CEST	445	50044	20.161.184.2	192.168.2.6
Jun 7, 2024 19:18:24.504332066 CEST	50043	445	192.168.2.6	20.161.184.2
Jun 7, 2024 19:18:24.504363060 CEST	50044	445	192.168.2.6	20.161.184.2
Jun 7, 2024 19:18:24.504417896 CEST	50044	445	192.168.2.6	20.161.184.2
Jun 7, 2024 19:18:24.509403944 CEST	445	50044	20.161.184.2	192.168.2.6
Jun 7, 2024 19:18:24.731209040 CEST	445	49968	196.22.85.2	192.168.2.6
Jun 7, 2024 19:18:24.731425047 CEST	49968	445	192.168.2.6	196.22.85.2
Jun 7, 2024 19:18:24.731425047 CEST	49968	445	192.168.2.6	196.22.85.2
Jun 7, 2024 19:18:24.731425047 CEST	49968	445	192.168.2.6	196.22.85.2
Jun 7, 2024 19:18:24.736470938 CEST	445	49968	196.22.85.2	192.168.2.6
Jun 7, 2024 19:18:24.736603975 CEST	445	49968	196.22.85.2	192.168.2.6
Jun 7, 2024 19:18:24.791002035 CEST	445	49972	59.20.234.1	192.168.2.6
Jun 7, 2024 19:18:24.791104078 CEST	49972	445	192.168.2.6	59.20.234.1
Jun 7, 2024 19:18:24.791105032 CEST	49972	445	192.168.2.6	59.20.234.1
Jun 7, 2024 19:18:24.791191101 CEST	49972	445	192.168.2.6	59.20.234.1
Jun 7, 2024 19:18:24.796129942 CEST	445	49972	59.20.234.1	192.168.2.6
Jun 7, 2024 19:18:24.796220064 CEST	445	49972	59.20.234.1	192.168.2.6
Jun 7, 2024 19:18:25.774987936 CEST	50045	445	192.168.2.6	149.97.149.1
Jun 7, 2024 19:18:25.780138016 CEST	445	50045	149.97.149.1	192.168.2.6
Jun 7, 2024 19:18:25.780222893 CEST	50045	445	192.168.2.6	149.97.149.1
Jun 7, 2024 19:18:25.780232906 CEST	50045	445	192.168.2.6	149.97.149.1
Jun 7, 2024 19:18:25.785278082 CEST	445	50045	149.97.149.1	192.168.2.6
Jun 7, 2024 19:18:25.993911982 CEST	50046	445	192.168.2.6	199.164.60.2
Jun 7, 2024 19:18:26.137453079 CEST	445	50046	199.164.60.2	192.168.2.6
Jun 7, 2024 19:18:26.137592077 CEST	50046	445	192.168.2.6	199.164.60.2
Jun 7, 2024 19:18:26.137649059 CEST	50046	445	192.168.2.6	199.164.60.2
Jun 7, 2024 19:18:26.142522097 CEST	445	50046	199.164.60.2	192.168.2.6
Jun 7, 2024 19:18:26.227035046 CEST	445	49986	123.63.163.1	192.168.2.6
Jun 7, 2024 19:18:26.227123976 CEST	49986	445	192.168.2.6	123.63.163.1
Jun 7, 2024 19:18:26.227185965 CEST	49986	445	192.168.2.6	123.63.163.1
Jun 7, 2024 19:18:26.227250099 CEST	49986	445	192.168.2.6	123.63.163.1
Jun 7, 2024 19:18:26.232038021 CEST	445	49986	123.63.163.1	192.168.2.6
Jun 7, 2024 19:18:26.232204914 CEST	445	49986	123.63.163.1	192.168.2.6
Jun 7, 2024 19:18:26.290781975 CEST	50047	445	192.168.2.6	123.63.163.2
Jun 7, 2024 19:18:26.295727968 CEST	445	50047	123.63.163.2	192.168.2.6
Jun 7, 2024 19:18:26.295840979 CEST	50047	445	192.168.2.6	123.63.163.2
Jun 7, 2024 19:18:26.300116062 CEST	50047	445	192.168.2.6	123.63.163.2
Jun 7, 2024 19:18:26.300466061 CEST	50048	445	192.168.2.6	123.63.163.2
Jun 7, 2024 19:18:26.305565119 CEST	445	50047	123.63.163.2	192.168.2.6
Jun 7, 2024 19:18:26.305619001 CEST	445	50048	123.63.163.2	192.168.2.6
Jun 7, 2024 19:18:26.305629969 CEST	50047	445	192.168.2.6	123.63.163.2
Jun 7, 2024 19:18:26.305681944 CEST	50048	445	192.168.2.6	123.63.163.2
Jun 7, 2024 19:18:26.305701017 CEST	50048	445	192.168.2.6	123.63.163.2
Jun 7, 2024 19:18:26.310693979 CEST	445	50048	123.63.163.2	192.168.2.6
Jun 7, 2024 19:18:26.353564978 CEST	50049	445	192.168.2.6	205.139.6.227
Jun 7, 2024 19:18:26.358562946 CEST	445	50049	205.139.6.227	192.168.2.6
Jun 7, 2024 19:18:26.358714104 CEST	50049	445	192.168.2.6	205.139.6.227
Jun 7, 2024 19:18:26.358714104 CEST	50049	445	192.168.2.6	205.139.6.227
Jun 7, 2024 19:18:26.358814955 CEST	50050	445	192.168.2.6	205.139.6.1
Jun 7, 2024 19:18:26.363893032 CEST	445	50050	205.139.6.1	192.168.2.6
Jun 7, 2024 19:18:26.363969088 CEST	50050	445	192.168.2.6	205.139.6.1
Jun 7, 2024 19:18:26.364000082 CEST	445	50049	205.139.6.227	192.168.2.6
Jun 7, 2024 19:18:26.364042044 CEST	50050	445	192.168.2.6	205.139.6.1
Jun 7, 2024 19:18:26.364065886 CEST	50049	445	192.168.2.6	205.139.6.227
Jun 7, 2024 19:18:26.364258051 CEST	50051	445	192.168.2.6	205.139.6.1
Jun 7, 2024 19:18:26.369218111 CEST	445	50050	205.139.6.1	192.168.2.6
Jun 7, 2024 19:18:26.369249105 CEST	445	50051	205.139.6.1	192.168.2.6
Jun 7, 2024 19:18:26.369282961 CEST	50050	445	192.168.2.6	205.139.6.1
Jun 7, 2024 19:18:26.369312048 CEST	50051	445	192.168.2.6	205.139.6.1
Jun 7, 2024 19:18:26.369334936 CEST	50051	445	192.168.2.6	205.139.6.1
Jun 7, 2024 19:18:26.374202967 CEST	445	50051	205.139.6.1	192.168.2.6
Jun 7, 2024 19:18:26.664257050 CEST	445	50046	199.164.60.2	192.168.2.6
Jun 7, 2024 19:18:26.664352894 CEST	50046	445	192.168.2.6	199.164.60.2
Jun 7, 2024 19:18:26.664443970 CEST	50046	445	192.168.2.6	199.164.60.2
Jun 7, 2024 19:18:26.664443970 CEST	50046	445	192.168.2.6	199.164.60.2
Jun 7, 2024 19:18:26.669400930 CEST	445	50046	199.164.60.2	192.168.2.6
Jun 7, 2024 19:18:26.669451952 CEST	445	50046	199.164.60.2	192.168.2.6
Jun 7, 2024 19:18:26.728244066 CEST	50052	445	192.168.2.6	199.164.60.3
Jun 7, 2024 19:18:26.733249903 CEST	445	50052	199.164.60.3	192.168.2.6
Jun 7, 2024 19:18:26.733331919 CEST	50052	445	192.168.2.6	199.164.60.3
Jun 7, 2024 19:18:26.733422995 CEST	50052	445	192.168.2.6	199.164.60.3
Jun 7, 2024 19:18:26.733887911 CEST	50053	445	192.168.2.6	199.164.60.3
Jun 7, 2024 19:18:26.738548994 CEST	445	50052	199.164.60.3	192.168.2.6
Jun 7, 2024 19:18:26.738612890 CEST	50052	445	192.168.2.6	199.164.60.3
Jun 7, 2024 19:18:26.738837957 CEST	445	50053	199.164.60.3	192.168.2.6
Jun 7, 2024 19:18:26.738924980 CEST	50053	445	192.168.2.6	199.164.60.3
Jun 7, 2024 19:18:26.738924980 CEST	50053	445	192.168.2.6	199.164.60.3
Jun 7, 2024 19:18:26.743837118 CEST	445	50053	199.164.60.3	192.168.2.6
Jun 7, 2024 19:18:26.746179104 CEST	445	49994	38.185.73.2	192.168.2.6
Jun 7, 2024 19:18:26.746231079 CEST	49994	445	192.168.2.6	38.185.73.2
Jun 7, 2024 19:18:26.746253014 CEST	49994	445	192.168.2.6	38.185.73.2
Jun 7, 2024 19:18:26.746272087 CEST	49994	445	192.168.2.6	38.185.73.2
Jun 7, 2024 19:18:26.751163006 CEST	445	49994	38.185.73.2	192.168.2.6
Jun 7, 2024 19:18:26.751214027 CEST	445	49994	38.185.73.2	192.168.2.6
Jun 7, 2024 19:18:27.269391060 CEST	445	50053	199.164.60.3	192.168.2.6
Jun 7, 2024 19:18:27.269517899 CEST	50053	445	192.168.2.6	199.164.60.3
Jun 7, 2024 19:18:27.269612074 CEST	50053	445	192.168.2.6	199.164.60.3
Jun 7, 2024 19:18:27.269612074 CEST	50053	445	192.168.2.6	199.164.60.3
Jun 7, 2024 19:18:27.274655104 CEST	445	50053	199.164.60.3	192.168.2.6
Jun 7, 2024 19:18:27.274683952 CEST	445	50053	199.164.60.3	192.168.2.6
Jun 7, 2024 19:18:27.743746042 CEST	50054	445	192.168.2.6	196.22.85.2
Jun 7, 2024 19:18:27.751468897 CEST	445	50054	196.22.85.2	192.168.2.6
Jun 7, 2024 19:18:27.751559973 CEST	50054	445	192.168.2.6	196.22.85.2
Jun 7, 2024 19:18:27.751605988 CEST	50054	445	192.168.2.6	196.22.85.2
Jun 7, 2024 19:18:27.756532907 CEST	445	50054	196.22.85.2	192.168.2.6
Jun 7, 2024 19:18:27.806271076 CEST	50055	445	192.168.2.6	59.20.234.1
Jun 7, 2024 19:18:27.811484098 CEST	445	50055	59.20.234.1	192.168.2.6
Jun 7, 2024 19:18:27.811593056 CEST	50055	445	192.168.2.6	59.20.234.1
Jun 7, 2024 19:18:27.811623096 CEST	50055	445	192.168.2.6	59.20.234.1
Jun 7, 2024 19:18:27.816590071 CEST	445	50055	59.20.234.1	192.168.2.6
Jun 7, 2024 19:18:28.231139898 CEST	445	50014	129.100.47.1	192.168.2.6
Jun 7, 2024 19:18:28.231452942 CEST	50014	445	192.168.2.6	129.100.47.1
Jun 7, 2024 19:18:28.231452942 CEST	50014	445	192.168.2.6	129.100.47.1
Jun 7, 2024 19:18:28.231452942 CEST	50014	445	192.168.2.6	129.100.47.1
Jun 7, 2024 19:18:28.236578941 CEST	445	50014	129.100.47.1	192.168.2.6
Jun 7, 2024 19:18:28.236609936 CEST	445	50014	129.100.47.1	192.168.2.6
Jun 7, 2024 19:18:28.290694952 CEST	50056	445	192.168.2.6	129.100.47.2
Jun 7, 2024 19:18:28.295921087 CEST	445	50056	129.100.47.2	192.168.2.6
Jun 7, 2024 19:18:28.296103001 CEST	50056	445	192.168.2.6	129.100.47.2
Jun 7, 2024 19:18:28.296135902 CEST	50056	445	192.168.2.6	129.100.47.2
Jun 7, 2024 19:18:28.296427965 CEST	50057	445	192.168.2.6	129.100.47.2
Jun 7, 2024 19:18:28.301433086 CEST	445	50056	129.100.47.2	192.168.2.6
Jun 7, 2024 19:18:28.301469088 CEST	445	50057	129.100.47.2	192.168.2.6
Jun 7, 2024 19:18:28.301496983 CEST	50056	445	192.168.2.6	129.100.47.2
Jun 7, 2024 19:18:28.301542997 CEST	50057	445	192.168.2.6	129.100.47.2
Jun 7, 2024 19:18:28.301587105 CEST	50057	445	192.168.2.6	129.100.47.2
Jun 7, 2024 19:18:28.306440115 CEST	445	50057	129.100.47.2	192.168.2.6
Jun 7, 2024 19:18:28.369093895 CEST	50058	445	192.168.2.6	156.45.127.52
Jun 7, 2024 19:18:28.374412060 CEST	445	50058	156.45.127.52	192.168.2.6
Jun 7, 2024 19:18:28.374517918 CEST	50058	445	192.168.2.6	156.45.127.52
Jun 7, 2024 19:18:28.375847101 CEST	50058	445	192.168.2.6	156.45.127.52
Jun 7, 2024 19:18:28.376036882 CEST	50059	445	192.168.2.6	156.45.127.1
Jun 7, 2024 19:18:28.380909920 CEST	445	50058	156.45.127.52	192.168.2.6
Jun 7, 2024 19:18:28.381066084 CEST	50058	445	192.168.2.6	156.45.127.52
Jun 7, 2024 19:18:28.381144047 CEST	445	50059	156.45.127.1	192.168.2.6
Jun 7, 2024 19:18:28.381222963 CEST	50059	445	192.168.2.6	156.45.127.1
Jun 7, 2024 19:18:28.381268024 CEST	50059	445	192.168.2.6	156.45.127.1
Jun 7, 2024 19:18:28.381647110 CEST	50060	445	192.168.2.6	156.45.127.1
Jun 7, 2024 19:18:28.386476994 CEST	445	50059	156.45.127.1	192.168.2.6
Jun 7, 2024 19:18:28.386567116 CEST	50059	445	192.168.2.6	156.45.127.1
Jun 7, 2024 19:18:28.386641979 CEST	445	50060	156.45.127.1	192.168.2.6
Jun 7, 2024 19:18:28.386710882 CEST	50060	445	192.168.2.6	156.45.127.1
Jun 7, 2024 19:18:28.386754036 CEST	50060	445	192.168.2.6	156.45.127.1
Jun 7, 2024 19:18:28.391849041 CEST	445	50060	156.45.127.1	192.168.2.6
Jun 7, 2024 19:18:28.752284050 CEST	445	50020	35.130.55.2	192.168.2.6
Jun 7, 2024 19:18:28.752361059 CEST	50020	445	192.168.2.6	35.130.55.2
Jun 7, 2024 19:18:28.752578020 CEST	50020	445	192.168.2.6	35.130.55.2
Jun 7, 2024 19:18:28.752624035 CEST	50020	445	192.168.2.6	35.130.55.2
Jun 7, 2024 19:18:28.757503986 CEST	445	50020	35.130.55.2	192.168.2.6
Jun 7, 2024 19:18:28.757534981 CEST	445	50020	35.130.55.2	192.168.2.6
Jun 7, 2024 19:18:28.810290098 CEST	445	50024	122.155.26.1	192.168.2.6
Jun 7, 2024 19:18:28.810364962 CEST	50024	445	192.168.2.6	122.155.26.1
Jun 7, 2024 19:18:28.810395956 CEST	50024	445	192.168.2.6	122.155.26.1
Jun 7, 2024 19:18:28.810440063 CEST	50024	445	192.168.2.6	122.155.26.1
Jun 7, 2024 19:18:28.815443993 CEST	445	50024	122.155.26.1	192.168.2.6
Jun 7, 2024 19:18:28.815474987 CEST	445	50024	122.155.26.1	192.168.2.6
Jun 7, 2024 19:18:29.759393930 CEST	50061	445	192.168.2.6	38.185.73.2
Jun 7, 2024 19:18:29.764553070 CEST	445	50061	38.185.73.2	192.168.2.6
Jun 7, 2024 19:18:29.764650106 CEST	50061	445	192.168.2.6	38.185.73.2
Jun 7, 2024 19:18:29.764684916 CEST	50061	445	192.168.2.6	38.185.73.2
Jun 7, 2024 19:18:29.769604921 CEST	445	50061	38.185.73.2	192.168.2.6
Jun 7, 2024 19:18:30.237030983 CEST	445	50029	219.1.165.1	192.168.2.6
Jun 7, 2024 19:18:30.237230062 CEST	50029	445	192.168.2.6	219.1.165.1
Jun 7, 2024 19:18:30.237320900 CEST	50029	445	192.168.2.6	219.1.165.1
Jun 7, 2024 19:18:30.237376928 CEST	50029	445	192.168.2.6	219.1.165.1
Jun 7, 2024 19:18:30.242337942 CEST	445	50029	219.1.165.1	192.168.2.6
Jun 7, 2024 19:18:30.242352009 CEST	445	50029	219.1.165.1	192.168.2.6
Jun 7, 2024 19:18:30.275149107 CEST	50062	445	192.168.2.6	199.164.60.3
Jun 7, 2024 19:18:30.280111074 CEST	445	50062	199.164.60.3	192.168.2.6
Jun 7, 2024 19:18:30.280204058 CEST	50062	445	192.168.2.6	199.164.60.3
Jun 7, 2024 19:18:30.280267954 CEST	50062	445	192.168.2.6	199.164.60.3
Jun 7, 2024 19:18:30.285126925 CEST	445	50062	199.164.60.3	192.168.2.6
Jun 7, 2024 19:18:30.290637016 CEST	50063	445	192.168.2.6	219.1.165.2
Jun 7, 2024 19:18:30.295520067 CEST	445	50063	219.1.165.2	192.168.2.6
Jun 7, 2024 19:18:30.295593023 CEST	50063	445	192.168.2.6	219.1.165.2
Jun 7, 2024 19:18:30.295644045 CEST	50063	445	192.168.2.6	219.1.165.2
Jun 7, 2024 19:18:30.295939922 CEST	50064	445	192.168.2.6	219.1.165.2
Jun 7, 2024 19:18:30.300746918 CEST	445	50063	219.1.165.2	192.168.2.6
Jun 7, 2024 19:18:30.300807953 CEST	50063	445	192.168.2.6	219.1.165.2
Jun 7, 2024 19:18:30.300875902 CEST	445	50064	219.1.165.2	192.168.2.6
Jun 7, 2024 19:18:30.300940037 CEST	50064	445	192.168.2.6	219.1.165.2
Jun 7, 2024 19:18:30.300976038 CEST	50064	445	192.168.2.6	219.1.165.2
Jun 7, 2024 19:18:30.305862904 CEST	445	50064	219.1.165.2	192.168.2.6
Jun 7, 2024 19:18:30.384917974 CEST	50065	445	192.168.2.6	189.250.95.125
Jun 7, 2024 19:18:30.390002966 CEST	445	50065	189.250.95.125	192.168.2.6
Jun 7, 2024 19:18:30.390201092 CEST	50065	445	192.168.2.6	189.250.95.125
Jun 7, 2024 19:18:30.390240908 CEST	50065	445	192.168.2.6	189.250.95.125
Jun 7, 2024 19:18:30.390433073 CEST	50066	445	192.168.2.6	189.250.95.1
Jun 7, 2024 19:18:30.395488024 CEST	445	50066	189.250.95.1	192.168.2.6
Jun 7, 2024 19:18:30.395560026 CEST	50066	445	192.168.2.6	189.250.95.1
Jun 7, 2024 19:18:30.395600080 CEST	50066	445	192.168.2.6	189.250.95.1
Jun 7, 2024 19:18:30.395715952 CEST	445	50065	189.250.95.125	192.168.2.6
Jun 7, 2024 19:18:30.395772934 CEST	50065	445	192.168.2.6	189.250.95.125
Jun 7, 2024 19:18:30.395850897 CEST	50067	445	192.168.2.6	189.250.95.1
Jun 7, 2024 19:18:30.400789976 CEST	445	50067	189.250.95.1	192.168.2.6
Jun 7, 2024 19:18:30.400856018 CEST	50067	445	192.168.2.6	189.250.95.1
Jun 7, 2024 19:18:30.400881052 CEST	50067	445	192.168.2.6	189.250.95.1
Jun 7, 2024 19:18:30.400954008 CEST	445	50066	189.250.95.1	192.168.2.6
Jun 7, 2024 19:18:30.401011944 CEST	50066	445	192.168.2.6	189.250.95.1
Jun 7, 2024 19:18:30.405766964 CEST	445	50067	189.250.95.1	192.168.2.6
Jun 7, 2024 19:18:30.747638941 CEST	445	50033	217.179.3.2	192.168.2.6
Jun 7, 2024 19:18:30.747798920 CEST	50033	445	192.168.2.6	217.179.3.2
Jun 7, 2024 19:18:30.747895956 CEST	50033	445	192.168.2.6	217.179.3.2
Jun 7, 2024 19:18:30.748007059 CEST	50033	445	192.168.2.6	217.179.3.2
Jun 7, 2024 19:18:30.755887032 CEST	445	50033	217.179.3.2	192.168.2.6
Jun 7, 2024 19:18:30.755903959 CEST	445	50033	217.179.3.2	192.168.2.6
Jun 7, 2024 19:18:30.809680939 CEST	445	50062	199.164.60.3	192.168.2.6
Jun 7, 2024 19:18:30.809763908 CEST	50062	445	192.168.2.6	199.164.60.3
Jun 7, 2024 19:18:30.809823036 CEST	50062	445	192.168.2.6	199.164.60.3
Jun 7, 2024 19:18:30.809873104 CEST	50062	445	192.168.2.6	199.164.60.3
Jun 7, 2024 19:18:30.816137075 CEST	445	50062	199.164.60.3	192.168.2.6
Jun 7, 2024 19:18:30.816150904 CEST	445	50062	199.164.60.3	192.168.2.6
Jun 7, 2024 19:18:30.833931923 CEST	445	50036	71.243.85.1	192.168.2.6
Jun 7, 2024 19:18:30.834039927 CEST	50036	445	192.168.2.6	71.243.85.1
Jun 7, 2024 19:18:30.834093094 CEST	50036	445	192.168.2.6	71.243.85.1
Jun 7, 2024 19:18:30.834093094 CEST	50036	445	192.168.2.6	71.243.85.1
Jun 7, 2024 19:18:30.839833975 CEST	445	50036	71.243.85.1	192.168.2.6
Jun 7, 2024 19:18:30.839848995 CEST	445	50036	71.243.85.1	192.168.2.6
Jun 7, 2024 19:18:30.868984938 CEST	50068	445	192.168.2.6	199.164.60.4
Jun 7, 2024 19:18:30.875583887 CEST	445	50068	199.164.60.4	192.168.2.6
Jun 7, 2024 19:18:30.875792027 CEST	50068	445	192.168.2.6	199.164.60.4
Jun 7, 2024 19:18:30.875901937 CEST	50068	445	192.168.2.6	199.164.60.4
Jun 7, 2024 19:18:30.876429081 CEST	50069	445	192.168.2.6	199.164.60.4
Jun 7, 2024 19:18:30.883547068 CEST	445	50068	199.164.60.4	192.168.2.6
Jun 7, 2024 19:18:30.883683920 CEST	50068	445	192.168.2.6	199.164.60.4
Jun 7, 2024 19:18:30.883713961 CEST	445	50069	199.164.60.4	192.168.2.6
Jun 7, 2024 19:18:30.883797884 CEST	50069	445	192.168.2.6	199.164.60.4
Jun 7, 2024 19:18:30.883835077 CEST	50069	445	192.168.2.6	199.164.60.4
Jun 7, 2024 19:18:30.890357018 CEST	445	50069	199.164.60.4	192.168.2.6
Jun 7, 2024 19:18:31.423804998 CEST	445	50069	199.164.60.4	192.168.2.6
Jun 7, 2024 19:18:31.423919916 CEST	50069	445	192.168.2.6	199.164.60.4
Jun 7, 2024 19:18:31.423965931 CEST	50069	445	192.168.2.6	199.164.60.4
Jun 7, 2024 19:18:31.424010992 CEST	50069	445	192.168.2.6	199.164.60.4
Jun 7, 2024 19:18:31.428874016 CEST	445	50069	199.164.60.4	192.168.2.6
Jun 7, 2024 19:18:31.428900003 CEST	445	50069	199.164.60.4	192.168.2.6
Jun 7, 2024 19:18:31.759466887 CEST	50070	445	192.168.2.6	35.130.55.2
Jun 7, 2024 19:18:31.764451027 CEST	445	50070	35.130.55.2	192.168.2.6
Jun 7, 2024 19:18:31.764612913 CEST	50070	445	192.168.2.6	35.130.55.2
Jun 7, 2024 19:18:31.764648914 CEST	50070	445	192.168.2.6	35.130.55.2
Jun 7, 2024 19:18:31.769517899 CEST	445	50070	35.130.55.2	192.168.2.6
Jun 7, 2024 19:18:31.821943998 CEST	50071	445	192.168.2.6	122.155.26.1
Jun 7, 2024 19:18:31.826971054 CEST	445	50071	122.155.26.1	192.168.2.6
Jun 7, 2024 19:18:31.827076912 CEST	50071	445	192.168.2.6	122.155.26.1
Jun 7, 2024 19:18:31.827157974 CEST	50071	445	192.168.2.6	122.155.26.1
Jun 7, 2024 19:18:31.832187891 CEST	445	50071	122.155.26.1	192.168.2.6
Jun 7, 2024 19:18:32.256093025 CEST	445	50039	31.163.218.1	192.168.2.6
Jun 7, 2024 19:18:32.256184101 CEST	50039	445	192.168.2.6	31.163.218.1
Jun 7, 2024 19:18:32.256268024 CEST	50039	445	192.168.2.6	31.163.218.1
Jun 7, 2024 19:18:32.256339073 CEST	50039	445	192.168.2.6	31.163.218.1
Jun 7, 2024 19:18:32.261159897 CEST	445	50039	31.163.218.1	192.168.2.6
Jun 7, 2024 19:18:32.261221886 CEST	445	50039	31.163.218.1	192.168.2.6
Jun 7, 2024 19:18:32.262726068 CEST	50072	445	192.168.2.6	109.235.245.131
Jun 7, 2024 19:18:32.267683029 CEST	445	50072	109.235.245.131	192.168.2.6
Jun 7, 2024 19:18:32.267796040 CEST	50072	445	192.168.2.6	109.235.245.131
Jun 7, 2024 19:18:32.267853022 CEST	50072	445	192.168.2.6	109.235.245.131
Jun 7, 2024 19:18:32.267987967 CEST	50073	445	192.168.2.6	109.235.245.1
Jun 7, 2024 19:18:32.272907972 CEST	445	50073	109.235.245.1	192.168.2.6
Jun 7, 2024 19:18:32.273003101 CEST	50073	445	192.168.2.6	109.235.245.1
Jun 7, 2024 19:18:32.273066998 CEST	50073	445	192.168.2.6	109.235.245.1
Jun 7, 2024 19:18:32.273175955 CEST	445	50072	109.235.245.131	192.168.2.6
Jun 7, 2024 19:18:32.273238897 CEST	50072	445	192.168.2.6	109.235.245.131
Jun 7, 2024 19:18:32.273380995 CEST	50074	445	192.168.2.6	109.235.245.1
Jun 7, 2024 19:18:32.278544903 CEST	445	50073	109.235.245.1	192.168.2.6
Jun 7, 2024 19:18:32.278559923 CEST	445	50074	109.235.245.1	192.168.2.6
Jun 7, 2024 19:18:32.278611898 CEST	50073	445	192.168.2.6	109.235.245.1
