Edit tour

Windows Analysis Report
qt680eucI4.dll

Overview

General Information

Sample name:	qt680eucI4.dll renamed because original name is a hash value
Original sample name:	c05e2dab77349cd639aa837e7e121710b8a0718d8fc93fb4cc6458ae90e5c597.dll
Analysis ID:	1453824
MD5:	ae12bb54af31227017feffd9598a6f5e
SHA1:	f597a1cc16d42b7f02e077696e067cd3030a06d9
SHA256:	c05e2dab77349cd639aa837e7e121710b8a0718d8fc93fb4cc6458ae90e5c597
Infos:

Detection

Wannacry

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to download HTTP data from a sinkholed server

Yara detected Wannacry ransomware

Connects to many different private IPs (likely to spread or exploit)

Connects to many different private IPs via SMB (likely to spread or exploit)

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Connects to several IPs in different countries

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected non-DNS traffic on DNS port

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

HTTP GET or POST without a user agent

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6692 cmdline: loaddll32.exe "C:\Users\user\Desktop\qt680eucI4.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 6788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 7216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6488 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\qt680eucI4.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 5808 cmdline: rundll32.exe "C:\Users\user\Desktop\qt680eucI4.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6572 cmdline: rundll32.exe C:\Users\user\Desktop\qt680eucI4.dll,PlayGame MD5: 889B99C52A60DD49227C5E485A016679)

mssecsvc.exe (PID: 3328 cmdline: C:\WINDOWS\mssecsvc.exe MD5: 0C694193CEAC8BFB016491FFB534EB7C)

tasksche.exe (PID: 7200 cmdline: C:\WINDOWS\tasksche.exe /i MD5: 7F7CCAA16FB15EB1C7399D422F8363E8)

rundll32.exe (PID: 7248 cmdline: rundll32.exe "C:\Users\user\Desktop\qt680eucI4.dll",PlayGame MD5: 889B99C52A60DD49227C5E485A016679)

mssecsvc.exe (PID: 7264 cmdline: C:\WINDOWS\mssecsvc.exe MD5: 0C694193CEAC8BFB016491FFB534EB7C)

tasksche.exe (PID: 7336 cmdline: C:\WINDOWS\tasksche.exe /i MD5: 7F7CCAA16FB15EB1C7399D422F8363E8)

mssecsvc.exe (PID: 6864 cmdline: C:\WINDOWS\mssecsvc.exe -m security MD5: 0C694193CEAC8BFB016491FFB534EB7C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
WannaCryptor, WannaCry, WannaCrypt		Lazarus Group	http://blog.emsisoft.com/2017/05/12/wcry-ransomware-outbreak/ http://www.independent.co.uk/news/uk/home-news/wannacry-malware-hack-nhs-report-cybercrime-north-korea-uk-ben-wallace-a8022491.html https://baesystemsai.blogspot.de/2017/05/wanacrypt0r-ransomworm.html https://blog.avast.com/ransomware-that-infected-telefonica-and-nhs-hospitals-is-spreading-aggressively-with-over-50000-attacks-so-far-today https://blog.comae.io/wannacry-decrypting-files-with-wanakiwi-demo-86bafb81112d	https://malpedia.caad.fkie.fraunhofer.de/details/win.wannacryptor

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
qt680eucI4.dll	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
qt680eucI4.dll	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x45604:$x1: icacls . /grant Everyone:F /T /C /Q 0x353d0:$x3: tasksche.exe 0x455e0:$x3: tasksche.exe 0x455bc:$x4: Global\MsWinZonesCacheCounterMutexA 0x45634:$x5: WNcry@2ol7 0x3543b:$x6: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com 0x3028:$x7: mssecsvc.exe 0x120ac:$x7: mssecsvc.exe 0x1b3b4:$x7: mssecsvc.exe 0x353a8:$x8: C:\%s\qeriuwjhrf 0x45604:$x9: icacls . /grant Everyone:F /T /C /Q 0x3014:$s1: C:\%s\%s 0x12098:$s1: C:\%s\%s 0x1b39c:$s1: C:\%s\%s 0x353bc:$s1: C:\%s\%s 0x45534:$s3: cmd.exe /c "%s" 0x77a88:$s4: msg/m_portuguese.wnry 0x326f0:$s5: \\192.168.56.20\IPC$ 0x1fae5:$s6: \\172.16.99.5\IPC$ 0xd195:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x78da:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44
qt680eucI4.dll	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x455e0:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x45608:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\tasksche.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Windows\tasksche.exe	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
C:\Windows\tasksche.exe	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
C:\Windows\tasksche.exe	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
C:\Windows\mssecsvc.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Windows\mssecsvc.exe	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x313d7:$x6: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com 0xe048:$x7: mssecsvc.exe 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0xe034:$s1: C:\%s\%s 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88 0x34aa6:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
C:\Windows\mssecsvc.exe	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
C:\Windows\mssecsvc.exe	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
C:\Windows\mssecsvc.exe	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x340ba:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x8090:$start_service_3: 83 EC 10 68 04 01 00 00 68 60 F7 70 00 6A 00 FF 15 6C A0 40 00 FF 15 2C A1 40 00 83 38 02 7D 09 E8 6B FE FF FF 83 C4 10 C3 57 68 3F 00 0F 00 6A 00 6A 00 FF 15 10 A0 40 00 8B F8 85 FF 74 32 53 ... 0x9a16:$entrypoint_all: 55 8B EC 6A FF 68 A0 A1 40 00 68 A2 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C0 A0 40 00 59 83 0D 94 F8 70 00 FF 83 0D 98 F8 70 ... 0x3985e:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
Click to see the 4 entries

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000000.1732074425.000000000040E000.00000008.00000001.01000000.00000007.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000005.00000002.1717308991.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000002.2351367030.000000000042E000.00000004.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000009.00000002.1733349852.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.1701768638.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000A.00000002.1732756951.000000000040E000.00000008.00000001.01000000.00000007.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000007.00000002.1716722163.000000000040E000.00000008.00000001.01000000.00000007.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000007.00000000.1716262074.000000000040E000.00000008.00000001.01000000.00000007.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000009.00000000.1721407931.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000000.1693433039.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000009.00000000.1721552401.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000009.00000000.1721552401.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000009.00000002.1733511619.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000009.00000002.1733511619.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000006.00000000.1701928491.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.1701928491.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000005.00000000.1693543324.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000000.1693543324.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000006.00000002.2351656922.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000002.2351656922.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000005.00000002.1717442764.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000002.1717442764.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000006.00000002.2352554988.0000000001EB4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000002.2352554988.0000000001EB4000.00000004.00000020.00020000.00000000.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x32600:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x32628:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000006.00000002.2352874636.00000000023D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000002.2352874636.00000000023D1000.00000004.00000020.00020000.00000000.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x32e44:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x32e6c:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
Process Memory Space: mssecsvc.exe PID: 3328	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvc.exe PID: 6864	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvc.exe PID: 7264	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 24 entries

Snort Signatures

ET TROJAN Known Sinkhole Response Kryptos Logic - Source IP: 104.16.167.228 - Destination IP: 192.168.2.4

Timestamp:	06/07/24-19:46:45.138222
SID:	2031515
Source Port:	80
Destination Port:	49749
Protocol:	TCP
Classtype:	Misc activity

ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 - Source IP: 192.168.2.4 - Destination IP: 104.16.167.228

Timestamp:	06/07/24-19:46:44.477491
SID:	2024298
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 - Source IP: 192.168.2.4 - Destination IP: 104.16.167.228

Timestamp:	06/07/24-19:46:43.047997
SID:	2024298
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Kryptos Logic - Source IP: 104.16.167.228 - Destination IP: 192.168.2.4

Timestamp:	06/07/24-19:46:42.331605
SID:	2031515
Source Port:	80
Destination Port:	49731
Protocol:	TCP
Classtype:	Misc activity

ET TROJAN Known Sinkhole Response Kryptos Logic - Source IP: 104.16.167.228 - Destination IP: 192.168.2.4

Timestamp:	06/07/24-19:46:43.690291
SID:	2031515
Source Port:	80
Destination Port:	49732
Protocol:	TCP
Classtype:	Misc activity

ET TROJAN Possible WannaCry DNS Lookup 1 - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	06/07/24-19:46:41.674173
SID:	2024291
Source Port:	55637
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 - Source IP: 192.168.2.4 - Destination IP: 104.16.167.228

Timestamp:	06/07/24-19:46:41.695714
SID:	2024298
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: qt680eucI4.dll

Avira: detected

Antivirus detection for URL or domain

Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/wf	Avira URL Cloud: Label: phishing
Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/	Avira URL Cloud: Label: phishing
Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	Avira URL Cloud: Label: phishing
Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/td	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Windows\tasksche.exe	Avira: detection malicious, Label: TR/AD.WannaCry.sewvt
Source: C:\Windows\mssecsvc.exe	Avira: detection malicious, Label: TR/AD.WannaCry.bqdjz

Multi AV Scanner detection for dropped file

Source: C:\WINDOWS\qeriuwjhrf (copy)	ReversingLabs: Detection: 100%
Source: C:\Windows\mssecsvc.exe	ReversingLabs: Detection: 100%
Source: C:\Windows\tasksche.exe	ReversingLabs: Detection: 100%

Multi AV Scanner detection for submitted file

Source: qt680eucI4.dll

ReversingLabs: Detection: 91%

Machine Learning detection for dropped file

Source: C:\Windows\tasksche.exe	Joe Sandbox ML: detected
Source: C:\Windows\mssecsvc.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: qt680eucI4.dll

Joe Sandbox ML: detected

Exploits

Connects to many different private IPs (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior

Connects to many different private IPs via SMB (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior

Source: qt680eucI4.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.95.31.18:443 -> 192.168.2.4:64150 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:64163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:64171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:64179 version: TLS 1.2

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2024291 ET TROJAN Possible WannaCry DNS Lookup 1 192.168.2.4:55637 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2024298 ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 192.168.2.4:49731 -> 104.16.167.228:80
Source: Traffic	Snort IDS: 2031515 ET TROJAN Known Sinkhole Response Kryptos Logic 104.16.167.228:80 -> 192.168.2.4:49731
Source: Traffic	Snort IDS: 2024298 ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 192.168.2.4:49732 -> 104.16.167.228:80
Source: Traffic	Snort IDS: 2031515 ET TROJAN Known Sinkhole Response Kryptos Logic 104.16.167.228:80 -> 192.168.2.4:49732
Source: Traffic	Snort IDS: 2024298 ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 192.168.2.4:49749 -> 104.16.167.228:80
Source: Traffic	Snort IDS: 2031515 ET TROJAN Known Sinkhole Response Kryptos Logic 104.16.167.228:80 -> 192.168.2.4:49749

Tries to download HTTP data from a sinkholed server

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Jun 2024 17:46:42 GMTContent-Type: text/htmlContent-Length: 607Connection: closeServer: cloudflareCF-RAY: 8902768e0c3f4796-DFWData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Jun 2024 17:46:43 GMTContent-Type: text/htmlContent-Length: 607Connection: closeServer: cloudflareCF-RAY: 89027696892f2e5d-DFWData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Jun 2024 17:46:45 GMTContent-Type: text/htmlContent-Length: 607Connection: closeServer: cloudflareCF-RAY: 8902769f5ea228e8-DFWData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>

Source: unknown

Network traffic detected: IP country count 12

Source: global traffic

TCP traffic: 192.168.2.4:64144 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 103.194.154.134
Source: unknown	TCP traffic detected without corresponding DNS query: 103.194.154.134
Source: unknown	TCP traffic detected without corresponding DNS query: 103.194.154.134
Source: unknown	TCP traffic detected without corresponding DNS query: 103.194.154.1
Source: unknown	TCP traffic detected without corresponding DNS query: 103.194.154.1
Source: unknown	TCP traffic detected without corresponding DNS query: 103.194.154.1
Source: unknown	TCP traffic detected without corresponding DNS query: 103.194.154.134
Source: unknown	TCP traffic detected without corresponding DNS query: 103.194.154.1
Source: unknown	TCP traffic detected without corresponding DNS query: 103.194.154.1
Source: unknown	TCP traffic detected without corresponding DNS query: 103.194.154.1
Source: unknown	TCP traffic detected without corresponding DNS query: 103.194.154.1
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 73.148.167.178
Source: unknown	TCP traffic detected without corresponding DNS query: 73.148.167.178
Source: unknown	TCP traffic detected without corresponding DNS query: 73.148.167.178
Source: unknown	TCP traffic detected without corresponding DNS query: 73.148.167.1
Source: unknown	TCP traffic detected without corresponding DNS query: 73.148.167.1
Source: unknown	TCP traffic detected without corresponding DNS query: 73.148.167.1
Source: unknown	TCP traffic detected without corresponding DNS query: 73.148.167.178
Source: unknown	TCP traffic detected without corresponding DNS query: 73.148.167.1
Source: unknown	TCP traffic detected without corresponding DNS query: 73.148.167.1
Source: unknown	TCP traffic detected without corresponding DNS query: 73.148.167.1
Source: unknown	TCP traffic detected without corresponding DNS query: 73.148.167.1
Source: unknown	TCP traffic detected without corresponding DNS query: 189.66.242.36
Source: unknown	TCP traffic detected without corresponding DNS query: 189.66.242.36
Source: unknown	TCP traffic detected without corresponding DNS query: 189.66.242.36
Source: unknown	TCP traffic detected without corresponding DNS query: 189.66.242.1
Source: unknown	TCP traffic detected without corresponding DNS query: 189.66.242.1
Source: unknown	TCP traffic detected without corresponding DNS query: 189.66.242.1
Source: unknown	TCP traffic detected without corresponding DNS query: 189.66.242.36
Source: unknown	TCP traffic detected without corresponding DNS query: 189.66.242.1
Source: unknown	TCP traffic detected without corresponding DNS query: 189.66.242.1
Source: unknown	TCP traffic detected without corresponding DNS query: 189.66.242.1
Source: unknown	TCP traffic detected without corresponding DNS query: 189.66.242.1
Source: unknown	TCP traffic detected without corresponding DNS query: 134.136.111.217
Source: unknown	TCP traffic detected without corresponding DNS query: 134.136.111.217
Source: unknown	TCP traffic detected without corresponding DNS query: 134.136.111.217
Source: unknown	TCP traffic detected without corresponding DNS query: 134.136.111.1
Source: unknown	TCP traffic detected without corresponding DNS query: 134.136.111.1
Source: unknown	TCP traffic detected without corresponding DNS query: 134.136.111.1
Source: unknown	TCP traffic detected without corresponding DNS query: 134.136.111.217
Source: unknown	TCP traffic detected without corresponding DNS query: 134.136.111.1
Source: unknown	TCP traffic detected without corresponding DNS query: 134.136.111.1
Source: unknown	TCP traffic detected without corresponding DNS query: 134.136.111.1
Source: unknown	TCP traffic detected without corresponding DNS query: 134.136.111.1
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.28.115
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.28.115
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.28.115
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.28.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fyr8nFvVYcbgg5r&MD=tx7ud3pw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /clientwebservice/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: fe3cr.delivery.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /sls/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fyr8nFvVYcbgg5r&MD=tx7ud3pw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fyr8nFvVYcbgg5r&MD=tx7ud3pw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Source: global traffic	DNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 157.123.68.40.in-addr.arpa

Source: mssecsvc.exe.4.dr	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Source: mssecsvc.exe, 00000009.00000002.1733941384.0000000000D52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
Source: mssecsvc.exe, 00000005.00000002.1717781648.0000000000C80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/td
Source: mssecsvc.exe, 00000005.00000002.1717781648.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/wf
Source: mssecsvc.exe, 00000006.00000002.2351120500.000000000019D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJ
Source: mssecsvc.exe, 00000005.00000002.1717781648.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comM

Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 64153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64150
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64163
Source: unknown	Network traffic detected: HTTP traffic on port 64150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64153
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64179
Source: unknown	Network traffic detected: HTTP traffic on port 64179 -> 443

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.95.31.18:443 -> 192.168.2.4:64150 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:64163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:64171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:64179 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Yara detected Wannacry ransomware

Source: Yara match	File source: qt680eucI4.dll, type: SAMPLE
Source: Yara match	File source: 00000005.00000002.1717308991.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2351367030.000000000042E000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1733349852.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.1701768638.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.1721407931.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.1693433039.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.1721552401.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1733511619.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.1701928491.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.1693543324.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2351656922.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1717442764.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2352554988.0000000001EB4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2352874636.00000000023D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 3328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 6864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 7264, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\tasksche.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\mssecsvc.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: qt680eucI4.dll, type: SAMPLE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: qt680eucI4.dll, type: SAMPLE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 0000000A.00000000.1732074425.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 0000000A.00000002.1732756951.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000007.00000002.1716722163.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000007.00000000.1716262074.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000009.00000000.1721552401.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000009.00000002.1733511619.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000006.00000000.1701928491.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000005.00000000.1693543324.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000006.00000002.2351656922.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000005.00000002.1717442764.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000006.00000002.2352554988.0000000001EB4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000006.00000002.2352874636.00000000023D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\WINDOWS\mssecsvc.exe	Jump to behavior
Source: C:\Windows\mssecsvc.exe	File created: C:\WINDOWS\tasksche.exe	Jump to behavior
Source: C:\Windows\mssecsvc.exe	File created: C:\WINDOWS\tasksche.exe	Jump to behavior

Source: Joe Sandbox View	Dropped File: C:\WINDOWS\qeriuwjhrf (copy) 2584E1521065E45EC3C17767C065429038FC6291C091097EA8B22C8A502C41DD
Source: Joe Sandbox View	Dropped File: C:\Windows\tasksche.exe 2584E1521065E45EC3C17767C065429038FC6291C091097EA8B22C8A502C41DD

Source: mssecsvc.exe.4.dr	Static PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: tasksche.exe.5.dr	Static PE information: Resource name: XIA type: Zip archive data, at least v2.0 to extract, compression method=deflate

Source: qt680eucI4.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: qt680eucI4.dll, type: SAMPLE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: qt680eucI4.dll, type: SAMPLE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 0000000A.00000000.1732074425.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 0000000A.00000002.1732756951.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000007.00000002.1716722163.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000007.00000000.1716262074.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000009.00000000.1721552401.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000009.00000002.1733511619.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000006.00000000.1701928491.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000005.00000000.1693543324.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000006.00000002.2351656922.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000005.00000002.1717442764.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000006.00000002.2352554988.0000000001EB4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000006.00000002.2352874636.00000000023D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware

Source: tasksche.exe, 00000007.00000002.1716722163.000000000040E000.00000008.00000001.01000000.00000007.sdmp, tasksche.exe, 0000000A.00000000.1732074425.000000000040E000.00000008.00000001.01000000.00000007.sdmp, qt680eucI4.dll, tasksche.exe.5.dr, mssecsvc.exe.4.dr

Binary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll

Source: classification engine

Classification label: mal100.rans.expl.evad.winDLL@21/3@3/100

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7216:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6788:120:WilError_03

Source: qt680eucI4.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\qt680eucI4.dll,PlayGame

Source: qt680eucI4.dll

ReversingLabs: Detection: 91%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\qt680eucI4.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\qt680eucI4.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\qt680eucI4.dll,PlayGame
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\qt680eucI4.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
Source: unknown	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe -m security
Source: C:\Windows\mssecsvc.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\qt680eucI4.dll",PlayGame
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
Source: C:\Windows\mssecsvc.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\qt680eucI4.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\qt680eucI4.dll,PlayGame	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\qt680eucI4.dll",PlayGame	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\qt680eucI4.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\mssecsvc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: qt680eucI4.dll

Static file information: File size 5267459 > 1048576

Source: qt680eucI4.dll

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x501000

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\rundll32.exe	Executable created and started: C:\WINDOWS\mssecsvc.exe			Jump to behavior
Source: C:\Windows\mssecsvc.exe	Executable created and started: C:\WINDOWS\tasksche.exe			Jump to behavior

Source: C:\Windows\mssecsvc.exe	File created: C:\WINDOWS\qeriuwjhrf (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvc.exe	Jump to dropped file
Source: C:\Windows\mssecsvc.exe	File created: C:\Windows\tasksche.exe	Jump to dropped file

Source: C:\Windows\mssecsvc.exe	File created: C:\WINDOWS\qeriuwjhrf (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvc.exe	Jump to dropped file
Source: C:\Windows\mssecsvc.exe	File created: C:\Windows\tasksche.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\mssecsvc.exe

Thread delayed: delay time: 86400000

Jump to behavior

Source: C:\Windows\mssecsvc.exe TID: 7172	Thread sleep count: 91 > 30	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 7172	Thread sleep time: -182000s >= -30000s	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 7176	Thread sleep count: 119 > 30	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 7176	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 7172	Thread sleep time: -86400000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\mssecsvc.exe	Thread delayed: delay time: 86400000			Jump to behavior

Source: mssecsvc.exe, 00000006.00000002.2352126120.0000000000C8B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWn
Source: mssecsvc.exe, 00000006.00000002.2352126120.0000000000C48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWxg
Source: mssecsvc.exe, 00000005.00000002.1717781648.0000000000C94000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 00000005.00000002.1717781648.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 00000006.00000002.2352126120.0000000000C8B000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 00000009.00000002.1733941384.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 00000009.00000002.1733941384.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\qt680eucI4.dll",#1

Jump to behavior

Source: C:\Windows\mssecsvc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	12 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Rundll32	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
qt680eucI4.dll	91%	ReversingLabs	Win32.Ransomware.WannaCry
qt680eucI4.dll	100%	Avira	TR/AD.WannaCry.zbqny
qt680eucI4.dll	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\tasksche.exe	100%	Avira	TR/AD.WannaCry.sewvt
C:\Windows\mssecsvc.exe	100%	Avira	TR/AD.WannaCry.bqdjz
C:\Windows\tasksche.exe	100%	Joe Sandbox ML
C:\Windows\mssecsvc.exe	100%	Joe Sandbox ML
C:\WINDOWS\qeriuwjhrf (copy)	100%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Windows\mssecsvc.exe	100%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Windows\tasksche.exe	100%	ReversingLabs	Win32.Ransomware.WannaCry

Source	Detection	Scanner	Label
https://ipinfo.io/	0%	URL Reputation	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJ	0%	Avira URL Cloud	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comM	0%	Avira URL Cloud	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/wf	100%	Avira URL Cloud	phishing
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/	100%	Avira URL Cloud	phishing
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	100%	Avira URL Cloud	phishing
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/td	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	104.16.167.228	true	true	unknown
18.31.95.13.in-addr.arpa	unknown	unknown	false	unknown
157.123.68.40.in-addr.arpa	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/	true	Avira URL Cloud: phishing	unknown
https://ipinfo.io/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	mssecsvc.exe.4.dr	false	Avira URL Cloud: phishing	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/td	mssecsvc.exe, 00000005.00000002.1717781648.0000000000C80000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comM	mssecsvc.exe, 00000005.00000002.1717781648.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/wf	mssecsvc.exe, 00000005.00000002.1717781648.0000000000C6F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJ	mssecsvc.exe, 00000006.00000002.2351120500.000000000019D000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
35.246.127.247	unknown	United States	15169	GOOGLEUS	false
31.109.231.1	unknown	United Kingdom	12576	EELtdGB	false
103.194.154.4	unknown	India	134452	SNAPDEAL-AS-APJasperInfotechPvtLtdIN	false
103.194.154.3	unknown	India	134452	SNAPDEAL-AS-APJasperInfotechPvtLtdIN	false
103.194.154.2	unknown	India	134452	SNAPDEAL-AS-APJasperInfotechPvtLtdIN	false
2.32.195.248	unknown	Italy	30722	VODAFONE-IT-ASNIT	false
103.194.154.1	unknown	India	134452	SNAPDEAL-AS-APJasperInfotechPvtLtdIN	false
125.190.126.3	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
83.55.32.1	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
125.190.126.1	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
83.55.32.2	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
144.144.246.70	unknown	United States	58541	CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN	false
125.190.126.2	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
83.55.32.3	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
218.42.144.2	unknown	Japan	9600	SONYTELECOMSo-netCorporationJP	false
218.42.144.1	unknown	Japan	9600	SONYTELECOMSo-netCorporationJP	false
172.183.28.115	unknown	United States	7018	ATT-INTERNET4US	false
144.144.246.2	unknown	United States	58541	CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN	false
144.144.246.1	unknown	United States	58541	CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN	false
213.63.222.163	unknown	Portugal	12926	ARTELECOMPTArTelecomAutonomousSystemPT	false
35.246.127.1	unknown	United States	15169	GOOGLEUS	false
142.0.124.67	unknown	United States	10461	EZE-CASTLE-SOFTWARE-LLCUS	false
208.90.116.74	unknown	United States	31995	SCANTRONUS	false
205.222.42.2	unknown	United States	32073	MCPS-K12-MD-US	false
220.152.113.1	unknown	Bangladesh	58689	ICCNET-DHK-BDICCCommunicationBD	false
205.222.42.1	unknown	United States	32073	MCPS-K12-MD-US	false
189.66.242.36	unknown	Brazil	26615	TIMSABR	false
146.209.254.17	unknown	United States	19254	KOCH-INDUSTRIESUS	false
166.84.10.1	unknown	United States	2033	PANIXUS	false
166.84.10.3	unknown	United States	2033	PANIXUS	false
166.84.10.2	unknown	United States	2033	PANIXUS	false
166.84.10.4	unknown	United States	2033	PANIXUS	false
78.235.15.2	unknown	France	12322	PROXADFR	false
78.235.15.1	unknown	France	12322	PROXADFR	false

Private

IP
192.168.2.148
192.168.2.149
192.168.2.146
192.168.2.147
192.168.2.140
192.168.2.141
192.168.2.144
192.168.2.145
192.168.2.142
192.168.2.143
192.168.2.159
192.168.2.157
192.168.2.158
192.168.2.151
192.168.2.152
192.168.2.150
192.168.2.155
192.168.2.156
192.168.2.153
192.168.2.154
192.168.2.126
192.168.2.247
192.168.2.127
192.168.2.248
192.168.2.124
192.168.2.245
192.168.2.125
192.168.2.246
192.168.2.128
192.168.2.249
192.168.2.129
192.168.2.240
192.168.2.122
192.168.2.243
192.168.2.123
192.168.2.244
192.168.2.120
192.168.2.241
192.168.2.121
192.168.2.242
192.168.2.97
192.168.2.137
192.168.2.96
192.168.2.138
192.168.2.99
192.168.2.135
192.168.2.98
192.168.2.136
192.168.2.139
192.168.2.250
192.168.2.130
192.168.2.251
192.168.2.91
192.168.2.90
192.168.2.93
192.168.2.133
192.168.2.254
192.168.2.92
192.168.2.134
192.168.2.95
192.168.2.131
192.168.2.252
192.168.2.94
192.168.2.132
192.168.2.253
192.168.2.104

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1453824
Start date and time:	2024-06-07 19:45:47 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	qt680eucI4.dll renamed because original name is a hash value
Original Sample Name:	c05e2dab77349cd639aa837e7e121710b8a0718d8fc93fb4cc6458ae90e5c597.dll
Detection:	MAL
Classification:	mal100.rans.expl.evad.winDLL@21/3@3/100
Cookbook Comments:	Found application associated with file extension: .dll Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 217.20.57.34, 192.229.221.95
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: qt680eucI4.dll

Simulations

Behavior and APIs

Time	Type	Description
13:46:43	API Interceptor	1x Sleep call for process: loaddll32.exe modified
13:47:17	API Interceptor	112x Sleep call for process: mssecsvc.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	Get hash	malicious	Unknown	Browse	104.16.167.228
	qCc1a4w5YZ.exe	Get hash	malicious	Wannacry	Browse	104.17.244.81
	http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	Get hash	malicious	Unknown	Browse	104.17.244.81
	http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	Get hash	malicious	Unknown	Browse	104.16.173.80
	02353699.exe	Get hash	malicious	Wannacry	Browse	104.16.173.80
	05894899.exe	Get hash	malicious	Wannacry	Browse	104.17.244.81
	dNDbcC4Trx.exe	Get hash	malicious	Wannacry	Browse	104.17.244.81
	tk6uE0LqBo.exe	Get hash	malicious	Wannacry	Browse	104.17.244.81
	lioUeojCW0.exe	Get hash	malicious	Wannacry	Browse	104.17.244.81

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SNAPDEAL-AS-APJasperInfotechPvtLtdIN	cDyutLZq7l.elf	Get hash	malicious	Mirai	Browse	103.194.152.247
	ONZRjy4HYK.elf	Get hash	malicious	Mirai	Browse	103.194.152.224
	uZYeUiXjyA.elf	Get hash	malicious	Mirai, Moobot	Browse	103.194.152.202
	0qdjzL1bxv	Get hash	malicious	Mirai	Browse	103.194.152.226
	arm	Get hash	malicious	Mirai	Browse	103.194.152.239
	68jxUMVwPN	Get hash	malicious	Mirai	Browse	103.194.152.211
	M3BCznhDP5	Get hash	malicious	Mirai	Browse	103.194.152.206
	nu7s6MzWid	Get hash	malicious	Mirai	Browse	103.194.152.243
	tPzL0MlKIo	Get hash	malicious	Unknown	Browse	103.194.152.243
SNAPDEAL-AS-APJasperInfotechPvtLtdIN	cDyutLZq7l.elf	Get hash	malicious	Mirai	Browse	103.194.152.247
	ONZRjy4HYK.elf	Get hash	malicious	Mirai	Browse	103.194.152.224
	uZYeUiXjyA.elf	Get hash	malicious	Mirai, Moobot	Browse	103.194.152.202
	0qdjzL1bxv	Get hash	malicious	Mirai	Browse	103.194.152.226
	arm	Get hash	malicious	Mirai	Browse	103.194.152.239
	68jxUMVwPN	Get hash	malicious	Mirai	Browse	103.194.152.211
	M3BCznhDP5	Get hash	malicious	Mirai	Browse	103.194.152.206
	nu7s6MzWid	Get hash	malicious	Mirai	Browse	103.194.152.243
	tPzL0MlKIo	Get hash	malicious	Unknown	Browse	103.194.152.243
EELtdGB	x86.elf	Get hash	malicious	Mirai	Browse	31.118.153.211
	arm7.elf	Get hash	malicious	Mirai	Browse	31.112.131.151
	skid.mips.elf	Get hash	malicious	Mirai, Moobot	Browse	31.119.143.127
	HRJiIRr1Hp.elf	Get hash	malicious	Unknown	Browse	31.81.200.235
	aoXLsHGJOX.elf	Get hash	malicious	Mirai	Browse	31.77.234.18
	JiUm2xQj3e.elf	Get hash	malicious	Mirai	Browse	95.144.81.202
	y4YCgjlv0U.elf	Get hash	malicious	Mirai	Browse	2.28.99.51
	g4KkNl0StO.elf	Get hash	malicious	Unknown	Browse	95.150.106.237
	RsxXCSXOUK.elf	Get hash	malicious	Unknown	Browse	46.68.28.83
	xS8bwPQjO2.elf	Get hash	malicious	Mirai	Browse	31.64.109.80
SNAPDEAL-AS-APJasperInfotechPvtLtdIN	cDyutLZq7l.elf	Get hash	malicious	Mirai	Browse	103.194.152.247
	ONZRjy4HYK.elf	Get hash	malicious	Mirai	Browse	103.194.152.224
	uZYeUiXjyA.elf	Get hash	malicious	Mirai, Moobot	Browse	103.194.152.202
	0qdjzL1bxv	Get hash	malicious	Mirai	Browse	103.194.152.226
	arm	Get hash	malicious	Mirai	Browse	103.194.152.239
	68jxUMVwPN	Get hash	malicious	Mirai	Browse	103.194.152.211
	M3BCznhDP5	Get hash	malicious	Mirai	Browse	103.194.152.206
	nu7s6MzWid	Get hash	malicious	Mirai	Browse	103.194.152.243
	tPzL0MlKIo	Get hash	malicious	Unknown	Browse	103.194.152.243
VODAFONE-IT-ASNIT	KKveTTgaAAsecNNaaaa.arm.elf	Get hash	malicious	Unknown	Browse	31.156.174.162
	ZXZMRvEA9M.elf	Get hash	malicious	Mirai	Browse	93.150.243.81
	aBBIZp2Mdu.elf	Get hash	malicious	Unknown	Browse	93.68.144.250
	ACKpfvO313.elf	Get hash	malicious	Mirai	Browse	176.242.36.229
	QJP0ekw0wX.elf	Get hash	malicious	Mirai	Browse	37.179.5.74
	6OS2bzcvt9.elf	Get hash	malicious	Mirai	Browse	31.156.202.22
	bot.mips-20240528-2110.elf	Get hash	malicious	Mirai, Moobot	Browse	37.176.220.178
	arm7.nn.elf	Get hash	malicious	Mirai	Browse	31.156.202.17
	abkzsHZ00o.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	5.91.239.152
	PaRWfF3x5K.elf	Get hash	malicious	Unknown	Browse	5.92.80.192

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://xtrfr.com/t/1/m3WHCF?p=1kpU6NUBF-6AZQCXRW_1kpU72q8p-6BdU97to	Get hash	malicious	Unknown	Browse	40.127.169.103 13.95.31.18 40.68.123.157 20.12.23.50
	http://myworkspace2f139.myclickfunnels.com/onlinereviews?preview=true	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	40.127.169.103 13.95.31.18 40.68.123.157 20.12.23.50
	https://cloud.letsignit.com/collect/bc/5e8451ea469b88b5cea97417?p=OjfPT7lREiUDLQp6d36aSXQolbQ31LL303XXq73c0LgCPRp2orT9jnqhLprOLL90LfaIzvzkFLCd3-2924eBGaNnzzdb2z0VcZL3eza6pD7Lvwp-E0If3Kq_h3YGcTVhXX2GI1pL-hkiu7mMH-yy70unDaTgV2kM4DQ-HStdqgkF7zy0WhQyMck9ofym3AGicaSsvd1nX6vBxj3Gigg-Jk5WTk6QhcYqtI7diLh8ciaTnz7P5Co45mD3SSBKwruGP56kB0EhGHeljKZvuOLe6ppx9ZBLT3k3gvWvTcJPtdA=	Get hash	malicious	Unknown	Browse	40.127.169.103 13.95.31.18 40.68.123.157 20.12.23.50
	http://norauto-dreux.myfreesites.net	Get hash	malicious	Unknown	Browse	40.127.169.103 13.95.31.18 40.68.123.157 20.12.23.50
	https://www.hsbcqh.com.cn/	Get hash	malicious	Unknown	Browse	40.127.169.103 13.95.31.18 40.68.123.157 20.12.23.50
	https://www.tcsfuel.com	Get hash	malicious	Unknown	Browse	40.127.169.103 13.95.31.18 40.68.123.157 20.12.23.50
	https://ykmm2k9z.r.us-west-1.awstrack.me/L0/https:%2F%2Fatpscan.global.hornetsecurity.com%2Findex.php%3Fatp_str=am_k8LOPbUbePsfY-hKWBmPaLDazKPnHG4jgTUQirWpga72hak_a5NKRFGbXRT_nnpgzPYdx0w8exXS55Fcp8WGYFJ9rF7NbP9YDx5XhnQonunOobszh2UUrWZZnge2pJMarfaiZAqQcCAma3qVy7myZYfRUSoSvz6VKZBX_08i44Tp25Hl13pzKSAeJxY4zGA5QdKIZ6jauqCQUDLNdxAOgf31Ce4RI2rjyAwtDmNxG7pu00VIybu_gNwipmx4F5IFfSxz7VEOKyp3CucZ5M5iqrPYqvlDRcg8jOjojL_P6Wr3_SQCB2Z0bIzo6I_ei1xQj27Yk9qwRXKzsKMs/1/0111018fef761e90-05d92175-04ab-45dc-b869-d508a2bdcd27-000000/Em26ZPrClpDT_ZVT_bHsu3LhDrM=162	Get hash	malicious	Unknown	Browse	40.127.169.103 13.95.31.18 40.68.123.157 20.12.23.50
	https://capitalaitechlab.pro/index.php?products=investgeniusaide&eng_click=297dc4e0ac4544d4a012eea865a19727&eng_website=238723&eng_creative=1029836897&eng_widget=228333&pixelid=240455&key=griss&eng_source=238723&eng_subid=null&eng_click=297dc4e0ac4544d4a012eea865a19727	Get hash	malicious	Unknown	Browse	40.127.169.103 13.95.31.18 40.68.123.157 20.12.23.50
	http://signatureanalytics.com	Get hash	malicious	Unknown	Browse	40.127.169.103 13.95.31.18 40.68.123.157 20.12.23.50

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\WINDOWS\qeriuwjhrf (copy)	qCc1a4w5YZ.exe	Get hash	malicious	Wannacry	Browse
	stN592INV6.exe	Get hash	malicious	Wannacry	Browse
	onq54JS79W.exe	Get hash	malicious	Wannacry	Browse
	MSNRf9dZ63.exe	Get hash	malicious	Wannacry	Browse
	7Qu8thR7WW.dll	Get hash	malicious	Wannacry, Virut	Browse
	MSmReFKunQ.dll	Get hash	malicious	Wannacry	Browse
	kXpnLUmuU2.dll	Get hash	malicious	Wannacry	Browse
	TigrxMihsc.dll	Get hash	malicious	Wannacry	Browse
C:\Windows\tasksche.exe	qCc1a4w5YZ.exe	Get hash	malicious	Wannacry	Browse
	stN592INV6.exe	Get hash	malicious	Wannacry	Browse
	onq54JS79W.exe	Get hash	malicious	Wannacry	Browse
	MSNRf9dZ63.exe	Get hash	malicious	Wannacry	Browse
	7Qu8thR7WW.dll	Get hash	malicious	Wannacry, Virut	Browse
	MSmReFKunQ.dll	Get hash	malicious	Wannacry	Browse
	kXpnLUmuU2.dll	Get hash	malicious	Wannacry	Browse
	TigrxMihsc.dll	Get hash	malicious	Wannacry	Browse

Created / dropped Files

C:\WINDOWS\qeriuwjhrf (copy)

Download File

Process:	C:\Windows\mssecsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3514368
Entropy (8bit):	7.996072890929898
Encrypted:	true
SSDEEP:	98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hj:QqPe1Cxcxk3ZAEUadzR8yc4Hj
MD5:	7F7CCAA16FB15EB1C7399D422F8363E8
SHA1:	BD44D0AB543BF814D93B719C24E90D8DD7111234
SHA-256:	2584E1521065E45EC3C17767C065429038FC6291C091097EA8B22C8A502C41DD
SHA-512:	83E334B80DE08903CFA9891A3FA349C1ECE7E19F8E62B74A017512FA9A7989A0FD31929BF1FC13847BEE04F2DA3DACF6BC3F5EE58F0E4B9D495F4B9AF12ED2B7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Joe Sandbox View:	Filename: qCc1a4w5YZ.exe, Detection: malicious, Browse Filename: stN592INV6.exe, Detection: malicious, Browse Filename: onq54JS79W.exe, Detection: malicious, Browse Filename: MSNRf9dZ63.exe, Detection: malicious, Browse Filename: 7Qu8thR7WW.dll, Detection: malicious, Browse Filename: MSmReFKunQ.dll, Detection: malicious, Browse Filename: kXpnLUmuU2.dll, Detection: malicious, Browse Filename: TigrxMihsc.dll, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..T...T...T..X...T.._...T.'.Z...T..^...T..P...T.g.....T...U...T..._...T.c.R...T.Rich..T.........................PE..L...A..L.................p... 5......w............@...........................5.................................................d.........4..........................................................................................................text....i.......p.................. ..`.rdata..p_.......`..................@..@.data...X........ ..................@....rsrc.....4.......4.................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\mssecsvc.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3723264
Entropy (8bit):	7.965905243891064
Encrypted:	false
SSDEEP:	98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HI:yDqPe1Cxcxk3ZAEUadzR8yc4HI
MD5:	0C694193CEAC8BFB016491FFB534EB7C
SHA1:	3AFA73283D1E17DE1BDE6CC14E19417E70FC9554
SHA-256:	DBF3890B782AC04136C3336814EEF97E3C0F4133F9592E882C131C179161B27B
SHA-512:	BFA729E9449C0A438CFB51FC9F4314022B2F18092938FD42702A06246EDC865DB77327399A8D21CC1FA208A99E3436E4A460CB010E428CADDC638C3FA6547AFB
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvc.exe, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (based on rule by US CERT) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvc.exe, Author: us-cert code analysis team Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\mssecsvc.exe, Author: ReversingLabs
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U<S..]=..]=..]=.jA1..]=.A3..]=.~B7..]=.~B6..]=.~B9..]=..R`..]=..]<.J]=.'{6..]=..[;..]=.Rich.]=.........................PE..L.....L.....................08...................@...........................f......................................................1.T.5..........................................................................................................text.............................. ..`.rdata..............................@..@.data....H0......p..................@....rsrc...T.5...1...5.. ..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\tasksche.exe

Download File

Process:	C:\Windows\mssecsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3514368
Entropy (8bit):	7.996072890929898
Encrypted:	true
SSDEEP:	98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hj:QqPe1Cxcxk3ZAEUadzR8yc4Hj
MD5:	7F7CCAA16FB15EB1C7399D422F8363E8
SHA1:	BD44D0AB543BF814D93B719C24E90D8DD7111234
SHA-256:	2584E1521065E45EC3C17767C065429038FC6291C091097EA8B22C8A502C41DD
SHA-512:	83E334B80DE08903CFA9891A3FA349C1ECE7E19F8E62B74A017512FA9A7989A0FD31929BF1FC13847BEE04F2DA3DACF6BC3F5EE58F0E4B9D495F4B9AF12ED2B7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\tasksche.exe, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\tasksche.exe, Author: ReversingLabs
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Joe Sandbox View:	Filename: qCc1a4w5YZ.exe, Detection: malicious, Browse Filename: stN592INV6.exe, Detection: malicious, Browse Filename: onq54JS79W.exe, Detection: malicious, Browse Filename: MSNRf9dZ63.exe, Detection: malicious, Browse Filename: 7Qu8thR7WW.dll, Detection: malicious, Browse Filename: MSmReFKunQ.dll, Detection: malicious, Browse Filename: kXpnLUmuU2.dll, Detection: malicious, Browse Filename: TigrxMihsc.dll, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..T...T...T..X...T.._...T.'.Z...T..^...T..P...T.g.....T...U...T..._...T.c.R...T.Rich..T.........................PE..L...A..L.................p... 5......w............@...........................5.................................................d.........4..........................................................................................................text....i.......p.................. ..`.rdata..p_.......`..................@..@.data...X........ ..................@....rsrc.....4.......4.................@..@........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.412630716402947
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	qt680eucI4.dll
File size:	5'267'459 bytes
MD5:	ae12bb54af31227017feffd9598a6f5e
SHA1:	f597a1cc16d42b7f02e077696e067cd3030a06d9
SHA256:	c05e2dab77349cd639aa837e7e121710b8a0718d8fc93fb4cc6458ae90e5c597
SHA512:	a80b1cc70cafff3b8edb2e732fa2360436cc7556ba91977ab1fa505ad7c6e184c465839d1584f827be17ccb751240432348debe69eed4e006321d9af4334621b
SSDEEP:	98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:+DqPe1Cxcxk3ZAEUadzR8yc4H
TLSH:	92363394622CB2FCF0440EB44463896BB7B33C6967BA5E1F8BC086670D43B5BAFD0641
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.r_9...9...9.......=...9...6.....A.:.......8.......8.......:...Rich9...........................PE..L...QW.Y...........!.......