Jun 7, 2024 19:18:32.278642893 CEST	50074	445	192.168.2.6	109.235.245.1
Jun 7, 2024 19:18:32.278687954 CEST	50074	445	192.168.2.6	109.235.245.1
Jun 7, 2024 19:18:32.283694983 CEST	445	50074	109.235.245.1	192.168.2.6
Jun 7, 2024 19:18:32.321969032 CEST	50075	445	192.168.2.6	31.163.218.2
Jun 7, 2024 19:18:32.327068090 CEST	445	50075	31.163.218.2	192.168.2.6
Jun 7, 2024 19:18:32.327152014 CEST	50075	445	192.168.2.6	31.163.218.2
Jun 7, 2024 19:18:32.327210903 CEST	50075	445	192.168.2.6	31.163.218.2
Jun 7, 2024 19:18:32.327569008 CEST	50076	445	192.168.2.6	31.163.218.2
Jun 7, 2024 19:18:32.332331896 CEST	445	50075	31.163.218.2	192.168.2.6
Jun 7, 2024 19:18:32.332403898 CEST	50075	445	192.168.2.6	31.163.218.2
Jun 7, 2024 19:18:32.332438946 CEST	445	50076	31.163.218.2	192.168.2.6
Jun 7, 2024 19:18:32.332509041 CEST	50076	445	192.168.2.6	31.163.218.2
Jun 7, 2024 19:18:32.332554102 CEST	50076	445	192.168.2.6	31.163.218.2
Jun 7, 2024 19:18:32.337357044 CEST	445	50076	31.163.218.2	192.168.2.6
Jun 7, 2024 19:18:32.855485916 CEST	445	50042	213.153.200.1	192.168.2.6
Jun 7, 2024 19:18:32.855745077 CEST	50042	445	192.168.2.6	213.153.200.1
Jun 7, 2024 19:18:32.855745077 CEST	50042	445	192.168.2.6	213.153.200.1
Jun 7, 2024 19:18:32.855788946 CEST	50042	445	192.168.2.6	213.153.200.1
Jun 7, 2024 19:18:32.860707998 CEST	445	50042	213.153.200.1	192.168.2.6
Jun 7, 2024 19:18:32.860759020 CEST	445	50042	213.153.200.1	192.168.2.6
Jun 7, 2024 19:18:32.926614046 CEST	445	50074	109.235.245.1	192.168.2.6
Jun 7, 2024 19:18:32.926728964 CEST	50074	445	192.168.2.6	109.235.245.1
Jun 7, 2024 19:18:32.926770926 CEST	50074	445	192.168.2.6	109.235.245.1
Jun 7, 2024 19:18:32.926825047 CEST	50074	445	192.168.2.6	109.235.245.1
Jun 7, 2024 19:18:32.931685925 CEST	445	50074	109.235.245.1	192.168.2.6
Jun 7, 2024 19:18:32.931755066 CEST	445	50074	109.235.245.1	192.168.2.6
Jun 7, 2024 19:18:32.995959997 CEST	445	50044	20.161.184.2	192.168.2.6
Jun 7, 2024 19:18:32.996095896 CEST	50044	445	192.168.2.6	20.161.184.2
Jun 7, 2024 19:18:32.996118069 CEST	50044	445	192.168.2.6	20.161.184.2
Jun 7, 2024 19:18:32.996165991 CEST	50044	445	192.168.2.6	20.161.184.2
Jun 7, 2024 19:18:33.001440048 CEST	445	50044	20.161.184.2	192.168.2.6
Jun 7, 2024 19:18:33.001468897 CEST	445	50044	20.161.184.2	192.168.2.6
Jun 7, 2024 19:18:33.759881973 CEST	50077	445	192.168.2.6	217.179.3.2
Jun 7, 2024 19:18:33.764853001 CEST	445	50077	217.179.3.2	192.168.2.6
Jun 7, 2024 19:18:33.764960051 CEST	50077	445	192.168.2.6	217.179.3.2
Jun 7, 2024 19:18:33.767740011 CEST	50077	445	192.168.2.6	217.179.3.2
Jun 7, 2024 19:18:33.772679090 CEST	445	50077	217.179.3.2	192.168.2.6
Jun 7, 2024 19:18:33.837502956 CEST	50078	445	192.168.2.6	71.243.85.1
Jun 7, 2024 19:18:33.842514038 CEST	445	50078	71.243.85.1	192.168.2.6
Jun 7, 2024 19:18:33.842588902 CEST	50078	445	192.168.2.6	71.243.85.1
Jun 7, 2024 19:18:33.842616081 CEST	50078	445	192.168.2.6	71.243.85.1
Jun 7, 2024 19:18:33.847935915 CEST	445	50078	71.243.85.1	192.168.2.6
Jun 7, 2024 19:18:34.009704113 CEST	50079	445	192.168.2.6	97.92.55.44
Jun 7, 2024 19:18:34.014806986 CEST	445	50079	97.92.55.44	192.168.2.6
Jun 7, 2024 19:18:34.015320063 CEST	50079	445	192.168.2.6	97.92.55.44
Jun 7, 2024 19:18:34.015355110 CEST	50079	445	192.168.2.6	97.92.55.44
Jun 7, 2024 19:18:34.015527010 CEST	50080	445	192.168.2.6	97.92.55.1
Jun 7, 2024 19:18:34.020517111 CEST	445	50080	97.92.55.1	192.168.2.6
Jun 7, 2024 19:18:34.020674944 CEST	445	50079	97.92.55.44	192.168.2.6
Jun 7, 2024 19:18:34.020788908 CEST	50080	445	192.168.2.6	97.92.55.1
Jun 7, 2024 19:18:34.020910978 CEST	50080	445	192.168.2.6	97.92.55.1
Jun 7, 2024 19:18:34.021173954 CEST	50081	445	192.168.2.6	97.92.55.1
Jun 7, 2024 19:18:34.021219015 CEST	445	50079	97.92.55.44	192.168.2.6
Jun 7, 2024 19:18:34.024971962 CEST	50079	445	192.168.2.6	97.92.55.44
Jun 7, 2024 19:18:34.026004076 CEST	445	50080	97.92.55.1	192.168.2.6
Jun 7, 2024 19:18:34.026084900 CEST	50080	445	192.168.2.6	97.92.55.1
Jun 7, 2024 19:18:34.026110888 CEST	445	50081	97.92.55.1	192.168.2.6
Jun 7, 2024 19:18:34.028851986 CEST	50081	445	192.168.2.6	97.92.55.1
Jun 7, 2024 19:18:34.028882980 CEST	50081	445	192.168.2.6	97.92.55.1
Jun 7, 2024 19:18:34.033787966 CEST	445	50081	97.92.55.1	192.168.2.6
Jun 7, 2024 19:18:34.291801929 CEST	445	50045	149.97.149.1	192.168.2.6
Jun 7, 2024 19:18:34.292007923 CEST	50045	445	192.168.2.6	149.97.149.1
Jun 7, 2024 19:18:34.292098045 CEST	50045	445	192.168.2.6	149.97.149.1
Jun 7, 2024 19:18:34.292140007 CEST	50045	445	192.168.2.6	149.97.149.1
Jun 7, 2024 19:18:34.297008038 CEST	445	50045	149.97.149.1	192.168.2.6
Jun 7, 2024 19:18:34.297038078 CEST	445	50045	149.97.149.1	192.168.2.6
Jun 7, 2024 19:18:34.353295088 CEST	50082	445	192.168.2.6	149.97.149.2
Jun 7, 2024 19:18:34.358206034 CEST	445	50082	149.97.149.2	192.168.2.6
Jun 7, 2024 19:18:34.358316898 CEST	50082	445	192.168.2.6	149.97.149.2
Jun 7, 2024 19:18:34.358357906 CEST	50082	445	192.168.2.6	149.97.149.2
Jun 7, 2024 19:18:34.358758926 CEST	50083	445	192.168.2.6	149.97.149.2
Jun 7, 2024 19:18:34.363369942 CEST	445	50082	149.97.149.2	192.168.2.6
Jun 7, 2024 19:18:34.363435984 CEST	50082	445	192.168.2.6	149.97.149.2
Jun 7, 2024 19:18:34.363687992 CEST	445	50083	149.97.149.2	192.168.2.6
Jun 7, 2024 19:18:34.363758087 CEST	50083	445	192.168.2.6	149.97.149.2
Jun 7, 2024 19:18:34.363811016 CEST	50083	445	192.168.2.6	149.97.149.2
Jun 7, 2024 19:18:34.368648052 CEST	445	50083	149.97.149.2	192.168.2.6
Jun 7, 2024 19:18:34.431407928 CEST	50084	445	192.168.2.6	199.164.60.4
Jun 7, 2024 19:18:34.436547041 CEST	445	50084	199.164.60.4	192.168.2.6
Jun 7, 2024 19:18:34.439630032 CEST	50084	445	192.168.2.6	199.164.60.4
Jun 7, 2024 19:18:34.439655066 CEST	50084	445	192.168.2.6	199.164.60.4
Jun 7, 2024 19:18:34.444547892 CEST	445	50084	199.164.60.4	192.168.2.6
Jun 7, 2024 19:18:34.794290066 CEST	445	50048	123.63.163.2	192.168.2.6
Jun 7, 2024 19:18:34.797605991 CEST	50048	445	192.168.2.6	123.63.163.2
Jun 7, 2024 19:18:34.797650099 CEST	50048	445	192.168.2.6	123.63.163.2
Jun 7, 2024 19:18:34.797698021 CEST	50048	445	192.168.2.6	123.63.163.2
Jun 7, 2024 19:18:34.802651882 CEST	445	50048	123.63.163.2	192.168.2.6
Jun 7, 2024 19:18:34.802717924 CEST	445	50048	123.63.163.2	192.168.2.6
Jun 7, 2024 19:18:34.859436035 CEST	445	50051	205.139.6.1	192.168.2.6
Jun 7, 2024 19:18:34.861767054 CEST	50051	445	192.168.2.6	205.139.6.1
Jun 7, 2024 19:18:34.887929916 CEST	50051	445	192.168.2.6	205.139.6.1
Jun 7, 2024 19:18:34.887929916 CEST	50051	445	192.168.2.6	205.139.6.1
Jun 7, 2024 19:18:34.892915010 CEST	445	50051	205.139.6.1	192.168.2.6
Jun 7, 2024 19:18:34.892940998 CEST	445	50051	205.139.6.1	192.168.2.6
Jun 7, 2024 19:18:34.970211983 CEST	445	50084	199.164.60.4	192.168.2.6
Jun 7, 2024 19:18:34.970319033 CEST	50084	445	192.168.2.6	199.164.60.4
Jun 7, 2024 19:18:34.970366001 CEST	50084	445	192.168.2.6	199.164.60.4
Jun 7, 2024 19:18:34.970397949 CEST	50084	445	192.168.2.6	199.164.60.4
Jun 7, 2024 19:18:34.975353003 CEST	445	50084	199.164.60.4	192.168.2.6
Jun 7, 2024 19:18:34.975447893 CEST	445	50084	199.164.60.4	192.168.2.6
Jun 7, 2024 19:18:35.056750059 CEST	50085	445	192.168.2.6	199.164.60.5
Jun 7, 2024 19:18:35.061815023 CEST	445	50085	199.164.60.5	192.168.2.6
Jun 7, 2024 19:18:35.061887026 CEST	50085	445	192.168.2.6	199.164.60.5
Jun 7, 2024 19:18:35.061958075 CEST	50085	445	192.168.2.6	199.164.60.5
Jun 7, 2024 19:18:35.064755917 CEST	50086	445	192.168.2.6	199.164.60.5
Jun 7, 2024 19:18:35.067111015 CEST	445	50085	199.164.60.5	192.168.2.6
Jun 7, 2024 19:18:35.067162037 CEST	50085	445	192.168.2.6	199.164.60.5
Jun 7, 2024 19:18:35.069727898 CEST	445	50086	199.164.60.5	192.168.2.6
Jun 7, 2024 19:18:35.069803953 CEST	50086	445	192.168.2.6	199.164.60.5
Jun 7, 2024 19:18:35.069839954 CEST	50086	445	192.168.2.6	199.164.60.5
Jun 7, 2024 19:18:35.074747086 CEST	445	50086	199.164.60.5	192.168.2.6
Jun 7, 2024 19:18:35.600656986 CEST	445	50086	199.164.60.5	192.168.2.6
Jun 7, 2024 19:18:35.600740910 CEST	50086	445	192.168.2.6	199.164.60.5
Jun 7, 2024 19:18:35.600783110 CEST	50086	445	192.168.2.6	199.164.60.5
Jun 7, 2024 19:18:35.600819111 CEST	50086	445	192.168.2.6	199.164.60.5
Jun 7, 2024 19:18:35.605900049 CEST	445	50086	199.164.60.5	192.168.2.6
Jun 7, 2024 19:18:35.605931044 CEST	445	50086	199.164.60.5	192.168.2.6
Jun 7, 2024 19:18:35.651815891 CEST	50087	445	192.168.2.6	65.79.232.212
Jun 7, 2024 19:18:35.657057047 CEST	445	50087	65.79.232.212	192.168.2.6
Jun 7, 2024 19:18:35.657143116 CEST	50087	445	192.168.2.6	65.79.232.212
Jun 7, 2024 19:18:35.657212019 CEST	50087	445	192.168.2.6	65.79.232.212
Jun 7, 2024 19:18:35.657340050 CEST	50088	445	192.168.2.6	65.79.232.1
Jun 7, 2024 19:18:35.662303925 CEST	445	50088	65.79.232.1	192.168.2.6
Jun 7, 2024 19:18:35.662360907 CEST	445	50087	65.79.232.212	192.168.2.6
Jun 7, 2024 19:18:35.662370920 CEST	50088	445	192.168.2.6	65.79.232.1
Jun 7, 2024 19:18:35.662410975 CEST	50087	445	192.168.2.6	65.79.232.212
Jun 7, 2024 19:18:35.662452936 CEST	50088	445	192.168.2.6	65.79.232.1
Jun 7, 2024 19:18:35.662877083 CEST	50089	445	192.168.2.6	65.79.232.1
Jun 7, 2024 19:18:35.667485952 CEST	445	50088	65.79.232.1	192.168.2.6
Jun 7, 2024 19:18:35.667547941 CEST	50088	445	192.168.2.6	65.79.232.1
Jun 7, 2024 19:18:35.667922020 CEST	445	50089	65.79.232.1	192.168.2.6
Jun 7, 2024 19:18:35.667987108 CEST	50089	445	192.168.2.6	65.79.232.1
Jun 7, 2024 19:18:35.668188095 CEST	50089	445	192.168.2.6	65.79.232.1
Jun 7, 2024 19:18:35.673089981 CEST	445	50089	65.79.232.1	192.168.2.6
Jun 7, 2024 19:18:35.868923903 CEST	50090	445	192.168.2.6	213.153.200.1
Jun 7, 2024 19:18:35.874368906 CEST	445	50090	213.153.200.1	192.168.2.6
Jun 7, 2024 19:18:35.874582052 CEST	50090	445	192.168.2.6	213.153.200.1
Jun 7, 2024 19:18:35.874609947 CEST	50090	445	192.168.2.6	213.153.200.1
Jun 7, 2024 19:18:35.879571915 CEST	445	50090	213.153.200.1	192.168.2.6
Jun 7, 2024 19:18:35.931207895 CEST	50091	445	192.168.2.6	109.235.245.1
Jun 7, 2024 19:18:35.936461926 CEST	445	50091	109.235.245.1	192.168.2.6
Jun 7, 2024 19:18:35.936590910 CEST	50091	445	192.168.2.6	109.235.245.1
Jun 7, 2024 19:18:35.936656952 CEST	50091	445	192.168.2.6	109.235.245.1
Jun 7, 2024 19:18:35.941514969 CEST	445	50091	109.235.245.1	192.168.2.6
Jun 7, 2024 19:18:36.009440899 CEST	50092	445	192.168.2.6	20.161.184.2
Jun 7, 2024 19:18:36.014841080 CEST	445	50092	20.161.184.2	192.168.2.6
Jun 7, 2024 19:18:36.014950037 CEST	50092	445	192.168.2.6	20.161.184.2
Jun 7, 2024 19:18:36.015000105 CEST	50092	445	192.168.2.6	20.161.184.2
Jun 7, 2024 19:18:36.019947052 CEST	445	50092	20.161.184.2	192.168.2.6
Jun 7, 2024 19:18:36.251930952 CEST	445	50054	196.22.85.2	192.168.2.6
Jun 7, 2024 19:18:36.252013922 CEST	50054	445	192.168.2.6	196.22.85.2
Jun 7, 2024 19:18:36.252048969 CEST	50054	445	192.168.2.6	196.22.85.2
Jun 7, 2024 19:18:36.252059937 CEST	50054	445	192.168.2.6	196.22.85.2
Jun 7, 2024 19:18:36.257215023 CEST	445	50054	196.22.85.2	192.168.2.6
Jun 7, 2024 19:18:36.257268906 CEST	445	50054	196.22.85.2	192.168.2.6
Jun 7, 2024 19:18:36.298960924 CEST	445	50055	59.20.234.1	192.168.2.6
Jun 7, 2024 19:18:36.299034119 CEST	50055	445	192.168.2.6	59.20.234.1
Jun 7, 2024 19:18:36.299067020 CEST	50055	445	192.168.2.6	59.20.234.1
Jun 7, 2024 19:18:36.299098969 CEST	50055	445	192.168.2.6	59.20.234.1
Jun 7, 2024 19:18:36.303966045 CEST	445	50055	59.20.234.1	192.168.2.6
Jun 7, 2024 19:18:36.304018021 CEST	445	50055	59.20.234.1	192.168.2.6
Jun 7, 2024 19:18:36.306456089 CEST	50093	445	192.168.2.6	196.22.85.3
Jun 7, 2024 19:18:36.311615944 CEST	445	50093	196.22.85.3	192.168.2.6
Jun 7, 2024 19:18:36.311711073 CEST	50093	445	192.168.2.6	196.22.85.3
Jun 7, 2024 19:18:36.311752081 CEST	50093	445	192.168.2.6	196.22.85.3
Jun 7, 2024 19:18:36.311970949 CEST	50094	445	192.168.2.6	196.22.85.3
Jun 7, 2024 19:18:36.316845894 CEST	445	50094	196.22.85.3	192.168.2.6
Jun 7, 2024 19:18:36.317042112 CEST	50094	445	192.168.2.6	196.22.85.3
Jun 7, 2024 19:18:36.317102909 CEST	50094	445	192.168.2.6	196.22.85.3
Jun 7, 2024 19:18:36.317270994 CEST	445	50093	196.22.85.3	192.168.2.6
Jun 7, 2024 19:18:36.317337990 CEST	50093	445	192.168.2.6	196.22.85.3
Jun 7, 2024 19:18:36.321954966 CEST	445	50094	196.22.85.3	192.168.2.6
Jun 7, 2024 19:18:36.353158951 CEST	50095	445	192.168.2.6	59.20.234.2
Jun 7, 2024 19:18:36.358108044 CEST	445	50095	59.20.234.2	192.168.2.6
Jun 7, 2024 19:18:36.358299971 CEST	50095	445	192.168.2.6	59.20.234.2
Jun 7, 2024 19:18:36.358437061 CEST	50095	445	192.168.2.6	59.20.234.2
Jun 7, 2024 19:18:36.358817101 CEST	50096	445	192.168.2.6	59.20.234.2
Jun 7, 2024 19:18:36.363450050 CEST	445	50095	59.20.234.2	192.168.2.6
Jun 7, 2024 19:18:36.363523006 CEST	50095	445	192.168.2.6	59.20.234.2
Jun 7, 2024 19:18:36.363667965 CEST	445	50096	59.20.234.2	192.168.2.6
Jun 7, 2024 19:18:36.363739014 CEST	50096	445	192.168.2.6	59.20.234.2
Jun 7, 2024 19:18:36.363789082 CEST	50096	445	192.168.2.6	59.20.234.2
Jun 7, 2024 19:18:36.368653059 CEST	445	50096	59.20.234.2	192.168.2.6
Jun 7, 2024 19:18:36.535617113 CEST	445	50090	213.153.200.1	192.168.2.6
Jun 7, 2024 19:18:36.535729885 CEST	50090	445	192.168.2.6	213.153.200.1
Jun 7, 2024 19:18:36.535773993 CEST	50090	445	192.168.2.6	213.153.200.1
Jun 7, 2024 19:18:36.535819054 CEST	50090	445	192.168.2.6	213.153.200.1
Jun 7, 2024 19:18:36.540931940 CEST	445	50090	213.153.200.1	192.168.2.6
Jun 7, 2024 19:18:36.540987015 CEST	445	50090	213.153.200.1	192.168.2.6
Jun 7, 2024 19:18:36.567272902 CEST	445	50091	109.235.245.1	192.168.2.6
Jun 7, 2024 19:18:36.567349911 CEST	50091	445	192.168.2.6	109.235.245.1
Jun 7, 2024 19:18:36.567393064 CEST	50091	445	192.168.2.6	109.235.245.1
Jun 7, 2024 19:18:36.567434072 CEST	50091	445	192.168.2.6	109.235.245.1
Jun 7, 2024 19:18:36.572355032 CEST	445	50091	109.235.245.1	192.168.2.6
Jun 7, 2024 19:18:36.572427988 CEST	445	50091	109.235.245.1	192.168.2.6
Jun 7, 2024 19:18:36.587615967 CEST	50097	445	192.168.2.6	213.153.200.2
Jun 7, 2024 19:18:36.592601061 CEST	445	50097	213.153.200.2	192.168.2.6
Jun 7, 2024 19:18:36.592703104 CEST	50097	445	192.168.2.6	213.153.200.2
Jun 7, 2024 19:18:36.592703104 CEST	50097	445	192.168.2.6	213.153.200.2
Jun 7, 2024 19:18:36.593046904 CEST	50098	445	192.168.2.6	213.153.200.2
Jun 7, 2024 19:18:36.597889900 CEST	445	50097	213.153.200.2	192.168.2.6
Jun 7, 2024 19:18:36.597955942 CEST	50097	445	192.168.2.6	213.153.200.2
Jun 7, 2024 19:18:36.598026991 CEST	445	50098	213.153.200.2	192.168.2.6
Jun 7, 2024 19:18:36.598092079 CEST	50098	445	192.168.2.6	213.153.200.2
Jun 7, 2024 19:18:36.598139048 CEST	50098	445	192.168.2.6	213.153.200.2
Jun 7, 2024 19:18:36.602993965 CEST	445	50098	213.153.200.2	192.168.2.6
Jun 7, 2024 19:18:36.618711948 CEST	50099	445	192.168.2.6	109.235.245.2
Jun 7, 2024 19:18:36.623673916 CEST	445	50099	109.235.245.2	192.168.2.6
Jun 7, 2024 19:18:36.623752117 CEST	50099	445	192.168.2.6	109.235.245.2
Jun 7, 2024 19:18:36.623770952 CEST	50099	445	192.168.2.6	109.235.245.2
Jun 7, 2024 19:18:36.624073029 CEST	50100	445	192.168.2.6	109.235.245.2
Jun 7, 2024 19:18:36.629065990 CEST	445	50099	109.235.245.2	192.168.2.6
Jun 7, 2024 19:18:36.629096985 CEST	445	50100	109.235.245.2	192.168.2.6
Jun 7, 2024 19:18:36.629138947 CEST	50099	445	192.168.2.6	109.235.245.2
Jun 7, 2024 19:18:36.629188061 CEST	50100	445	192.168.2.6	109.235.245.2
Jun 7, 2024 19:18:36.629204988 CEST	50100	445	192.168.2.6	109.235.245.2
Jun 7, 2024 19:18:36.634165049 CEST	445	50100	109.235.245.2	192.168.2.6
Jun 7, 2024 19:18:36.790915966 CEST	445	50057	129.100.47.2	192.168.2.6
Jun 7, 2024 19:18:36.790986061 CEST	50057	445	192.168.2.6	129.100.47.2
Jun 7, 2024 19:18:36.791033983 CEST	50057	445	192.168.2.6	129.100.47.2
Jun 7, 2024 19:18:36.791095018 CEST	50057	445	192.168.2.6	129.100.47.2
Jun 7, 2024 19:18:36.797336102 CEST	445	50057	129.100.47.2	192.168.2.6
Jun 7, 2024 19:18:36.797386885 CEST	445	50057	129.100.47.2	192.168.2.6
Jun 7, 2024 19:18:36.878534079 CEST	445	50060	156.45.127.1	192.168.2.6
Jun 7, 2024 19:18:36.878669024 CEST	50060	445	192.168.2.6	156.45.127.1
Jun 7, 2024 19:18:36.878767967 CEST	50060	445	192.168.2.6	156.45.127.1
Jun 7, 2024 19:18:36.878767967 CEST	50060	445	192.168.2.6	156.45.127.1
Jun 7, 2024 19:18:36.883758068 CEST	445	50060	156.45.127.1	192.168.2.6
Jun 7, 2024 19:18:36.883790016 CEST	445	50060	156.45.127.1	192.168.2.6
Jun 7, 2024 19:18:37.182058096 CEST	50101	445	192.168.2.6	140.73.58.175
Jun 7, 2024 19:18:37.187130928 CEST	445	50101	140.73.58.175	192.168.2.6
Jun 7, 2024 19:18:37.187247038 CEST	50101	445	192.168.2.6	140.73.58.175
Jun 7, 2024 19:18:37.187289953 CEST	50101	445	192.168.2.6	140.73.58.175
Jun 7, 2024 19:18:37.187460899 CEST	50102	445	192.168.2.6	140.73.58.1
Jun 7, 2024 19:18:37.192466021 CEST	445	50102	140.73.58.1	192.168.2.6
Jun 7, 2024 19:18:37.192550898 CEST	50102	445	192.168.2.6	140.73.58.1
Jun 7, 2024 19:18:37.192583084 CEST	50102	445	192.168.2.6	140.73.58.1
Jun 7, 2024 19:18:37.192625999 CEST	445	50101	140.73.58.175	192.168.2.6
Jun 7, 2024 19:18:37.192969084 CEST	50103	445	192.168.2.6	140.73.58.1
Jun 7, 2024 19:18:37.193888903 CEST	445	50101	140.73.58.175	192.168.2.6
Jun 7, 2024 19:18:37.194135904 CEST	50101	445	192.168.2.6	140.73.58.175
Jun 7, 2024 19:18:37.197880030 CEST	445	50102	140.73.58.1	192.168.2.6
Jun 7, 2024 19:18:37.197940111 CEST	445	50103	140.73.58.1	192.168.2.6
Jun 7, 2024 19:18:37.197963953 CEST	50102	445	192.168.2.6	140.73.58.1
Jun 7, 2024 19:18:37.198015928 CEST	50103	445	192.168.2.6	140.73.58.1
Jun 7, 2024 19:18:37.198046923 CEST	50103	445	192.168.2.6	140.73.58.1
Jun 7, 2024 19:18:37.206536055 CEST	445	50103	140.73.58.1	192.168.2.6
Jun 7, 2024 19:18:37.806313038 CEST	50104	445	192.168.2.6	123.63.163.2
Jun 7, 2024 19:18:37.811450005 CEST	445	50104	123.63.163.2	192.168.2.6
Jun 7, 2024 19:18:37.811639071 CEST	50104	445	192.168.2.6	123.63.163.2
Jun 7, 2024 19:18:37.811706066 CEST	50104	445	192.168.2.6	123.63.163.2
Jun 7, 2024 19:18:37.816590071 CEST	445	50104	123.63.163.2	192.168.2.6
Jun 7, 2024 19:18:37.900048018 CEST	50105	445	192.168.2.6	205.139.6.1
Jun 7, 2024 19:18:37.905109882 CEST	445	50105	205.139.6.1	192.168.2.6