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x100011e9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x59145751 [Thu May 11 12:21:37 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2e5708ae5fed0403e8117c645fb23e5b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ebx
mov ebx, dword ptr [ebp+08h]
push esi
mov esi, dword ptr [ebp+0Ch]
push edi
mov edi, dword ptr [ebp+10h]
test esi, esi
jne 00007F90FCBA916Bh
cmp dword ptr [10003140h], 00000000h
jmp 00007F90FCBA9188h
cmp esi, 01h
je 00007F90FCBA9167h
cmp esi, 02h
jne 00007F90FCBA9184h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F90FCBA916Bh
push edi
push esi
push ebx
call eax
test eax, eax
je 00007F90FCBA916Eh
push edi
push esi
push ebx
call 00007F90FCBA907Ah
test eax, eax
jne 00007F90FCBA9166h
xor eax, eax
jmp 00007F90FCBA91B0h
push edi
push esi
push ebx
call 00007F90FCBA8F2Ch
cmp esi, 01h
mov dword ptr [ebp+0Ch], eax
jne 00007F90FCBA916Eh
test eax, eax
jne 00007F90FCBA9199h
push edi
push eax
push ebx
call 00007F90FCBA9056h
test esi, esi
je 00007F90FCBA9167h
cmp esi, 03h
jne 00007F90FCBA9188h
push edi
push esi
push ebx
call 00007F90FCBA9045h
test eax, eax
jne 00007F90FCBA9165h
and dword ptr [ebp+0Ch], eax
cmp dword ptr [ebp+0Ch], 00000000h
je 00007F90FCBA9173h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F90FCBA916Ah
push edi
push esi
push ebx
call eax
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
pop esi
pop ebx
pop ebp
retn 000Ch
jmp dword ptr [10002028h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[C++] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2190	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x203c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x500060	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x505000	0x5c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28c	0x1000	8de9a2cb31e4c74bd008b871d14bfafc	False	0.13037109375	data	1.4429971244731552	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x1d8	0x1000	3dd394f95ab218593f2bc8eb65184db4	False	0.072509765625	data	0.7346018133622799	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x154	0x1000	fe5022c5b5d015ad38b2b77fc437a5cb	False	0.016845703125	Matlab v4 mat-file (little endian) C:\%s\%s, numeric, rows 0, columns 0	0.085238686413312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x500060	0x501000	d0fa4e97f2da8d58667c85e5416426e6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x505000	0x2ac	0x1000	620f0b67a91f7f74151bc5be745b7110	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
W	0x4060	0x500000	data	English	United States	0.8770942687988281

Imports

DLL	Import
KERNEL32.dll	CloseHandle, WriteFile, CreateFileA, SizeofResource, LockResource, LoadResource, FindResourceA, CreateProcessA
MSVCRT.dll	free, _initterm, malloc, _adjust_fdiv, sprintf

Exports

Name	Ordinal	Address
PlayGame	1	0x10001114

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/07/24-19:46:45.138222	TCP	2031515	ET TROJAN Known Sinkhole Response Kryptos Logic	80	49749	104.16.167.228	192.168.2.4
06/07/24-19:46:44.477491	TCP	2024298	ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1	49749	80	192.168.2.4	104.16.167.228
06/07/24-19:46:43.047997	TCP	2024298	ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1	49732	80	192.168.2.4	104.16.167.228
06/07/24-19:46:42.331605	TCP	2031515	ET TROJAN Known Sinkhole Response Kryptos Logic	80	49731	104.16.167.228	192.168.2.4
06/07/24-19:46:43.690291	TCP	2031515	ET TROJAN Known Sinkhole Response Kryptos Logic	80	49732	104.16.167.228	192.168.2.4
06/07/24-19:46:41.674173	UDP	2024291	ET TROJAN Possible WannaCry DNS Lookup 1	55637	53	192.168.2.4	1.1.1.1
06/07/24-19:46:41.695714	TCP	2024298	ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1	49731	80	192.168.2.4	104.16.167.228