Jun 7, 2024 19:18:37.905205965 CEST	50105	445	192.168.2.6	205.139.6.1
Jun 7, 2024 19:18:37.905250072 CEST	50105	445	192.168.2.6	205.139.6.1
Jun 7, 2024 19:18:37.910196066 CEST	445	50105	205.139.6.1	192.168.2.6
Jun 7, 2024 19:18:38.254096985 CEST	445	50061	38.185.73.2	192.168.2.6
Jun 7, 2024 19:18:38.254235983 CEST	50061	445	192.168.2.6	38.185.73.2
Jun 7, 2024 19:18:38.254334927 CEST	50061	445	192.168.2.6	38.185.73.2
Jun 7, 2024 19:18:38.254336119 CEST	50061	445	192.168.2.6	38.185.73.2
Jun 7, 2024 19:18:38.259387016 CEST	445	50061	38.185.73.2	192.168.2.6
Jun 7, 2024 19:18:38.259444952 CEST	445	50061	38.185.73.2	192.168.2.6
Jun 7, 2024 19:18:38.306468010 CEST	50106	445	192.168.2.6	38.185.73.3
Jun 7, 2024 19:18:38.311433077 CEST	445	50106	38.185.73.3	192.168.2.6
Jun 7, 2024 19:18:38.311528921 CEST	50106	445	192.168.2.6	38.185.73.3
Jun 7, 2024 19:18:38.311578989 CEST	50106	445	192.168.2.6	38.185.73.3
Jun 7, 2024 19:18:38.311969042 CEST	50107	445	192.168.2.6	38.185.73.3
Jun 7, 2024 19:18:38.316899061 CEST	445	50106	38.185.73.3	192.168.2.6
Jun 7, 2024 19:18:38.316929102 CEST	445	50107	38.185.73.3	192.168.2.6
Jun 7, 2024 19:18:38.316962957 CEST	50106	445	192.168.2.6	38.185.73.3
Jun 7, 2024 19:18:38.317009926 CEST	50107	445	192.168.2.6	38.185.73.3
Jun 7, 2024 19:18:38.317044973 CEST	50107	445	192.168.2.6	38.185.73.3
Jun 7, 2024 19:18:38.321960926 CEST	445	50107	38.185.73.3	192.168.2.6
Jun 7, 2024 19:18:38.603421926 CEST	50108	445	192.168.2.6	199.164.60.5
Jun 7, 2024 19:18:38.603734016 CEST	50109	445	192.168.2.6	85.248.203.38
Jun 7, 2024 19:18:38.608433962 CEST	445	50108	199.164.60.5	192.168.2.6
Jun 7, 2024 19:18:38.608519077 CEST	50108	445	192.168.2.6	199.164.60.5
Jun 7, 2024 19:18:38.608575106 CEST	50108	445	192.168.2.6	199.164.60.5
Jun 7, 2024 19:18:38.608916044 CEST	445	50109	85.248.203.38	192.168.2.6
Jun 7, 2024 19:18:38.608977079 CEST	50109	445	192.168.2.6	85.248.203.38
Jun 7, 2024 19:18:38.608993053 CEST	50109	445	192.168.2.6	85.248.203.38
Jun 7, 2024 19:18:38.609126091 CEST	50110	445	192.168.2.6	85.248.203.1
Jun 7, 2024 19:18:38.613650084 CEST	445	50108	199.164.60.5	192.168.2.6
Jun 7, 2024 19:18:38.614095926 CEST	445	50110	85.248.203.1	192.168.2.6
Jun 7, 2024 19:18:38.614149094 CEST	445	50109	85.248.203.38	192.168.2.6
Jun 7, 2024 19:18:38.614156008 CEST	50110	445	192.168.2.6	85.248.203.1
Jun 7, 2024 19:18:38.614228964 CEST	50110	445	192.168.2.6	85.248.203.1
Jun 7, 2024 19:18:38.614228964 CEST	50109	445	192.168.2.6	85.248.203.38
Jun 7, 2024 19:18:38.614495039 CEST	50111	445	192.168.2.6	85.248.203.1
Jun 7, 2024 19:18:38.619370937 CEST	445	50110	85.248.203.1	192.168.2.6
Jun 7, 2024 19:18:38.619400024 CEST	445	50111	85.248.203.1	192.168.2.6
Jun 7, 2024 19:18:38.619422913 CEST	50110	445	192.168.2.6	85.248.203.1
Jun 7, 2024 19:18:38.619493961 CEST	50111	445	192.168.2.6	85.248.203.1
Jun 7, 2024 19:18:38.619493961 CEST	50111	445	192.168.2.6	85.248.203.1
Jun 7, 2024 19:18:38.624656916 CEST	445	50111	85.248.203.1	192.168.2.6
Jun 7, 2024 19:18:38.793121099 CEST	445	50064	219.1.165.2	192.168.2.6
Jun 7, 2024 19:18:38.793323040 CEST	50064	445	192.168.2.6	219.1.165.2
Jun 7, 2024 19:18:38.793355942 CEST	50064	445	192.168.2.6	219.1.165.2
Jun 7, 2024 19:18:38.793400049 CEST	50064	445	192.168.2.6	219.1.165.2
Jun 7, 2024 19:18:38.798739910 CEST	445	50064	219.1.165.2	192.168.2.6
Jun 7, 2024 19:18:38.798791885 CEST	445	50064	219.1.165.2	192.168.2.6
Jun 7, 2024 19:18:38.890805006 CEST	445	50067	189.250.95.1	192.168.2.6
Jun 7, 2024 19:18:38.890913010 CEST	50067	445	192.168.2.6	189.250.95.1
Jun 7, 2024 19:18:38.890953064 CEST	50067	445	192.168.2.6	189.250.95.1
Jun 7, 2024 19:18:38.891001940 CEST	50067	445	192.168.2.6	189.250.95.1
Jun 7, 2024 19:18:38.895808935 CEST	445	50067	189.250.95.1	192.168.2.6
Jun 7, 2024 19:18:38.895845890 CEST	445	50067	189.250.95.1	192.168.2.6
Jun 7, 2024 19:18:39.138871908 CEST	445	50108	199.164.60.5	192.168.2.6
Jun 7, 2024 19:18:39.138961077 CEST	50108	445	192.168.2.6	199.164.60.5
Jun 7, 2024 19:18:39.139012098 CEST	50108	445	192.168.2.6	199.164.60.5
Jun 7, 2024 19:18:39.139056921 CEST	50108	445	192.168.2.6	199.164.60.5
Jun 7, 2024 19:18:39.143997908 CEST	445	50108	199.164.60.5	192.168.2.6
Jun 7, 2024 19:18:39.144030094 CEST	445	50108	199.164.60.5	192.168.2.6
Jun 7, 2024 19:18:39.196964025 CEST	50112	445	192.168.2.6	199.164.60.6
Jun 7, 2024 19:18:39.202111959 CEST	445	50112	199.164.60.6	192.168.2.6
Jun 7, 2024 19:18:39.202215910 CEST	50112	445	192.168.2.6	199.164.60.6
Jun 7, 2024 19:18:39.202254057 CEST	50112	445	192.168.2.6	199.164.60.6
Jun 7, 2024 19:18:39.202574015 CEST	50113	445	192.168.2.6	199.164.60.6
Jun 7, 2024 19:18:39.207509995 CEST	445	50112	199.164.60.6	192.168.2.6
Jun 7, 2024 19:18:39.207544088 CEST	445	50113	199.164.60.6	192.168.2.6
Jun 7, 2024 19:18:39.207575083 CEST	50112	445	192.168.2.6	199.164.60.6
Jun 7, 2024 19:18:39.207613945 CEST	50113	445	192.168.2.6	199.164.60.6
Jun 7, 2024 19:18:39.207623959 CEST	50113	445	192.168.2.6	199.164.60.6
Jun 7, 2024 19:18:39.212522030 CEST	445	50113	199.164.60.6	192.168.2.6
Jun 7, 2024 19:18:39.744636059 CEST	445	50113	199.164.60.6	192.168.2.6
Jun 7, 2024 19:18:39.744860888 CEST	50113	445	192.168.2.6	199.164.60.6
Jun 7, 2024 19:18:39.744860888 CEST	50113	445	192.168.2.6	199.164.60.6
Jun 7, 2024 19:18:39.744860888 CEST	50113	445	192.168.2.6	199.164.60.6
Jun 7, 2024 19:18:39.750555992 CEST	445	50113	199.164.60.6	192.168.2.6
Jun 7, 2024 19:18:39.750710011 CEST	445	50113	199.164.60.6	192.168.2.6
Jun 7, 2024 19:18:39.806365013 CEST	50114	445	192.168.2.6	129.100.47.2
Jun 7, 2024 19:18:39.811475039 CEST	445	50114	129.100.47.2	192.168.2.6
Jun 7, 2024 19:18:39.811630011 CEST	50114	445	192.168.2.6	129.100.47.2
Jun 7, 2024 19:18:39.811630011 CEST	50114	445	192.168.2.6	129.100.47.2
Jun 7, 2024 19:18:39.816848040 CEST	445	50114	129.100.47.2	192.168.2.6
Jun 7, 2024 19:18:39.884464025 CEST	50115	445	192.168.2.6	156.45.127.1
Jun 7, 2024 19:18:39.889446020 CEST	445	50115	156.45.127.1	192.168.2.6
Jun 7, 2024 19:18:39.889552116 CEST	50115	445	192.168.2.6	156.45.127.1
Jun 7, 2024 19:18:39.889597893 CEST	50115	445	192.168.2.6	156.45.127.1
Jun 7, 2024 19:18:39.894622087 CEST	445	50115	156.45.127.1	192.168.2.6
Jun 7, 2024 19:18:39.931838989 CEST	50116	445	192.168.2.6	130.209.93.74
Jun 7, 2024 19:18:39.937143087 CEST	445	50116	130.209.93.74	192.168.2.6
Jun 7, 2024 19:18:39.937254906 CEST	50116	445	192.168.2.6	130.209.93.74
Jun 7, 2024 19:18:39.937338114 CEST	50116	445	192.168.2.6	130.209.93.74
Jun 7, 2024 19:18:39.937511921 CEST	50117	445	192.168.2.6	130.209.93.1
Jun 7, 2024 19:18:39.942418098 CEST	445	50117	130.209.93.1	192.168.2.6
Jun 7, 2024 19:18:39.942483902 CEST	50117	445	192.168.2.6	130.209.93.1
Jun 7, 2024 19:18:39.942502975 CEST	50117	445	192.168.2.6	130.209.93.1
Jun 7, 2024 19:18:39.942576885 CEST	445	50116	130.209.93.74	192.168.2.6
Jun 7, 2024 19:18:39.942645073 CEST	50116	445	192.168.2.6	130.209.93.74
Jun 7, 2024 19:18:39.942718983 CEST	50118	445	192.168.2.6	130.209.93.1
Jun 7, 2024 19:18:39.947594881 CEST	445	50118	130.209.93.1	192.168.2.6
Jun 7, 2024 19:18:39.947647095 CEST	445	50117	130.209.93.1	192.168.2.6
Jun 7, 2024 19:18:39.947655916 CEST	50118	445	192.168.2.6	130.209.93.1
Jun 7, 2024 19:18:39.947681904 CEST	50118	445	192.168.2.6	130.209.93.1
Jun 7, 2024 19:18:39.947699070 CEST	50117	445	192.168.2.6	130.209.93.1
Jun 7, 2024 19:18:39.952738047 CEST	445	50118	130.209.93.1	192.168.2.6
Jun 7, 2024 19:18:40.255980015 CEST	445	50070	35.130.55.2	192.168.2.6
Jun 7, 2024 19:18:40.256170988 CEST	50070	445	192.168.2.6	35.130.55.2
Jun 7, 2024 19:18:40.256252050 CEST	50070	445	192.168.2.6	35.130.55.2
Jun 7, 2024 19:18:40.256252050 CEST	50070	445	192.168.2.6	35.130.55.2
Jun 7, 2024 19:18:40.261414051 CEST	445	50070	35.130.55.2	192.168.2.6
Jun 7, 2024 19:18:40.261445999 CEST	445	50070	35.130.55.2	192.168.2.6
Jun 7, 2024 19:18:40.315244913 CEST	445	50071	122.155.26.1	192.168.2.6
Jun 7, 2024 19:18:40.315449953 CEST	50071	445	192.168.2.6	122.155.26.1
Jun 7, 2024 19:18:40.315449953 CEST	50071	445	192.168.2.6	122.155.26.1
Jun 7, 2024 19:18:40.315450907 CEST	50071	445	192.168.2.6	122.155.26.1
Jun 7, 2024 19:18:40.320806026 CEST	445	50071	122.155.26.1	192.168.2.6
Jun 7, 2024 19:18:40.320836067 CEST	445	50071	122.155.26.1	192.168.2.6
Jun 7, 2024 19:18:40.321949959 CEST	50119	445	192.168.2.6	35.130.55.3
Jun 7, 2024 19:18:40.326874018 CEST	445	50119	35.130.55.3	192.168.2.6
Jun 7, 2024 19:18:40.326947927 CEST	50119	445	192.168.2.6	35.130.55.3
Jun 7, 2024 19:18:40.326975107 CEST	50119	445	192.168.2.6	35.130.55.3
Jun 7, 2024 19:18:40.327331066 CEST	50120	445	192.168.2.6	35.130.55.3
Jun 7, 2024 19:18:40.332109928 CEST	445	50119	35.130.55.3	192.168.2.6
Jun 7, 2024 19:18:40.332166910 CEST	50119	445	192.168.2.6	35.130.55.3
Jun 7, 2024 19:18:40.332204103 CEST	445	50120	35.130.55.3	192.168.2.6
Jun 7, 2024 19:18:40.332261086 CEST	50120	445	192.168.2.6	35.130.55.3
Jun 7, 2024 19:18:40.332304955 CEST	50120	445	192.168.2.6	35.130.55.3
Jun 7, 2024 19:18:40.337251902 CEST	445	50120	35.130.55.3	192.168.2.6
Jun 7, 2024 19:18:40.368729115 CEST	50121	445	192.168.2.6	122.155.26.2
Jun 7, 2024 19:18:40.373806953 CEST	445	50121	122.155.26.2	192.168.2.6
Jun 7, 2024 19:18:40.373887062 CEST	50121	445	192.168.2.6	122.155.26.2
Jun 7, 2024 19:18:40.373912096 CEST	50121	445	192.168.2.6	122.155.26.2
Jun 7, 2024 19:18:40.374125957 CEST	50122	445	192.168.2.6	122.155.26.2
Jun 7, 2024 19:18:40.379126072 CEST	445	50122	122.155.26.2	192.168.2.6
Jun 7, 2024 19:18:40.379187107 CEST	50122	445	192.168.2.6	122.155.26.2
Jun 7, 2024 19:18:40.379232883 CEST	50122	445	192.168.2.6	122.155.26.2
Jun 7, 2024 19:18:40.379237890 CEST	445	50121	122.155.26.2	192.168.2.6
Jun 7, 2024 19:18:40.379287958 CEST	50121	445	192.168.2.6	122.155.26.2
Jun 7, 2024 19:18:40.384260893 CEST	445	50122	122.155.26.2	192.168.2.6
Jun 7, 2024 19:18:40.823210955 CEST	445	50076	31.163.218.2	192.168.2.6
Jun 7, 2024 19:18:40.823309898 CEST	50076	445	192.168.2.6	31.163.218.2
Jun 7, 2024 19:18:40.823333025 CEST	50076	445	192.168.2.6	31.163.218.2
Jun 7, 2024 19:18:40.823383093 CEST	50076	445	192.168.2.6	31.163.218.2
Jun 7, 2024 19:18:40.828408003 CEST	445	50076	31.163.218.2	192.168.2.6
Jun 7, 2024 19:18:40.828447104 CEST	445	50076	31.163.218.2	192.168.2.6
Jun 7, 2024 19:18:41.167192936 CEST	50123	445	192.168.2.6	143.112.228.92
Jun 7, 2024 19:18:41.172350883 CEST	445	50123	143.112.228.92	192.168.2.6
Jun 7, 2024 19:18:41.172559977 CEST	50123	445	192.168.2.6	143.112.228.92
Jun 7, 2024 19:18:41.172559977 CEST	50123	445	192.168.2.6	143.112.228.92
Jun 7, 2024 19:18:41.172602892 CEST	50124	445	192.168.2.6	143.112.228.1
Jun 7, 2024 19:18:41.177643061 CEST	445	50124	143.112.228.1	192.168.2.6
Jun 7, 2024 19:18:41.177723885 CEST	50124	445	192.168.2.6	143.112.228.1
Jun 7, 2024 19:18:41.177725077 CEST	50124	445	192.168.2.6	143.112.228.1
Jun 7, 2024 19:18:41.177750111 CEST	445	50123	143.112.228.92	192.168.2.6
Jun 7, 2024 19:18:41.177815914 CEST	50123	445	192.168.2.6	143.112.228.92
Jun 7, 2024 19:18:41.178147078 CEST	50125	445	192.168.2.6	143.112.228.1
Jun 7, 2024 19:18:41.183157921 CEST	445	50124	143.112.228.1	192.168.2.6
Jun 7, 2024 19:18:41.183190107 CEST	445	50125	143.112.228.1	192.168.2.6
Jun 7, 2024 19:18:41.183227062 CEST	50124	445	192.168.2.6	143.112.228.1
Jun 7, 2024 19:18:41.183271885 CEST	50125	445	192.168.2.6	143.112.228.1
Jun 7, 2024 19:18:41.183290958 CEST	50125	445	192.168.2.6	143.112.228.1
Jun 7, 2024 19:18:41.188271999 CEST	445	50125	143.112.228.1	192.168.2.6
Jun 7, 2024 19:18:41.809678078 CEST	50126	445	192.168.2.6	219.1.165.2
Jun 7, 2024 19:18:41.815027952 CEST	445	50126	219.1.165.2	192.168.2.6
Jun 7, 2024 19:18:41.815306902 CEST	50126	445	192.168.2.6	219.1.165.2
Jun 7, 2024 19:18:41.817043066 CEST	50126	445	192.168.2.6	219.1.165.2
Jun 7, 2024 19:18:41.822021008 CEST	445	50126	219.1.165.2	192.168.2.6
Jun 7, 2024 19:18:41.915148020 CEST	50127	445	192.168.2.6	189.250.95.1
Jun 7, 2024 19:18:41.920432091 CEST	445	50127	189.250.95.1	192.168.2.6
Jun 7, 2024 19:18:41.920730114 CEST	50127	445	192.168.2.6	189.250.95.1
Jun 7, 2024 19:18:41.920730114 CEST	50127	445	192.168.2.6	189.250.95.1
Jun 7, 2024 19:18:41.925911903 CEST	445	50127	189.250.95.1	192.168.2.6
Jun 7, 2024 19:18:42.265463114 CEST	445	50077	217.179.3.2	192.168.2.6
Jun 7, 2024 19:18:42.265795946 CEST	50077	445	192.168.2.6	217.179.3.2
Jun 7, 2024 19:18:42.265795946 CEST	50077	445	192.168.2.6	217.179.3.2
Jun 7, 2024 19:18:42.265795946 CEST	50077	445	192.168.2.6	217.179.3.2
Jun 7, 2024 19:18:42.270872116 CEST	445	50077	217.179.3.2	192.168.2.6
Jun 7, 2024 19:18:42.270904064 CEST	445	50077	217.179.3.2	192.168.2.6
Jun 7, 2024 19:18:42.322195053 CEST	50128	445	192.168.2.6	217.179.3.3
Jun 7, 2024 19:18:42.322421074 CEST	50129	445	192.168.2.6	128.133.0.32
Jun 7, 2024 19:18:42.327343941 CEST	445	50128	217.179.3.3	192.168.2.6
Jun 7, 2024 19:18:42.327445030 CEST	50128	445	192.168.2.6	217.179.3.3
Jun 7, 2024 19:18:42.327450037 CEST	445	50129	128.133.0.32	192.168.2.6
Jun 7, 2024 19:18:42.327516079 CEST	50129	445	192.168.2.6	128.133.0.32
Jun 7, 2024 19:18:42.327518940 CEST	50128	445	192.168.2.6	217.179.3.3
Jun 7, 2024 19:18:42.327545881 CEST	50129	445	192.168.2.6	128.133.0.32
Jun 7, 2024 19:18:42.327666998 CEST	50130	445	192.168.2.6	128.133.0.1
Jun 7, 2024 19:18:42.327815056 CEST	50131	445	192.168.2.6	217.179.3.3
Jun 7, 2024 19:18:42.331238031 CEST	445	50078	71.243.85.1	192.168.2.6
Jun 7, 2024 19:18:42.331312895 CEST	50078	445	192.168.2.6	71.243.85.1
Jun 7, 2024 19:18:42.331332922 CEST	50078	445	192.168.2.6	71.243.85.1
Jun 7, 2024 19:18:42.331358910 CEST	50078	445	192.168.2.6	71.243.85.1
Jun 7, 2024 19:18:42.332851887 CEST	445	50130	128.133.0.1	192.168.2.6
Jun 7, 2024 19:18:42.332884073 CEST	445	50131	217.179.3.3	192.168.2.6
Jun 7, 2024 19:18:42.332916975 CEST	50130	445	192.168.2.6	128.133.0.1
Jun 7, 2024 19:18:42.332943916 CEST	50131	445	192.168.2.6	217.179.3.3
Jun 7, 2024 19:18:42.332973003 CEST	50131	445	192.168.2.6	217.179.3.3
Jun 7, 2024 19:18:42.333000898 CEST	50130	445	192.168.2.6	128.133.0.1
Jun 7, 2024 19:18:42.333005905 CEST	445	50128	217.179.3.3	192.168.2.6
Jun 7, 2024 19:18:42.333058119 CEST	50128	445	192.168.2.6	217.179.3.3
Jun 7, 2024 19:18:42.333167076 CEST	445	50129	128.133.0.32	192.168.2.6
Jun 7, 2024 19:18:42.333231926 CEST	50129	445	192.168.2.6	128.133.0.32
Jun 7, 2024 19:18:42.333254099 CEST	50132	445	192.168.2.6	128.133.0.1
Jun 7, 2024 19:18:42.336261034 CEST	445	50078	71.243.85.1	192.168.2.6
Jun 7, 2024 19:18:42.336289883 CEST	445	50078	71.243.85.1	192.168.2.6
Jun 7, 2024 19:18:42.337979078 CEST	445	50131	217.179.3.3	192.168.2.6
Jun 7, 2024 19:18:42.338125944 CEST	445	50130	128.133.0.1	192.168.2.6
Jun 7, 2024 19:18:42.338160992 CEST	445	50132	128.133.0.1	192.168.2.6
Jun 7, 2024 19:18:42.338181973 CEST	50130	445	192.168.2.6	128.133.0.1
Jun 7, 2024 19:18:42.338218927 CEST	50132	445	192.168.2.6	128.133.0.1
Jun 7, 2024 19:18:42.338264942 CEST	50132	445	192.168.2.6	128.133.0.1
Jun 7, 2024 19:18:42.343143940 CEST	445	50132	128.133.0.1	192.168.2.6
Jun 7, 2024 19:18:42.384455919 CEST	50133	445	192.168.2.6	71.243.85.2
Jun 7, 2024 19:18:42.389621973 CEST	445	50133	71.243.85.2	192.168.2.6
Jun 7, 2024 19:18:42.389736891 CEST	50133	445	192.168.2.6	71.243.85.2
Jun 7, 2024 19:18:42.389765024 CEST	50133	445	192.168.2.6	71.243.85.2
Jun 7, 2024 19:18:42.390099049 CEST	50134	445	192.168.2.6	71.243.85.2
Jun 7, 2024 19:18:42.395051003 CEST	445	50133	71.243.85.2	192.168.2.6
Jun 7, 2024 19:18:42.395085096 CEST	445	50134	71.243.85.2	192.168.2.6
Jun 7, 2024 19:18:42.395122051 CEST	50133	445	192.168.2.6	71.243.85.2
Jun 7, 2024 19:18:42.395159006 CEST	50134	445	192.168.2.6	71.243.85.2
Jun 7, 2024 19:18:42.395189047 CEST	50134	445	192.168.2.6	71.243.85.2
Jun 7, 2024 19:18:42.400150061 CEST	445	50134	71.243.85.2	192.168.2.6
Jun 7, 2024 19:18:42.536958933 CEST	445	50081	97.92.55.1	192.168.2.6
Jun 7, 2024 19:18:42.537033081 CEST	50081	445	192.168.2.6	97.92.55.1
Jun 7, 2024 19:18:42.537066936 CEST	50081	445	192.168.2.6	97.92.55.1
Jun 7, 2024 19:18:42.537112951 CEST	50081	445	192.168.2.6	97.92.55.1
Jun 7, 2024 19:18:42.542042017 CEST	445	50081	97.92.55.1	192.168.2.6
Jun 7, 2024 19:18:42.542097092 CEST	445	50081	97.92.55.1	192.168.2.6
Jun 7, 2024 19:18:42.759660959 CEST	50135	445	192.168.2.6	199.164.60.6
Jun 7, 2024 19:18:42.764955044 CEST	445	50135	199.164.60.6	192.168.2.6
Jun 7, 2024 19:18:42.765168905 CEST	50135	445	192.168.2.6	199.164.60.6
Jun 7, 2024 19:18:42.765170097 CEST	50135	445	192.168.2.6	199.164.60.6
Jun 7, 2024 19:18:42.770279884 CEST	445	50135	199.164.60.6	192.168.2.6
Jun 7, 2024 19:18:42.852096081 CEST	445	50083	149.97.149.2	192.168.2.6
Jun 7, 2024 19:18:42.852308035 CEST	50083	445	192.168.2.6	149.97.149.2
Jun 7, 2024 19:18:42.852355957 CEST	50083	445	192.168.2.6	149.97.149.2
Jun 7, 2024 19:18:42.852401972 CEST	50083	445	192.168.2.6	149.97.149.2
Jun 7, 2024 19:18:42.857417107 CEST	445	50083	149.97.149.2	192.168.2.6
Jun 7, 2024 19:18:42.857445002 CEST	445	50083	149.97.149.2	192.168.2.6
Jun 7, 2024 19:18:43.302740097 CEST	445	50135	199.164.60.6	192.168.2.6
Jun 7, 2024 19:18:43.302896976 CEST	50135	445	192.168.2.6	199.164.60.6
Jun 7, 2024 19:18:43.302997112 CEST	50135	445	192.168.2.6	199.164.60.6
Jun 7, 2024 19:18:43.302998066 CEST	50135	445	192.168.2.6	199.164.60.6
Jun 7, 2024 19:18:43.307955027 CEST	445	50135	199.164.60.6	192.168.2.6
Jun 7, 2024 19:18:43.307981968 CEST	445	50135	199.164.60.6	192.168.2.6
Jun 7, 2024 19:18:43.368877888 CEST	50136	445	192.168.2.6	199.164.60.7
Jun 7, 2024 19:18:43.375046968 CEST	445	50136	199.164.60.7	192.168.2.6
Jun 7, 2024 19:18:43.375176907 CEST	50136	445	192.168.2.6	199.164.60.7
Jun 7, 2024 19:18:43.375471115 CEST	50136	445	192.168.2.6	199.164.60.7
Jun 7, 2024 19:18:43.375482082 CEST	50137	445	192.168.2.6	199.164.60.7
Jun 7, 2024 19:18:43.380534887 CEST	445	50137	199.164.60.7	192.168.2.6
Jun 7, 2024 19:18:43.380567074 CEST	445	50136	199.164.60.7	192.168.2.6
Jun 7, 2024 19:18:43.380641937 CEST	50137	445	192.168.2.6	199.164.60.7
Jun 7, 2024 19:18:43.380641937 CEST	50137	445	192.168.2.6	199.164.60.7
Jun 7, 2024 19:18:43.380647898 CEST	50136	445	192.168.2.6	199.164.60.7
Jun 7, 2024 19:18:43.385632992 CEST	445	50137	199.164.60.7	192.168.2.6
Jun 7, 2024 19:18:43.400171041 CEST	50138	445	192.168.2.6	42.37.158.171
Jun 7, 2024 19:18:43.405565977 CEST	445	50138	42.37.158.171	192.168.2.6
Jun 7, 2024 19:18:43.405677080 CEST	50138	445	192.168.2.6	42.37.158.171
Jun 7, 2024 19:18:43.405762911 CEST	50139	445	192.168.2.6	42.37.158.1
Jun 7, 2024 19:18:43.405766010 CEST	50138	445	192.168.2.6	42.37.158.171
Jun 7, 2024 19:18:43.410759926 CEST	445	50139	42.37.158.1	192.168.2.6
Jun 7, 2024 19:18:43.410989046 CEST	50139	445	192.168.2.6	42.37.158.1
Jun 7, 2024 19:18:43.411052942 CEST	50139	445	192.168.2.6	42.37.158.1
Jun 7, 2024 19:18:43.411164999 CEST	445	50138	42.37.158.171	192.168.2.6
Jun 7, 2024 19:18:43.411227942 CEST	50138	445	192.168.2.6	42.37.158.171
Jun 7, 2024 19:18:43.411248922 CEST	50140	445	192.168.2.6	42.37.158.1
Jun 7, 2024 19:18:43.416400909 CEST	445	50139	42.37.158.1	192.168.2.6
Jun 7, 2024 19:18:43.416430950 CEST	445	50140	42.37.158.1	192.168.2.6
Jun 7, 2024 19:18:43.416460037 CEST	50139	445	192.168.2.6	42.37.158.1
Jun 7, 2024 19:18:43.416498899 CEST	50140	445	192.168.2.6	42.37.158.1
Jun 7, 2024 19:18:43.416507006 CEST	50140	445	192.168.2.6	42.37.158.1
Jun 7, 2024 19:18:43.421595097 CEST	445	50140	42.37.158.1	192.168.2.6
Jun 7, 2024 19:18:43.837632895 CEST	50141	445	192.168.2.6	31.163.218.2
Jun 7, 2024 19:18:43.842978954 CEST	445	50141	31.163.218.2	192.168.2.6
Jun 7, 2024 19:18:43.843170881 CEST	50141	445	192.168.2.6	31.163.218.2
Jun 7, 2024 19:18:43.843264103 CEST	50141	445	192.168.2.6	31.163.218.2
Jun 7, 2024 19:18:43.848362923 CEST	445	50141	31.163.218.2	192.168.2.6
Jun 7, 2024 19:18:43.909822941 CEST	445	50137	199.164.60.7	192.168.2.6
Jun 7, 2024 19:18:43.910234928 CEST	50137	445	192.168.2.6	199.164.60.7
Jun 7, 2024 19:18:43.910234928 CEST	50137	445	192.168.2.6	199.164.60.7
Jun 7, 2024 19:18:43.910234928 CEST	50137	445	192.168.2.6	199.164.60.7
Jun 7, 2024 19:18:43.915724039 CEST	445	50137	199.164.60.7	192.168.2.6
Jun 7, 2024 19:18:43.915811062 CEST	445	50137	199.164.60.7	192.168.2.6
Jun 7, 2024 19:18:44.164011955 CEST	445	50089	65.79.232.1	192.168.2.6
Jun 7, 2024 19:18:44.164313078 CEST	50089	445	192.168.2.6	65.79.232.1
Jun 7, 2024 19:18:44.164313078 CEST	50089	445	192.168.2.6	65.79.232.1
Jun 7, 2024 19:18:44.164313078 CEST	50089	445	192.168.2.6	65.79.232.1
Jun 7, 2024 19:18:44.169398069 CEST	445	50089	65.79.232.1	192.168.2.6
Jun 7, 2024 19:18:44.169475079 CEST	445	50089	65.79.232.1	192.168.2.6
Jun 7, 2024 19:18:44.415903091 CEST	50142	445	192.168.2.6	99.28.220.253
Jun 7, 2024 19:18:44.421021938 CEST	445	50142	99.28.220.253	192.168.2.6
Jun 7, 2024 19:18:44.421112061 CEST	50142	445	192.168.2.6	99.28.220.253
Jun 7, 2024 19:18:44.421200991 CEST	50142	445	192.168.2.6	99.28.220.253
Jun 7, 2024 19:18:44.421441078 CEST	50143	445	192.168.2.6	99.28.220.1
Jun 7, 2024 19:18:44.426317930 CEST	445	50142	99.28.220.253	192.168.2.6
Jun 7, 2024 19:18:44.426376104 CEST	445	50143	99.28.220.1	192.168.2.6
Jun 7, 2024 19:18:44.426378012 CEST	50142	445	192.168.2.6	99.28.220.253
Jun 7, 2024 19:18:44.426455021 CEST	50143	445	192.168.2.6	99.28.220.1
Jun 7, 2024 19:18:44.426455975 CEST	50143	445	192.168.2.6	99.28.220.1
Jun 7, 2024 19:18:44.426661015 CEST	50144	445	192.168.2.6	99.28.220.1
Jun 7, 2024 19:18:44.431643009 CEST	445	50144	99.28.220.1	192.168.2.6
Jun 7, 2024 19:18:44.431706905 CEST	50144	445	192.168.2.6	99.28.220.1
Jun 7, 2024 19:18:44.431725979 CEST	50144	445	192.168.2.6	99.28.220.1
Jun 7, 2024 19:18:44.431885004 CEST	445	50143	99.28.220.1	192.168.2.6
Jun 7, 2024 19:18:44.431941986 CEST	50143	445	192.168.2.6	99.28.220.1
Jun 7, 2024 19:18:44.436703920 CEST	445	50144	99.28.220.1	192.168.2.6
Jun 7, 2024 19:18:44.500508070 CEST	445	50092	20.161.184.2	192.168.2.6
Jun 7, 2024 19:18:44.500848055 CEST	50092	445	192.168.2.6	20.161.184.2
Jun 7, 2024 19:18:44.500848055 CEST	50092	445	192.168.2.6	20.161.184.2
Jun 7, 2024 19:18:44.500849009 CEST	50092	445	192.168.2.6	20.161.184.2
Jun 7, 2024 19:18:44.506114960 CEST	445	50092	20.161.184.2	192.168.2.6
Jun 7, 2024 19:18:44.506145954 CEST	445	50092	20.161.184.2	192.168.2.6
Jun 7, 2024 19:18:44.556587934 CEST	50145	445	192.168.2.6	20.161.184.3
Jun 7, 2024 19:18:44.561902046 CEST	445	50145	20.161.184.3	192.168.2.6
Jun 7, 2024 19:18:44.561995983 CEST	50145	445	192.168.2.6	20.161.184.3
Jun 7, 2024 19:18:44.562037945 CEST	50145	445	192.168.2.6	20.161.184.3
Jun 7, 2024 19:18:44.562290907 CEST	50146	445	192.168.2.6	20.161.184.3
Jun 7, 2024 19:18:44.567235947 CEST	445	50146	20.161.184.3	192.168.2.6
Jun 7, 2024 19:18:44.567313910 CEST	50146	445	192.168.2.6	20.161.184.3
Jun 7, 2024 19:18:44.567354918 CEST	50146	445	192.168.2.6	20.161.184.3
Jun 7, 2024 19:18:44.567845106 CEST	445	50145	20.161.184.3	192.168.2.6
Jun 7, 2024 19:18:44.567907095 CEST	50145	445	192.168.2.6	20.161.184.3
Jun 7, 2024 19:18:44.572403908 CEST	445	50146	20.161.184.3	192.168.2.6
Jun 7, 2024 19:18:44.815926075 CEST	445	50094	196.22.85.3	192.168.2.6
Jun 7, 2024 19:18:44.816020966 CEST	50094	445	192.168.2.6	196.22.85.3
Jun 7, 2024 19:18:44.816102028 CEST	50094	445	192.168.2.6	196.22.85.3
Jun 7, 2024 19:18:44.816102028 CEST	50094	445	192.168.2.6	196.22.85.3
Jun 7, 2024 19:18:44.821046114 CEST	445	50094	196.22.85.3	192.168.2.6
Jun 7, 2024 19:18:44.821094036 CEST	445	50094	196.22.85.3	192.168.2.6
Jun 7, 2024 19:18:44.863823891 CEST	445	50096	59.20.234.2	192.168.2.6
Jun 7, 2024 19:18:44.864042044 CEST	50096	445	192.168.2.6	59.20.234.2
Jun 7, 2024 19:18:44.864042997 CEST	50096	445	192.168.2.6	59.20.234.2
Jun 7, 2024 19:18:44.864042997 CEST	50096	445	192.168.2.6	59.20.234.2
Jun 7, 2024 19:18:44.869158983 CEST	445	50096	59.20.234.2	192.168.2.6
Jun 7, 2024 19:18:44.869170904 CEST	445	50096	59.20.234.2	192.168.2.6
Jun 7, 2024 19:18:45.088831902 CEST	445	50098	213.153.200.2	192.168.2.6
Jun 7, 2024 19:18:45.088932037 CEST	50098	445	192.168.2.6	213.153.200.2
Jun 7, 2024 19:18:45.089029074 CEST	50098	445	192.168.2.6	213.153.200.2
Jun 7, 2024 19:18:45.089029074 CEST	50098	445	192.168.2.6	213.153.200.2
Jun 7, 2024 19:18:45.094145060 CEST	445	50098	213.153.200.2	192.168.2.6
Jun 7, 2024 19:18:45.094176054 CEST	445	50098	213.153.200.2	192.168.2.6
Jun 7, 2024 19:18:45.124962091 CEST	445	50100	109.235.245.2	192.168.2.6
Jun 7, 2024 19:18:45.125057936 CEST	50100	445	192.168.2.6	109.235.245.2
Jun 7, 2024 19:18:45.125098944 CEST	50100	445	192.168.2.6	109.235.245.2
Jun 7, 2024 19:18:45.125111103 CEST	50100	445	192.168.2.6	109.235.245.2
Jun 7, 2024 19:18:45.130239010 CEST	445	50100	109.235.245.2	192.168.2.6
Jun 7, 2024 19:18:45.130270958 CEST	445	50100	109.235.245.2	192.168.2.6
Jun 7, 2024 19:18:45.353408098 CEST	50147	445	192.168.2.6	57.121.200.69
Jun 7, 2024 19:18:45.358629942 CEST	445	50147	57.121.200.69	192.168.2.6
Jun 7, 2024 19:18:45.358776093 CEST	50147	445	192.168.2.6	57.121.200.69
Jun 7, 2024 19:18:45.358822107 CEST	50147	445	192.168.2.6	57.121.200.69
Jun 7, 2024 19:18:45.358972073 CEST	50148	445	192.168.2.6	57.121.200.1
Jun 7, 2024 19:18:45.364007950 CEST	445	50148	57.121.200.1	192.168.2.6
Jun 7, 2024 19:18:45.364080906 CEST	50148	445	192.168.2.6	57.121.200.1
Jun 7, 2024 19:18:45.364121914 CEST	50148	445	192.168.2.6	57.121.200.1
Jun 7, 2024 19:18:45.364310026 CEST	50149	445	192.168.2.6	57.121.200.1
Jun 7, 2024 19:18:45.364322901 CEST	445	50147	57.121.200.69	192.168.2.6
Jun 7, 2024 19:18:45.364370108 CEST	50147	445	192.168.2.6	57.121.200.69
Jun 7, 2024 19:18:45.369317055 CEST	445	50149	57.121.200.1	192.168.2.6
Jun 7, 2024 19:18:45.369386911 CEST	50149	445	192.168.2.6	57.121.200.1
Jun 7, 2024 19:18:45.369417906 CEST	50149	445	192.168.2.6	57.121.200.1
Jun 7, 2024 19:18:45.370526075 CEST	445	50148	57.121.200.1	192.168.2.6
Jun 7, 2024 19:18:45.370589972 CEST	50148	445	192.168.2.6	57.121.200.1
Jun 7, 2024 19:18:45.374408007 CEST	445	50149	57.121.200.1	192.168.2.6
Jun 7, 2024 19:18:45.540596008 CEST	50150	445	192.168.2.6	97.92.55.1
Jun 7, 2024 19:18:45.545712948 CEST	445	50150	97.92.55.1	192.168.2.6
Jun 7, 2024 19:18:45.545799971 CEST	50150	445	192.168.2.6	97.92.55.1
Jun 7, 2024 19:18:45.545840025 CEST	50150	445	192.168.2.6	97.92.55.1
Jun 7, 2024 19:18:45.550914049 CEST	445	50150	97.92.55.1	192.168.2.6
Jun 7, 2024 19:18:45.695780039 CEST	445	50103	140.73.58.1	192.168.2.6
Jun 7, 2024 19:18:45.696084023 CEST	50103	445	192.168.2.6	140.73.58.1
Jun 7, 2024 19:18:45.696187973 CEST	50103	445	192.168.2.6	140.73.58.1
Jun 7, 2024 19:18:45.696224928 CEST	50103	445	192.168.2.6	140.73.58.1
Jun 7, 2024 19:18:45.701306105 CEST	445	50103	140.73.58.1	192.168.2.6
Jun 7, 2024 19:18:45.701349974 CEST	445	50103	140.73.58.1	192.168.2.6
Jun 7, 2024 19:18:45.853400946 CEST	50151	445	192.168.2.6	149.97.149.2
Jun 7, 2024 19:18:45.858513117 CEST	445	50151	149.97.149.2	192.168.2.6
Jun 7, 2024 19:18:45.858767033 CEST	50151	445	192.168.2.6	149.97.149.2
Jun 7, 2024 19:18:45.858767033 CEST	50151	445	192.168.2.6	149.97.149.2
Jun 7, 2024 19:18:45.864115953 CEST	445	50151	149.97.149.2	192.168.2.6
Jun 7, 2024 19:18:46.228429079 CEST	50152	445	192.168.2.6	84.53.215.175
Jun 7, 2024 19:18:46.233656883 CEST	445	50152	84.53.215.175	192.168.2.6
Jun 7, 2024 19:18:46.233747959 CEST	50152	445	192.168.2.6	84.53.215.175
Jun 7, 2024 19:18:46.233786106 CEST	50152	445	192.168.2.6	84.53.215.175
Jun 7, 2024 19:18:46.233916998 CEST	50153	445	192.168.2.6	84.53.215.1
Jun 7, 2024 19:18:46.238993883 CEST	445	50153	84.53.215.1	192.168.2.6
Jun 7, 2024 19:18:46.239063978 CEST	50153	445	192.168.2.6	84.53.215.1
Jun 7, 2024 19:18:46.239114046 CEST	50153	445	192.168.2.6	84.53.215.1
Jun 7, 2024 19:18:46.239348888 CEST	50154	445	192.168.2.6	84.53.215.1
Jun 7, 2024 19:18:46.239392042 CEST	445	50152	84.53.215.175	192.168.2.6
Jun 7, 2024 19:18:46.239456892 CEST	50152	445	192.168.2.6	84.53.215.175
Jun 7, 2024 19:18:46.244317055 CEST	445	50154	84.53.215.1	192.168.2.6
Jun 7, 2024 19:18:46.244438887 CEST	50154	445	192.168.2.6	84.53.215.1
Jun 7, 2024 19:18:46.244502068 CEST	50154	445	192.168.2.6	84.53.215.1
Jun 7, 2024 19:18:46.245095015 CEST	445	50153	84.53.215.1	192.168.2.6
Jun 7, 2024 19:18:46.245150089 CEST	50153	445	192.168.2.6	84.53.215.1
Jun 7, 2024 19:18:46.249423027 CEST	445	50154	84.53.215.1	192.168.2.6
Jun 7, 2024 19:18:46.296147108 CEST	445	50104	123.63.163.2	192.168.2.6
Jun 7, 2024 19:18:46.296224117 CEST	50104	445	192.168.2.6	123.63.163.2
Jun 7, 2024 19:18:46.296224117 CEST	50104	445	192.168.2.6	123.63.163.2
Jun 7, 2024 19:18:46.296288013 CEST	50104	445	192.168.2.6	123.63.163.2
Jun 7, 2024 19:18:46.301343918 CEST	445	50104	123.63.163.2	192.168.2.6
Jun 7, 2024 19:18:46.301383018 CEST	445	50104	123.63.163.2	192.168.2.6
Jun 7, 2024 19:18:46.353276014 CEST	50155	445	192.168.2.6	123.63.163.3
Jun 7, 2024 19:18:46.358576059 CEST	445	50155	123.63.163.3	192.168.2.6
Jun 7, 2024 19:18:46.358711004 CEST	50155	445	192.168.2.6	123.63.163.3
Jun 7, 2024 19:18:46.360707998 CEST	50155	445	192.168.2.6	123.63.163.3
Jun 7, 2024 19:18:46.361433983 CEST	50156	445	192.168.2.6	123.63.163.3
Jun 7, 2024 19:18:46.365767002 CEST	445	50155	123.63.163.3	192.168.2.6
Jun 7, 2024 19:18:46.365942001 CEST	50155	445	192.168.2.6	123.63.163.3
Jun 7, 2024 19:18:46.366424084 CEST	445	50156	123.63.163.3	192.168.2.6
Jun 7, 2024 19:18:46.366499901 CEST	50156	445	192.168.2.6	123.63.163.3
Jun 7, 2024 19:18:46.366543055 CEST	50156	445	192.168.2.6	123.63.163.3
Jun 7, 2024 19:18:46.371625900 CEST	445	50156	123.63.163.3	192.168.2.6
Jun 7, 2024 19:18:46.410310984 CEST	445	50105	205.139.6.1	192.168.2.6
Jun 7, 2024 19:18:46.410403967 CEST	50105	445	192.168.2.6	205.139.6.1
Jun 7, 2024 19:18:46.410491943 CEST	50105	445	192.168.2.6	205.139.6.1
Jun 7, 2024 19:18:46.410491943 CEST	50105	445	192.168.2.6	205.139.6.1
Jun 7, 2024 19:18:46.415548086 CEST	445	50105	205.139.6.1	192.168.2.6
Jun 7, 2024 19:18:46.415580034 CEST	445	50105	205.139.6.1	192.168.2.6
Jun 7, 2024 19:18:46.462661982 CEST	50157	445	192.168.2.6	205.139.6.2
Jun 7, 2024 19:18:46.467613935 CEST	445	50157	205.139.6.2	192.168.2.6
Jun 7, 2024 19:18:46.467691898 CEST	50157	445	192.168.2.6	205.139.6.2
Jun 7, 2024 19:18:46.467710018 CEST	50157	445	192.168.2.6	205.139.6.2
Jun 7, 2024 19:18:46.467914104 CEST	50158	445	192.168.2.6	205.139.6.2
Jun 7, 2024 19:18:46.472990990 CEST	445	50158	205.139.6.2	192.168.2.6
Jun 7, 2024 19:18:46.473148108 CEST	50158	445	192.168.2.6	205.139.6.2
Jun 7, 2024 19:18:46.473148108 CEST	50158	445	192.168.2.6	205.139.6.2
Jun 7, 2024 19:18:46.474991083 CEST	445	50157	205.139.6.2	192.168.2.6
Jun 7, 2024 19:18:46.475061893 CEST	50157	445	192.168.2.6	205.139.6.2
Jun 7, 2024 19:18:46.478141069 CEST	445	50158	205.139.6.2	192.168.2.6
Jun 7, 2024 19:18:46.641534090 CEST	50159	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:46.641642094 CEST	443	50159	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:46.641772032 CEST	50159	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:46.642110109 CEST	50159	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:46.642149925 CEST	443	50159	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:46.806164980 CEST	445	50107	38.185.73.3	192.168.2.6
Jun 7, 2024 19:18:46.806257963 CEST	50107	445	192.168.2.6	38.185.73.3
Jun 7, 2024 19:18:46.806293011 CEST	50107	445	192.168.2.6	38.185.73.3
Jun 7, 2024 19:18:46.806335926 CEST	50107	445	192.168.2.6	38.185.73.3
Jun 7, 2024 19:18:46.811259985 CEST	445	50107	38.185.73.3	192.168.2.6
Jun 7, 2024 19:18:46.811290979 CEST	445	50107	38.185.73.3	192.168.2.6
Jun 7, 2024 19:18:46.915904045 CEST	50160	445	192.168.2.6	199.164.60.7
Jun 7, 2024 19:18:46.921058893 CEST	445	50160	199.164.60.7	192.168.2.6
Jun 7, 2024 19:18:46.921154022 CEST	50160	445	192.168.2.6	199.164.60.7
Jun 7, 2024 19:18:46.921170950 CEST	50160	445	192.168.2.6	199.164.60.7
Jun 7, 2024 19:18:46.926096916 CEST	445	50160	199.164.60.7	192.168.2.6
Jun 7, 2024 19:18:47.057260036 CEST	50161	445	192.168.2.6	15.114.112.48
Jun 7, 2024 19:18:47.062417984 CEST	445	50161	15.114.112.48	192.168.2.6
Jun 7, 2024 19:18:47.062524080 CEST	50161	445	192.168.2.6	15.114.112.48
Jun 7, 2024 19:18:47.063278913 CEST	50161	445	192.168.2.6	15.114.112.48
Jun 7, 2024 19:18:47.063430071 CEST	50162	445	192.168.2.6	15.114.112.1
Jun 7, 2024 19:18:47.068407059 CEST	445	50162	15.114.112.1	192.168.2.6
Jun 7, 2024 19:18:47.068497896 CEST	50162	445	192.168.2.6	15.114.112.1
Jun 7, 2024 19:18:47.068598986 CEST	50162	445	192.168.2.6	15.114.112.1
Jun 7, 2024 19:18:47.068650007 CEST	445	50161	15.114.112.48	192.168.2.6
Jun 7, 2024 19:18:47.068840027 CEST	445	50161	15.114.112.48	192.168.2.6
Jun 7, 2024 19:18:47.068893909 CEST	50161	445	192.168.2.6	15.114.112.48
Jun 7, 2024 19:18:47.069387913 CEST	50163	445	192.168.2.6	15.114.112.1
Jun 7, 2024 19:18:47.074049950 CEST	445	50162	15.114.112.1	192.168.2.6
Jun 7, 2024 19:18:47.074393988 CEST	445	50163	15.114.112.1	192.168.2.6
Jun 7, 2024 19:18:47.074996948 CEST	50162	445	192.168.2.6	15.114.112.1
Jun 7, 2024 19:18:47.075023890 CEST	50163	445	192.168.2.6	15.114.112.1
Jun 7, 2024 19:18:47.075190067 CEST	50163	445	192.168.2.6	15.114.112.1
Jun 7, 2024 19:18:47.080106020 CEST	445	50163	15.114.112.1	192.168.2.6
Jun 7, 2024 19:18:47.111179113 CEST	445	50111	85.248.203.1	192.168.2.6
Jun 7, 2024 19:18:47.111251116 CEST	50111	445	192.168.2.6	85.248.203.1
Jun 7, 2024 19:18:47.111293077 CEST	50111	445	192.168.2.6	85.248.203.1
Jun 7, 2024 19:18:47.111304998 CEST	50111	445	192.168.2.6	85.248.203.1
Jun 7, 2024 19:18:47.116297007 CEST	445	50111	85.248.203.1	192.168.2.6
Jun 7, 2024 19:18:47.116328955 CEST	445	50111	85.248.203.1	192.168.2.6
Jun 7, 2024 19:18:47.165627956 CEST	50164	445	192.168.2.6	65.79.232.1
Jun 7, 2024 19:18:47.170892954 CEST	445	50164	65.79.232.1	192.168.2.6
Jun 7, 2024 19:18:47.170970917 CEST	50164	445	192.168.2.6	65.79.232.1
Jun 7, 2024 19:18:47.171011925 CEST	50164	445	192.168.2.6	65.79.232.1
Jun 7, 2024 19:18:47.175883055 CEST	445	50164	65.79.232.1	192.168.2.6
Jun 7, 2024 19:18:47.456311941 CEST	445	50160	199.164.60.7	192.168.2.6
Jun 7, 2024 19:18:47.456408978 CEST	50160	445	192.168.2.6	199.164.60.7
Jun 7, 2024 19:18:47.456475019 CEST	50160	445	192.168.2.6	199.164.60.7
Jun 7, 2024 19:18:47.456526041 CEST	50160	445	192.168.2.6	199.164.60.7
Jun 7, 2024 19:18:47.457607985 CEST	443	50159	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:47.457725048 CEST	50159	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:47.459207058 CEST	50159	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:47.459240913 CEST	443	50159	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:47.460268021 CEST	443	50159	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:47.461440086 CEST	445	50160	199.164.60.7	192.168.2.6
Jun 7, 2024 19:18:47.461467981 CEST	445	50160	199.164.60.7	192.168.2.6
Jun 7, 2024 19:18:47.468748093 CEST	50159	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:47.509624958 CEST	50165	445	192.168.2.6	199.164.60.8
Jun 7, 2024 19:18:47.514533997 CEST	445	50165	199.164.60.8	192.168.2.6
Jun 7, 2024 19:18:47.514647007 CEST	50165	445	192.168.2.6	199.164.60.8
Jun 7, 2024 19:18:47.514683008 CEST	50165	445	192.168.2.6	199.164.60.8
Jun 7, 2024 19:18:47.515017986 CEST	50166	445	192.168.2.6	199.164.60.8
Jun 7, 2024 19:18:47.516494989 CEST	443	50159	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:47.519865990 CEST	445	50165	199.164.60.8	192.168.2.6
Jun 7, 2024 19:18:47.519882917 CEST	445	50166	199.164.60.8	192.168.2.6
Jun 7, 2024 19:18:47.519926071 CEST	50165	445	192.168.2.6	199.164.60.8
Jun 7, 2024 19:18:47.519953966 CEST	50166	445	192.168.2.6	199.164.60.8
Jun 7, 2024 19:18:47.520004034 CEST	50166	445	192.168.2.6	199.164.60.8
Jun 7, 2024 19:18:47.524890900 CEST	445	50166	199.164.60.8	192.168.2.6