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 7, 2024 19:46:34.483158112 CEST	49675	443	192.168.2.4	173.222.162.32
Jun 7, 2024 19:46:41.690236092 CEST	49731	80	192.168.2.4	104.16.167.228
Jun 7, 2024 19:46:41.695405006 CEST	80	49731	104.16.167.228	192.168.2.4
Jun 7, 2024 19:46:41.695574999 CEST	49731	80	192.168.2.4	104.16.167.228
Jun 7, 2024 19:46:41.695713997 CEST	49731	80	192.168.2.4	104.16.167.228
Jun 7, 2024 19:46:41.700659990 CEST	80	49731	104.16.167.228	192.168.2.4
Jun 7, 2024 19:46:42.331604958 CEST	80	49731	104.16.167.228	192.168.2.4
Jun 7, 2024 19:46:42.331804037 CEST	49731	80	192.168.2.4	104.16.167.228
Jun 7, 2024 19:46:42.331898928 CEST	49731	80	192.168.2.4	104.16.167.228
Jun 7, 2024 19:46:42.333373070 CEST	80	49731	104.16.167.228	192.168.2.4
Jun 7, 2024 19:46:42.333528042 CEST	49731	80	192.168.2.4	104.16.167.228
Jun 7, 2024 19:46:42.337009907 CEST	80	49731	104.16.167.228	192.168.2.4
Jun 7, 2024 19:46:43.038265944 CEST	49732	80	192.168.2.4	104.16.167.228
Jun 7, 2024 19:46:43.047276020 CEST	80	49732	104.16.167.228	192.168.2.4
Jun 7, 2024 19:46:43.047408104 CEST	49732	80	192.168.2.4	104.16.167.228
Jun 7, 2024 19:46:43.047996998 CEST	49732	80	192.168.2.4	104.16.167.228
Jun 7, 2024 19:46:43.053236008 CEST	80	49732	104.16.167.228	192.168.2.4
Jun 7, 2024 19:46:43.690290928 CEST	80	49732	104.16.167.228	192.168.2.4
Jun 7, 2024 19:46:43.690972090 CEST	49732	80	192.168.2.4	104.16.167.228
Jun 7, 2024 19:46:43.691000938 CEST	49732	80	192.168.2.4	104.16.167.228
Jun 7, 2024 19:46:43.692262888 CEST	80	49732	104.16.167.228	192.168.2.4
Jun 7, 2024 19:46:43.692585945 CEST	49732	80	192.168.2.4	104.16.167.228
Jun 7, 2024 19:46:43.696963072 CEST	80	49732	104.16.167.228	192.168.2.4
Jun 7, 2024 19:46:43.763494015 CEST	49733	445	192.168.2.4	103.194.154.134
Jun 7, 2024 19:46:43.779386044 CEST	445	49733	103.194.154.134	192.168.2.4
Jun 7, 2024 19:46:43.779472113 CEST	49733	445	192.168.2.4	103.194.154.134
Jun 7, 2024 19:46:43.779519081 CEST	49733	445	192.168.2.4	103.194.154.134
Jun 7, 2024 19:46:43.779691935 CEST	49736	445	192.168.2.4	103.194.154.1
Jun 7, 2024 19:46:43.784795046 CEST	445	49736	103.194.154.1	192.168.2.4
Jun 7, 2024 19:46:43.784868002 CEST	49736	445	192.168.2.4	103.194.154.1
Jun 7, 2024 19:46:43.785573959 CEST	49736	445	192.168.2.4	103.194.154.1
Jun 7, 2024 19:46:43.787606955 CEST	445	49733	103.194.154.134	192.168.2.4
Jun 7, 2024 19:46:43.787671089 CEST	49733	445	192.168.2.4	103.194.154.134
Jun 7, 2024 19:46:43.788517952 CEST	49737	445	192.168.2.4	103.194.154.1
Jun 7, 2024 19:46:43.792222977 CEST	445	49736	103.194.154.1	192.168.2.4
Jun 7, 2024 19:46:43.792289972 CEST	49736	445	192.168.2.4	103.194.154.1
Jun 7, 2024 19:46:43.793438911 CEST	445	49737	103.194.154.1	192.168.2.4
Jun 7, 2024 19:46:43.793512106 CEST	49737	445	192.168.2.4	103.194.154.1
Jun 7, 2024 19:46:43.793548107 CEST	49737	445	192.168.2.4	103.194.154.1
Jun 7, 2024 19:46:43.798468113 CEST	445	49737	103.194.154.1	192.168.2.4
Jun 7, 2024 19:46:44.107994080 CEST	49675	443	192.168.2.4	173.222.162.32
Jun 7, 2024 19:46:44.471924067 CEST	49749	80	192.168.2.4	104.16.167.228
Jun 7, 2024 19:46:44.477077961 CEST	80	49749	104.16.167.228	192.168.2.4
Jun 7, 2024 19:46:44.477185011 CEST	49749	80	192.168.2.4	104.16.167.228
Jun 7, 2024 19:46:44.477490902 CEST	49749	80	192.168.2.4	104.16.167.228
Jun 7, 2024 19:46:44.482561111 CEST	80	49749	104.16.167.228	192.168.2.4
Jun 7, 2024 19:46:45.138221979 CEST	80	49749	104.16.167.228	192.168.2.4
Jun 7, 2024 19:46:45.138525963 CEST	49749	80	192.168.2.4	104.16.167.228
Jun 7, 2024 19:46:45.138622999 CEST	49749	80	192.168.2.4	104.16.167.228
Jun 7, 2024 19:46:45.139679909 CEST	80	49749	104.16.167.228	192.168.2.4
Jun 7, 2024 19:46:45.139750004 CEST	49749	80	192.168.2.4	104.16.167.228
Jun 7, 2024 19:46:45.143837929 CEST	80	49749	104.16.167.228	192.168.2.4
Jun 7, 2024 19:46:45.778990030 CEST	49759	445	192.168.2.4	73.148.167.178
Jun 7, 2024 19:46:45.784257889 CEST	445	49759	73.148.167.178	192.168.2.4
Jun 7, 2024 19:46:45.784356117 CEST	49759	445	192.168.2.4	73.148.167.178
Jun 7, 2024 19:46:45.784425974 CEST	49759	445	192.168.2.4	73.148.167.178
Jun 7, 2024 19:46:45.784594059 CEST	49760	445	192.168.2.4	73.148.167.1
Jun 7, 2024 19:46:45.789591074 CEST	445	49760	73.148.167.1	192.168.2.4
Jun 7, 2024 19:46:45.789712906 CEST	49760	445	192.168.2.4	73.148.167.1
Jun 7, 2024 19:46:45.789741993 CEST	49760	445	192.168.2.4	73.148.167.1
Jun 7, 2024 19:46:45.789849043 CEST	445	49759	73.148.167.178	192.168.2.4
Jun 7, 2024 19:46:45.789906025 CEST	49759	445	192.168.2.4	73.148.167.178
Jun 7, 2024 19:46:45.790728092 CEST	49761	445	192.168.2.4	73.148.167.1
Jun 7, 2024 19:46:45.795222044 CEST	445	49760	73.148.167.1	192.168.2.4
Jun 7, 2024 19:46:45.795277119 CEST	49760	445	192.168.2.4	73.148.167.1
Jun 7, 2024 19:46:45.795619965 CEST	445	49761	73.148.167.1	192.168.2.4
Jun 7, 2024 19:46:45.795696020 CEST	49761	445	192.168.2.4	73.148.167.1
Jun 7, 2024 19:46:45.795763016 CEST	49761	445	192.168.2.4	73.148.167.1
Jun 7, 2024 19:46:45.801131964 CEST	445	49761	73.148.167.1	192.168.2.4
Jun 7, 2024 19:46:47.780819893 CEST	49784	445	192.168.2.4	189.66.242.36
Jun 7, 2024 19:46:47.786017895 CEST	445	49784	189.66.242.36	192.168.2.4
Jun 7, 2024 19:46:47.786111116 CEST	49784	445	192.168.2.4	189.66.242.36
Jun 7, 2024 19:46:47.786151886 CEST	49784	445	192.168.2.4	189.66.242.36
Jun 7, 2024 19:46:47.786315918 CEST	49785	445	192.168.2.4	189.66.242.1
Jun 7, 2024 19:46:47.791248083 CEST	445	49785	189.66.242.1	192.168.2.4
Jun 7, 2024 19:46:47.791313887 CEST	49785	445	192.168.2.4	189.66.242.1
Jun 7, 2024 19:46:47.791348934 CEST	49785	445	192.168.2.4	189.66.242.1
Jun 7, 2024 19:46:47.791445017 CEST	445	49784	189.66.242.36	192.168.2.4
Jun 7, 2024 19:46:47.791501045 CEST	49784	445	192.168.2.4	189.66.242.36
Jun 7, 2024 19:46:47.792283058 CEST	49786	445	192.168.2.4	189.66.242.1
Jun 7, 2024 19:46:47.796686888 CEST	445	49785	189.66.242.1	192.168.2.4
Jun 7, 2024 19:46:47.796741009 CEST	49785	445	192.168.2.4	189.66.242.1
Jun 7, 2024 19:46:47.797135115 CEST	445	49786	189.66.242.1	192.168.2.4
Jun 7, 2024 19:46:47.797195911 CEST	49786	445	192.168.2.4	189.66.242.1
Jun 7, 2024 19:46:47.797238111 CEST	49786	445	192.168.2.4	189.66.242.1
Jun 7, 2024 19:46:47.802074909 CEST	445	49786	189.66.242.1	192.168.2.4
Jun 7, 2024 19:46:49.797208071 CEST	49809	445	192.168.2.4	134.136.111.217
Jun 7, 2024 19:46:49.802330017 CEST	445	49809	134.136.111.217	192.168.2.4
Jun 7, 2024 19:46:49.802406073 CEST	49809	445	192.168.2.4	134.136.111.217
Jun 7, 2024 19:46:49.802428961 CEST	49809	445	192.168.2.4	134.136.111.217
Jun 7, 2024 19:46:49.802567959 CEST	49810	445	192.168.2.4	134.136.111.1
Jun 7, 2024 19:46:49.807611942 CEST	445	49810	134.136.111.1	192.168.2.4
Jun 7, 2024 19:46:49.807677031 CEST	49810	445	192.168.2.4	134.136.111.1
Jun 7, 2024 19:46:49.807717085 CEST	49810	445	192.168.2.4	134.136.111.1
Jun 7, 2024 19:46:49.807960033 CEST	445	49809	134.136.111.217	192.168.2.4
Jun 7, 2024 19:46:49.808016062 CEST	49809	445	192.168.2.4	134.136.111.217
Jun 7, 2024 19:46:49.808996916 CEST	49811	445	192.168.2.4	134.136.111.1
Jun 7, 2024 19:46:49.812932014 CEST	445	49810	134.136.111.1	192.168.2.4
Jun 7, 2024 19:46:49.812990904 CEST	49810	445	192.168.2.4	134.136.111.1
Jun 7, 2024 19:46:49.813940048 CEST	445	49811	134.136.111.1	192.168.2.4
Jun 7, 2024 19:46:49.814032078 CEST	49811	445	192.168.2.4	134.136.111.1
Jun 7, 2024 19:46:49.814032078 CEST	49811	445	192.168.2.4	134.136.111.1
Jun 7, 2024 19:46:49.819179058 CEST	445	49811	134.136.111.1	192.168.2.4
Jun 7, 2024 19:46:51.812513113 CEST	49831	445	192.168.2.4	172.183.28.115
Jun 7, 2024 19:46:51.818001986 CEST	445	49831	172.183.28.115	192.168.2.4
Jun 7, 2024 19:46:51.818219900 CEST	49831	445	192.168.2.4	172.183.28.115
Jun 7, 2024 19:46:51.820154905 CEST	49831	445	192.168.2.4	172.183.28.115
Jun 7, 2024 19:46:51.820224047 CEST	49832	445	192.168.2.4	172.183.28.1
Jun 7, 2024 19:46:51.825383902 CEST	445	49832	172.183.28.1	192.168.2.4
Jun 7, 2024 19:46:51.825400114 CEST	445	49831	172.183.28.115	192.168.2.4
Jun 7, 2024 19:46:51.825592041 CEST	49832	445	192.168.2.4	172.183.28.1
Jun 7, 2024 19:46:51.825704098 CEST	49831	445	192.168.2.4	172.183.28.115
Jun 7, 2024 19:46:51.826812029 CEST	49833	445	192.168.2.4	172.183.28.1
Jun 7, 2024 19:46:51.830825090 CEST	445	49832	172.183.28.1	192.168.2.4
Jun 7, 2024 19:46:51.830889940 CEST	49832	445	192.168.2.4	172.183.28.1
Jun 7, 2024 19:46:51.831737041 CEST	445	49833	172.183.28.1	192.168.2.4
Jun 7, 2024 19:46:51.831806898 CEST	49833	445	192.168.2.4	172.183.28.1
Jun 7, 2024 19:46:51.831850052 CEST	49833	445	192.168.2.4	172.183.28.1
Jun 7, 2024 19:46:51.836833000 CEST	445	49833	172.183.28.1	192.168.2.4
Jun 7, 2024 19:46:52.284830093 CEST	445	49737	103.194.154.1	192.168.2.4
Jun 7, 2024 19:46:52.285052061 CEST	49737	445	192.168.2.4	103.194.154.1
Jun 7, 2024 19:46:52.285052061 CEST	49737	445	192.168.2.4	103.194.154.1
Jun 7, 2024 19:46:52.285135031 CEST	49737	445	192.168.2.4	103.194.154.1
Jun 7, 2024 19:46:52.290420055 CEST	445	49737	103.194.154.1	192.168.2.4
Jun 7, 2024 19:46:52.290437937 CEST	445	49737	103.194.154.1	192.168.2.4
Jun 7, 2024 19:46:53.828509092 CEST	49856	445	192.168.2.4	78.235.15.161
Jun 7, 2024 19:46:53.833873034 CEST	445	49856	78.235.15.161	192.168.2.4
Jun 7, 2024 19:46:53.834105015 CEST	49856	445	192.168.2.4	78.235.15.161
Jun 7, 2024 19:46:53.834105015 CEST	49856	445	192.168.2.4	78.235.15.161
Jun 7, 2024 19:46:53.834462881 CEST	49857	445	192.168.2.4	78.235.15.1
Jun 7, 2024 19:46:53.839540958 CEST	445	49857	78.235.15.1	192.168.2.4
Jun 7, 2024 19:46:53.839572906 CEST	445	49856	78.235.15.161	192.168.2.4
Jun 7, 2024 19:46:53.839838028 CEST	49856	445	192.168.2.4	78.235.15.161
Jun 7, 2024 19:46:53.839838982 CEST	49857	445	192.168.2.4	78.235.15.1
Jun 7, 2024 19:46:53.839838982 CEST	49857	445	192.168.2.4	78.235.15.1
Jun 7, 2024 19:46:53.841108084 CEST	49858	445	192.168.2.4	78.235.15.1
Jun 7, 2024 19:46:53.845293045 CEST	445	49857	78.235.15.1	192.168.2.4
Jun 7, 2024 19:46:53.845506907 CEST	49857	445	192.168.2.4	78.235.15.1
Jun 7, 2024 19:46:53.846087933 CEST	445	49858	78.235.15.1	192.168.2.4
Jun 7, 2024 19:46:53.846211910 CEST	49858	445	192.168.2.4	78.235.15.1
Jun 7, 2024 19:46:53.846307993 CEST	49858	445	192.168.2.4	78.235.15.1
Jun 7, 2024 19:46:53.851350069 CEST	445	49858	78.235.15.1	192.168.2.4
Jun 7, 2024 19:46:54.286660910 CEST	445	49761	73.148.167.1	192.168.2.4
Jun 7, 2024 19:46:54.286915064 CEST	49761	445	192.168.2.4	73.148.167.1
Jun 7, 2024 19:46:54.286916018 CEST	49761	445	192.168.2.4	73.148.167.1
Jun 7, 2024 19:46:54.287036896 CEST	49761	445	192.168.2.4	73.148.167.1
Jun 7, 2024 19:46:54.292416096 CEST	445	49761	73.148.167.1	192.168.2.4
Jun 7, 2024 19:46:54.292459011 CEST	445	49761	73.148.167.1	192.168.2.4
Jun 7, 2024 19:46:55.295939922 CEST	49875	445	192.168.2.4	103.194.154.1
Jun 7, 2024 19:46:55.301318884 CEST	445	49875	103.194.154.1	192.168.2.4
Jun 7, 2024 19:46:55.301534891 CEST	49875	445	192.168.2.4	103.194.154.1
Jun 7, 2024 19:46:55.301534891 CEST	49875	445	192.168.2.4	103.194.154.1
Jun 7, 2024 19:46:55.306833029 CEST	445	49875	103.194.154.1	192.168.2.4
Jun 7, 2024 19:46:55.788585901 CEST	445	49875	103.194.154.1	192.168.2.4
Jun 7, 2024 19:46:55.788667917 CEST	49875	445	192.168.2.4	103.194.154.1
Jun 7, 2024 19:46:55.788753033 CEST	49875	445	192.168.2.4	103.194.154.1
Jun 7, 2024 19:46:55.788753033 CEST	49875	445	192.168.2.4	103.194.154.1
Jun 7, 2024 19:46:55.793775082 CEST	445	49875	103.194.154.1	192.168.2.4
Jun 7, 2024 19:46:55.793828011 CEST	445	49875	103.194.154.1	192.168.2.4
Jun 7, 2024 19:46:55.842406988 CEST	49881	445	192.168.2.4	103.194.154.2
Jun 7, 2024 19:46:55.842691898 CEST	49882	445	192.168.2.4	83.55.32.45
Jun 7, 2024 19:46:55.848135948 CEST	445	49881	103.194.154.2	192.168.2.4
Jun 7, 2024 19:46:55.848217010 CEST	49881	445	192.168.2.4	103.194.154.2
Jun 7, 2024 19:46:55.848247051 CEST	49881	445	192.168.2.4	103.194.154.2
Jun 7, 2024 19:46:55.848562956 CEST	49883	445	192.168.2.4	103.194.154.2
Jun 7, 2024 19:46:55.848666906 CEST	445	49882	83.55.32.45	192.168.2.4
Jun 7, 2024 19:46:55.848738909 CEST	49882	445	192.168.2.4	83.55.32.45
Jun 7, 2024 19:46:55.848788023 CEST	49882	445	192.168.2.4	83.55.32.45
Jun 7, 2024 19:46:55.848892927 CEST	49884	445	192.168.2.4	83.55.32.1
Jun 7, 2024 19:46:55.854430914 CEST	445	49883	103.194.154.2	192.168.2.4
Jun 7, 2024 19:46:55.854501963 CEST	49883	445	192.168.2.4	103.194.154.2
Jun 7, 2024 19:46:55.854542971 CEST	49883	445	192.168.2.4	103.194.154.2
Jun 7, 2024 19:46:55.854801893 CEST	445	49881	103.194.154.2	192.168.2.4
Jun 7, 2024 19:46:55.854860067 CEST	49881	445	192.168.2.4	103.194.154.2
Jun 7, 2024 19:46:55.854938030 CEST	445	49884	83.55.32.1	192.168.2.4
Jun 7, 2024 19:46:55.855003119 CEST	49884	445	192.168.2.4	83.55.32.1
Jun 7, 2024 19:46:55.855062008 CEST	49884	445	192.168.2.4	83.55.32.1
Jun 7, 2024 19:46:55.855350018 CEST	49885	445	192.168.2.4	83.55.32.1
Jun 7, 2024 19:46:55.856579065 CEST	445	49882	83.55.32.45	192.168.2.4
Jun 7, 2024 19:46:55.856636047 CEST	49882	445	192.168.2.4	83.55.32.45
Jun 7, 2024 19:46:55.859471083 CEST	445	49883	103.194.154.2	192.168.2.4
Jun 7, 2024 19:46:55.860075951 CEST	445	49884	83.55.32.1	192.168.2.4
Jun 7, 2024 19:46:55.860137939 CEST	49884	445	192.168.2.4	83.55.32.1
Jun 7, 2024 19:46:55.860271931 CEST	445	49885	83.55.32.1	192.168.2.4
Jun 7, 2024 19:46:55.860337019 CEST	49885	445	192.168.2.4	83.55.32.1
Jun 7, 2024 19:46:55.860379934 CEST	49885	445	192.168.2.4	83.55.32.1
Jun 7, 2024 19:46:55.865295887 CEST	445	49885	83.55.32.1	192.168.2.4
Jun 7, 2024 19:46:56.303317070 CEST	445	49786	189.66.242.1	192.168.2.4
Jun 7, 2024 19:46:56.303399086 CEST	49786	445	192.168.2.4	189.66.242.1
Jun 7, 2024 19:46:56.303448915 CEST	49786	445	192.168.2.4	189.66.242.1
Jun 7, 2024 19:46:56.303525925 CEST	49786	445	192.168.2.4	189.66.242.1
Jun 7, 2024 19:46:56.308507919 CEST	445	49786	189.66.242.1	192.168.2.4
Jun 7, 2024 19:46:56.308538914 CEST	445	49786	189.66.242.1	192.168.2.4
Jun 7, 2024 19:46:56.901846886 CEST	49897	443	192.168.2.4	20.12.23.50
Jun 7, 2024 19:46:56.901933908 CEST	443	49897	20.12.23.50	192.168.2.4
Jun 7, 2024 19:46:56.902014971 CEST	49897	443	192.168.2.4	20.12.23.50
Jun 7, 2024 19:46:56.903604031 CEST	49897	443	192.168.2.4	20.12.23.50
Jun 7, 2024 19:46:56.903633118 CEST	443	49897	20.12.23.50	192.168.2.4
Jun 7, 2024 19:46:57.295629978 CEST	49902	445	192.168.2.4	73.148.167.1
Jun 7, 2024 19:46:57.300781012 CEST	445	49902	73.148.167.1	192.168.2.4
Jun 7, 2024 19:46:57.300869942 CEST	49902	445	192.168.2.4	73.148.167.1
Jun 7, 2024 19:46:57.301059961 CEST	49902	445	192.168.2.4	73.148.167.1
Jun 7, 2024 19:46:57.306071043 CEST	445	49902	73.148.167.1	192.168.2.4
Jun 7, 2024 19:46:57.841517925 CEST	443	49897	20.12.23.50	192.168.2.4
Jun 7, 2024 19:46:57.841840029 CEST	49897	443	192.168.2.4	20.12.23.50
Jun 7, 2024 19:46:57.844712973 CEST	49897	443	192.168.2.4	20.12.23.50
Jun 7, 2024 19:46:57.844743967 CEST	443	49897	20.12.23.50	192.168.2.4
Jun 7, 2024 19:46:57.845300913 CEST	443	49897	20.12.23.50	192.168.2.4
Jun 7, 2024 19:46:57.860809088 CEST	49910	445	192.168.2.4	215.114.241.16
Jun 7, 2024 19:46:57.865885019 CEST	445	49910	215.114.241.16	192.168.2.4
Jun 7, 2024 19:46:57.867840052 CEST	49910	445	192.168.2.4	215.114.241.16
Jun 7, 2024 19:46:57.867903948 CEST	49910	445	192.168.2.4	215.114.241.16
Jun 7, 2024 19:46:57.868020058 CEST	49911	445	192.168.2.4	215.114.241.1
Jun 7, 2024 19:46:57.873203039 CEST	445	49911	215.114.241.1	192.168.2.4
Jun 7, 2024 19:46:57.873236895 CEST	445	49910	215.114.241.16	192.168.2.4
Jun 7, 2024 19:46:57.873326063 CEST	49910	445	192.168.2.4	215.114.241.16
Jun 7, 2024 19:46:57.873650074 CEST	49911	445	192.168.2.4	215.114.241.1
Jun 7, 2024 19:46:57.873650074 CEST	49911	445	192.168.2.4	215.114.241.1