Jun 7, 2024 19:18:47.729876041 CEST	443	50159	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:47.729931116 CEST	443	50159	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:47.729975939 CEST	443	50159	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:47.730163097 CEST	50159	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:47.730163097 CEST	50159	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:47.730233908 CEST	443	50159	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:47.730312109 CEST	50159	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:47.730743885 CEST	443	50159	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:47.730796099 CEST	443	50159	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:47.730813026 CEST	50159	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:47.730829954 CEST	443	50159	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:47.730880976 CEST	50159	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:47.730894089 CEST	443	50159	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:47.730946064 CEST	443	50159	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:47.730997086 CEST	50159	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:47.734869003 CEST	50159	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:47.734903097 CEST	443	50159	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:47.734930038 CEST	50159	443	192.168.2.6	52.165.165.26
Jun 7, 2024 19:18:47.734945059 CEST	443	50159	52.165.165.26	192.168.2.6
Jun 7, 2024 19:18:47.822217941 CEST	50167	445	192.168.2.6	196.22.85.3
Jun 7, 2024 19:18:47.823328972 CEST	50168	445	192.168.2.6	141.113.21.127
Jun 7, 2024 19:18:47.827239990 CEST	445	50167	196.22.85.3	192.168.2.6
Jun 7, 2024 19:18:47.827316046 CEST	50167	445	192.168.2.6	196.22.85.3
Jun 7, 2024 19:18:47.827366114 CEST	50167	445	192.168.2.6	196.22.85.3
Jun 7, 2024 19:18:47.829108000 CEST	445	50168	141.113.21.127	192.168.2.6
Jun 7, 2024 19:18:47.829170942 CEST	50168	445	192.168.2.6	141.113.21.127
Jun 7, 2024 19:18:47.829246044 CEST	50168	445	192.168.2.6	141.113.21.127
Jun 7, 2024 19:18:47.829472065 CEST	50169	445	192.168.2.6	141.113.21.1
Jun 7, 2024 19:18:47.832428932 CEST	445	50167	196.22.85.3	192.168.2.6
Jun 7, 2024 19:18:47.834290981 CEST	445	50168	141.113.21.127	192.168.2.6
Jun 7, 2024 19:18:47.834336996 CEST	50168	445	192.168.2.6	141.113.21.127
Jun 7, 2024 19:18:47.834403992 CEST	445	50169	141.113.21.1	192.168.2.6
Jun 7, 2024 19:18:47.834456921 CEST	50169	445	192.168.2.6	141.113.21.1
Jun 7, 2024 19:18:47.834520102 CEST	50169	445	192.168.2.6	141.113.21.1
Jun 7, 2024 19:18:47.834933996 CEST	50170	445	192.168.2.6	141.113.21.1
Jun 7, 2024 19:18:47.839591026 CEST	445	50169	141.113.21.1	192.168.2.6
Jun 7, 2024 19:18:47.839664936 CEST	50169	445	192.168.2.6	141.113.21.1
Jun 7, 2024 19:18:47.839776039 CEST	445	50170	141.113.21.1	192.168.2.6
Jun 7, 2024 19:18:47.839828968 CEST	50170	445	192.168.2.6	141.113.21.1
Jun 7, 2024 19:18:47.839855909 CEST	50170	445	192.168.2.6	141.113.21.1
Jun 7, 2024 19:18:47.844748020 CEST	445	50170	141.113.21.1	192.168.2.6
Jun 7, 2024 19:18:47.868697882 CEST	50171	445	192.168.2.6	59.20.234.2
Jun 7, 2024 19:18:47.873708963 CEST	445	50171	59.20.234.2	192.168.2.6
Jun 7, 2024 19:18:47.873768091 CEST	50171	445	192.168.2.6	59.20.234.2
Jun 7, 2024 19:18:47.873811960 CEST	50171	445	192.168.2.6	59.20.234.2
Jun 7, 2024 19:18:47.878674984 CEST	445	50171	59.20.234.2	192.168.2.6
Jun 7, 2024 19:18:48.055804968 CEST	445	50166	199.164.60.8	192.168.2.6
Jun 7, 2024 19:18:48.055936098 CEST	50166	445	192.168.2.6	199.164.60.8
Jun 7, 2024 19:18:48.055994034 CEST	50166	445	192.168.2.6	199.164.60.8
Jun 7, 2024 19:18:48.056015968 CEST	50166	445	192.168.2.6	199.164.60.8
Jun 7, 2024 19:18:48.060997963 CEST	445	50166	199.164.60.8	192.168.2.6
Jun 7, 2024 19:18:48.061050892 CEST	445	50166	199.164.60.8	192.168.2.6
Jun 7, 2024 19:18:48.106493950 CEST	50172	445	192.168.2.6	213.153.200.2
Jun 7, 2024 19:18:48.113502979 CEST	445	50172	213.153.200.2	192.168.2.6
Jun 7, 2024 19:18:48.113691092 CEST	50172	445	192.168.2.6	213.153.200.2
Jun 7, 2024 19:18:48.113770962 CEST	50172	445	192.168.2.6	213.153.200.2
Jun 7, 2024 19:18:48.118643045 CEST	445	50172	213.153.200.2	192.168.2.6
Jun 7, 2024 19:18:48.134473085 CEST	50173	445	192.168.2.6	109.235.245.2
Jun 7, 2024 19:18:48.142590046 CEST	445	50173	109.235.245.2	192.168.2.6
Jun 7, 2024 19:18:48.142682076 CEST	50173	445	192.168.2.6	109.235.245.2
Jun 7, 2024 19:18:48.142712116 CEST	50173	445	192.168.2.6	109.235.245.2
Jun 7, 2024 19:18:48.147663116 CEST	445	50173	109.235.245.2	192.168.2.6
Jun 7, 2024 19:18:48.302449942 CEST	445	50114	129.100.47.2	192.168.2.6
Jun 7, 2024 19:18:48.302548885 CEST	50114	445	192.168.2.6	129.100.47.2
Jun 7, 2024 19:18:48.302648067 CEST	50114	445	192.168.2.6	129.100.47.2
Jun 7, 2024 19:18:48.302648067 CEST	50114	445	192.168.2.6	129.100.47.2
Jun 7, 2024 19:18:48.307590008 CEST	445	50114	129.100.47.2	192.168.2.6
Jun 7, 2024 19:18:48.307627916 CEST	445	50114	129.100.47.2	192.168.2.6
Jun 7, 2024 19:18:48.330020905 CEST	50174	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:48.330092907 CEST	443	50174	40.115.3.253	192.168.2.6
Jun 7, 2024 19:18:48.330243111 CEST	50174	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:48.330849886 CEST	50174	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:48.330863953 CEST	443	50174	40.115.3.253	192.168.2.6
Jun 7, 2024 19:18:48.353226900 CEST	50175	445	192.168.2.6	129.100.47.3
Jun 7, 2024 19:18:48.358202934 CEST	445	50175	129.100.47.3	192.168.2.6
Jun 7, 2024 19:18:48.358303070 CEST	50175	445	192.168.2.6	129.100.47.3
Jun 7, 2024 19:18:48.358361006 CEST	50175	445	192.168.2.6	129.100.47.3
Jun 7, 2024 19:18:48.358695030 CEST	50176	445	192.168.2.6	129.100.47.3
Jun 7, 2024 19:18:48.363614082 CEST	445	50175	129.100.47.3	192.168.2.6
Jun 7, 2024 19:18:48.363643885 CEST	445	50176	129.100.47.3	192.168.2.6
Jun 7, 2024 19:18:48.363676071 CEST	50175	445	192.168.2.6	129.100.47.3
Jun 7, 2024 19:18:48.363723040 CEST	50176	445	192.168.2.6	129.100.47.3
Jun 7, 2024 19:18:48.363749027 CEST	50176	445	192.168.2.6	129.100.47.3
Jun 7, 2024 19:18:48.368616104 CEST	445	50176	129.100.47.3	192.168.2.6
Jun 7, 2024 19:18:48.381087065 CEST	445	50115	156.45.127.1	192.168.2.6
Jun 7, 2024 19:18:48.381160021 CEST	50115	445	192.168.2.6	156.45.127.1
Jun 7, 2024 19:18:48.381191015 CEST	50115	445	192.168.2.6	156.45.127.1
Jun 7, 2024 19:18:48.381223917 CEST	50115	445	192.168.2.6	156.45.127.1
Jun 7, 2024 19:18:48.386126995 CEST	445	50115	156.45.127.1	192.168.2.6
Jun 7, 2024 19:18:48.386152983 CEST	445	50115	156.45.127.1	192.168.2.6
Jun 7, 2024 19:18:48.431317091 CEST	445	50118	130.209.93.1	192.168.2.6
Jun 7, 2024 19:18:48.433660984 CEST	50118	445	192.168.2.6	130.209.93.1
Jun 7, 2024 19:18:48.433708906 CEST	50118	445	192.168.2.6	130.209.93.1
Jun 7, 2024 19:18:48.433739901 CEST	50118	445	192.168.2.6	130.209.93.1
Jun 7, 2024 19:18:48.438671112 CEST	445	50118	130.209.93.1	192.168.2.6
Jun 7, 2024 19:18:48.438730001 CEST	445	50118	130.209.93.1	192.168.2.6
Jun 7, 2024 19:18:48.446994066 CEST	50177	445	192.168.2.6	156.45.127.2
Jun 7, 2024 19:18:48.452025890 CEST	445	50177	156.45.127.2	192.168.2.6
Jun 7, 2024 19:18:48.452137947 CEST	50177	445	192.168.2.6	156.45.127.2
Jun 7, 2024 19:18:48.452179909 CEST	50177	445	192.168.2.6	156.45.127.2
Jun 7, 2024 19:18:48.452522039 CEST	50178	445	192.168.2.6	156.45.127.2
Jun 7, 2024 19:18:48.457459927 CEST	445	50178	156.45.127.2	192.168.2.6
Jun 7, 2024 19:18:48.457534075 CEST	50178	445	192.168.2.6	156.45.127.2
Jun 7, 2024 19:18:48.457557917 CEST	50178	445	192.168.2.6	156.45.127.2
Jun 7, 2024 19:18:48.457576990 CEST	445	50177	156.45.127.2	192.168.2.6
Jun 7, 2024 19:18:48.457642078 CEST	50177	445	192.168.2.6	156.45.127.2
Jun 7, 2024 19:18:48.462647915 CEST	445	50178	156.45.127.2	192.168.2.6
Jun 7, 2024 19:18:48.697073936 CEST	50180	445	192.168.2.6	140.73.58.1
Jun 7, 2024 19:18:48.702328920 CEST	445	50180	140.73.58.1	192.168.2.6
Jun 7, 2024 19:18:48.702420950 CEST	50180	445	192.168.2.6	140.73.58.1
Jun 7, 2024 19:18:48.702445030 CEST	50180	445	192.168.2.6	140.73.58.1
Jun 7, 2024 19:18:48.707464933 CEST	445	50180	140.73.58.1	192.168.2.6
Jun 7, 2024 19:18:48.834649086 CEST	445	50120	35.130.55.3	192.168.2.6
Jun 7, 2024 19:18:48.834743977 CEST	50120	445	192.168.2.6	35.130.55.3
Jun 7, 2024 19:18:48.834791899 CEST	50120	445	192.168.2.6	35.130.55.3
Jun 7, 2024 19:18:48.834816933 CEST	50120	445	192.168.2.6	35.130.55.3
Jun 7, 2024 19:18:48.839809895 CEST	445	50120	35.130.55.3	192.168.2.6
Jun 7, 2024 19:18:48.839874029 CEST	445	50120	35.130.55.3	192.168.2.6
Jun 7, 2024 19:18:48.869131088 CEST	445	50122	122.155.26.2	192.168.2.6
Jun 7, 2024 19:18:48.873642921 CEST	50122	445	192.168.2.6	122.155.26.2
Jun 7, 2024 19:18:48.873718977 CEST	50122	445	192.168.2.6	122.155.26.2
Jun 7, 2024 19:18:48.873774052 CEST	50122	445	192.168.2.6	122.155.26.2
Jun 7, 2024 19:18:48.878809929 CEST	445	50122	122.155.26.2	192.168.2.6
Jun 7, 2024 19:18:48.878839016 CEST	445	50122	122.155.26.2	192.168.2.6
Jun 7, 2024 19:18:49.450298071 CEST	443	50174	40.115.3.253	192.168.2.6
Jun 7, 2024 19:18:49.450429916 CEST	50174	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:49.452236891 CEST	50174	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:49.452248096 CEST	443	50174	40.115.3.253	192.168.2.6
Jun 7, 2024 19:18:49.453049898 CEST	443	50174	40.115.3.253	192.168.2.6
Jun 7, 2024 19:18:49.463231087 CEST	50174	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:49.463311911 CEST	50174	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:49.463320971 CEST	443	50174	40.115.3.253	192.168.2.6
Jun 7, 2024 19:18:49.463536978 CEST	50174	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:49.508510113 CEST	443	50174	40.115.3.253	192.168.2.6
Jun 7, 2024 19:18:49.674937010 CEST	445	50125	143.112.228.1	192.168.2.6
Jun 7, 2024 19:18:49.675033092 CEST	50125	445	192.168.2.6	143.112.228.1
Jun 7, 2024 19:18:49.675069094 CEST	50125	445	192.168.2.6	143.112.228.1
Jun 7, 2024 19:18:49.675080061 CEST	50125	445	192.168.2.6	143.112.228.1
Jun 7, 2024 19:18:49.680094004 CEST	445	50125	143.112.228.1	192.168.2.6
Jun 7, 2024 19:18:49.680206060 CEST	445	50125	143.112.228.1	192.168.2.6
Jun 7, 2024 19:18:49.709359884 CEST	443	50174	40.115.3.253	192.168.2.6
Jun 7, 2024 19:18:49.710227966 CEST	50174	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:49.710242033 CEST	443	50174	40.115.3.253	192.168.2.6
Jun 7, 2024 19:18:49.710263014 CEST	50174	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:49.710316896 CEST	50174	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:18:49.821945906 CEST	50183	445	192.168.2.6	38.185.73.3
Jun 7, 2024 19:18:49.827104092 CEST	445	50183	38.185.73.3	192.168.2.6
Jun 7, 2024 19:18:49.827234983 CEST	50183	445	192.168.2.6	38.185.73.3
Jun 7, 2024 19:18:49.827318907 CEST	50183	445	192.168.2.6	38.185.73.3
Jun 7, 2024 19:18:49.832372904 CEST	445	50183	38.185.73.3	192.168.2.6
Jun 7, 2024 19:18:50.122390032 CEST	50185	445	192.168.2.6	85.248.203.1
Jun 7, 2024 19:18:50.127643108 CEST	445	50185	85.248.203.1	192.168.2.6
Jun 7, 2024 19:18:50.127742052 CEST	50185	445	192.168.2.6	85.248.203.1
Jun 7, 2024 19:18:50.127866983 CEST	50185	445	192.168.2.6	85.248.203.1
Jun 7, 2024 19:18:50.132798910 CEST	445	50185	85.248.203.1	192.168.2.6
Jun 7, 2024 19:18:50.311227083 CEST	445	50126	219.1.165.2	192.168.2.6
Jun 7, 2024 19:18:50.311431885 CEST	50126	445	192.168.2.6	219.1.165.2
Jun 7, 2024 19:18:50.311433077 CEST	50126	445	192.168.2.6	219.1.165.2
Jun 7, 2024 19:18:50.311433077 CEST	50126	445	192.168.2.6	219.1.165.2
Jun 7, 2024 19:18:50.316435099 CEST	445	50126	219.1.165.2	192.168.2.6
Jun 7, 2024 19:18:50.316457033 CEST	445	50126	219.1.165.2	192.168.2.6
Jun 7, 2024 19:18:50.369180918 CEST	50187	445	192.168.2.6	219.1.165.3
Jun 7, 2024 19:18:50.374583006 CEST	445	50187	219.1.165.3	192.168.2.6
Jun 7, 2024 19:18:50.374989033 CEST	50187	445	192.168.2.6	219.1.165.3
Jun 7, 2024 19:18:50.374989033 CEST	50187	445	192.168.2.6	219.1.165.3
Jun 7, 2024 19:18:50.375236988 CEST	50188	445	192.168.2.6	219.1.165.3
Jun 7, 2024 19:18:50.380525112 CEST	445	50187	219.1.165.3	192.168.2.6
Jun 7, 2024 19:18:50.380558014 CEST	445	50188	219.1.165.3	192.168.2.6
Jun 7, 2024 19:18:50.380594969 CEST	50187	445	192.168.2.6	219.1.165.3
Jun 7, 2024 19:18:50.380654097 CEST	50188	445	192.168.2.6	219.1.165.3
Jun 7, 2024 19:18:50.380691051 CEST	50188	445	192.168.2.6	219.1.165.3
Jun 7, 2024 19:18:50.385551929 CEST	445	50188	219.1.165.3	192.168.2.6
Jun 7, 2024 19:18:50.416028976 CEST	445	50127	189.250.95.1	192.168.2.6
Jun 7, 2024 19:18:50.416233063 CEST	50127	445	192.168.2.6	189.250.95.1
Jun 7, 2024 19:18:50.416284084 CEST	50127	445	192.168.2.6	189.250.95.1
Jun 7, 2024 19:18:50.416285038 CEST	50127	445	192.168.2.6	189.250.95.1
Jun 7, 2024 19:18:50.421189070 CEST	445	50127	189.250.95.1	192.168.2.6
Jun 7, 2024 19:18:50.421221018 CEST	445	50127	189.250.95.1	192.168.2.6
Jun 7, 2024 19:18:50.478483915 CEST	50190	445	192.168.2.6	189.250.95.2
Jun 7, 2024 19:18:50.483661890 CEST	445	50190	189.250.95.2	192.168.2.6
Jun 7, 2024 19:18:50.483926058 CEST	50190	445	192.168.2.6	189.250.95.2
Jun 7, 2024 19:18:50.489469051 CEST	50190	445	192.168.2.6	189.250.95.2
Jun 7, 2024 19:18:50.489774942 CEST	50191	445	192.168.2.6	189.250.95.2
Jun 7, 2024 19:18:50.494602919 CEST	445	50190	189.250.95.2	192.168.2.6
Jun 7, 2024 19:18:50.494677067 CEST	50190	445	192.168.2.6	189.250.95.2
Jun 7, 2024 19:18:50.494771957 CEST	445	50191	189.250.95.2	192.168.2.6
Jun 7, 2024 19:18:50.494839907 CEST	50191	445	192.168.2.6	189.250.95.2
Jun 7, 2024 19:18:50.494894028 CEST	50191	445	192.168.2.6	189.250.95.2
Jun 7, 2024 19:18:50.499797106 CEST	445	50191	189.250.95.2	192.168.2.6
Jun 7, 2024 19:18:50.824522018 CEST	445	50131	217.179.3.3	192.168.2.6
Jun 7, 2024 19:18:50.824759960 CEST	50131	445	192.168.2.6	217.179.3.3
Jun 7, 2024 19:18:50.824759960 CEST	50131	445	192.168.2.6	217.179.3.3
Jun 7, 2024 19:18:50.824759960 CEST	50131	445	192.168.2.6	217.179.3.3
Jun 7, 2024 19:18:50.830347061 CEST	445	50131	217.179.3.3	192.168.2.6
Jun 7, 2024 19:18:50.830401897 CEST	445	50131	217.179.3.3	192.168.2.6
Jun 7, 2024 19:18:50.830759048 CEST	445	50132	128.133.0.1	192.168.2.6
Jun 7, 2024 19:18:50.830832005 CEST	50132	445	192.168.2.6	128.133.0.1
Jun 7, 2024 19:18:50.837187052 CEST	50132	445	192.168.2.6	128.133.0.1
Jun 7, 2024 19:18:50.837362051 CEST	50132	445	192.168.2.6	128.133.0.1
Jun 7, 2024 19:18:50.842138052 CEST	445	50132	128.133.0.1	192.168.2.6
Jun 7, 2024 19:18:50.842355967 CEST	445	50132	128.133.0.1	192.168.2.6
Jun 7, 2024 19:18:50.887792110 CEST	445	50134	71.243.85.2	192.168.2.6
Jun 7, 2024 19:18:50.888006926 CEST	50134	445	192.168.2.6	71.243.85.2
Jun 7, 2024 19:18:50.888044119 CEST	50134	445	192.168.2.6	71.243.85.2
Jun 7, 2024 19:18:50.888044119 CEST	50134	445	192.168.2.6	71.243.85.2
Jun 7, 2024 19:18:50.893163919 CEST	445	50134	71.243.85.2	192.168.2.6
Jun 7, 2024 19:18:50.893196106 CEST	445	50134	71.243.85.2	192.168.2.6
Jun 7, 2024 19:18:51.056904078 CEST	50195	445	192.168.2.6	199.164.60.8
Jun 7, 2024 19:18:51.062494993 CEST	445	50195	199.164.60.8	192.168.2.6
Jun 7, 2024 19:18:51.062711000 CEST	50195	445	192.168.2.6	199.164.60.8
Jun 7, 2024 19:18:51.062762976 CEST	50195	445	192.168.2.6	199.164.60.8
Jun 7, 2024 19:18:51.068104029 CEST	445	50195	199.164.60.8	192.168.2.6
Jun 7, 2024 19:18:51.447160006 CEST	50197	445	192.168.2.6	130.209.93.1
Jun 7, 2024 19:18:51.452672005 CEST	445	50197	130.209.93.1	192.168.2.6
Jun 7, 2024 19:18:51.453099012 CEST	50197	445	192.168.2.6	130.209.93.1
Jun 7, 2024 19:18:51.453099012 CEST	50197	445	192.168.2.6	130.209.93.1
Jun 7, 2024 19:18:51.458533049 CEST	445	50197	130.209.93.1	192.168.2.6
Jun 7, 2024 19:18:51.589838028 CEST	445	50195	199.164.60.8	192.168.2.6
Jun 7, 2024 19:18:51.589972973 CEST	50195	445	192.168.2.6	199.164.60.8
Jun 7, 2024 19:18:51.590022087 CEST	50195	445	192.168.2.6	199.164.60.8
Jun 7, 2024 19:18:51.590044022 CEST	50195	445	192.168.2.6	199.164.60.8
Jun 7, 2024 19:18:51.595123053 CEST	445	50195	199.164.60.8	192.168.2.6
Jun 7, 2024 19:18:51.595169067 CEST	445	50195	199.164.60.8	192.168.2.6
Jun 7, 2024 19:18:51.650254011 CEST	50200	445	192.168.2.6	199.164.60.9
Jun 7, 2024 19:18:51.655386925 CEST	445	50200	199.164.60.9	192.168.2.6
Jun 7, 2024 19:18:51.655489922 CEST	50200	445	192.168.2.6	199.164.60.9
Jun 7, 2024 19:18:51.655554056 CEST	50200	445	192.168.2.6	199.164.60.9
Jun 7, 2024 19:18:51.655920029 CEST	50201	445	192.168.2.6	199.164.60.9
Jun 7, 2024 19:18:51.660619020 CEST	445	50200	199.164.60.9	192.168.2.6
Jun 7, 2024 19:18:51.660842896 CEST	445	50200	199.164.60.9	192.168.2.6
Jun 7, 2024 19:18:51.660880089 CEST	445	50201	199.164.60.9	192.168.2.6
Jun 7, 2024 19:18:51.660900116 CEST	50200	445	192.168.2.6	199.164.60.9
Jun 7, 2024 19:18:51.660957098 CEST	50201	445	192.168.2.6	199.164.60.9
Jun 7, 2024 19:18:51.661000013 CEST	50201	445	192.168.2.6	199.164.60.9
Jun 7, 2024 19:18:51.665849924 CEST	445	50201	199.164.60.9	192.168.2.6
Jun 7, 2024 19:18:51.837594986 CEST	50202	445	192.168.2.6	35.130.55.3
Jun 7, 2024 19:18:51.842784882 CEST	445	50202	35.130.55.3	192.168.2.6
Jun 7, 2024 19:18:51.842925072 CEST	50202	445	192.168.2.6	35.130.55.3
Jun 7, 2024 19:18:51.842925072 CEST	50202	445	192.168.2.6	35.130.55.3
Jun 7, 2024 19:18:51.847805977 CEST	445	50202	35.130.55.3	192.168.2.6
Jun 7, 2024 19:18:51.885528088 CEST	50204	445	192.168.2.6	122.155.26.2
Jun 7, 2024 19:18:51.890532970 CEST	445	50204	122.155.26.2	192.168.2.6
Jun 7, 2024 19:18:51.890640974 CEST	50204	445	192.168.2.6	122.155.26.2
Jun 7, 2024 19:18:51.890783072 CEST	50204	445	192.168.2.6	122.155.26.2
Jun 7, 2024 19:18:51.895634890 CEST	445	50204	122.155.26.2	192.168.2.6
Jun 7, 2024 19:18:51.908839941 CEST	445	50140	42.37.158.1	192.168.2.6
Jun 7, 2024 19:18:51.908921957 CEST	50140	445	192.168.2.6	42.37.158.1
Jun 7, 2024 19:18:51.908952951 CEST	50140	445	192.168.2.6	42.37.158.1
Jun 7, 2024 19:18:51.908988953 CEST	50140	445	192.168.2.6	42.37.158.1
Jun 7, 2024 19:18:51.913902998 CEST	445	50140	42.37.158.1	192.168.2.6
Jun 7, 2024 19:18:51.913933039 CEST	445	50140	42.37.158.1	192.168.2.6
Jun 7, 2024 19:18:52.191165924 CEST	445	50201	199.164.60.9	192.168.2.6
Jun 7, 2024 19:18:52.191353083 CEST	50201	445	192.168.2.6	199.164.60.9
Jun 7, 2024 19:18:52.191354036 CEST	50201	445	192.168.2.6	199.164.60.9
Jun 7, 2024 19:18:52.191734076 CEST	50201	445	192.168.2.6	199.164.60.9
Jun 7, 2024 19:18:52.196341038 CEST	445	50201	199.164.60.9	192.168.2.6
Jun 7, 2024 19:18:52.196602106 CEST	445	50201	199.164.60.9	192.168.2.6
Jun 7, 2024 19:18:52.331581116 CEST	445	50141	31.163.218.2	192.168.2.6
Jun 7, 2024 19:18:52.331676960 CEST	50141	445	192.168.2.6	31.163.218.2
Jun 7, 2024 19:18:52.331726074 CEST	50141	445	192.168.2.6	31.163.218.2
Jun 7, 2024 19:18:52.331757069 CEST	50141	445	192.168.2.6	31.163.218.2
Jun 7, 2024 19:18:52.336703062 CEST	445	50141	31.163.218.2	192.168.2.6
Jun 7, 2024 19:18:52.336716890 CEST	445	50141	31.163.218.2	192.168.2.6
Jun 7, 2024 19:18:52.384495020 CEST	50208	445	192.168.2.6	31.163.218.3
Jun 7, 2024 19:18:52.389558077 CEST	445	50208	31.163.218.3	192.168.2.6
Jun 7, 2024 19:18:52.389646053 CEST	50208	445	192.168.2.6	31.163.218.3
Jun 7, 2024 19:18:52.389688015 CEST	50208	445	192.168.2.6	31.163.218.3
Jun 7, 2024 19:18:52.389940977 CEST	50209	445	192.168.2.6	31.163.218.3
Jun 7, 2024 19:18:52.394860029 CEST	445	50208	31.163.218.3	192.168.2.6
Jun 7, 2024 19:18:52.394886971 CEST	445	50209	31.163.218.3	192.168.2.6
Jun 7, 2024 19:18:52.394916058 CEST	50208	445	192.168.2.6	31.163.218.3
Jun 7, 2024 19:18:52.394947052 CEST	50209	445	192.168.2.6	31.163.218.3
Jun 7, 2024 19:18:52.394975901 CEST	50209	445	192.168.2.6	31.163.218.3
Jun 7, 2024 19:18:52.399872065 CEST	445	50209	31.163.218.3	192.168.2.6
Jun 7, 2024 19:18:52.681379080 CEST	50214	445	192.168.2.6	143.112.228.1
Jun 7, 2024 19:18:52.686603069 CEST	445	50214	143.112.228.1	192.168.2.6
Jun 7, 2024 19:18:52.686722994 CEST	50214	445	192.168.2.6	143.112.228.1
Jun 7, 2024 19:18:52.686768055 CEST	50214	445	192.168.2.6	143.112.228.1
Jun 7, 2024 19:18:52.691679001 CEST	445	50214	143.112.228.1	192.168.2.6
Jun 7, 2024 19:18:52.920012951 CEST	445	50144	99.28.220.1	192.168.2.6
Jun 7, 2024 19:18:52.920113087 CEST	50144	445	192.168.2.6	99.28.220.1
Jun 7, 2024 19:18:52.920197964 CEST	50144	445	192.168.2.6	99.28.220.1
Jun 7, 2024 19:18:52.920233011 CEST	50144	445	192.168.2.6	99.28.220.1
Jun 7, 2024 19:18:52.925350904 CEST	445	50144	99.28.220.1	192.168.2.6
Jun 7, 2024 19:18:52.925419092 CEST	445	50144	99.28.220.1	192.168.2.6
Jun 7, 2024 19:18:53.066217899 CEST	445	50146	20.161.184.3	192.168.2.6
Jun 7, 2024 19:18:53.066366911 CEST	50146	445	192.168.2.6	20.161.184.3
Jun 7, 2024 19:18:53.066596985 CEST	50146	445	192.168.2.6	20.161.184.3
Jun 7, 2024 19:18:53.066596985 CEST	50146	445	192.168.2.6	20.161.184.3
Jun 7, 2024 19:18:53.071837902 CEST	445	50146	20.161.184.3	192.168.2.6
Jun 7, 2024 19:18:53.071852922 CEST	445	50146	20.161.184.3	192.168.2.6
Jun 7, 2024 19:18:53.837712049 CEST	50227	445	192.168.2.6	128.133.0.1
Jun 7, 2024 19:18:53.837766886 CEST	50226	445	192.168.2.6	217.179.3.3
Jun 7, 2024 19:18:53.842824936 CEST	445	50227	128.133.0.1	192.168.2.6
Jun 7, 2024 19:18:53.842844009 CEST	445	50226	217.179.3.3	192.168.2.6
Jun 7, 2024 19:18:53.842922926 CEST	50227	445	192.168.2.6	128.133.0.1
Jun 7, 2024 19:18:53.843027115 CEST	50227	445	192.168.2.6	128.133.0.1
Jun 7, 2024 19:18:53.843100071 CEST	50226	445	192.168.2.6	217.179.3.3
Jun 7, 2024 19:18:53.843100071 CEST	50226	445	192.168.2.6	217.179.3.3
Jun 7, 2024 19:18:53.847929955 CEST	445	50227	128.133.0.1	192.168.2.6
Jun 7, 2024 19:18:53.848280907 CEST	445	50226	217.179.3.3	192.168.2.6
Jun 7, 2024 19:18:53.858971119 CEST	445	50149	57.121.200.1	192.168.2.6
Jun 7, 2024 19:18:53.859054089 CEST	50149	445	192.168.2.6	57.121.200.1
Jun 7, 2024 19:18:53.859098911 CEST	50149	445	192.168.2.6	57.121.200.1
Jun 7, 2024 19:18:53.859129906 CEST	50149	445	192.168.2.6	57.121.200.1
Jun 7, 2024 19:18:53.864073992 CEST	445	50149	57.121.200.1	192.168.2.6
Jun 7, 2024 19:18:53.864104033 CEST	445	50149	57.121.200.1	192.168.2.6
Jun 7, 2024 19:18:53.900228977 CEST	50228	445	192.168.2.6	71.243.85.2
Jun 7, 2024 19:18:53.905288935 CEST	445	50228	71.243.85.2	192.168.2.6
Jun 7, 2024 19:18:53.905497074 CEST	50228	445	192.168.2.6	71.243.85.2
Jun 7, 2024 19:18:53.905544996 CEST	50228	445	192.168.2.6	71.243.85.2
Jun 7, 2024 19:18:53.910762072 CEST	445	50228	71.243.85.2	192.168.2.6
Jun 7, 2024 19:18:54.039686918 CEST	445	50150	97.92.55.1	192.168.2.6
Jun 7, 2024 19:18:54.039818048 CEST	50150	445	192.168.2.6	97.92.55.1
Jun 7, 2024 19:18:54.039819002 CEST	50150	445	192.168.2.6	97.92.55.1
Jun 7, 2024 19:18:54.039905071 CEST	50150	445	192.168.2.6	97.92.55.1
Jun 7, 2024 19:18:54.044992924 CEST	445	50150	97.92.55.1	192.168.2.6
Jun 7, 2024 19:18:54.045030117 CEST	445	50150	97.92.55.1	192.168.2.6
Jun 7, 2024 19:18:54.103319883 CEST	50231	445	192.168.2.6	97.92.55.2
Jun 7, 2024 19:18:54.108304977 CEST	445	50231	97.92.55.2	192.168.2.6
Jun 7, 2024 19:18:54.108416080 CEST	50231	445	192.168.2.6	97.92.55.2
Jun 7, 2024 19:18:54.108442068 CEST	50231	445	192.168.2.6	97.92.55.2
Jun 7, 2024 19:18:54.108899117 CEST	50232	445	192.168.2.6	97.92.55.2
Jun 7, 2024 19:18:54.113666058 CEST	445	50231	97.92.55.2	192.168.2.6
Jun 7, 2024 19:18:54.113739967 CEST	50231	445	192.168.2.6	97.92.55.2
Jun 7, 2024 19:18:54.113744020 CEST	445	50232	97.92.55.2	192.168.2.6
Jun 7, 2024 19:18:54.113810062 CEST	50232	445	192.168.2.6	97.92.55.2
Jun 7, 2024 19:18:54.113843918 CEST	50232	445	192.168.2.6	97.92.55.2
Jun 7, 2024 19:18:54.118786097 CEST	445	50232	97.92.55.2	192.168.2.6
Jun 7, 2024 19:18:54.354211092 CEST	445	50151	149.97.149.2	192.168.2.6
Jun 7, 2024 19:18:54.354422092 CEST	50151	445	192.168.2.6	149.97.149.2
Jun 7, 2024 19:18:54.354476929 CEST	50151	445	192.168.2.6	149.97.149.2
Jun 7, 2024 19:18:54.354515076 CEST	50151	445	192.168.2.6	149.97.149.2
Jun 7, 2024 19:18:54.359436989 CEST	445	50151	149.97.149.2	192.168.2.6
Jun 7, 2024 19:18:54.359467983 CEST	445	50151	149.97.149.2	192.168.2.6
Jun 7, 2024 19:18:54.415828943 CEST	50239	445	192.168.2.6	149.97.149.3
Jun 7, 2024 19:18:54.421025038 CEST	445	50239	149.97.149.3	192.168.2.6
Jun 7, 2024 19:18:54.421120882 CEST	50239	445	192.168.2.6	149.97.149.3
Jun 7, 2024 19:18:54.421149015 CEST	50239	445	192.168.2.6	149.97.149.3
Jun 7, 2024 19:18:54.421577930 CEST	50240	445	192.168.2.6	149.97.149.3
Jun 7, 2024 19:18:54.426398039 CEST	445	50239	149.97.149.3	192.168.2.6
Jun 7, 2024 19:18:54.426467896 CEST	50239	445	192.168.2.6	149.97.149.3
Jun 7, 2024 19:18:54.426517963 CEST	445	50240	149.97.149.3	192.168.2.6
Jun 7, 2024 19:18:54.426598072 CEST	50240	445	192.168.2.6	149.97.149.3
Jun 7, 2024 19:18:54.426636934 CEST	50240	445	192.168.2.6	149.97.149.3
Jun 7, 2024 19:18:54.431576967 CEST	445	50240	149.97.149.3	192.168.2.6
Jun 7, 2024 19:18:54.737848043 CEST	445	50154	84.53.215.1	192.168.2.6
Jun 7, 2024 19:18:54.737963915 CEST	50154	445	192.168.2.6	84.53.215.1
Jun 7, 2024 19:18:54.738039970 CEST	50154	445	192.168.2.6	84.53.215.1
Jun 7, 2024 19:18:54.738136053 CEST	50154	445	192.168.2.6	84.53.215.1
Jun 7, 2024 19:18:54.744932890 CEST	445	50154	84.53.215.1	192.168.2.6
Jun 7, 2024 19:18:54.744946957 CEST	445	50154	84.53.215.1	192.168.2.6
Jun 7, 2024 19:18:54.865818024 CEST	445	50156	123.63.163.3	192.168.2.6
Jun 7, 2024 19:18:54.865930080 CEST	50156	445	192.168.2.6	123.63.163.3
Jun 7, 2024 19:18:54.865971088 CEST	50156	445	192.168.2.6	123.63.163.3
Jun 7, 2024 19:18:54.866075039 CEST	50156	445	192.168.2.6	123.63.163.3
Jun 7, 2024 19:18:54.871553898 CEST	445	50156	123.63.163.3	192.168.2.6
Jun 7, 2024 19:18:54.871676922 CEST	445	50156	123.63.163.3	192.168.2.6
Jun 7, 2024 19:18:54.915934086 CEST	50248	445	192.168.2.6	42.37.158.1
Jun 7, 2024 19:18:54.921128988 CEST	445	50248	42.37.158.1	192.168.2.6
Jun 7, 2024 19:18:54.921224117 CEST	50248	445	192.168.2.6	42.37.158.1
Jun 7, 2024 19:18:54.921251059 CEST	50248	445	192.168.2.6	42.37.158.1
Jun 7, 2024 19:18:54.926183939 CEST	445	50248	42.37.158.1	192.168.2.6
Jun 7, 2024 19:18:54.974905014 CEST	445	50158	205.139.6.2	192.168.2.6
Jun 7, 2024 19:18:54.975003958 CEST	50158	445	192.168.2.6	205.139.6.2
Jun 7, 2024 19:18:54.975193024 CEST	50158	445	192.168.2.6	205.139.6.2
Jun 7, 2024 19:18:54.975249052 CEST	50158	445	192.168.2.6	205.139.6.2
Jun 7, 2024 19:18:54.980300903 CEST	445	50158	205.139.6.2	192.168.2.6
Jun 7, 2024 19:18:54.980333090 CEST	445	50158	205.139.6.2	192.168.2.6
Jun 7, 2024 19:18:55.197007895 CEST	50252	445	192.168.2.6	199.164.60.9
Jun 7, 2024 19:18:55.202198982 CEST	445	50252	199.164.60.9	192.168.2.6
Jun 7, 2024 19:18:55.202334881 CEST	50252	445	192.168.2.6	199.164.60.9
Jun 7, 2024 19:18:55.202334881 CEST	50252	445	192.168.2.6	199.164.60.9
Jun 7, 2024 19:18:55.207370043 CEST	445	50252	199.164.60.9	192.168.2.6
Jun 7, 2024 19:18:55.566293955 CEST	445	50163	15.114.112.1	192.168.2.6
Jun 7, 2024 19:18:55.566420078 CEST	50163	445	192.168.2.6	15.114.112.1
Jun 7, 2024 19:18:55.566472054 CEST	50163	445	192.168.2.6	15.114.112.1
Jun 7, 2024 19:18:55.566521883 CEST	50163	445	192.168.2.6	15.114.112.1
Jun 7, 2024 19:18:55.571580887 CEST	445	50163	15.114.112.1	192.168.2.6
Jun 7, 2024 19:18:55.571636915 CEST	445	50163	15.114.112.1	192.168.2.6
Jun 7, 2024 19:18:55.662929058 CEST	445	50164	65.79.232.1	192.168.2.6
Jun 7, 2024 19:18:55.663182974 CEST	50164	445	192.168.2.6	65.79.232.1
Jun 7, 2024 19:18:55.663182974 CEST	50164	445	192.168.2.6	65.79.232.1
Jun 7, 2024 19:18:55.663305044 CEST	50164	445	192.168.2.6	65.79.232.1
Jun 7, 2024 19:18:55.668397903 CEST	445	50164	65.79.232.1	192.168.2.6
Jun 7, 2024 19:18:55.668447018 CEST	445	50164	65.79.232.1	192.168.2.6
Jun 7, 2024 19:18:55.728341103 CEST	50262	445	192.168.2.6	65.79.232.2
Jun 7, 2024 19:18:55.733459949 CEST	445	50262	65.79.232.2	192.168.2.6
Jun 7, 2024 19:18:55.733551025 CEST	50262	445	192.168.2.6	65.79.232.2
Jun 7, 2024 19:18:55.733584881 CEST	50262	445	192.168.2.6	65.79.232.2
Jun 7, 2024 19:18:55.734142065 CEST	50263	445	192.168.2.6	65.79.232.2
Jun 7, 2024 19:18:55.739061117 CEST	445	50262	65.79.232.2	192.168.2.6
Jun 7, 2024 19:18:55.739077091 CEST	445	50263	65.79.232.2	192.168.2.6
Jun 7, 2024 19:18:55.739099026 CEST	445	50252	199.164.60.9	192.168.2.6
Jun 7, 2024 19:18:55.739128113 CEST	50262	445	192.168.2.6	65.79.232.2
Jun 7, 2024 19:18:55.739260912 CEST	50252	445	192.168.2.6	199.164.60.9
Jun 7, 2024 19:18:55.739260912 CEST	50252	445	192.168.2.6	199.164.60.9
Jun 7, 2024 19:18:55.739284992 CEST	50252	445	192.168.2.6	199.164.60.9
Jun 7, 2024 19:18:55.739394903 CEST	50263	445	192.168.2.6	65.79.232.2
Jun 7, 2024 19:18:55.739394903 CEST	50263	445	192.168.2.6	65.79.232.2
Jun 7, 2024 19:18:55.744271994 CEST	445	50252	199.164.60.9	192.168.2.6
Jun 7, 2024 19:18:55.744287014 CEST	445	50252	199.164.60.9	192.168.2.6
Jun 7, 2024 19:18:55.744359016 CEST	445	50263	65.79.232.2	192.168.2.6
Jun 7, 2024 19:18:55.790746927 CEST	50265	445	192.168.2.6	199.164.60.10
Jun 7, 2024 19:18:55.795993090 CEST	445	50265	199.164.60.10	192.168.2.6
Jun 7, 2024 19:18:55.796188116 CEST	50265	445	192.168.2.6	199.164.60.10
Jun 7, 2024 19:18:55.796188116 CEST	50265	445	192.168.2.6	199.164.60.10
Jun 7, 2024 19:18:55.796458960 CEST	50266	445	192.168.2.6	199.164.60.10
Jun 7, 2024 19:18:55.801470995 CEST	445	50266	199.164.60.10	192.168.2.6
Jun 7, 2024 19:18:55.801542044 CEST	445	50265	199.164.60.10	192.168.2.6
Jun 7, 2024 19:18:55.801688910 CEST	50266	445	192.168.2.6	199.164.60.10
Jun 7, 2024 19:18:55.801690102 CEST	50266	445	192.168.2.6	199.164.60.10
Jun 7, 2024 19:18:55.801690102 CEST	50265	445	192.168.2.6	199.164.60.10
Jun 7, 2024 19:18:55.807039976 CEST	445	50266	199.164.60.10	192.168.2.6
Jun 7, 2024 19:18:55.931304932 CEST	50270	445	192.168.2.6	99.28.220.1
Jun 7, 2024 19:18:55.936605930 CEST	445	50270	99.28.220.1	192.168.2.6
Jun 7, 2024 19:18:55.936784029 CEST	50270	445	192.168.2.6	99.28.220.1
Jun 7, 2024 19:18:55.936814070 CEST	50270	445	192.168.2.6	99.28.220.1
Jun 7, 2024 19:18:55.941824913 CEST	445	50270	99.28.220.1	192.168.2.6
Jun 7, 2024 19:18:56.072176933 CEST	50275	445	192.168.2.6	20.161.184.3
Jun 7, 2024 19:18:56.077795029 CEST	445	50275	20.161.184.3	192.168.2.6
Jun 7, 2024 19:18:56.077963114 CEST	50275	445	192.168.2.6	20.161.184.3
Jun 7, 2024 19:18:56.078049898 CEST	50275	445	192.168.2.6	20.161.184.3
Jun 7, 2024 19:18:56.083180904 CEST	445	50275	20.161.184.3	192.168.2.6
Jun 7, 2024 19:18:56.314059973 CEST	445	50167	196.22.85.3	192.168.2.6
Jun 7, 2024 19:18:56.314172029 CEST	50167	445	192.168.2.6	196.22.85.3
Jun 7, 2024 19:18:56.314260960 CEST	50167	445	192.168.2.6	196.22.85.3
Jun 7, 2024 19:18:56.314313889 CEST	50167	445	192.168.2.6	196.22.85.3
Jun 7, 2024 19:18:56.319231033 CEST	445	50167	196.22.85.3	192.168.2.6
Jun 7, 2024 19:18:56.319262028 CEST	445	50167	196.22.85.3	192.168.2.6
Jun 7, 2024 19:18:56.334160089 CEST	445	50266	199.164.60.10	192.168.2.6
Jun 7, 2024 19:18:56.334305048 CEST	50266	445	192.168.2.6	199.164.60.10
Jun 7, 2024 19:18:56.336512089 CEST	50266	445	192.168.2.6	199.164.60.10
Jun 7, 2024 19:18:56.336512089 CEST	50266	445	192.168.2.6	199.164.60.10
Jun 7, 2024 19:18:56.341466904 CEST	445	50266	199.164.60.10	192.168.2.6
Jun 7, 2024 19:18:56.341480017 CEST	445	50266	199.164.60.10	192.168.2.6
Jun 7, 2024 19:18:56.342103958 CEST	445	50170	141.113.21.1	192.168.2.6
Jun 7, 2024 19:18:56.342168093 CEST	50170	445	192.168.2.6	141.113.21.1
Jun 7, 2024 19:18:56.342230082 CEST	50170	445	192.168.2.6	141.113.21.1
Jun 7, 2024 19:18:56.342240095 CEST	50170	445	192.168.2.6	141.113.21.1
Jun 7, 2024 19:18:56.347121000 CEST	445	50170	141.113.21.1	192.168.2.6
Jun 7, 2024 19:18:56.347134113 CEST	445	50170	141.113.21.1	192.168.2.6
Jun 7, 2024 19:18:56.356688023 CEST	445	50171	59.20.234.2	192.168.2.6
Jun 7, 2024 19:18:56.356803894 CEST	50171	445	192.168.2.6	59.20.234.2
Jun 7, 2024 19:18:56.357038975 CEST	50171	445	192.168.2.6	59.20.234.2
Jun 7, 2024 19:18:56.357038975 CEST	50171	445	192.168.2.6	59.20.234.2
Jun 7, 2024 19:18:56.362030983 CEST	445	50171	59.20.234.2	192.168.2.6
Jun 7, 2024 19:18:56.362059116 CEST	445	50171	59.20.234.2	192.168.2.6
Jun 7, 2024 19:18:56.370649099 CEST	50281	445	192.168.2.6	196.22.85.4
Jun 7, 2024 19:18:56.375647068 CEST	445	50281	196.22.85.4	192.168.2.6
Jun 7, 2024 19:18:56.375724077 CEST	50281	445	192.168.2.6	196.22.85.4
Jun 7, 2024 19:18:56.375854015 CEST	50281	445	192.168.2.6	196.22.85.4
Jun 7, 2024 19:18:56.376266003 CEST	50283	445	192.168.2.6	196.22.85.4
Jun 7, 2024 19:18:56.381187916 CEST	445	50281	196.22.85.4	192.168.2.6
Jun 7, 2024 19:18:56.381259918 CEST	50281	445	192.168.2.6	196.22.85.4
Jun 7, 2024 19:18:56.381278038 CEST	445	50283	196.22.85.4	192.168.2.6
Jun 7, 2024 19:18:56.381344080 CEST	50283	445	192.168.2.6	196.22.85.4
Jun 7, 2024 19:18:56.384743929 CEST	50283	445	192.168.2.6	196.22.85.4
Jun 7, 2024 19:18:56.389703035 CEST	445	50283	196.22.85.4	192.168.2.6
Jun 7, 2024 19:18:56.416095018 CEST	50284	445	192.168.2.6	59.20.234.3
Jun 7, 2024 19:18:56.421236992 CEST	445	50284	59.20.234.3	192.168.2.6
Jun 7, 2024 19:18:56.421319008 CEST	50284	445	192.168.2.6	59.20.234.3
Jun 7, 2024 19:18:56.421412945 CEST	50284	445	192.168.2.6	59.20.234.3
Jun 7, 2024 19:18:56.422892094 CEST	50285	445	192.168.2.6	59.20.234.3
Jun 7, 2024 19:18:56.426717043 CEST	445	50284	59.20.234.3	192.168.2.6
Jun 7, 2024 19:18:56.426774979 CEST	50284	445	192.168.2.6	59.20.234.3
Jun 7, 2024 19:18:56.427850962 CEST	445	50285	59.20.234.3	192.168.2.6
Jun 7, 2024 19:18:56.427920103 CEST	50285	445	192.168.2.6	59.20.234.3
Jun 7, 2024 19:18:56.427954912 CEST	50285	445	192.168.2.6	59.20.234.3
Jun 7, 2024 19:18:56.433023930 CEST	445	50285	59.20.234.3	192.168.2.6
Jun 7, 2024 19:18:56.604218006 CEST	445	50172	213.153.200.2	192.168.2.6
Jun 7, 2024 19:18:56.604314089 CEST	50172	445	192.168.2.6	213.153.200.2
Jun 7, 2024 19:18:56.605392933 CEST	50172	445	192.168.2.6	213.153.200.2
Jun 7, 2024 19:18:56.605442047 CEST	50172	445	192.168.2.6	213.153.200.2
Jun 7, 2024 19:18:56.610399961 CEST	445	50172	213.153.200.2	192.168.2.6
Jun 7, 2024 19:18:56.610455036 CEST	445	50172	213.153.200.2	192.168.2.6
Jun 7, 2024 19:18:56.657268047 CEST	445	50173	109.235.245.2	192.168.2.6
Jun 7, 2024 19:18:56.657524109 CEST	50173	445	192.168.2.6	109.235.245.2
Jun 7, 2024 19:18:56.662245035 CEST	50173	445	192.168.2.6	109.235.245.2
Jun 7, 2024 19:18:56.662245035 CEST	50173	445	192.168.2.6	109.235.245.2
Jun 7, 2024 19:18:56.667295933 CEST	445	50173	109.235.245.2	192.168.2.6
Jun 7, 2024 19:18:56.667326927 CEST	445	50173	109.235.245.2	192.168.2.6
Jun 7, 2024 19:18:56.734982014 CEST	50294	445	192.168.2.6	213.153.200.3
Jun 7, 2024 19:18:56.735696077 CEST	50295	445	192.168.2.6	109.235.245.3
Jun 7, 2024 19:18:56.740052938 CEST	445	50294	213.153.200.3	192.168.2.6
Jun 7, 2024 19:18:56.740134001 CEST	50294	445	192.168.2.6	213.153.200.3
Jun 7, 2024 19:18:56.740648031 CEST	445	50295	109.235.245.3	192.168.2.6
Jun 7, 2024 19:18:56.740712881 CEST	50295	445	192.168.2.6	109.235.245.3
Jun 7, 2024 19:18:56.743999958 CEST	50294	445	192.168.2.6	213.153.200.3
Jun 7, 2024 19:18:56.746681929 CEST	50295	445	192.168.2.6	109.235.245.3
Jun 7, 2024 19:18:56.747729063 CEST	50297	445	192.168.2.6	213.153.200.3
Jun 7, 2024 19:18:56.747893095 CEST	50298	445	192.168.2.6	109.235.245.3
Jun 7, 2024 19:18:56.749011993 CEST	445	50294	213.153.200.3	192.168.2.6
Jun 7, 2024 19:18:56.749070883 CEST	50294	445	192.168.2.6	213.153.200.3
Jun 7, 2024 19:18:56.751781940 CEST	445	50295	109.235.245.3	192.168.2.6
Jun 7, 2024 19:18:56.751837015 CEST	50295	445	192.168.2.6	109.235.245.3
Jun 7, 2024 19:18:56.752640009 CEST	445	50297	213.153.200.3	192.168.2.6
Jun 7, 2024 19:18:56.752708912 CEST	50297	445	192.168.2.6	213.153.200.3
Jun 7, 2024 19:18:56.752849102 CEST	445	50298	109.235.245.3	192.168.2.6
Jun 7, 2024 19:18:56.752902031 CEST	50298	445	192.168.2.6	109.235.245.3
Jun 7, 2024 19:18:56.754297018 CEST	50297	445	192.168.2.6	213.153.200.3
Jun 7, 2024 19:18:56.754359961 CEST	50298	445	192.168.2.6	109.235.245.3
Jun 7, 2024 19:18:56.759270906 CEST	445	50297	213.153.200.3	192.168.2.6
Jun 7, 2024 19:18:56.759299994 CEST	445	50298	109.235.245.3	192.168.2.6
Jun 7, 2024 19:18:56.862366915 CEST	445	50176	129.100.47.3	192.168.2.6
Jun 7, 2024 19:18:56.862474918 CEST	50176	445	192.168.2.6	129.100.47.3
Jun 7, 2024 19:18:56.862615108 CEST	50176	445	192.168.2.6	129.100.47.3
Jun 7, 2024 19:18:56.862664938 CEST	50176	445	192.168.2.6	129.100.47.3
Jun 7, 2024 19:18:56.867788076 CEST	445	50176	129.100.47.3	192.168.2.6
Jun 7, 2024 19:18:56.867819071 CEST	445	50176	129.100.47.3	192.168.2.6
Jun 7, 2024 19:18:56.868858099 CEST	50300	445	192.168.2.6	57.121.200.1
Jun 7, 2024 19:18:56.873967886 CEST	445	50300	57.121.200.1	192.168.2.6