Jun 7, 2024 19:46:57.878985882 CEST	445	49911	215.114.241.1	192.168.2.4
Jun 7, 2024 19:46:57.879255056 CEST	49911	445	192.168.2.4	215.114.241.1
Jun 7, 2024 19:46:57.889122009 CEST	49897	443	192.168.2.4	20.12.23.50
Jun 7, 2024 19:46:58.102010012 CEST	49912	445	192.168.2.4	215.114.241.1
Jun 7, 2024 19:46:58.108452082 CEST	445	49912	215.114.241.1	192.168.2.4
Jun 7, 2024 19:46:58.111804962 CEST	49912	445	192.168.2.4	215.114.241.1
Jun 7, 2024 19:46:58.139995098 CEST	49912	445	192.168.2.4	215.114.241.1
Jun 7, 2024 19:46:58.145046949 CEST	445	49912	215.114.241.1	192.168.2.4
Jun 7, 2024 19:46:58.302052975 CEST	445	49811	134.136.111.1	192.168.2.4
Jun 7, 2024 19:46:58.302257061 CEST	49811	445	192.168.2.4	134.136.111.1
Jun 7, 2024 19:46:58.302356005 CEST	49811	445	192.168.2.4	134.136.111.1
Jun 7, 2024 19:46:58.302356005 CEST	49811	445	192.168.2.4	134.136.111.1
Jun 7, 2024 19:46:58.307344913 CEST	445	49811	134.136.111.1	192.168.2.4
Jun 7, 2024 19:46:58.307374001 CEST	445	49811	134.136.111.1	192.168.2.4
Jun 7, 2024 19:46:59.090886116 CEST	49897	443	192.168.2.4	20.12.23.50
Jun 7, 2024 19:46:59.132592916 CEST	443	49897	20.12.23.50	192.168.2.4
Jun 7, 2024 19:46:59.311244011 CEST	49928	445	192.168.2.4	189.66.242.1
Jun 7, 2024 19:46:59.316349983 CEST	445	49928	189.66.242.1	192.168.2.4
Jun 7, 2024 19:46:59.316468000 CEST	49928	445	192.168.2.4	189.66.242.1
Jun 7, 2024 19:46:59.316534042 CEST	49928	445	192.168.2.4	189.66.242.1
Jun 7, 2024 19:46:59.321499109 CEST	445	49928	189.66.242.1	192.168.2.4
Jun 7, 2024 19:46:59.391311884 CEST	443	49897	20.12.23.50	192.168.2.4
Jun 7, 2024 19:46:59.391372919 CEST	443	49897	20.12.23.50	192.168.2.4
Jun 7, 2024 19:46:59.391392946 CEST	443	49897	20.12.23.50	192.168.2.4
Jun 7, 2024 19:46:59.391446114 CEST	49897	443	192.168.2.4	20.12.23.50
Jun 7, 2024 19:46:59.391480923 CEST	443	49897	20.12.23.50	192.168.2.4
Jun 7, 2024 19:46:59.391508102 CEST	443	49897	20.12.23.50	192.168.2.4
Jun 7, 2024 19:46:59.391526937 CEST	443	49897	20.12.23.50	192.168.2.4
Jun 7, 2024 19:46:59.391592979 CEST	49897	443	192.168.2.4	20.12.23.50
Jun 7, 2024 19:46:59.391592979 CEST	49897	443	192.168.2.4	20.12.23.50
Jun 7, 2024 19:46:59.391592979 CEST	49897	443	192.168.2.4	20.12.23.50
Jun 7, 2024 19:46:59.391592979 CEST	49897	443	192.168.2.4	20.12.23.50
Jun 7, 2024 19:46:59.391818047 CEST	443	49897	20.12.23.50	192.168.2.4
Jun 7, 2024 19:46:59.391891003 CEST	49897	443	192.168.2.4	20.12.23.50
Jun 7, 2024 19:46:59.391904116 CEST	443	49897	20.12.23.50	192.168.2.4
Jun 7, 2024 19:46:59.392029047 CEST	443	49897	20.12.23.50	192.168.2.4
Jun 7, 2024 19:46:59.392081976 CEST	49897	443	192.168.2.4	20.12.23.50
Jun 7, 2024 19:46:59.873843908 CEST	49939	445	192.168.2.4	125.190.126.35
Jun 7, 2024 19:46:59.879400969 CEST	445	49939	125.190.126.35	192.168.2.4
Jun 7, 2024 19:46:59.879506111 CEST	49939	445	192.168.2.4	125.190.126.35
Jun 7, 2024 19:46:59.879573107 CEST	49939	445	192.168.2.4	125.190.126.35
Jun 7, 2024 19:46:59.879684925 CEST	49940	445	192.168.2.4	125.190.126.1
Jun 7, 2024 19:46:59.884840965 CEST	445	49940	125.190.126.1	192.168.2.4
Jun 7, 2024 19:46:59.884872913 CEST	445	49939	125.190.126.35	192.168.2.4
Jun 7, 2024 19:46:59.884903908 CEST	49940	445	192.168.2.4	125.190.126.1
Jun 7, 2024 19:46:59.884944916 CEST	49939	445	192.168.2.4	125.190.126.35
Jun 7, 2024 19:46:59.884969950 CEST	49940	445	192.168.2.4	125.190.126.1
Jun 7, 2024 19:46:59.885330915 CEST	49941	445	192.168.2.4	125.190.126.1
Jun 7, 2024 19:46:59.890496016 CEST	445	49941	125.190.126.1	192.168.2.4
Jun 7, 2024 19:46:59.890649080 CEST	49941	445	192.168.2.4	125.190.126.1
Jun 7, 2024 19:46:59.890650034 CEST	49941	445	192.168.2.4	125.190.126.1
Jun 7, 2024 19:46:59.890702009 CEST	445	49940	125.190.126.1	192.168.2.4
Jun 7, 2024 19:46:59.890754938 CEST	49940	445	192.168.2.4	125.190.126.1
Jun 7, 2024 19:46:59.897001028 CEST	445	49941	125.190.126.1	192.168.2.4
Jun 7, 2024 19:47:00.269174099 CEST	49897	443	192.168.2.4	20.12.23.50
Jun 7, 2024 19:47:00.269175053 CEST	49897	443	192.168.2.4	20.12.23.50
Jun 7, 2024 19:47:00.269248009 CEST	443	49897	20.12.23.50	192.168.2.4
Jun 7, 2024 19:47:00.269284010 CEST	443	49897	20.12.23.50	192.168.2.4
Jun 7, 2024 19:47:00.322788000 CEST	445	49833	172.183.28.1	192.168.2.4
Jun 7, 2024 19:47:00.322860956 CEST	49833	445	192.168.2.4	172.183.28.1
Jun 7, 2024 19:47:00.322943926 CEST	49833	445	192.168.2.4	172.183.28.1
Jun 7, 2024 19:47:00.322966099 CEST	49833	445	192.168.2.4	172.183.28.1
Jun 7, 2024 19:47:00.327914953 CEST	445	49833	172.183.28.1	192.168.2.4
Jun 7, 2024 19:47:00.327950954 CEST	445	49833	172.183.28.1	192.168.2.4
Jun 7, 2024 19:47:01.311323881 CEST	49954	445	192.168.2.4	134.136.111.1
Jun 7, 2024 19:47:01.316524029 CEST	445	49954	134.136.111.1	192.168.2.4
Jun 7, 2024 19:47:01.316595078 CEST	49954	445	192.168.2.4	134.136.111.1
Jun 7, 2024 19:47:01.316656113 CEST	49954	445	192.168.2.4	134.136.111.1
Jun 7, 2024 19:47:01.321799040 CEST	445	49954	134.136.111.1	192.168.2.4
Jun 7, 2024 19:47:01.889791012 CEST	49964	445	192.168.2.4	146.45.88.56
Jun 7, 2024 19:47:01.894866943 CEST	445	49964	146.45.88.56	192.168.2.4
Jun 7, 2024 19:47:01.894983053 CEST	49964	445	192.168.2.4	146.45.88.56
Jun 7, 2024 19:47:01.895098925 CEST	49965	445	192.168.2.4	146.45.88.1
Jun 7, 2024 19:47:01.895098925 CEST	49964	445	192.168.2.4	146.45.88.56
Jun 7, 2024 19:47:01.900007963 CEST	445	49965	146.45.88.1	192.168.2.4
Jun 7, 2024 19:47:01.900125980 CEST	49965	445	192.168.2.4	146.45.88.1
Jun 7, 2024 19:47:01.900125980 CEST	49965	445	192.168.2.4	146.45.88.1
Jun 7, 2024 19:47:01.900320053 CEST	445	49964	146.45.88.56	192.168.2.4
Jun 7, 2024 19:47:01.900338888 CEST	49966	445	192.168.2.4	146.45.88.1
Jun 7, 2024 19:47:01.900377035 CEST	49964	445	192.168.2.4	146.45.88.56
Jun 7, 2024 19:47:01.905232906 CEST	445	49966	146.45.88.1	192.168.2.4
Jun 7, 2024 19:47:01.905307055 CEST	49966	445	192.168.2.4	146.45.88.1
Jun 7, 2024 19:47:01.905345917 CEST	49966	445	192.168.2.4	146.45.88.1
Jun 7, 2024 19:47:01.905394077 CEST	445	49965	146.45.88.1	192.168.2.4
Jun 7, 2024 19:47:01.905440092 CEST	49965	445	192.168.2.4	146.45.88.1
Jun 7, 2024 19:47:01.910463095 CEST	445	49966	146.45.88.1	192.168.2.4
Jun 7, 2024 19:47:02.014014959 CEST	49723	80	192.168.2.4	93.184.221.240
Jun 7, 2024 19:47:02.019267082 CEST	80	49723	93.184.221.240	192.168.2.4
Jun 7, 2024 19:47:02.019341946 CEST	49723	80	192.168.2.4	93.184.221.240
Jun 7, 2024 19:47:02.344353914 CEST	445	49858	78.235.15.1	192.168.2.4
Jun 7, 2024 19:47:02.344430923 CEST	49858	445	192.168.2.4	78.235.15.1
Jun 7, 2024 19:47:02.344532967 CEST	49858	445	192.168.2.4	78.235.15.1
Jun 7, 2024 19:47:02.344579935 CEST	49858	445	192.168.2.4	78.235.15.1
Jun 7, 2024 19:47:02.349632025 CEST	445	49858	78.235.15.1	192.168.2.4
Jun 7, 2024 19:47:02.349647999 CEST	445	49858	78.235.15.1	192.168.2.4
Jun 7, 2024 19:47:03.326965094 CEST	49981	445	192.168.2.4	172.183.28.1
Jun 7, 2024 19:47:03.331940889 CEST	445	49981	172.183.28.1	192.168.2.4
Jun 7, 2024 19:47:03.332042933 CEST	49981	445	192.168.2.4	172.183.28.1
Jun 7, 2024 19:47:03.332097054 CEST	49981	445	192.168.2.4	172.183.28.1
Jun 7, 2024 19:47:03.336941957 CEST	445	49981	172.183.28.1	192.168.2.4
Jun 7, 2024 19:47:03.905002117 CEST	49991	445	192.168.2.4	56.152.161.70
Jun 7, 2024 19:47:03.910239935 CEST	445	49991	56.152.161.70	192.168.2.4
Jun 7, 2024 19:47:03.910342932 CEST	49991	445	192.168.2.4	56.152.161.70
Jun 7, 2024 19:47:03.910383940 CEST	49991	445	192.168.2.4	56.152.161.70
Jun 7, 2024 19:47:03.910521984 CEST	49992	445	192.168.2.4	56.152.161.1
Jun 7, 2024 19:47:03.915539026 CEST	445	49992	56.152.161.1	192.168.2.4
Jun 7, 2024 19:47:03.915620089 CEST	445	49991	56.152.161.70	192.168.2.4
Jun 7, 2024 19:47:03.915621996 CEST	49992	445	192.168.2.4	56.152.161.1
Jun 7, 2024 19:47:03.915636063 CEST	49992	445	192.168.2.4	56.152.161.1
Jun 7, 2024 19:47:03.915673971 CEST	49991	445	192.168.2.4	56.152.161.70
Jun 7, 2024 19:47:03.915854931 CEST	49993	445	192.168.2.4	56.152.161.1
Jun 7, 2024 19:47:03.920701027 CEST	445	49992	56.152.161.1	192.168.2.4
Jun 7, 2024 19:47:03.920747995 CEST	49992	445	192.168.2.4	56.152.161.1
Jun 7, 2024 19:47:03.920767069 CEST	445	49993	56.152.161.1	192.168.2.4
Jun 7, 2024 19:47:03.920825958 CEST	49993	445	192.168.2.4	56.152.161.1
Jun 7, 2024 19:47:03.920878887 CEST	49993	445	192.168.2.4	56.152.161.1
Jun 7, 2024 19:47:03.925678015 CEST	445	49993	56.152.161.1	192.168.2.4
Jun 7, 2024 19:47:04.343445063 CEST	445	49883	103.194.154.2	192.168.2.4
Jun 7, 2024 19:47:04.343527079 CEST	49883	445	192.168.2.4	103.194.154.2
Jun 7, 2024 19:47:04.343616009 CEST	49883	445	192.168.2.4	103.194.154.2
Jun 7, 2024 19:47:04.343616009 CEST	49883	445	192.168.2.4	103.194.154.2
Jun 7, 2024 19:47:04.348510981 CEST	445	49883	103.194.154.2	192.168.2.4
Jun 7, 2024 19:47:04.348602057 CEST	445	49883	103.194.154.2	192.168.2.4
Jun 7, 2024 19:47:04.371046066 CEST	445	49885	83.55.32.1	192.168.2.4
Jun 7, 2024 19:47:04.371114016 CEST	49885	445	192.168.2.4	83.55.32.1
Jun 7, 2024 19:47:04.371201038 CEST	49885	445	192.168.2.4	83.55.32.1
Jun 7, 2024 19:47:04.371201038 CEST	49885	445	192.168.2.4	83.55.32.1
Jun 7, 2024 19:47:04.376405954 CEST	445	49885	83.55.32.1	192.168.2.4
Jun 7, 2024 19:47:04.376422882 CEST	445	49885	83.55.32.1	192.168.2.4
Jun 7, 2024 19:47:05.358035088 CEST	50007	445	192.168.2.4	78.235.15.1
Jun 7, 2024 19:47:05.363140106 CEST	445	50007	78.235.15.1	192.168.2.4
Jun 7, 2024 19:47:05.363209009 CEST	50007	445	192.168.2.4	78.235.15.1
Jun 7, 2024 19:47:05.363289118 CEST	50007	445	192.168.2.4	78.235.15.1
Jun 7, 2024 19:47:05.368601084 CEST	445	50007	78.235.15.1	192.168.2.4
Jun 7, 2024 19:47:05.921753883 CEST	50015	445	192.168.2.4	140.23.22.171
Jun 7, 2024 19:47:06.010298967 CEST	445	49902	73.148.167.1	192.168.2.4
Jun 7, 2024 19:47:06.010648966 CEST	49902	445	192.168.2.4	73.148.167.1
Jun 7, 2024 19:47:06.010648966 CEST	49902	445	192.168.2.4	73.148.167.1
Jun 7, 2024 19:47:06.010751009 CEST	49902	445	192.168.2.4	73.148.167.1
Jun 7, 2024 19:47:06.014048100 CEST	445	49902	73.148.167.1	192.168.2.4
Jun 7, 2024 19:47:06.014101982 CEST	49902	445	192.168.2.4	73.148.167.1
Jun 7, 2024 19:47:06.015322924 CEST	445	50015	140.23.22.171	192.168.2.4
Jun 7, 2024 19:47:06.015396118 CEST	50015	445	192.168.2.4	140.23.22.171
Jun 7, 2024 19:47:06.015476942 CEST	50015	445	192.168.2.4	140.23.22.171
Jun 7, 2024 19:47:06.015778065 CEST	50017	445	192.168.2.4	140.23.22.1
Jun 7, 2024 19:47:06.016186953 CEST	445	49902	73.148.167.1	192.168.2.4
Jun 7, 2024 19:47:06.016202927 CEST	445	49902	73.148.167.1	192.168.2.4
Jun 7, 2024 19:47:06.018982887 CEST	445	49902	73.148.167.1	192.168.2.4
Jun 7, 2024 19:47:06.020648003 CEST	445	50015	140.23.22.171	192.168.2.4
Jun 7, 2024 19:47:06.020680904 CEST	445	50017	140.23.22.1	192.168.2.4
Jun 7, 2024 19:47:06.020714998 CEST	50015	445	192.168.2.4	140.23.22.171
Jun 7, 2024 19:47:06.020865917 CEST	50017	445	192.168.2.4	140.23.22.1
Jun 7, 2024 19:47:06.020865917 CEST	50017	445	192.168.2.4	140.23.22.1
Jun 7, 2024 19:47:06.021212101 CEST	50018	445	192.168.2.4	140.23.22.1
Jun 7, 2024 19:47:06.026140928 CEST	445	50017	140.23.22.1	192.168.2.4
Jun 7, 2024 19:47:06.026158094 CEST	445	50018	140.23.22.1	192.168.2.4
Jun 7, 2024 19:47:06.026221991 CEST	50017	445	192.168.2.4	140.23.22.1
Jun 7, 2024 19:47:06.026222944 CEST	50018	445	192.168.2.4	140.23.22.1
Jun 7, 2024 19:47:06.026312113 CEST	50018	445	192.168.2.4	140.23.22.1
Jun 7, 2024 19:47:06.031173944 CEST	445	50018	140.23.22.1	192.168.2.4
Jun 7, 2024 19:47:06.080739021 CEST	50020	445	192.168.2.4	73.148.167.2
Jun 7, 2024 19:47:06.085653067 CEST	445	50020	73.148.167.2	192.168.2.4
Jun 7, 2024 19:47:06.085705996 CEST	50020	445	192.168.2.4	73.148.167.2
Jun 7, 2024 19:47:06.085767984 CEST	50020	445	192.168.2.4	73.148.167.2
Jun 7, 2024 19:47:06.086075068 CEST	50021	445	192.168.2.4	73.148.167.2
Jun 7, 2024 19:47:06.091137886 CEST	445	50021	73.148.167.2	192.168.2.4
Jun 7, 2024 19:47:06.091202974 CEST	50021	445	192.168.2.4	73.148.167.2
Jun 7, 2024 19:47:06.091243982 CEST	50021	445	192.168.2.4	73.148.167.2
Jun 7, 2024 19:47:06.101469040 CEST	445	50020	73.148.167.2	192.168.2.4
Jun 7, 2024 19:47:06.101485968 CEST	445	50021	73.148.167.2	192.168.2.4
Jun 7, 2024 19:47:06.113806963 CEST	445	50020	73.148.167.2	192.168.2.4
Jun 7, 2024 19:47:06.113853931 CEST	50020	445	192.168.2.4	73.148.167.2
Jun 7, 2024 19:47:06.609036922 CEST	445	49912	215.114.241.1	192.168.2.4
Jun 7, 2024 19:47:06.609184027 CEST	49912	445	192.168.2.4	215.114.241.1
Jun 7, 2024 19:47:06.609224081 CEST	49912	445	192.168.2.4	215.114.241.1
Jun 7, 2024 19:47:06.609277010 CEST	49912	445	192.168.2.4	215.114.241.1
Jun 7, 2024 19:47:06.614377022 CEST	445	49912	215.114.241.1	192.168.2.4
Jun 7, 2024 19:47:06.614397049 CEST	445	49912	215.114.241.1	192.168.2.4
Jun 7, 2024 19:47:07.358760118 CEST	50035	445	192.168.2.4	103.194.154.2
Jun 7, 2024 19:47:07.363735914 CEST	445	50035	103.194.154.2	192.168.2.4
Jun 7, 2024 19:47:07.363815069 CEST	50035	445	192.168.2.4	103.194.154.2
Jun 7, 2024 19:47:07.364006042 CEST	50035	445	192.168.2.4	103.194.154.2
Jun 7, 2024 19:47:07.368804932 CEST	445	50035	103.194.154.2	192.168.2.4
Jun 7, 2024 19:47:07.376214027 CEST	50036	445	192.168.2.4	83.55.32.1
Jun 7, 2024 19:47:07.381114006 CEST	445	50036	83.55.32.1	192.168.2.4
Jun 7, 2024 19:47:07.381207943 CEST	50036	445	192.168.2.4	83.55.32.1
Jun 7, 2024 19:47:07.389872074 CEST	50036	445	192.168.2.4	83.55.32.1
Jun 7, 2024 19:47:07.395972013 CEST	445	50036	83.55.32.1	192.168.2.4
Jun 7, 2024 19:47:07.802953959 CEST	445	49928	189.66.242.1	192.168.2.4
Jun 7, 2024 19:47:07.803199053 CEST	49928	445	192.168.2.4	189.66.242.1
Jun 7, 2024 19:47:07.803199053 CEST	49928	445	192.168.2.4	189.66.242.1
Jun 7, 2024 19:47:07.803199053 CEST	49928	445	192.168.2.4	189.66.242.1
Jun 7, 2024 19:47:07.808382988 CEST	445	49928	189.66.242.1	192.168.2.4
Jun 7, 2024 19:47:07.808398962 CEST	445	49928	189.66.242.1	192.168.2.4
Jun 7, 2024 19:47:07.858728886 CEST	50042	445	192.168.2.4	189.66.242.2
Jun 7, 2024 19:47:07.864280939 CEST	445	50042	189.66.242.2	192.168.2.4
Jun 7, 2024 19:47:07.864459038 CEST	50042	445	192.168.2.4	189.66.242.2
Jun 7, 2024 19:47:07.864527941 CEST	50042	445	192.168.2.4	189.66.242.2
Jun 7, 2024 19:47:07.864862919 CEST	50043	445	192.168.2.4	189.66.242.2
Jun 7, 2024 19:47:07.869930983 CEST	445	50043	189.66.242.2	192.168.2.4
Jun 7, 2024 19:47:07.869949102 CEST	445	50042	189.66.242.2	192.168.2.4
Jun 7, 2024 19:47:07.870048046 CEST	445	50042	189.66.242.2	192.168.2.4
Jun 7, 2024 19:47:07.870098114 CEST	50042	445	192.168.2.4	189.66.242.2
Jun 7, 2024 19:47:07.870146036 CEST	50043	445	192.168.2.4	189.66.242.2
Jun 7, 2024 19:47:07.870146036 CEST	50043	445	192.168.2.4	189.66.242.2
Jun 7, 2024 19:47:07.875212908 CEST	445	50043	189.66.242.2	192.168.2.4
Jun 7, 2024 19:47:07.936168909 CEST	50045	445	192.168.2.4	205.222.42.51
Jun 7, 2024 19:47:07.941359997 CEST	445	50045	205.222.42.51	192.168.2.4
Jun 7, 2024 19:47:07.941423893 CEST	50045	445	192.168.2.4	205.222.42.51
Jun 7, 2024 19:47:07.941467047 CEST	50045	445	192.168.2.4	205.222.42.51
Jun 7, 2024 19:47:07.941565037 CEST	50046	445	192.168.2.4	205.222.42.1
Jun 7, 2024 19:47:07.946445942 CEST	445	50046	205.222.42.1	192.168.2.4
Jun 7, 2024 19:47:07.946511984 CEST	50046	445	192.168.2.4	205.222.42.1
Jun 7, 2024 19:47:07.946551085 CEST	50046	445	192.168.2.4	205.222.42.1
Jun 7, 2024 19:47:07.946765900 CEST	50047	445	192.168.2.4	205.222.42.1
Jun 7, 2024 19:47:07.946964025 CEST	445	50045	205.222.42.51	192.168.2.4
Jun 7, 2024 19:47:07.947014093 CEST	50045	445	192.168.2.4	205.222.42.51
Jun 7, 2024 19:47:07.951630116 CEST	445	50047	205.222.42.1	192.168.2.4
Jun 7, 2024 19:47:07.951721907 CEST	50047	445	192.168.2.4	205.222.42.1
Jun 7, 2024 19:47:07.951747894 CEST	50047	445	192.168.2.4	205.222.42.1
Jun 7, 2024 19:47:07.951915979 CEST	445	50046	205.222.42.1	192.168.2.4
Jun 7, 2024 19:47:07.951970100 CEST	50046	445	192.168.2.4	205.222.42.1
Jun 7, 2024 19:47:07.956602097 CEST	445	50047	205.222.42.1	192.168.2.4
Jun 7, 2024 19:47:08.388658047 CEST	445	49941	125.190.126.1	192.168.2.4
Jun 7, 2024 19:47:08.388871908 CEST	49941	445	192.168.2.4	125.190.126.1
Jun 7, 2024 19:47:08.388873100 CEST	49941	445	192.168.2.4	125.190.126.1
Jun 7, 2024 19:47:08.388873100 CEST	49941	445	192.168.2.4	125.190.126.1
Jun 7, 2024 19:47:08.607945919 CEST	49941	445	192.168.2.4	125.190.126.1
Jun 7, 2024 19:47:08.619739056 CEST	445	49941	125.190.126.1	192.168.2.4
Jun 7, 2024 19:47:08.619965076 CEST	445	49941	125.190.126.1	192.168.2.4
Jun 7, 2024 19:47:08.619982958 CEST	49941	445	192.168.2.4	125.190.126.1
Jun 7, 2024 19:47:08.620003939 CEST	445	49941	125.190.126.1	192.168.2.4
Jun 7, 2024 19:47:08.620038986 CEST	445	49941	125.190.126.1	192.168.2.4
Jun 7, 2024 19:47:08.625041962 CEST	445	49941	125.190.126.1	192.168.2.4
Jun 7, 2024 19:47:09.623791933 CEST	50051	445	192.168.2.4	215.114.241.1
Jun 7, 2024 19:47:09.628901958 CEST	445	50051	215.114.241.1	192.168.2.4
Jun 7, 2024 19:47:09.629169941 CEST	50051	445	192.168.2.4	215.114.241.1
Jun 7, 2024 19:47:09.629169941 CEST	50051	445	192.168.2.4	215.114.241.1
Jun 7, 2024 19:47:09.634279966 CEST	445	50051	215.114.241.1	192.168.2.4
Jun 7, 2024 19:47:09.814785004 CEST	445	49954	134.136.111.1	192.168.2.4
Jun 7, 2024 19:47:09.815002918 CEST	49954	445	192.168.2.4	134.136.111.1
Jun 7, 2024 19:47:09.815002918 CEST	49954	445	192.168.2.4	134.136.111.1
Jun 7, 2024 19:47:09.815002918 CEST	49954	445	192.168.2.4	134.136.111.1
Jun 7, 2024 19:47:09.820086002 CEST	445	49954	134.136.111.1	192.168.2.4
Jun 7, 2024 19:47:09.820103884 CEST	445	49954	134.136.111.1	192.168.2.4
Jun 7, 2024 19:47:09.873863935 CEST	50052	445	192.168.2.4	134.136.111.2
Jun 7, 2024 19:47:09.879775047 CEST	445	50052	134.136.111.2	192.168.2.4
Jun 7, 2024 19:47:09.880179882 CEST	50052	445	192.168.2.4	134.136.111.2
Jun 7, 2024 19:47:09.880179882 CEST	50052	445	192.168.2.4	134.136.111.2
Jun 7, 2024 19:47:09.880568981 CEST	50053	445	192.168.2.4	134.136.111.2
Jun 7, 2024 19:47:09.885736942 CEST	445	50053	134.136.111.2	192.168.2.4
Jun 7, 2024 19:47:09.885757923 CEST	445	50052	134.136.111.2	192.168.2.4
Jun 7, 2024 19:47:09.885873079 CEST	50053	445	192.168.2.4	134.136.111.2
Jun 7, 2024 19:47:09.885875940 CEST	50052	445	192.168.2.4	134.136.111.2
Jun 7, 2024 19:47:09.890885115 CEST	445	50053	134.136.111.2	192.168.2.4
Jun 7, 2024 19:47:09.952058077 CEST	50054	445	192.168.2.4	146.209.254.17
Jun 7, 2024 19:47:09.957230091 CEST	445	50054	146.209.254.17	192.168.2.4
Jun 7, 2024 19:47:09.957387924 CEST	50054	445	192.168.2.4	146.209.254.17
Jun 7, 2024 19:47:09.957387924 CEST	50054	445	192.168.2.4	146.209.254.17
Jun 7, 2024 19:47:09.957495928 CEST	50055	445	192.168.2.4	146.209.254.1
Jun 7, 2024 19:47:09.962564945 CEST	445	50055	146.209.254.1	192.168.2.4
Jun 7, 2024 19:47:09.962660074 CEST	50055	445	192.168.2.4	146.209.254.1
Jun 7, 2024 19:47:09.962660074 CEST	50055	445	192.168.2.4	146.209.254.1
Jun 7, 2024 19:47:09.962744951 CEST	445	50054	146.209.254.17	192.168.2.4
Jun 7, 2024 19:47:09.962893963 CEST	50056	445	192.168.2.4	146.209.254.1
Jun 7, 2024 19:47:09.962944031 CEST	50054	445	192.168.2.4	146.209.254.17
Jun 7, 2024 19:47:09.967880964 CEST	445	50056	146.209.254.1	192.168.2.4
Jun 7, 2024 19:47:09.967896938 CEST	445	50055	146.209.254.1	192.168.2.4
Jun 7, 2024 19:47:09.967952967 CEST	50056	445	192.168.2.4	146.209.254.1
Jun 7, 2024 19:47:09.967988968 CEST	50055	445	192.168.2.4	146.209.254.1
Jun 7, 2024 19:47:09.967988968 CEST	50056	445	192.168.2.4	146.209.254.1
Jun 7, 2024 19:47:09.972940922 CEST	445	50056	146.209.254.1	192.168.2.4
Jun 7, 2024 19:47:10.397114992 CEST	445	49966	146.45.88.1	192.168.2.4
Jun 7, 2024 19:47:10.397180080 CEST	49966	445	192.168.2.4	146.45.88.1
Jun 7, 2024 19:47:10.397218943 CEST	49966	445	192.168.2.4	146.45.88.1
Jun 7, 2024 19:47:10.397264957 CEST	49966	445	192.168.2.4	146.45.88.1
Jun 7, 2024 19:47:10.402195930 CEST	445	49966	146.45.88.1	192.168.2.4
Jun 7, 2024 19:47:10.402215958 CEST	445	49966	146.45.88.1	192.168.2.4
Jun 7, 2024 19:47:10.454159975 CEST	445	50056	146.209.254.1	192.168.2.4
Jun 7, 2024 19:47:10.454361916 CEST	50056	445	192.168.2.4	146.209.254.1
Jun 7, 2024 19:47:10.454446077 CEST	50056	445	192.168.2.4	146.209.254.1
Jun 7, 2024 19:47:10.454446077 CEST	50056	445	192.168.2.4	146.209.254.1
Jun 7, 2024 19:47:10.461314917 CEST	445	50056	146.209.254.1	192.168.2.4
Jun 7, 2024 19:47:10.461472034 CEST	445	50056	146.209.254.1	192.168.2.4
Jun 7, 2024 19:47:11.389914036 CEST	50057	445	192.168.2.4	125.190.126.1
Jun 7, 2024 19:47:11.395468950 CEST	445	50057	125.190.126.1	192.168.2.4
Jun 7, 2024 19:47:11.395631075 CEST	50057	445	192.168.2.4	125.190.126.1
Jun 7, 2024 19:47:11.395720005 CEST	50057	445	192.168.2.4	125.190.126.1
Jun 7, 2024 19:47:11.400770903 CEST	445	50057	125.190.126.1	192.168.2.4
Jun 7, 2024 19:47:11.820534945 CEST	445	49981	172.183.28.1	192.168.2.4
Jun 7, 2024 19:47:11.820744991 CEST	49981	445	192.168.2.4	172.183.28.1
Jun 7, 2024 19:47:11.820744991 CEST	49981	445	192.168.2.4	172.183.28.1
Jun 7, 2024 19:47:11.820745945 CEST	49981	445	192.168.2.4	172.183.28.1
Jun 7, 2024 19:47:11.825795889 CEST	445	49981	172.183.28.1	192.168.2.4
Jun 7, 2024 19:47:11.825959921 CEST	445	49981	172.183.28.1	192.168.2.4
Jun 7, 2024 19:47:11.876688004 CEST	50058	445	192.168.2.4	172.183.28.2
Jun 7, 2024 19:47:11.882005930 CEST	445	50058	172.183.28.2	192.168.2.4
Jun 7, 2024 19:47:11.882097960 CEST	50058	445	192.168.2.4	172.183.28.2
Jun 7, 2024 19:47:11.882172108 CEST	50058	445	192.168.2.4	172.183.28.2
Jun 7, 2024 19:47:11.882795095 CEST	50059	445	192.168.2.4	172.183.28.2
Jun 7, 2024 19:47:11.887459993 CEST	445	50058	172.183.28.2	192.168.2.4
Jun 7, 2024 19:47:11.887522936 CEST	50058	445	192.168.2.4	172.183.28.2
Jun 7, 2024 19:47:11.887698889 CEST	445	50059	172.183.28.2	192.168.2.4
Jun 7, 2024 19:47:11.887773037 CEST	50059	445	192.168.2.4	172.183.28.2
Jun 7, 2024 19:47:11.889081955 CEST	50059	445	192.168.2.4	172.183.28.2
Jun 7, 2024 19:47:11.894097090 CEST	445	50059	172.183.28.2	192.168.2.4
Jun 7, 2024 19:47:11.967602015 CEST	50060	445	192.168.2.4	166.84.10.184
Jun 7, 2024 19:47:11.972764969 CEST	445	50060	166.84.10.184	192.168.2.4
Jun 7, 2024 19:47:11.972872019 CEST	50060	445	192.168.2.4	166.84.10.184
Jun 7, 2024 19:47:11.972965002 CEST	50060	445	192.168.2.4	166.84.10.184
Jun 7, 2024 19:47:11.973222017 CEST	50061	445	192.168.2.4	166.84.10.1
Jun 7, 2024 19:47:11.978027105 CEST	445	50060	166.84.10.184	192.168.2.4
Jun 7, 2024 19:47:11.978204966 CEST	445	50061	166.84.10.1	192.168.2.4
Jun 7, 2024 19:47:11.978220940 CEST	445	50060	166.84.10.184	192.168.2.4
Jun 7, 2024 19:47:11.978293896 CEST	50060	445	192.168.2.4	166.84.10.184
Jun 7, 2024 19:47:11.978430986 CEST	50061	445	192.168.2.4	166.84.10.1
Jun 7, 2024 19:47:11.978430986 CEST	50061	445	192.168.2.4	166.84.10.1
Jun 7, 2024 19:47:11.978758097 CEST	50062	445	192.168.2.4	166.84.10.1
Jun 7, 2024 19:47:11.983829975 CEST	445	50061	166.84.10.1	192.168.2.4
Jun 7, 2024 19:47:11.983844042 CEST	445	50062	166.84.10.1	192.168.2.4
Jun 7, 2024 19:47:11.984038115 CEST	50061	445	192.168.2.4	166.84.10.1
Jun 7, 2024 19:47:11.984039068 CEST	50062	445	192.168.2.4	166.84.10.1
Jun 7, 2024 19:47:11.984039068 CEST	50062	445	192.168.2.4	166.84.10.1
Jun 7, 2024 19:47:11.989098072 CEST	445	50062	166.84.10.1	192.168.2.4
Jun 7, 2024 19:47:12.420916080 CEST	445	49993	56.152.161.1	192.168.2.4
Jun 7, 2024 19:47:12.421154976 CEST	49993	445	192.168.2.4	56.152.161.1
Jun 7, 2024 19:47:12.421154976 CEST	49993	445	192.168.2.4	56.152.161.1
Jun 7, 2024 19:47:12.421154976 CEST	49993	445	192.168.2.4	56.152.161.1
Jun 7, 2024 19:47:12.426366091 CEST	445	49993	56.152.161.1	192.168.2.4
Jun 7, 2024 19:47:12.426398039 CEST	445	49993	56.152.161.1	192.168.2.4
Jun 7, 2024 19:47:12.516180038 CEST	445	50062	166.84.10.1	192.168.2.4
Jun 7, 2024 19:47:12.516448021 CEST	50062	445	192.168.2.4	166.84.10.1
Jun 7, 2024 19:47:12.516448021 CEST	50062	445	192.168.2.4	166.84.10.1
Jun 7, 2024 19:47:12.516448021 CEST	50062	445	192.168.2.4	166.84.10.1
Jun 7, 2024 19:47:12.522064924 CEST	445	50062	166.84.10.1	192.168.2.4
Jun 7, 2024 19:47:12.522108078 CEST	445	50062	166.84.10.1	192.168.2.4
Jun 7, 2024 19:47:13.405023098 CEST	50063	445	192.168.2.4	146.45.88.1
Jun 7, 2024 19:47:13.410348892 CEST	445	50063	146.45.88.1	192.168.2.4
Jun 7, 2024 19:47:13.410794973 CEST	50063	445	192.168.2.4	146.45.88.1
Jun 7, 2024 19:47:13.410795927 CEST	50063	445	192.168.2.4	146.45.88.1
Jun 7, 2024 19:47:13.416030884 CEST	445	50063	146.45.88.1	192.168.2.4
Jun 7, 2024 19:47:13.467570066 CEST	50064	445	192.168.2.4	146.209.254.1
Jun 7, 2024 19:47:13.473104954 CEST	445	50064	146.209.254.1	192.168.2.4
Jun 7, 2024 19:47:13.473438025 CEST	50064	445	192.168.2.4	146.209.254.1
Jun 7, 2024 19:47:13.473639965 CEST	50064	445	192.168.2.4	146.209.254.1
Jun 7, 2024 19:47:13.478806973 CEST	445	50064	146.209.254.1	192.168.2.4
Jun 7, 2024 19:47:13.616605043 CEST	64144	53	192.168.2.4	162.159.36.2
Jun 7, 2024 19:47:13.621818066 CEST	53	64144	162.159.36.2	192.168.2.4
Jun 7, 2024 19:47:13.621953011 CEST	64144	53	192.168.2.4	162.159.36.2
Jun 7, 2024 19:47:13.627193928 CEST	53	64144	162.159.36.2	192.168.2.4
Jun 7, 2024 19:47:13.853703976 CEST	445	50007	78.235.15.1	192.168.2.4
Jun 7, 2024 19:47:13.853916883 CEST	50007	445	192.168.2.4	78.235.15.1
Jun 7, 2024 19:47:13.854099989 CEST	50007	445	192.168.2.4	78.235.15.1
Jun 7, 2024 19:47:13.854099989 CEST	50007	445	192.168.2.4	78.235.15.1
Jun 7, 2024 19:47:13.859265089 CEST	445	50007	78.235.15.1	192.168.2.4
Jun 7, 2024 19:47:13.859296083 CEST	445	50007	78.235.15.1	192.168.2.4
Jun 7, 2024 19:47:13.921890974 CEST	64145	445	192.168.2.4	78.235.15.2
Jun 7, 2024 19:47:13.927119017 CEST	445	64145	78.235.15.2	192.168.2.4
Jun 7, 2024 19:47:13.927349091 CEST	64145	445	192.168.2.4	78.235.15.2
Jun 7, 2024 19:47:13.927349091 CEST	64145	445	192.168.2.4	78.235.15.2
Jun 7, 2024 19:47:13.928248882 CEST	64146	445	192.168.2.4	78.235.15.2
Jun 7, 2024 19:47:13.932821989 CEST	445	64145	78.235.15.2	192.168.2.4
Jun 7, 2024 19:47:13.933039904 CEST	64145	445	192.168.2.4	78.235.15.2
Jun 7, 2024 19:47:13.933201075 CEST	445	64146	78.235.15.2	192.168.2.4
Jun 7, 2024 19:47:13.933379889 CEST	64146	445	192.168.2.4	78.235.15.2
Jun 7, 2024 19:47:13.933379889 CEST	64146	445	192.168.2.4	78.235.15.2
Jun 7, 2024 19:47:13.938450098 CEST	445	64146	78.235.15.2	192.168.2.4
Jun 7, 2024 19:47:13.983516932 CEST	64147	445	192.168.2.4	142.0.124.67
Jun 7, 2024 19:47:13.988763094 CEST	445	64147	142.0.124.67	192.168.2.4
Jun 7, 2024 19:47:13.988925934 CEST	64147	445	192.168.2.4	142.0.124.67
Jun 7, 2024 19:47:13.988925934 CEST	64147	445	192.168.2.4	142.0.124.67
Jun 7, 2024 19:47:13.989272118 CEST	64148	445	192.168.2.4	142.0.124.1
Jun 7, 2024 19:47:13.994267941 CEST	445	64147	142.0.124.67	192.168.2.4
Jun 7, 2024 19:47:13.994353056 CEST	445	64148	142.0.124.1	192.168.2.4
Jun 7, 2024 19:47:13.994424105 CEST	64147	445	192.168.2.4	142.0.124.67
Jun 7, 2024 19:47:13.994596004 CEST	64148	445	192.168.2.4	142.0.124.1
Jun 7, 2024 19:47:13.994596004 CEST	64148	445	192.168.2.4	142.0.124.1
Jun 7, 2024 19:47:13.994982958 CEST	64149	445	192.168.2.4	142.0.124.1
Jun 7, 2024 19:47:13.999922037 CEST	445	64149	142.0.124.1	192.168.2.4
Jun 7, 2024 19:47:13.999974012 CEST	445	64148	142.0.124.1	192.168.2.4
Jun 7, 2024 19:47:14.000138998 CEST	64149	445	192.168.2.4	142.0.124.1
Jun 7, 2024 19:47:14.000188112 CEST	64149	445	192.168.2.4	142.0.124.1
Jun 7, 2024 19:47:14.000237942 CEST	64148	445	192.168.2.4	142.0.124.1
Jun 7, 2024 19:47:14.005871058 CEST	445	64149	142.0.124.1	192.168.2.4
Jun 7, 2024 19:47:14.231437922 CEST	64144	53	192.168.2.4	162.159.36.2
Jun 7, 2024 19:47:14.236648083 CEST	53	64144	162.159.36.2	192.168.2.4
Jun 7, 2024 19:47:14.236725092 CEST	64144	53	192.168.2.4	162.159.36.2
Jun 7, 2024 19:47:14.286633968 CEST	64150	443	192.168.2.4	13.95.31.18
Jun 7, 2024 19:47:14.286673069 CEST	443	64150	13.95.31.18	192.168.2.4
Jun 7, 2024 19:47:14.286969900 CEST	64150	443	192.168.2.4	13.95.31.18
Jun 7, 2024 19:47:14.287858963 CEST	64150	443	192.168.2.4	13.95.31.18
Jun 7, 2024 19:47:14.287875891 CEST	443	64150	13.95.31.18	192.168.2.4
Jun 7, 2024 19:47:14.519712925 CEST	445	50018	140.23.22.1	192.168.2.4
Jun 7, 2024 19:47:14.519932032 CEST	50018	445	192.168.2.4	140.23.22.1
Jun 7, 2024 19:47:14.520024061 CEST	50018	445	192.168.2.4	140.23.22.1
Jun 7, 2024 19:47:14.520106077 CEST	50018	445	192.168.2.4	140.23.22.1
Jun 7, 2024 19:47:14.525135994 CEST	445	50018	140.23.22.1	192.168.2.4
Jun 7, 2024 19:47:14.525165081 CEST	445	50018	140.23.22.1	192.168.2.4
Jun 7, 2024 19:47:14.586008072 CEST	445	50021	73.148.167.2	192.168.2.4
Jun 7, 2024 19:47:14.586216927 CEST	50021	445	192.168.2.4	73.148.167.2
Jun 7, 2024 19:47:14.586216927 CEST	50021	445	192.168.2.4	73.148.167.2
Jun 7, 2024 19:47:14.591885090 CEST	445	50021	73.148.167.2	192.168.2.4
Jun 7, 2024 19:47:15.400892973 CEST	443	64150	13.95.31.18	192.168.2.4
Jun 7, 2024 19:47:15.401108980 CEST	64150	443	192.168.2.4	13.95.31.18
Jun 7, 2024 19:47:15.406604052 CEST	64150	443	192.168.2.4	13.95.31.18
Jun 7, 2024 19:47:15.406615973 CEST	443	64150	13.95.31.18	192.168.2.4
Jun 7, 2024 19:47:15.407107115 CEST	443	64150	13.95.31.18	192.168.2.4
Jun 7, 2024 19:47:15.418205023 CEST	64150	443	192.168.2.4	13.95.31.18
Jun 7, 2024 19:47:15.436501980 CEST	64151	445	192.168.2.4	56.152.161.1
Jun 7, 2024 19:47:15.442157984 CEST	445	64151	56.152.161.1	192.168.2.4
Jun 7, 2024 19:47:15.442254066 CEST	64151	445	192.168.2.4	56.152.161.1
Jun 7, 2024 19:47:15.442296028 CEST	64151	445	192.168.2.4	56.152.161.1
Jun 7, 2024 19:47:15.447613001 CEST	445	64151	56.152.161.1	192.168.2.4
Jun 7, 2024 19:47:15.464639902 CEST	443	64150	13.95.31.18	192.168.2.4
Jun 7, 2024 19:47:15.530141115 CEST	64152	445	192.168.2.4	166.84.10.1
Jun 7, 2024 19:47:15.535762072 CEST	445	64152	166.84.10.1	192.168.2.4
Jun 7, 2024 19:47:15.535990000 CEST	64152	445	192.168.2.4	166.84.10.1
Jun 7, 2024 19:47:15.535990000 CEST	64152	445	192.168.2.4	166.84.10.1
Jun 7, 2024 19:47:15.541376114 CEST	445	64152	166.84.10.1	192.168.2.4
Jun 7, 2024 19:47:15.660857916 CEST	443	64150	13.95.31.18	192.168.2.4
Jun 7, 2024 19:47:15.661247969 CEST	64150	443	192.168.2.4	13.95.31.18
Jun 7, 2024 19:47:15.661267996 CEST	443	64150	13.95.31.18	192.168.2.4
Jun 7, 2024 19:47:15.661298990 CEST	64150	443	192.168.2.4	13.95.31.18
Jun 7, 2024 19:47:15.661834955 CEST	443	64150	13.95.31.18	192.168.2.4
Jun 7, 2024 19:47:15.661905050 CEST	64150	443	192.168.2.4	13.95.31.18
Jun 7, 2024 19:47:15.725775003 CEST	64153	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:15.725830078 CEST	443	64153	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:15.725919962 CEST	64153	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:15.726316929 CEST	64153	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:15.726341963 CEST	443	64153	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:15.855411053 CEST	445	50035	103.194.154.2	192.168.2.4
Jun 7, 2024 19:47:15.855496883 CEST	50035	445	192.168.2.4	103.194.154.2
Jun 7, 2024 19:47:15.855583906 CEST	50035	445	192.168.2.4	103.194.154.2
Jun 7, 2024 19:47:15.855583906 CEST	50035	445	192.168.2.4	103.194.154.2
Jun 7, 2024 19:47:15.860702991 CEST	445	50035	103.194.154.2	192.168.2.4
Jun 7, 2024 19:47:15.860738993 CEST	445	50035	103.194.154.2	192.168.2.4
Jun 7, 2024 19:47:15.871784925 CEST	445	50036	83.55.32.1	192.168.2.4
Jun 7, 2024 19:47:15.871865988 CEST	50036	445	192.168.2.4	83.55.32.1
Jun 7, 2024 19:47:15.871932983 CEST	50036	445	192.168.2.4	83.55.32.1
Jun 7, 2024 19:47:15.871985912 CEST	50036	445	192.168.2.4	83.55.32.1
Jun 7, 2024 19:47:15.876934052 CEST	445	50036	83.55.32.1	192.168.2.4