Jun 7, 2024 19:18:56.874064922 CEST	50300	445	192.168.2.6	57.121.200.1
Jun 7, 2024 19:18:56.874087095 CEST	50300	445	192.168.2.6	57.121.200.1
Jun 7, 2024 19:18:56.879225969 CEST	445	50300	57.121.200.1	192.168.2.6
Jun 7, 2024 19:18:56.950901031 CEST	445	50178	156.45.127.2	192.168.2.6
Jun 7, 2024 19:18:56.950978994 CEST	50178	445	192.168.2.6	156.45.127.2
Jun 7, 2024 19:18:56.951139927 CEST	50178	445	192.168.2.6	156.45.127.2
Jun 7, 2024 19:18:56.951208115 CEST	50178	445	192.168.2.6	156.45.127.2
Jun 7, 2024 19:18:56.956063986 CEST	445	50178	156.45.127.2	192.168.2.6
Jun 7, 2024 19:18:56.956116915 CEST	445	50178	156.45.127.2	192.168.2.6
Jun 7, 2024 19:18:57.194538116 CEST	445	50180	140.73.58.1	192.168.2.6
Jun 7, 2024 19:18:57.194600105 CEST	50180	445	192.168.2.6	140.73.58.1
Jun 7, 2024 19:18:57.194629908 CEST	50180	445	192.168.2.6	140.73.58.1
Jun 7, 2024 19:18:57.194664955 CEST	50180	445	192.168.2.6	140.73.58.1
Jun 7, 2024 19:18:57.199600935 CEST	445	50180	140.73.58.1	192.168.2.6
Jun 7, 2024 19:18:57.199640989 CEST	445	50180	140.73.58.1	192.168.2.6
Jun 7, 2024 19:18:57.259438992 CEST	50312	445	192.168.2.6	140.73.58.2
Jun 7, 2024 19:18:57.265697002 CEST	445	50312	140.73.58.2	192.168.2.6
Jun 7, 2024 19:18:57.265820980 CEST	50312	445	192.168.2.6	140.73.58.2
Jun 7, 2024 19:18:57.265899897 CEST	50312	445	192.168.2.6	140.73.58.2
Jun 7, 2024 19:18:57.266217947 CEST	50313	445	192.168.2.6	140.73.58.2
Jun 7, 2024 19:18:57.272001982 CEST	445	50313	140.73.58.2	192.168.2.6
Jun 7, 2024 19:18:57.272084951 CEST	50313	445	192.168.2.6	140.73.58.2
Jun 7, 2024 19:18:57.272120953 CEST	50313	445	192.168.2.6	140.73.58.2
Jun 7, 2024 19:18:57.272320986 CEST	445	50312	140.73.58.2	192.168.2.6
Jun 7, 2024 19:18:57.272377014 CEST	50312	445	192.168.2.6	140.73.58.2
Jun 7, 2024 19:18:57.277683973 CEST	445	50313	140.73.58.2	192.168.2.6
Jun 7, 2024 19:18:57.388655901 CEST	445	50298	109.235.245.3	192.168.2.6
Jun 7, 2024 19:18:57.388761997 CEST	50298	445	192.168.2.6	109.235.245.3
Jun 7, 2024 19:18:57.388801098 CEST	50298	445	192.168.2.6	109.235.245.3
Jun 7, 2024 19:18:57.388813019 CEST	50298	445	192.168.2.6	109.235.245.3
Jun 7, 2024 19:18:57.393930912 CEST	445	50298	109.235.245.3	192.168.2.6
Jun 7, 2024 19:18:57.393961906 CEST	445	50298	109.235.245.3	192.168.2.6
Jun 7, 2024 19:18:57.743865013 CEST	50332	445	192.168.2.6	84.53.215.1
Jun 7, 2024 19:18:57.749303102 CEST	445	50332	84.53.215.1	192.168.2.6
Jun 7, 2024 19:18:57.749402046 CEST	50332	445	192.168.2.6	84.53.215.1
Jun 7, 2024 19:18:57.749423027 CEST	50332	445	192.168.2.6	84.53.215.1
Jun 7, 2024 19:18:57.754370928 CEST	445	50332	84.53.215.1	192.168.2.6
Jun 7, 2024 19:18:57.868869066 CEST	50337	445	192.168.2.6	123.63.163.3
Jun 7, 2024 19:18:57.873965979 CEST	445	50337	123.63.163.3	192.168.2.6
Jun 7, 2024 19:18:57.874106884 CEST	50337	445	192.168.2.6	123.63.163.3
Jun 7, 2024 19:18:57.874145985 CEST	50337	445	192.168.2.6	123.63.163.3
Jun 7, 2024 19:18:57.879049063 CEST	445	50337	123.63.163.3	192.168.2.6
Jun 7, 2024 19:18:57.978312969 CEST	50340	445	192.168.2.6	205.139.6.2
Jun 7, 2024 19:18:57.984667063 CEST	445	50340	205.139.6.2	192.168.2.6
Jun 7, 2024 19:18:57.984813929 CEST	50340	445	192.168.2.6	205.139.6.2
Jun 7, 2024 19:18:57.984833002 CEST	50340	445	192.168.2.6	205.139.6.2
Jun 7, 2024 19:18:57.990909100 CEST	445	50340	205.139.6.2	192.168.2.6
Jun 7, 2024 19:18:58.316958904 CEST	445	50183	38.185.73.3	192.168.2.6
Jun 7, 2024 19:18:58.317121983 CEST	50183	445	192.168.2.6	38.185.73.3
Jun 7, 2024 19:18:58.317121983 CEST	50183	445	192.168.2.6	38.185.73.3
Jun 7, 2024 19:18:58.317121983 CEST	50183	445	192.168.2.6	38.185.73.3
Jun 7, 2024 19:18:58.322230101 CEST	445	50183	38.185.73.3	192.168.2.6
Jun 7, 2024 19:18:58.322261095 CEST	445	50183	38.185.73.3	192.168.2.6
Jun 7, 2024 19:18:58.370101929 CEST	50359	445	192.168.2.6	38.185.73.4
Jun 7, 2024 19:18:58.375132084 CEST	445	50359	38.185.73.4	192.168.2.6
Jun 7, 2024 19:18:58.375197887 CEST	50359	445	192.168.2.6	38.185.73.4
Jun 7, 2024 19:18:58.375272989 CEST	50359	445	192.168.2.6	38.185.73.4
Jun 7, 2024 19:18:58.375555038 CEST	50360	445	192.168.2.6	38.185.73.4
Jun 7, 2024 19:18:58.380590916 CEST	445	50359	38.185.73.4	192.168.2.6
Jun 7, 2024 19:18:58.380621910 CEST	445	50360	38.185.73.4	192.168.2.6
Jun 7, 2024 19:18:58.380652905 CEST	50359	445	192.168.2.6	38.185.73.4
Jun 7, 2024 19:18:58.380686998 CEST	50360	445	192.168.2.6	38.185.73.4
Jun 7, 2024 19:18:58.380723953 CEST	50360	445	192.168.2.6	38.185.73.4
Jun 7, 2024 19:18:58.385979891 CEST	445	50360	38.185.73.4	192.168.2.6
Jun 7, 2024 19:18:58.572179079 CEST	50371	445	192.168.2.6	15.114.112.1
Jun 7, 2024 19:18:58.577384949 CEST	445	50371	15.114.112.1	192.168.2.6
Jun 7, 2024 19:18:58.577527046 CEST	50371	445	192.168.2.6	15.114.112.1
Jun 7, 2024 19:18:58.577543974 CEST	50371	445	192.168.2.6	15.114.112.1
Jun 7, 2024 19:18:58.582530022 CEST	445	50371	15.114.112.1	192.168.2.6
Jun 7, 2024 19:18:58.621452093 CEST	445	50185	85.248.203.1	192.168.2.6
Jun 7, 2024 19:18:58.621578932 CEST	50185	445	192.168.2.6	85.248.203.1
Jun 7, 2024 19:18:58.621745110 CEST	50185	445	192.168.2.6	85.248.203.1
Jun 7, 2024 19:18:58.622697115 CEST	50185	445	192.168.2.6	85.248.203.1
Jun 7, 2024 19:18:58.626852036 CEST	445	50185	85.248.203.1	192.168.2.6
Jun 7, 2024 19:18:58.628001928 CEST	445	50185	85.248.203.1	192.168.2.6
Jun 7, 2024 19:18:58.682596922 CEST	50380	445	192.168.2.6	85.248.203.2
Jun 7, 2024 19:18:58.687757015 CEST	445	50380	85.248.203.2	192.168.2.6
Jun 7, 2024 19:18:58.687881947 CEST	50380	445	192.168.2.6	85.248.203.2
Jun 7, 2024 19:18:58.687964916 CEST	50380	445	192.168.2.6	85.248.203.2
Jun 7, 2024 19:18:58.688611031 CEST	50381	445	192.168.2.6	85.248.203.2
Jun 7, 2024 19:18:58.693414927 CEST	445	50380	85.248.203.2	192.168.2.6
Jun 7, 2024 19:18:58.693593025 CEST	50380	445	192.168.2.6	85.248.203.2
Jun 7, 2024 19:18:58.693615913 CEST	445	50381	85.248.203.2	192.168.2.6
Jun 7, 2024 19:18:58.693722963 CEST	50381	445	192.168.2.6	85.248.203.2
Jun 7, 2024 19:18:58.693813086 CEST	50381	445	192.168.2.6	85.248.203.2
Jun 7, 2024 19:18:58.698700905 CEST	445	50381	85.248.203.2	192.168.2.6
Jun 7, 2024 19:18:58.874943972 CEST	445	50188	219.1.165.3	192.168.2.6
Jun 7, 2024 19:18:58.875017881 CEST	50188	445	192.168.2.6	219.1.165.3
Jun 7, 2024 19:18:58.875076056 CEST	50188	445	192.168.2.6	219.1.165.3
Jun 7, 2024 19:18:58.875114918 CEST	50188	445	192.168.2.6	219.1.165.3
Jun 7, 2024 19:18:58.880012989 CEST	445	50188	219.1.165.3	192.168.2.6
Jun 7, 2024 19:18:58.880033970 CEST	445	50188	219.1.165.3	192.168.2.6
Jun 7, 2024 19:18:58.992257118 CEST	445	50191	189.250.95.2	192.168.2.6
Jun 7, 2024 19:18:58.992489100 CEST	50191	445	192.168.2.6	189.250.95.2
Jun 7, 2024 19:18:58.992489100 CEST	50191	445	192.168.2.6	189.250.95.2
Jun 7, 2024 19:18:58.992522955 CEST	50191	445	192.168.2.6	189.250.95.2
Jun 7, 2024 19:18:58.997615099 CEST	445	50191	189.250.95.2	192.168.2.6
Jun 7, 2024 19:18:58.997685909 CEST	445	50191	189.250.95.2	192.168.2.6
Jun 7, 2024 19:18:59.337750912 CEST	50437	445	192.168.2.6	199.164.60.10
Jun 7, 2024 19:18:59.342973948 CEST	445	50437	199.164.60.10	192.168.2.6
Jun 7, 2024 19:18:59.343137026 CEST	50437	445	192.168.2.6	199.164.60.10
Jun 7, 2024 19:18:59.343301058 CEST	50437	445	192.168.2.6	199.164.60.10
Jun 7, 2024 19:18:59.348299026 CEST	445	50437	199.164.60.10	192.168.2.6
Jun 7, 2024 19:18:59.353619099 CEST	50439	445	192.168.2.6	141.113.21.1
Jun 7, 2024 19:18:59.358848095 CEST	445	50439	141.113.21.1	192.168.2.6
Jun 7, 2024 19:18:59.358983994 CEST	50439	445	192.168.2.6	141.113.21.1
Jun 7, 2024 19:18:59.359059095 CEST	50439	445	192.168.2.6	141.113.21.1
Jun 7, 2024 19:18:59.363926888 CEST	445	50439	141.113.21.1	192.168.2.6
Jun 7, 2024 19:18:59.872359037 CEST	445	50437	199.164.60.10	192.168.2.6
Jun 7, 2024 19:18:59.872426987 CEST	50437	445	192.168.2.6	199.164.60.10
Jun 7, 2024 19:18:59.945796967 CEST	445	50197	130.209.93.1	192.168.2.6
Jun 7, 2024 19:18:59.945862055 CEST	50197	445	192.168.2.6	130.209.93.1
Jun 7, 2024 19:19:00.332123995 CEST	445	50202	35.130.55.3	192.168.2.6
Jun 7, 2024 19:19:00.332308054 CEST	50202	445	192.168.2.6	35.130.55.3
Jun 7, 2024 19:19:00.385869026 CEST	445	50204	122.155.26.2	192.168.2.6
Jun 7, 2024 19:19:00.385931969 CEST	50204	445	192.168.2.6	122.155.26.2
Jun 7, 2024 19:19:00.703598976 CEST	50240	445	192.168.2.6	149.97.149.3
Jun 7, 2024 19:19:00.703639984 CEST	50232	445	192.168.2.6	97.92.55.2
Jun 7, 2024 19:19:00.703691959 CEST	50197	445	192.168.2.6	130.209.93.1
Jun 7, 2024 19:19:00.703748941 CEST	50270	445	192.168.2.6	99.28.220.1
Jun 7, 2024 19:19:00.703762054 CEST	50300	445	192.168.2.6	57.121.200.1
Jun 7, 2024 19:19:00.703814983 CEST	50275	445	192.168.2.6	20.161.184.3
Jun 7, 2024 19:19:00.703876019 CEST	50371	445	192.168.2.6	15.114.112.1
Jun 7, 2024 19:19:00.703897953 CEST	50263	445	192.168.2.6	65.79.232.2
Jun 7, 2024 19:19:00.703903913 CEST	50228	445	192.168.2.6	71.243.85.2
Jun 7, 2024 19:19:00.704040051 CEST	50204	445	192.168.2.6	122.155.26.2
Jun 7, 2024 19:19:00.704056025 CEST	50283	445	192.168.2.6	196.22.85.4
Jun 7, 2024 19:19:00.704061985 CEST	50313	445	192.168.2.6	140.73.58.2
Jun 7, 2024 19:19:00.704056025 CEST	50285	445	192.168.2.6	59.20.234.3
Jun 7, 2024 19:19:00.704056025 CEST	50214	445	192.168.2.6	143.112.228.1
Jun 7, 2024 19:19:00.704056025 CEST	50202	445	192.168.2.6	35.130.55.3
Jun 7, 2024 19:19:00.704077005 CEST	50209	445	192.168.2.6	31.163.218.3
Jun 7, 2024 19:19:00.704112053 CEST	50227	445	192.168.2.6	128.133.0.1
Jun 7, 2024 19:19:00.704134941 CEST	50248	445	192.168.2.6	42.37.158.1
Jun 7, 2024 19:19:00.704148054 CEST	50226	445	192.168.2.6	217.179.3.3
Jun 7, 2024 19:19:00.704154968 CEST	50332	445	192.168.2.6	84.53.215.1
Jun 7, 2024 19:19:00.704247952 CEST	50340	445	192.168.2.6	205.139.6.2
Jun 7, 2024 19:19:00.704251051 CEST	50297	445	192.168.2.6	213.153.200.3
Jun 7, 2024 19:19:00.704318047 CEST	50337	445	192.168.2.6	123.63.163.3
Jun 7, 2024 19:19:00.704412937 CEST	50439	445	192.168.2.6	141.113.21.1
Jun 7, 2024 19:19:00.704516888 CEST	50360	445	192.168.2.6	38.185.73.4
Jun 7, 2024 19:19:00.704713106 CEST	50381	445	192.168.2.6	85.248.203.2
Jun 7, 2024 19:19:00.705156088 CEST	50437	445	192.168.2.6	199.164.60.10
Jun 7, 2024 19:19:22.737457037 CEST	50475	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:19:22.737510920 CEST	443	50475	40.115.3.253	192.168.2.6
Jun 7, 2024 19:19:22.737605095 CEST	50475	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:19:22.738523006 CEST	50475	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:19:22.738539934 CEST	443	50475	40.115.3.253	192.168.2.6
Jun 7, 2024 19:19:23.847815037 CEST	443	50475	40.115.3.253	192.168.2.6
Jun 7, 2024 19:19:23.847907066 CEST	50475	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:19:23.850363970 CEST	50475	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:19:23.850375891 CEST	443	50475	40.115.3.253	192.168.2.6
Jun 7, 2024 19:19:23.850707054 CEST	443	50475	40.115.3.253	192.168.2.6
Jun 7, 2024 19:19:23.852921963 CEST	50475	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:19:23.853806019 CEST	50475	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:19:23.853811979 CEST	443	50475	40.115.3.253	192.168.2.6
Jun 7, 2024 19:19:23.854037046 CEST	50475	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:19:23.896507025 CEST	443	50475	40.115.3.253	192.168.2.6
Jun 7, 2024 19:19:24.098157883 CEST	443	50475	40.115.3.253	192.168.2.6
Jun 7, 2024 19:19:24.098870993 CEST	50475	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:19:24.098912954 CEST	443	50475	40.115.3.253	192.168.2.6
Jun 7, 2024 19:19:24.098932028 CEST	50475	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:19:24.098984957 CEST	50475	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:19:28.416107893 CEST	49703	80	192.168.2.6	199.232.214.172
Jun 7, 2024 19:19:28.479621887 CEST	80	49703	199.232.214.172	192.168.2.6
Jun 7, 2024 19:19:28.479693890 CEST	49703	80	192.168.2.6	199.232.214.172
Jun 7, 2024 19:19:59.502995968 CEST	50476	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:19:59.503097057 CEST	443	50476	40.115.3.253	192.168.2.6
Jun 7, 2024 19:19:59.503303051 CEST	50476	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:19:59.504123926 CEST	50476	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:19:59.504162073 CEST	443	50476	40.115.3.253	192.168.2.6
Jun 7, 2024 19:20:00.601905107 CEST	443	50476	40.115.3.253	192.168.2.6
Jun 7, 2024 19:20:00.601994038 CEST	50476	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:20:00.604840040 CEST	50476	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:20:00.604856014 CEST	443	50476	40.115.3.253	192.168.2.6
Jun 7, 2024 19:20:00.605197906 CEST	443	50476	40.115.3.253	192.168.2.6
Jun 7, 2024 19:20:00.607511044 CEST	50476	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:20:00.607582092 CEST	50476	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:20:00.607589006 CEST	443	50476	40.115.3.253	192.168.2.6
Jun 7, 2024 19:20:00.607953072 CEST	50476	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:20:00.652493000 CEST	443	50476	40.115.3.253	192.168.2.6
Jun 7, 2024 19:20:00.742769003 CEST	50477	80	192.168.2.6	104.16.166.228
Jun 7, 2024 19:20:00.749659061 CEST	80	50477	104.16.166.228	192.168.2.6
Jun 7, 2024 19:20:00.749756098 CEST	50477	80	192.168.2.6	104.16.166.228
Jun 7, 2024 19:20:00.749878883 CEST	50477	80	192.168.2.6	104.16.166.228
Jun 7, 2024 19:20:00.757308006 CEST	80	50477	104.16.166.228	192.168.2.6
Jun 7, 2024 19:20:00.851011992 CEST	443	50476	40.115.3.253	192.168.2.6
Jun 7, 2024 19:20:00.851599932 CEST	50476	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:20:00.851634026 CEST	443	50476	40.115.3.253	192.168.2.6
Jun 7, 2024 19:20:00.851659060 CEST	50476	443	192.168.2.6	40.115.3.253
Jun 7, 2024 19:20:00.851694107 CEST	50476	443	192.168.2.6	40.115.3.253

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 7, 2024 19:17:54.642321110 CEST	54007	53	192.168.2.6	1.1.1.1
Jun 7, 2024 19:17:54.652282953 CEST	53	54007	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 7, 2024 19:17:54.642321110 CEST	192.168.2.6	1.1.1.1	0xcc92	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 7, 2024 19:17:54.652282953 CEST	1.1.1.1	192.168.2.6	0xcc92	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com		104.16.166.228	A (IP address)	IN (0x0001)	false
Jun 7, 2024 19:17:54.652282953 CEST	1.1.1.1	192.168.2.6	0xcc92	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com		104.16.167.228	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ipinfo.io

slscr.update.microsoft.com

www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	104.16.166.228	80	3192	C:\Windows\mssecsvc.exe

Timestamp	Bytes transferred	Direction	Data
Jun 7, 2024 19:17:54.665874958 CEST	100	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com Cache-Control: no-cache
Jun 7, 2024 19:17:55.318490028 CEST	778	IN	HTTP/1.1 200 OK Date: Fri, 07 Jun 2024 17:17:55 GMT Content-Type: text/html Content-Length: 607 Connection: close Server: cloudflare CF-RAY: 89024c642f716b13-DFW Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49712	104.16.166.228	80	2924	C:\Windows\mssecsvc.exe

Timestamp	Bytes transferred	Direction	Data
Jun 7, 2024 19:17:55.463710070 CEST	100	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com Cache-Control: no-cache
Jun 7, 2024 19:17:56.092109919 CEST	778	IN	HTTP/1.1 200 OK Date: Fri, 07 Jun 2024 17:17:56 GMT Content-Type: text/html Content-Length: 607 Connection: close Server: cloudflare CF-RAY: 89024c690e4c2857-DFW Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49729	104.16.166.228	80	1036	C:\Windows\mssecsvc.exe

Timestamp	Bytes transferred	Direction	Data
Jun 7, 2024 19:17:56.918210983 CEST	100	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com Cache-Control: no-cache
Jun 7, 2024 19:17:57.559210062 CEST	778	IN	HTTP/1.1 200 OK Date: Fri, 07 Jun 2024 17:17:57 GMT Content-Type: text/html Content-Length: 607 Connection: close Server: cloudflare CF-RAY: 89024c723ec02e18-DFW Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	50477	104.16.166.228	80

Timestamp	Bytes transferred	Direction	Data
Jun 7, 2024 19:20:00.749878883 CEST	100	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com Cache-Control: no-cache

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49709	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-06-07 17:17:45 UTC	59	OUT	GET / HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
2024-06-07 17:17:46 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 07 Jun 2024 17:17:45 GMT content-type: application/json; charset=utf-8 Content-Length: 314 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-07 17:17:46 UTC	314	IN	Data Raw: 7b 0a 20 20 22 69 70 22 3a 20 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 31 22 2c 0a 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 31 2e 73 74 61 74 69 63 2e 71 75 61 64 72 61 6e 65 74 2e 63 6f 6d 22 2c 0a 20 20 22 63 69 74 79 22 3a 20 22 44 61 6c 6c 61 73 22 2c 0a 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 54 65 78 61 73 22 2c 0a 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 22 6c 6f 63 22 3a 20 22 33 32 2e 38 31 35 32 2c 2d 39 36 2e 38 37 30 33 22 2c 0a 20 20 22 6f 72 67 22 3a 20 22 41 53 38 31 30 30 20 51 75 61 64 72 61 4e 65 74 20 45 6e 74 65 72 70 72 69 73 65 73 20 4c 4c 43 22 2c 0a 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 37 35 32 34 37 22 2c 0a 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 Data Ascii: { "ip": "173.254.250.91", "hostname": "173.254.250.91.static.quadranet.com", "city": "Dallas", "region": "Texas", "country": "US", "loc": "32.8152,-96.8703", "org": "AS8100 QuadraNet Enterprises LLC", "postal": "75247", "timezone": "Amer

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49710	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-06-07 17:17:53 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 48 2f 71 6d 2f 6f 6e 4d 41 30 4b 67 65 74 33 34 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 32 61 66 39 36 64 34 37 64 35 34 63 62 38 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: H/qm/onMA0Kget34.1Context: b2af96d47d54cb80