Jun 7, 2024 19:47:15.877034903 CEST	445	50036	83.55.32.1	192.168.2.4
Jun 7, 2024 19:47:15.924179077 CEST	64154	445	192.168.2.4	103.194.154.3
Jun 7, 2024 19:47:15.931818962 CEST	445	64154	103.194.154.3	192.168.2.4
Jun 7, 2024 19:47:15.932025909 CEST	64154	445	192.168.2.4	103.194.154.3
Jun 7, 2024 19:47:15.932025909 CEST	64154	445	192.168.2.4	103.194.154.3
Jun 7, 2024 19:47:15.932358980 CEST	64155	445	192.168.2.4	103.194.154.3
Jun 7, 2024 19:47:15.936408997 CEST	64156	445	192.168.2.4	83.55.32.2
Jun 7, 2024 19:47:15.940028906 CEST	445	64154	103.194.154.3	192.168.2.4
Jun 7, 2024 19:47:15.940207005 CEST	445	64155	103.194.154.3	192.168.2.4
Jun 7, 2024 19:47:15.940224886 CEST	64154	445	192.168.2.4	103.194.154.3
Jun 7, 2024 19:47:15.940282106 CEST	64155	445	192.168.2.4	103.194.154.3
Jun 7, 2024 19:47:15.940463066 CEST	64155	445	192.168.2.4	103.194.154.3
Jun 7, 2024 19:47:15.943861961 CEST	445	64156	83.55.32.2	192.168.2.4
Jun 7, 2024 19:47:15.943931103 CEST	64156	445	192.168.2.4	83.55.32.2
Jun 7, 2024 19:47:15.944052935 CEST	64156	445	192.168.2.4	83.55.32.2
Jun 7, 2024 19:47:15.944380045 CEST	64157	445	192.168.2.4	83.55.32.2
Jun 7, 2024 19:47:15.947220087 CEST	445	64155	103.194.154.3	192.168.2.4
Jun 7, 2024 19:47:15.951000929 CEST	445	64156	83.55.32.2	192.168.2.4
Jun 7, 2024 19:47:15.951050043 CEST	445	64157	83.55.32.2	192.168.2.4
Jun 7, 2024 19:47:15.951060057 CEST	64156	445	192.168.2.4	83.55.32.2
Jun 7, 2024 19:47:15.951114893 CEST	64157	445	192.168.2.4	83.55.32.2
Jun 7, 2024 19:47:15.951169014 CEST	64157	445	192.168.2.4	83.55.32.2
Jun 7, 2024 19:47:15.956109047 CEST	445	64157	83.55.32.2	192.168.2.4
Jun 7, 2024 19:47:15.999423981 CEST	64158	445	192.168.2.4	190.49.101.168
Jun 7, 2024 19:47:16.007221937 CEST	445	64158	190.49.101.168	192.168.2.4
Jun 7, 2024 19:47:16.007319927 CEST	64158	445	192.168.2.4	190.49.101.168
Jun 7, 2024 19:47:16.007359028 CEST	64158	445	192.168.2.4	190.49.101.168
Jun 7, 2024 19:47:16.007570028 CEST	64159	445	192.168.2.4	190.49.101.1
Jun 7, 2024 19:47:16.012564898 CEST	445	64159	190.49.101.1	192.168.2.4
Jun 7, 2024 19:47:16.012665033 CEST	64159	445	192.168.2.4	190.49.101.1
Jun 7, 2024 19:47:16.012665987 CEST	64159	445	192.168.2.4	190.49.101.1
Jun 7, 2024 19:47:16.012785912 CEST	445	64158	190.49.101.168	192.168.2.4
Jun 7, 2024 19:47:16.012929916 CEST	64158	445	192.168.2.4	190.49.101.168
Jun 7, 2024 19:47:16.013124943 CEST	64160	445	192.168.2.4	190.49.101.1
Jun 7, 2024 19:47:16.018013954 CEST	445	64159	190.49.101.1	192.168.2.4
Jun 7, 2024 19:47:16.018069029 CEST	445	64160	190.49.101.1	192.168.2.4
Jun 7, 2024 19:47:16.018110037 CEST	64159	445	192.168.2.4	190.49.101.1
Jun 7, 2024 19:47:16.018198967 CEST	64160	445	192.168.2.4	190.49.101.1
Jun 7, 2024 19:47:16.018199921 CEST	64160	445	192.168.2.4	190.49.101.1
Jun 7, 2024 19:47:16.023315907 CEST	445	64160	190.49.101.1	192.168.2.4
Jun 7, 2024 19:47:16.056870937 CEST	445	64152	166.84.10.1	192.168.2.4
Jun 7, 2024 19:47:16.057154894 CEST	64152	445	192.168.2.4	166.84.10.1
Jun 7, 2024 19:47:16.057156086 CEST	64152	445	192.168.2.4	166.84.10.1
Jun 7, 2024 19:47:16.057156086 CEST	64152	445	192.168.2.4	166.84.10.1
Jun 7, 2024 19:47:16.062139034 CEST	445	64152	166.84.10.1	192.168.2.4
Jun 7, 2024 19:47:16.062263012 CEST	445	64152	166.84.10.1	192.168.2.4
Jun 7, 2024 19:47:16.108201027 CEST	64161	445	192.168.2.4	166.84.10.2
Jun 7, 2024 19:47:16.119815111 CEST	445	64161	166.84.10.2	192.168.2.4
Jun 7, 2024 19:47:16.120018959 CEST	64161	445	192.168.2.4	166.84.10.2
Jun 7, 2024 19:47:16.120018959 CEST	64161	445	192.168.2.4	166.84.10.2
Jun 7, 2024 19:47:16.120460987 CEST	64162	445	192.168.2.4	166.84.10.2
Jun 7, 2024 19:47:16.125547886 CEST	445	64162	166.84.10.2	192.168.2.4
Jun 7, 2024 19:47:16.125650883 CEST	64162	445	192.168.2.4	166.84.10.2
Jun 7, 2024 19:47:16.125720024 CEST	64162	445	192.168.2.4	166.84.10.2
Jun 7, 2024 19:47:16.125900030 CEST	445	64161	166.84.10.2	192.168.2.4
Jun 7, 2024 19:47:16.126317978 CEST	445	64161	166.84.10.2	192.168.2.4
Jun 7, 2024 19:47:16.126380920 CEST	64161	445	192.168.2.4	166.84.10.2
Jun 7, 2024 19:47:16.130748987 CEST	445	64162	166.84.10.2	192.168.2.4
Jun 7, 2024 19:47:16.364017963 CEST	445	50043	189.66.242.2	192.168.2.4
Jun 7, 2024 19:47:16.364124060 CEST	50043	445	192.168.2.4	189.66.242.2
Jun 7, 2024 19:47:16.364206076 CEST	50043	445	192.168.2.4	189.66.242.2
Jun 7, 2024 19:47:16.364206076 CEST	50043	445	192.168.2.4	189.66.242.2
Jun 7, 2024 19:47:16.369204044 CEST	445	50043	189.66.242.2	192.168.2.4
Jun 7, 2024 19:47:16.369259119 CEST	445	50043	189.66.242.2	192.168.2.4
Jun 7, 2024 19:47:16.438707113 CEST	445	50047	205.222.42.1	192.168.2.4
Jun 7, 2024 19:47:16.439008951 CEST	50047	445	192.168.2.4	205.222.42.1
Jun 7, 2024 19:47:16.439008951 CEST	50047	445	192.168.2.4	205.222.42.1
Jun 7, 2024 19:47:16.439064026 CEST	50047	445	192.168.2.4	205.222.42.1
Jun 7, 2024 19:47:16.443945885 CEST	445	50047	205.222.42.1	192.168.2.4
Jun 7, 2024 19:47:16.444000006 CEST	445	50047	205.222.42.1	192.168.2.4
Jun 7, 2024 19:47:16.873737097 CEST	64153	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:16.901838064 CEST	64163	443	192.168.2.4	40.68.123.157
Jun 7, 2024 19:47:16.901925087 CEST	443	64163	40.68.123.157	192.168.2.4
Jun 7, 2024 19:47:16.902021885 CEST	64163	443	192.168.2.4	40.68.123.157
Jun 7, 2024 19:47:16.902476072 CEST	64163	443	192.168.2.4	40.68.123.157
Jun 7, 2024 19:47:16.902508974 CEST	443	64163	40.68.123.157	192.168.2.4
Jun 7, 2024 19:47:17.529859066 CEST	64164	445	192.168.2.4	140.23.22.1
Jun 7, 2024 19:47:17.534929991 CEST	445	64164	140.23.22.1	192.168.2.4
Jun 7, 2024 19:47:17.535012007 CEST	64164	445	192.168.2.4	140.23.22.1
Jun 7, 2024 19:47:17.535109997 CEST	64164	445	192.168.2.4	140.23.22.1
Jun 7, 2024 19:47:17.539940119 CEST	445	64164	140.23.22.1	192.168.2.4
Jun 7, 2024 19:47:17.607955933 CEST	64165	445	192.168.2.4	73.148.167.2
Jun 7, 2024 19:47:17.613096952 CEST	445	64165	73.148.167.2	192.168.2.4
Jun 7, 2024 19:47:17.613168001 CEST	64165	445	192.168.2.4	73.148.167.2
Jun 7, 2024 19:47:17.613212109 CEST	64165	445	192.168.2.4	73.148.167.2
Jun 7, 2024 19:47:17.618123055 CEST	445	64165	73.148.167.2	192.168.2.4
Jun 7, 2024 19:47:18.017232895 CEST	64166	445	192.168.2.4	102.44.235.241
Jun 7, 2024 19:47:18.017802954 CEST	443	64163	40.68.123.157	192.168.2.4
Jun 7, 2024 19:47:18.017913103 CEST	64163	443	192.168.2.4	40.68.123.157
Jun 7, 2024 19:47:18.019326925 CEST	64163	443	192.168.2.4	40.68.123.157
Jun 7, 2024 19:47:18.019357920 CEST	443	64163	40.68.123.157	192.168.2.4
Jun 7, 2024 19:47:18.019906998 CEST	443	64163	40.68.123.157	192.168.2.4
Jun 7, 2024 19:47:18.020714045 CEST	64163	443	192.168.2.4	40.68.123.157
Jun 7, 2024 19:47:18.022238970 CEST	445	64166	102.44.235.241	192.168.2.4
Jun 7, 2024 19:47:18.022335052 CEST	64166	445	192.168.2.4	102.44.235.241
Jun 7, 2024 19:47:18.023488045 CEST	64166	445	192.168.2.4	102.44.235.241
Jun 7, 2024 19:47:18.023682117 CEST	64167	445	192.168.2.4	102.44.235.1
Jun 7, 2024 19:47:18.028553009 CEST	445	64166	102.44.235.241	192.168.2.4
Jun 7, 2024 19:47:18.028635025 CEST	64166	445	192.168.2.4	102.44.235.241
Jun 7, 2024 19:47:18.028645992 CEST	445	64167	102.44.235.1	192.168.2.4
Jun 7, 2024 19:47:18.028707027 CEST	64167	445	192.168.2.4	102.44.235.1
Jun 7, 2024 19:47:18.028757095 CEST	64167	445	192.168.2.4	102.44.235.1
Jun 7, 2024 19:47:18.028985023 CEST	64168	445	192.168.2.4	102.44.235.1
Jun 7, 2024 19:47:18.033906937 CEST	445	64167	102.44.235.1	192.168.2.4
Jun 7, 2024 19:47:18.033937931 CEST	445	64168	102.44.235.1	192.168.2.4
Jun 7, 2024 19:47:18.033977985 CEST	64167	445	192.168.2.4	102.44.235.1
Jun 7, 2024 19:47:18.034010887 CEST	64168	445	192.168.2.4	102.44.235.1
Jun 7, 2024 19:47:18.034070015 CEST	64168	445	192.168.2.4	102.44.235.1
Jun 7, 2024 19:47:18.039573908 CEST	445	64168	102.44.235.1	192.168.2.4
Jun 7, 2024 19:47:18.068536043 CEST	443	64163	40.68.123.157	192.168.2.4
Jun 7, 2024 19:47:18.126558065 CEST	445	50051	215.114.241.1	192.168.2.4
Jun 7, 2024 19:47:18.126763105 CEST	50051	445	192.168.2.4	215.114.241.1
Jun 7, 2024 19:47:18.126842976 CEST	50051	445	192.168.2.4	215.114.241.1
Jun 7, 2024 19:47:18.126842976 CEST	50051	445	192.168.2.4	215.114.241.1
Jun 7, 2024 19:47:18.131772041 CEST	445	50051	215.114.241.1	192.168.2.4
Jun 7, 2024 19:47:18.131824970 CEST	445	50051	215.114.241.1	192.168.2.4
Jun 7, 2024 19:47:18.187288046 CEST	64169	445	192.168.2.4	215.114.241.2
Jun 7, 2024 19:47:18.192615032 CEST	445	64169	215.114.241.2	192.168.2.4
Jun 7, 2024 19:47:18.192760944 CEST	64169	445	192.168.2.4	215.114.241.2
Jun 7, 2024 19:47:18.192841053 CEST	64169	445	192.168.2.4	215.114.241.2
Jun 7, 2024 19:47:18.194883108 CEST	64170	445	192.168.2.4	215.114.241.2
Jun 7, 2024 19:47:18.197954893 CEST	445	64169	215.114.241.2	192.168.2.4
Jun 7, 2024 19:47:18.198152065 CEST	445	64169	215.114.241.2	192.168.2.4
Jun 7, 2024 19:47:18.198210001 CEST	64169	445	192.168.2.4	215.114.241.2
Jun 7, 2024 19:47:18.199755907 CEST	445	64170	215.114.241.2	192.168.2.4
Jun 7, 2024 19:47:18.199826956 CEST	64170	445	192.168.2.4	215.114.241.2
Jun 7, 2024 19:47:18.209022045 CEST	64170	445	192.168.2.4	215.114.241.2
Jun 7, 2024 19:47:18.214073896 CEST	445	64170	215.114.241.2	192.168.2.4
Jun 7, 2024 19:47:18.266222000 CEST	443	64163	40.68.123.157	192.168.2.4
Jun 7, 2024 19:47:18.268930912 CEST	64163	443	192.168.2.4	40.68.123.157
Jun 7, 2024 19:47:18.269013882 CEST	443	64163	40.68.123.157	192.168.2.4
Jun 7, 2024 19:47:18.269045115 CEST	64163	443	192.168.2.4	40.68.123.157
Jun 7, 2024 19:47:18.269566059 CEST	443	64163	40.68.123.157	192.168.2.4
Jun 7, 2024 19:47:18.269653082 CEST	443	64163	40.68.123.157	192.168.2.4
Jun 7, 2024 19:47:18.269709110 CEST	64163	443	192.168.2.4	40.68.123.157
Jun 7, 2024 19:47:18.384742022 CEST	445	50053	134.136.111.2	192.168.2.4
Jun 7, 2024 19:47:18.384957075 CEST	50053	445	192.168.2.4	134.136.111.2
Jun 7, 2024 19:47:18.390175104 CEST	50053	445	192.168.2.4	134.136.111.2
Jun 7, 2024 19:47:18.390280008 CEST	50053	445	192.168.2.4	134.136.111.2
Jun 7, 2024 19:47:18.395294905 CEST	445	50053	134.136.111.2	192.168.2.4
Jun 7, 2024 19:47:18.395325899 CEST	445	50053	134.136.111.2	192.168.2.4
Jun 7, 2024 19:47:18.680610895 CEST	445	64168	102.44.235.1	192.168.2.4
Jun 7, 2024 19:47:18.680931091 CEST	64168	445	192.168.2.4	102.44.235.1
Jun 7, 2024 19:47:18.680931091 CEST	64168	445	192.168.2.4	102.44.235.1
Jun 7, 2024 19:47:18.680932045 CEST	64168	445	192.168.2.4	102.44.235.1
Jun 7, 2024 19:47:18.685980082 CEST	445	64168	102.44.235.1	192.168.2.4
Jun 7, 2024 19:47:18.686006069 CEST	445	64168	102.44.235.1	192.168.2.4
Jun 7, 2024 19:47:19.331561089 CEST	64171	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:19.331649065 CEST	443	64171	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:19.331724882 CEST	64171	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:19.332051039 CEST	64171	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:19.332087040 CEST	443	64171	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:19.373799086 CEST	64172	445	192.168.2.4	189.66.242.2
Jun 7, 2024 19:47:19.378784895 CEST	445	64172	189.66.242.2	192.168.2.4
Jun 7, 2024 19:47:19.378855944 CEST	64172	445	192.168.2.4	189.66.242.2
Jun 7, 2024 19:47:19.378897905 CEST	64172	445	192.168.2.4	189.66.242.2
Jun 7, 2024 19:47:19.383852959 CEST	445	64172	189.66.242.2	192.168.2.4
Jun 7, 2024 19:47:19.452089071 CEST	64173	445	192.168.2.4	205.222.42.1
Jun 7, 2024 19:47:19.457166910 CEST	445	64173	205.222.42.1	192.168.2.4
Jun 7, 2024 19:47:19.457355976 CEST	64173	445	192.168.2.4	205.222.42.1
Jun 7, 2024 19:47:19.457355976 CEST	64173	445	192.168.2.4	205.222.42.1
Jun 7, 2024 19:47:19.462335110 CEST	445	64173	205.222.42.1	192.168.2.4
Jun 7, 2024 19:47:19.887664080 CEST	445	50057	125.190.126.1	192.168.2.4
Jun 7, 2024 19:47:19.887861967 CEST	50057	445	192.168.2.4	125.190.126.1
Jun 7, 2024 19:47:19.887861967 CEST	50057	445	192.168.2.4	125.190.126.1
Jun 7, 2024 19:47:19.889547110 CEST	50057	445	192.168.2.4	125.190.126.1
Jun 7, 2024 19:47:19.889666080 CEST	64174	445	192.168.2.4	213.63.222.163
Jun 7, 2024 19:47:19.892960072 CEST	445	50057	125.190.126.1	192.168.2.4
Jun 7, 2024 19:47:19.894433022 CEST	445	50057	125.190.126.1	192.168.2.4
Jun 7, 2024 19:47:19.894612074 CEST	445	64174	213.63.222.163	192.168.2.4
Jun 7, 2024 19:47:19.894908905 CEST	64174	445	192.168.2.4	213.63.222.163
Jun 7, 2024 19:47:19.894910097 CEST	64174	445	192.168.2.4	213.63.222.163
Jun 7, 2024 19:47:19.895029068 CEST	64175	445	192.168.2.4	213.63.222.1
Jun 7, 2024 19:47:19.900057077 CEST	445	64175	213.63.222.1	192.168.2.4
Jun 7, 2024 19:47:19.900156021 CEST	445	64174	213.63.222.163	192.168.2.4
Jun 7, 2024 19:47:19.900165081 CEST	64175	445	192.168.2.4	213.63.222.1
Jun 7, 2024 19:47:19.900187969 CEST	64175	445	192.168.2.4	213.63.222.1
Jun 7, 2024 19:47:19.900346041 CEST	64174	445	192.168.2.4	213.63.222.163
Jun 7, 2024 19:47:19.900595903 CEST	64176	445	192.168.2.4	213.63.222.1
Jun 7, 2024 19:47:19.905313015 CEST	445	64175	213.63.222.1	192.168.2.4
Jun 7, 2024 19:47:19.905364037 CEST	64175	445	192.168.2.4	213.63.222.1
Jun 7, 2024 19:47:19.905492067 CEST	445	64176	213.63.222.1	192.168.2.4
Jun 7, 2024 19:47:19.905685902 CEST	64176	445	192.168.2.4	213.63.222.1
Jun 7, 2024 19:47:19.905685902 CEST	64176	445	192.168.2.4	213.63.222.1
Jun 7, 2024 19:47:19.910861969 CEST	445	64176	213.63.222.1	192.168.2.4
Jun 7, 2024 19:47:19.951772928 CEST	64177	445	192.168.2.4	125.190.126.2
Jun 7, 2024 19:47:19.956818104 CEST	445	64177	125.190.126.2	192.168.2.4
Jun 7, 2024 19:47:19.956872940 CEST	64177	445	192.168.2.4	125.190.126.2
Jun 7, 2024 19:47:19.956947088 CEST	64177	445	192.168.2.4	125.190.126.2
Jun 7, 2024 19:47:19.957263947 CEST	64178	445	192.168.2.4	125.190.126.2
Jun 7, 2024 19:47:19.962076902 CEST	445	64177	125.190.126.2	192.168.2.4
Jun 7, 2024 19:47:19.962136984 CEST	64177	445	192.168.2.4	125.190.126.2
Jun 7, 2024 19:47:19.962184906 CEST	445	64178	125.190.126.2	192.168.2.4
Jun 7, 2024 19:47:19.962245941 CEST	64178	445	192.168.2.4	125.190.126.2
Jun 7, 2024 19:47:19.962272882 CEST	64178	445	192.168.2.4	125.190.126.2
Jun 7, 2024 19:47:19.967118979 CEST	445	64178	125.190.126.2	192.168.2.4
Jun 7, 2024 19:47:20.387487888 CEST	445	50059	172.183.28.2	192.168.2.4
Jun 7, 2024 19:47:20.387814999 CEST	50059	445	192.168.2.4	172.183.28.2
Jun 7, 2024 19:47:20.387814999 CEST	50059	445	192.168.2.4	172.183.28.2
Jun 7, 2024 19:47:20.387814999 CEST	50059	445	192.168.2.4	172.183.28.2
Jun 7, 2024 19:47:20.393716097 CEST	445	50059	172.183.28.2	192.168.2.4
Jun 7, 2024 19:47:20.393744946 CEST	445	50059	172.183.28.2	192.168.2.4
Jun 7, 2024 19:47:20.450582027 CEST	443	64171	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:20.450839043 CEST	64171	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:20.452280045 CEST	64171	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:20.452313900 CEST	443	64171	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:20.452853918 CEST	443	64171	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:20.453744888 CEST	64171	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:20.496531010 CEST	443	64171	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:20.822189093 CEST	443	64171	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:20.822253942 CEST	443	64171	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:20.822300911 CEST	443	64171	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:20.822621107 CEST	64171	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:20.822621107 CEST	64171	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:20.822689056 CEST	443	64171	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:20.822788954 CEST	64171	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:20.830378056 CEST	64171	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:20.830378056 CEST	64171	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:20.830463886 CEST	443	64171	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:20.831007957 CEST	443	64171	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:20.831094980 CEST	443	64171	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:20.831288099 CEST	64171	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:20.964106083 CEST	64179	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:20.964195013 CEST	443	64179	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:20.964452028 CEST	64179	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:20.964680910 CEST	64179	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:20.964740992 CEST	443	64179	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:21.405031919 CEST	64180	445	192.168.2.4	134.136.111.2