2024-06-07 17:17:53 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-06-07 17:17:53 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 48 2f 71 6d 2f 6f 6e 4d 41 30 4b 67 65 74 33 34 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 32 61 66 39 36 64 34 37 64 35 34 63 62 38 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 7a 55 45 6b 33 4e 66 59 68 39 44 37 4a 45 5a 56 62 6c 51 70 7a 62 55 68 49 35 31 6e 4c 71 31 6c 79 78 73 49 65 70 6c 50 58 6f 72 4f 79 52 49 56 48 6e 75 53 2b 51 69 6e 32 63 6a 51 38 47 78 6c 52 66 65 2f 66 72 53 38 6e 4e 35 33 45 6b 50 56 49 67 5a 54 76 4c 63 7a 43 74 4b 2f 74 4b 78 6b 4e 6c 45 66 39 33 48 61 4b 43 39 4b Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: H/qm/onMA0Kget34.2Context: b2af96d47d54cb80<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXzUEk3NfYh9D7JEZVblQpzbUhI51nLq1lyxsIeplPXorOyRIVHnuS+Qin2cjQ8GxlRfe/frS8nN53EkPVIgZTvLczCtK/tKxkNlEf93HaKC9K
2024-06-07 17:17:53 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 48 2f 71 6d 2f 6f 6e 4d 41 30 4b 67 65 74 33 34 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 32 61 66 39 36 64 34 37 64 35 34 63 62 38 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: H/qm/onMA0Kget34.3Context: b2af96d47d54cb80<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-06-07 17:17:54 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-06-07 17:17:54 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 52 50 67 70 66 44 66 77 74 30 65 2f 78 4d 49 6e 2b 47 55 44 67 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: RPgpfDfwt0e/xMIn+GUDgQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49730	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-06-07 17:17:58 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 42 56 7a 55 2b 50 62 75 31 45 32 53 51 44 6d 7a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 65 30 34 64 62 36 33 64 34 61 34 31 38 35 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: BVzU+Pbu1E2SQDmz.1Context: 1e04db63d4a41852
2024-06-07 17:17:58 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-06-07 17:17:58 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 42 56 7a 55 2b 50 62 75 31 45 32 53 51 44 6d 7a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 65 30 34 64 62 36 33 64 34 61 34 31 38 35 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 75 33 45 58 33 6f 51 7a 71 4b 44 79 2f 45 2f 76 32 70 71 67 34 53 42 46 66 42 37 55 6f 4a 75 71 75 37 61 50 4c 36 43 6b 4e 6d 43 46 43 57 62 6b 44 53 6a 56 33 72 37 4d 62 4a 46 6a 52 7a 6d 49 70 33 52 38 6c 47 4a 39 50 37 44 50 74 78 78 65 30 6b 64 67 4b 53 31 64 4d 4c 67 4f 32 6c 77 35 7a 5a 62 4a 48 74 76 6e 62 30 35 4a Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: BVzU+Pbu1E2SQDmz.2Context: 1e04db63d4a41852<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWu3EX3oQzqKDy/E/v2pqg4SBFfB7UoJuqu7aPL6CkNmCFCWbkDSjV3r7MbJFjRzmIp3R8lGJ9P7DPtxxe0kdgKS1dMLgO2lw5zZbJHtvnb05J
2024-06-07 17:17:58 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 42 56 7a 55 2b 50 62 75 31 45 32 53 51 44 6d 7a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 65 30 34 64 62 36 33 64 34 61 34 31 38 35 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: BVzU+Pbu1E2SQDmz.3Context: 1e04db63d4a41852<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-06-07 17:17:58 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-06-07 17:17:58 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4f 70 78 41 41 58 33 65 65 6b 36 42 4e 76 30 73 56 53 39 51 75 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: OpxAAX3eek6BNv0sVS9Qug.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49873	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-06-07 17:18:09 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ruKz3o3T4HPhkZC&MD=wdey9Y6v HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-06-07 17:18:10 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: ee94735a-8bca-4e8e-871a-ad7d75d4a91a MS-RequestId: 0b014ebd-b3da-4552-ace2-b4a41a357861 MS-CV: wF8PofciKEid0wz4.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 07 Jun 2024 17:18:09 GMT Connection: close Content-Length: 24490
2024-06-07 17:18:10 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-06-07 17:18:10 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	50031	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-06-07 17:18:23 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 64 39 42 56 73 56 73 68 51 30 75 68 4d 5a 78 33 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 65 32 30 61 30 33 34 32 62 31 30 30 34 39 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: d9BVsVshQ0uhMZx3.1Context: 9e20a0342b10049d
2024-06-07 17:18:23 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-06-07 17:18:23 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 64 39 42 56 73 56 73 68 51 30 75 68 4d 5a 78 33 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 65 32 30 61 30 33 34 32 62 31 30 30 34 39 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 75 33 45 58 33 6f 51 7a 71 4b 44 79 2f 45 2f 76 32 70 71 67 34 53 42 46 66 42 37 55 6f 4a 75 71 75 37 61 50 4c 36 43 6b 4e 6d 43 46 43 57 62 6b 44 53 6a 56 33 72 37 4d 62 4a 46 6a 52 7a 6d 49 70 33 52 38 6c 47 4a 39 50 37 44 50 74 78 78 65 30 6b 64 67 4b 53 31 64 4d 4c 67 4f 32 6c 77 35 7a 5a 62 4a 48 74 76 6e 62 30 35 4a Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: d9BVsVshQ0uhMZx3.2Context: 9e20a0342b10049d<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWu3EX3oQzqKDy/E/v2pqg4SBFfB7UoJuqu7aPL6CkNmCFCWbkDSjV3r7MbJFjRzmIp3R8lGJ9P7DPtxxe0kdgKS1dMLgO2lw5zZbJHtvnb05J
2024-06-07 17:18:23 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 64 39 42 56 73 56 73 68 51 30 75 68 4d 5a 78 33 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 65 32 30 61 30 33 34 32 62 31 30 30 34 39 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: d9BVsVshQ0uhMZx3.3Context: 9e20a0342b10049d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-06-07 17:18:23 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-06-07 17:18:23 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 53 55 7a 7a 4f 67 66 4d 61 30 6d 31 31 73 6a 43 57 49 56 56 48 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: SUzzOgfMa0m11sjCWIVVHA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50159	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-06-07 17:18:47 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ruKz3o3T4HPhkZC&MD=wdey9Y6v HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-06-07 17:18:47 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_1440" MS-CorrelationId: ff71dbd9-5a06-4104-a8ac-59f5b36cc9c6 MS-RequestId: 3487f3ea-c417-40b1-b53f-0e2c9f94bb26 MS-CV: HIOe+L4/e0Kqa7Tm.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 07 Jun 2024 17:18:47 GMT Connection: close Content-Length: 25457
2024-06-07 17:18:47 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-06-07 17:18:47 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	50174	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-06-07 17:18:49 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 41 77 41 36 63 72 31 6c 32 55 47 46 51 2b 35 66 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 35 64 61 39 61 37 32 38 63 33 63 62 30 39 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: AwA6cr1l2UGFQ+5f.1Context: 85da9a728c3cb094
2024-06-07 17:18:49 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-06-07 17:18:49 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 41 77 41 36 63 72 31 6c 32 55 47 46 51 2b 35 66 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 35 64 61 39 61 37 32 38 63 33 63 62 30 39 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 75 33 45 58 33 6f 51 7a 71 4b 44 79 2f 45 2f 76 32 70 71 67 34 53 42 46 66 42 37 55 6f 4a 75 71 75 37 61 50 4c 36 43 6b 4e 6d 43 46 43 57 62 6b 44 53 6a 56 33 72 37 4d 62 4a 46 6a 52 7a 6d 49 70 33 52 38 6c 47 4a 39 50 37 44 50 74 78 78 65 30 6b 64 67 4b 53 31 64 4d 4c 67 4f 32 6c 77 35 7a 5a 62 4a 48 74 76 6e 62 30 35 4a Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: AwA6cr1l2UGFQ+5f.2Context: 85da9a728c3cb094<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWu3EX3oQzqKDy/E/v2pqg4SBFfB7UoJuqu7aPL6CkNmCFCWbkDSjV3r7MbJFjRzmIp3R8lGJ9P7DPtxxe0kdgKS1dMLgO2lw5zZbJHtvnb05J
2024-06-07 17:18:49 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 41 77 41 36 63 72 31 6c 32 55 47 46 51 2b 35 66 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 35 64 61 39 61 37 32 38 63 33 63 62 30 39 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: AwA6cr1l2UGFQ+5f.3Context: 85da9a728c3cb094<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-06-07 17:18:49 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-06-07 17:18:49 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 57 6f 59 79 30 66 67 51 2f 6b 57 45 30 45 75 30 35 48 47 79 33 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: WoYy0fgQ/kWE0Eu05HGy3w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	50475	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-06-07 17:19:23 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6c 4f 58 67 65 75 78 72 7a 6b 69 65 52 65 4c 74 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 64 61 37 64 32 30 63 39 63 32 32 37 35 65 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: lOXgeuxrzkieReLt.1Context: 3da7d20c9c2275e5
2024-06-07 17:19:23 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-06-07 17:19:23 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 6c 4f 58 67 65 75 78 72 7a 6b 69 65 52 65 4c 74 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 64 61 37 64 32 30 63 39 63 32 32 37 35 65 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 75 33 45 58 33 6f 51 7a 71 4b 44 79 2f 45 2f 76 32 70 71 67 34 53 42 46 66 42 37 55 6f 4a 75 71 75 37 61 50 4c 36 43 6b 4e 6d 43 46 43 57 62 6b 44 53 6a 56 33 72 37 4d 62 4a 46 6a 52 7a 6d 49 70 33 52 38 6c 47 4a 39 50 37 44 50 74 78 78 65 30 6b 64 67 4b 53 31 64 4d 4c 67 4f 32 6c 77 35 7a 5a 62 4a 48 74 76 6e 62 30 35 4a Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: lOXgeuxrzkieReLt.2Context: 3da7d20c9c2275e5<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWu3EX3oQzqKDy/E/v2pqg4SBFfB7UoJuqu7aPL6CkNmCFCWbkDSjV3r7MbJFjRzmIp3R8lGJ9P7DPtxxe0kdgKS1dMLgO2lw5zZbJHtvnb05J
2024-06-07 17:19:23 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6c 4f 58 67 65 75 78 72 7a 6b 69 65 52 65 4c 74 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 64 61 37 64 32 30 63 39 63 32 32 37 35 65 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: lOXgeuxrzkieReLt.3Context: 3da7d20c9c2275e5<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-06-07 17:19:24 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-06-07 17:19:24 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 68 30 30 4f 2f 7a 35 5a 68 6b 71 47 4f 6e 4d 2b 45 67 51 45 67 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: h00O/z5ZhkqGOnM+EgQEgA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	50476	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-06-07 17:20:00 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 76 61 33 73 6d 53 48 59 32 6b 71 5a 71 74 71 76 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 64 33 62 32 38 30 32 61 37 62 63 62 37 34 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: va3smSHY2kqZqtqv.1Context: 9d3b2802a7bcb746
2024-06-07 17:20:00 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-06-07 17:20:00 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 76 61 33 73 6d 53 48 59 32 6b 71 5a 71 74 71 76 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 64 33 62 32 38 30 32 61 37 62 63 62 37 34 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 75 33 45 58 33 6f 51 7a 71 4b 44 79 2f 45 2f 76 32 70 71 67 34 53 42 46 66 42 37 55 6f 4a 75 71 75 37 61 50 4c 36 43 6b 4e 6d 43 46 43 57 62 6b 44 53 6a 56 33 72 37 4d 62 4a 46 6a 52 7a 6d 49 70 33 52 38 6c 47 4a 39 50 37 44 50 74 78 78 65 30 6b 64 67 4b 53 31 64 4d 4c 67 4f 32 6c 77 35 7a 5a 62 4a 48 74 76 6e 62 30 35 4a Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: va3smSHY2kqZqtqv.2Context: 9d3b2802a7bcb746<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWu3EX3oQzqKDy/E/v2pqg4SBFfB7UoJuqu7aPL6CkNmCFCWbkDSjV3r7MbJFjRzmIp3R8lGJ9P7DPtxxe0kdgKS1dMLgO2lw5zZbJHtvnb05J
2024-06-07 17:20:00 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 76 61 33 73 6d 53 48 59 32 6b 71 5a 71 74 71 76 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 64 33 62 32 38 30 32 61 37 62 63 62 37 34 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: va3smSHY2kqZqtqv.3Context: 9d3b2802a7bcb746<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-06-07 17:20:00 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-06-07 17:20:00 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 56 34 35 43 44 39 71 72 72 30 36 47 33 30 46 41 31 62 4e 4d 56 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: V45CD9qrr06G30FA1bNMVw.0Payload parsing failed.

Target ID:	0
Start time:	13:17:52
Start date:	07/06/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\1w3BDu68Sg.dll"
Imagebase:	0xde0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:17:52
Start date:	07/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:17:52
Start date:	07/06/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\1w3BDu68Sg.dll",#1
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:17:52
Start date:	07/06/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\1w3BDu68Sg.dll,PlayGame
Imagebase:	0x4d0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:17:52
Start date:	07/06/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\1w3BDu68Sg.dll",#1
Imagebase:	0x4d0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:17:52
Start date:	07/06/2024
Path:	C:\Windows\mssecsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvc.exe
Imagebase:	0x400000
File size:	3'723'264 bytes
MD5 hash:	0C694193CEAC8BFB016491FFB534EB7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000002.2147501078.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.2124091676.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000002.2147653704.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000002.2147653704.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.2124227009.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000000.2124227009.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:17:54
Start date:	07/06/2024
Path:	C:\Windows\mssecsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvc.exe -m security
Imagebase:	0x400000
File size:	3'723'264 bytes
MD5 hash:	0C694193CEAC8BFB016491FFB534EB7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000002.2781831927.000000000042E000.00000004.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000000.2138160510.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000002.2783198767.00000000023DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000008.00000002.2783198767.00000000023DC000.00000004.00000020.00020000.00000000.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000000.2138279487.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000008.00000000.2138279487.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000002.2781957161.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000008.00000002.2781957161.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000002.2782901909.0000000001EB9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000008.00000002.2782901909.0000000001EB9000.00000004.00000020.00020000.00000000.sdmp, Author: us-cert code analysis team
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:17:54
Start date:	07/06/2024
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	false
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x400000
File size:	3'514'368 bytes
MD5 hash:	7F7CCAA16FB15EB1C7399D422F8363E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000009.00000002.2146717318.000000000040E000.00000008.00000001.01000000.00000007.sdmp, Author: us-cert code analysis team Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000009.00000000.2146308029.000000000040E000.00000008.00000001.01000000.00000007.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\tasksche.exe, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\tasksche.exe, Author: ReversingLabs
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:17:55
Start date:	07/06/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\1w3BDu68Sg.dll",PlayGame
Imagebase:	0x4d0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:17:55
Start date:	07/06/2024
Path:	C:\Windows\mssecsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvc.exe
Imagebase:	0x400000
File size:	3'723'264 bytes
MD5 hash:	0C694193CEAC8BFB016491FFB534EB7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000B.00000000.2152432616.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000B.00000002.2162442573.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000B.00000002.2162585695.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000B.00000002.2162585695.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000B.00000000.2152554456.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000B.00000000.2152554456.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:17:56
Start date:	07/06/2024
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	false
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x400000
File size:	3'514'368 bytes
MD5 hash:	7F7CCAA16FB15EB1C7399D422F8363E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000C.00000002.2161927625.000000000040E000.00000008.00000001.01000000.00000007.sdmp, Author: us-cert code analysis team Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000C.00000000.2161380343.000000000040E000.00000008.00000001.01000000.00000007.sdmp, Author: us-cert code analysis team
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:18:20
Start date:	07/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1w3BDu68Sg.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\WINDOWS\qeriuwjhrf (copy)

C:\Windows\tasksche.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
1w3BDu68Sg.dll