Jun 7, 2024 19:47:21.410238028 CEST	445	64180	134.136.111.2	192.168.2.4
Jun 7, 2024 19:47:21.410525084 CEST	64180	445	192.168.2.4	134.136.111.2
Jun 7, 2024 19:47:21.410525084 CEST	64180	445	192.168.2.4	134.136.111.2
Jun 7, 2024 19:47:21.415535927 CEST	445	64180	134.136.111.2	192.168.2.4
Jun 7, 2024 19:47:21.639528990 CEST	64181	445	192.168.2.4	57.1.47.81
Jun 7, 2024 19:47:21.686172962 CEST	64182	445	192.168.2.4	102.44.235.1
Jun 7, 2024 19:47:21.851162910 CEST	445	64181	57.1.47.81	192.168.2.4
Jun 7, 2024 19:47:21.851223946 CEST	445	64182	102.44.235.1	192.168.2.4
Jun 7, 2024 19:47:21.851248980 CEST	64181	445	192.168.2.4	57.1.47.81
Jun 7, 2024 19:47:21.851275921 CEST	64182	445	192.168.2.4	102.44.235.1
Jun 7, 2024 19:47:21.851476908 CEST	64182	445	192.168.2.4	102.44.235.1
Jun 7, 2024 19:47:21.851476908 CEST	64181	445	192.168.2.4	57.1.47.81
Jun 7, 2024 19:47:21.851643085 CEST	64183	445	192.168.2.4	57.1.47.1
Jun 7, 2024 19:47:21.856354952 CEST	445	64182	102.44.235.1	192.168.2.4
Jun 7, 2024 19:47:21.856667995 CEST	445	64181	57.1.47.81	192.168.2.4
Jun 7, 2024 19:47:21.856698036 CEST	445	64183	57.1.47.1	192.168.2.4
Jun 7, 2024 19:47:21.856724024 CEST	64181	445	192.168.2.4	57.1.47.81
Jun 7, 2024 19:47:21.856770992 CEST	64183	445	192.168.2.4	57.1.47.1
Jun 7, 2024 19:47:21.856828928 CEST	64183	445	192.168.2.4	57.1.47.1
Jun 7, 2024 19:47:21.857148886 CEST	64184	445	192.168.2.4	57.1.47.1
Jun 7, 2024 19:47:21.862056971 CEST	445	64183	57.1.47.1	192.168.2.4
Jun 7, 2024 19:47:21.862090111 CEST	445	64184	57.1.47.1	192.168.2.4
Jun 7, 2024 19:47:21.862144947 CEST	64183	445	192.168.2.4	57.1.47.1
Jun 7, 2024 19:47:21.862179041 CEST	64184	445	192.168.2.4	57.1.47.1
Jun 7, 2024 19:47:21.862200022 CEST	64184	445	192.168.2.4	57.1.47.1
Jun 7, 2024 19:47:21.867177963 CEST	445	64184	57.1.47.1	192.168.2.4
Jun 7, 2024 19:47:21.900465965 CEST	445	50063	146.45.88.1	192.168.2.4
Jun 7, 2024 19:47:21.902304888 CEST	50063	445	192.168.2.4	146.45.88.1
Jun 7, 2024 19:47:21.902338982 CEST	50063	445	192.168.2.4	146.45.88.1
Jun 7, 2024 19:47:21.902365923 CEST	50063	445	192.168.2.4	146.45.88.1
Jun 7, 2024 19:47:21.907721043 CEST	445	50063	146.45.88.1	192.168.2.4
Jun 7, 2024 19:47:21.907778025 CEST	445	50063	146.45.88.1	192.168.2.4
Jun 7, 2024 19:47:21.967686892 CEST	64185	445	192.168.2.4	146.45.88.2
Jun 7, 2024 19:47:21.972948074 CEST	445	64185	146.45.88.2	192.168.2.4
Jun 7, 2024 19:47:21.973844051 CEST	445	50064	146.209.254.1	192.168.2.4
Jun 7, 2024 19:47:21.973928928 CEST	50064	445	192.168.2.4	146.209.254.1
Jun 7, 2024 19:47:21.973988056 CEST	64185	445	192.168.2.4	146.45.88.2
Jun 7, 2024 19:47:21.973988056 CEST	64185	445	192.168.2.4	146.45.88.2
Jun 7, 2024 19:47:21.974010944 CEST	50064	445	192.168.2.4	146.209.254.1
Jun 7, 2024 19:47:21.974054098 CEST	50064	445	192.168.2.4	146.209.254.1
Jun 7, 2024 19:47:21.974387884 CEST	64186	445	192.168.2.4	146.45.88.2
Jun 7, 2024 19:47:21.979017973 CEST	445	50064	146.209.254.1	192.168.2.4
Jun 7, 2024 19:47:21.979032040 CEST	445	50064	146.209.254.1	192.168.2.4
Jun 7, 2024 19:47:21.979315042 CEST	445	64186	146.45.88.2	192.168.2.4
Jun 7, 2024 19:47:21.979373932 CEST	445	64185	146.45.88.2	192.168.2.4
Jun 7, 2024 19:47:21.979497910 CEST	64185	445	192.168.2.4	146.45.88.2
Jun 7, 2024 19:47:21.979497910 CEST	64186	445	192.168.2.4	146.45.88.2
Jun 7, 2024 19:47:21.979497910 CEST	64186	445	192.168.2.4	146.45.88.2
Jun 7, 2024 19:47:21.984591007 CEST	445	64186	146.45.88.2	192.168.2.4
Jun 7, 2024 19:47:22.030191898 CEST	64187	445	192.168.2.4	146.209.254.2
Jun 7, 2024 19:47:22.035707951 CEST	445	64187	146.209.254.2	192.168.2.4
Jun 7, 2024 19:47:22.038219929 CEST	64187	445	192.168.2.4	146.209.254.2
Jun 7, 2024 19:47:22.038378954 CEST	64187	445	192.168.2.4	146.209.254.2
Jun 7, 2024 19:47:22.038546085 CEST	64188	445	192.168.2.4	146.209.254.2
Jun 7, 2024 19:47:22.044178963 CEST	445	64188	146.209.254.2	192.168.2.4
Jun 7, 2024 19:47:22.044497967 CEST	445	64187	146.209.254.2	192.168.2.4
Jun 7, 2024 19:47:22.044574976 CEST	64187	445	192.168.2.4	146.209.254.2
Jun 7, 2024 19:47:22.044600010 CEST	64188	445	192.168.2.4	146.209.254.2
Jun 7, 2024 19:47:22.044600010 CEST	64188	445	192.168.2.4	146.209.254.2
Jun 7, 2024 19:47:22.049587011 CEST	445	64188	146.209.254.2	192.168.2.4
Jun 7, 2024 19:47:22.119457960 CEST	443	64179	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:22.119858980 CEST	64179	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:22.120847940 CEST	64179	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:22.120884895 CEST	443	64179	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:22.121915102 CEST	443	64179	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:22.123336077 CEST	64179	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:22.168505907 CEST	443	64179	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:22.427376032 CEST	445	64146	78.235.15.2	192.168.2.4
Jun 7, 2024 19:47:22.427479029 CEST	64146	445	192.168.2.4	78.235.15.2
Jun 7, 2024 19:47:22.427571058 CEST	64146	445	192.168.2.4	78.235.15.2
Jun 7, 2024 19:47:22.427571058 CEST	64146	445	192.168.2.4	78.235.15.2
Jun 7, 2024 19:47:22.432471991 CEST	445	64146	78.235.15.2	192.168.2.4
Jun 7, 2024 19:47:22.432568073 CEST	445	64146	78.235.15.2	192.168.2.4
Jun 7, 2024 19:47:22.503813028 CEST	445	64149	142.0.124.1	192.168.2.4
Jun 7, 2024 19:47:22.503885031 CEST	64149	445	192.168.2.4	142.0.124.1
Jun 7, 2024 19:47:22.503937960 CEST	64149	445	192.168.2.4	142.0.124.1
Jun 7, 2024 19:47:22.504003048 CEST	64149	445	192.168.2.4	142.0.124.1
Jun 7, 2024 19:47:22.504034042 CEST	445	64182	102.44.235.1	192.168.2.4
Jun 7, 2024 19:47:22.504093885 CEST	64182	445	192.168.2.4	102.44.235.1
Jun 7, 2024 19:47:22.504128933 CEST	64182	445	192.168.2.4	102.44.235.1
Jun 7, 2024 19:47:22.504162073 CEST	443	64179	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:22.504173040 CEST	64182	445	192.168.2.4	102.44.235.1
Jun 7, 2024 19:47:22.504221916 CEST	443	64179	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:22.504266024 CEST	443	64179	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:22.504317045 CEST	64179	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:22.504390001 CEST	443	64179	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:22.504430056 CEST	64179	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:22.504451036 CEST	64179	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:22.504745007 CEST	443	64179	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:22.504816055 CEST	64179	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:22.504827023 CEST	443	64179	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:22.504873991 CEST	443	64179	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:22.504942894 CEST	64179	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:22.507093906 CEST	64179	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:22.507128000 CEST	443	64179	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:22.507174969 CEST	64179	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:22.507476091 CEST	443	64179	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:22.507555962 CEST	443	64179	40.127.169.103	192.168.2.4
Jun 7, 2024 19:47:22.507615089 CEST	64179	443	192.168.2.4	40.127.169.103
Jun 7, 2024 19:47:22.509321928 CEST	445	64149	142.0.124.1	192.168.2.4
Jun 7, 2024 19:47:22.509375095 CEST	445	64149	142.0.124.1	192.168.2.4
Jun 7, 2024 19:47:22.509403944 CEST	445	64182	102.44.235.1	192.168.2.4
Jun 7, 2024 19:47:22.509430885 CEST	445	64182	102.44.235.1	192.168.2.4
Jun 7, 2024 19:47:22.561170101 CEST	64189	445	192.168.2.4	102.44.235.2
Jun 7, 2024 19:47:22.567219019 CEST	445	64189	102.44.235.2	192.168.2.4
Jun 7, 2024 19:47:22.567383051 CEST	64189	445	192.168.2.4	102.44.235.2
Jun 7, 2024 19:47:22.567384005 CEST	64189	445	192.168.2.4	102.44.235.2
Jun 7, 2024 19:47:22.567759037 CEST	64190	445	192.168.2.4	102.44.235.2
Jun 7, 2024 19:47:22.573600054 CEST	445	64189	102.44.235.2	192.168.2.4
Jun 7, 2024 19:47:22.573681116 CEST	64189	445	192.168.2.4	102.44.235.2
Jun 7, 2024 19:47:22.573791027 CEST	445	64190	102.44.235.2	192.168.2.4
Jun 7, 2024 19:47:22.573860884 CEST	64190	445	192.168.2.4	102.44.235.2
Jun 7, 2024 19:47:22.573916912 CEST	64190	445	192.168.2.4	102.44.235.2
Jun 7, 2024 19:47:22.578798056 CEST	445	64190	102.44.235.2	192.168.2.4
Jun 7, 2024 19:47:23.209089041 CEST	445	64190	102.44.235.2	192.168.2.4
Jun 7, 2024 19:47:23.209290981 CEST	64190	445	192.168.2.4	102.44.235.2
Jun 7, 2024 19:47:23.209382057 CEST	64190	445	192.168.2.4	102.44.235.2
Jun 7, 2024 19:47:23.209382057 CEST	64190	445	192.168.2.4	102.44.235.2
Jun 7, 2024 19:47:23.214529991 CEST	445	64190	102.44.235.2	192.168.2.4
Jun 7, 2024 19:47:23.214560032 CEST	445	64190	102.44.235.2	192.168.2.4
Jun 7, 2024 19:47:23.280375004 CEST	64191	445	192.168.2.4	11.204.88.163
Jun 7, 2024 19:47:23.290591955 CEST	445	64191	11.204.88.163	192.168.2.4
Jun 7, 2024 19:47:23.290824890 CEST	64191	445	192.168.2.4	11.204.88.163
Jun 7, 2024 19:47:23.290826082 CEST	64191	445	192.168.2.4	11.204.88.163
Jun 7, 2024 19:47:23.290910959 CEST	64192	445	192.168.2.4	11.204.88.1
Jun 7, 2024 19:47:23.295906067 CEST	445	64192	11.204.88.1	192.168.2.4
Jun 7, 2024 19:47:23.295993090 CEST	64192	445	192.168.2.4	11.204.88.1
Jun 7, 2024 19:47:23.296041012 CEST	64192	445	192.168.2.4	11.204.88.1
Jun 7, 2024 19:47:23.296111107 CEST	445	64191	11.204.88.163	192.168.2.4
Jun 7, 2024 19:47:23.296163082 CEST	64191	445	192.168.2.4	11.204.88.163
Jun 7, 2024 19:47:23.296384096 CEST	64193	445	192.168.2.4	11.204.88.1
Jun 7, 2024 19:47:23.301366091 CEST	445	64193	11.204.88.1	192.168.2.4
Jun 7, 2024 19:47:23.301422119 CEST	445	64192	11.204.88.1	192.168.2.4
Jun 7, 2024 19:47:23.301446915 CEST	64193	445	192.168.2.4	11.204.88.1
Jun 7, 2024 19:47:23.301498890 CEST	64193	445	192.168.2.4	11.204.88.1
Jun 7, 2024 19:47:23.301510096 CEST	64192	445	192.168.2.4	11.204.88.1
Jun 7, 2024 19:47:23.306701899 CEST	445	64193	11.204.88.1	192.168.2.4
Jun 7, 2024 19:47:23.389431000 CEST	64194	445	192.168.2.4	172.183.28.2
Jun 7, 2024 19:47:23.396950960 CEST	445	64194	172.183.28.2	192.168.2.4
Jun 7, 2024 19:47:23.397339106 CEST	64194	445	192.168.2.4	172.183.28.2
Jun 7, 2024 19:47:23.397339106 CEST	64194	445	192.168.2.4	172.183.28.2
Jun 7, 2024 19:47:23.405955076 CEST	445	64194	172.183.28.2	192.168.2.4
Jun 7, 2024 19:47:23.941555977 CEST	445	64151	56.152.161.1	192.168.2.4
Jun 7, 2024 19:47:23.941773891 CEST	64151	445	192.168.2.4	56.152.161.1
Jun 7, 2024 19:47:23.941773891 CEST	64151	445	192.168.2.4	56.152.161.1
Jun 7, 2024 19:47:23.941773891 CEST	64151	445	192.168.2.4	56.152.161.1
Jun 7, 2024 19:47:23.947345972 CEST	445	64151	56.152.161.1	192.168.2.4
Jun 7, 2024 19:47:23.947388887 CEST	445	64151	56.152.161.1	192.168.2.4
Jun 7, 2024 19:47:23.998790026 CEST	64195	445	192.168.2.4	56.152.161.2
Jun 7, 2024 19:47:24.004657984 CEST	445	64195	56.152.161.2	192.168.2.4
Jun 7, 2024 19:47:24.004765034 CEST	64195	445	192.168.2.4	56.152.161.2
Jun 7, 2024 19:47:24.004805088 CEST	64195	445	192.168.2.4	56.152.161.2
Jun 7, 2024 19:47:24.005233049 CEST	64196	445	192.168.2.4	56.152.161.2
Jun 7, 2024 19:47:24.010432005 CEST	445	64196	56.152.161.2	192.168.2.4
Jun 7, 2024 19:47:24.010528088 CEST	445	64195	56.152.161.2	192.168.2.4
Jun 7, 2024 19:47:24.010533094 CEST	64196	445	192.168.2.4	56.152.161.2
Jun 7, 2024 19:47:24.010533094 CEST	64196	445	192.168.2.4	56.152.161.2
Jun 7, 2024 19:47:24.010592937 CEST	64195	445	192.168.2.4	56.152.161.2
Jun 7, 2024 19:47:24.015855074 CEST	445	64196	56.152.161.2	192.168.2.4
Jun 7, 2024 19:47:24.431631088 CEST	445	64155	103.194.154.3	192.168.2.4
Jun 7, 2024 19:47:24.431746006 CEST	64155	445	192.168.2.4	103.194.154.3
Jun 7, 2024 19:47:24.431822062 CEST	64155	445	192.168.2.4	103.194.154.3
Jun 7, 2024 19:47:24.431875944 CEST	64155	445	192.168.2.4	103.194.154.3
Jun 7, 2024 19:47:24.436861038 CEST	445	64155	103.194.154.3	192.168.2.4
Jun 7, 2024 19:47:24.437390089 CEST	445	64155	103.194.154.3	192.168.2.4
Jun 7, 2024 19:47:24.449418068 CEST	445	64157	83.55.32.2	192.168.2.4
Jun 7, 2024 19:47:24.449548960 CEST	64157	445	192.168.2.4	83.55.32.2
Jun 7, 2024 19:47:24.449601889 CEST	64157	445	192.168.2.4	83.55.32.2
Jun 7, 2024 19:47:24.449662924 CEST	64157	445	192.168.2.4	83.55.32.2
Jun 7, 2024 19:47:24.455115080 CEST	445	64157	83.55.32.2	192.168.2.4
Jun 7, 2024 19:47:24.455158949 CEST	445	64157	83.55.32.2	192.168.2.4
Jun 7, 2024 19:47:24.512711048 CEST	445	64160	190.49.101.1	192.168.2.4
Jun 7, 2024 19:47:24.513062000 CEST	64160	445	192.168.2.4	190.49.101.1
Jun 7, 2024 19:47:24.513062954 CEST	64160	445	192.168.2.4	190.49.101.1
Jun 7, 2024 19:47:24.513159990 CEST	64160	445	192.168.2.4	190.49.101.1
Jun 7, 2024 19:47:24.518368006 CEST	445	64160	190.49.101.1	192.168.2.4
Jun 7, 2024 19:47:24.518409014 CEST	445	64160	190.49.101.1	192.168.2.4
Jun 7, 2024 19:47:24.620263100 CEST	445	64162	166.84.10.2	192.168.2.4
Jun 7, 2024 19:47:24.620492935 CEST	64162	445	192.168.2.4	166.84.10.2
Jun 7, 2024 19:47:24.621146917 CEST	64162	445	192.168.2.4	166.84.10.2
Jun 7, 2024 19:47:24.621146917 CEST	64162	445	192.168.2.4	166.84.10.2
Jun 7, 2024 19:47:24.626662970 CEST	445	64162	166.84.10.2	192.168.2.4
Jun 7, 2024 19:47:24.626704931 CEST	445	64162	166.84.10.2	192.168.2.4
Jun 7, 2024 19:47:24.811335087 CEST	64197	445	192.168.2.4	144.144.246.70
Jun 7, 2024 19:47:24.816708088 CEST	445	64197	144.144.246.70	192.168.2.4
Jun 7, 2024 19:47:24.816804886 CEST	64197	445	192.168.2.4	144.144.246.70
Jun 7, 2024 19:47:24.816826105 CEST	64197	445	192.168.2.4	144.144.246.70
Jun 7, 2024 19:47:24.817017078 CEST	64198	445	192.168.2.4	144.144.246.1
Jun 7, 2024 19:47:24.821974039 CEST	445	64197	144.144.246.70	192.168.2.4
Jun 7, 2024 19:47:24.822007895 CEST	445	64198	144.144.246.1	192.168.2.4
Jun 7, 2024 19:47:24.822139025 CEST	64198	445	192.168.2.4	144.144.246.1
Jun 7, 2024 19:47:24.822139978 CEST	64198	445	192.168.2.4	144.144.246.1
Jun 7, 2024 19:47:24.822216034 CEST	445	64197	144.144.246.70	192.168.2.4
Jun 7, 2024 19:47:24.822273016 CEST	64197	445	192.168.2.4	144.144.246.70
Jun 7, 2024 19:47:24.822419882 CEST	64199	445	192.168.2.4	144.144.246.1
Jun 7, 2024 19:47:24.827395916 CEST	445	64198	144.144.246.1	192.168.2.4
Jun 7, 2024 19:47:24.827426910 CEST	445	64199	144.144.246.1	192.168.2.4
Jun 7, 2024 19:47:24.827461958 CEST	64198	445	192.168.2.4	144.144.246.1
Jun 7, 2024 19:47:24.827506065 CEST	64199	445	192.168.2.4	144.144.246.1
Jun 7, 2024 19:47:24.827506065 CEST	64199	445	192.168.2.4	144.144.246.1
Jun 7, 2024 19:47:24.832401037 CEST	445	64199	144.144.246.1	192.168.2.4
Jun 7, 2024 19:47:25.436203003 CEST	64200	445	192.168.2.4	78.235.15.2
Jun 7, 2024 19:47:25.441760063 CEST	445	64200	78.235.15.2	192.168.2.4
Jun 7, 2024 19:47:25.441844940 CEST	64200	445	192.168.2.4	78.235.15.2
Jun 7, 2024 19:47:25.441879988 CEST	64200	445	192.168.2.4	78.235.15.2
Jun 7, 2024 19:47:25.447379112 CEST	445	64200	78.235.15.2	192.168.2.4
Jun 7, 2024 19:47:25.514446020 CEST	64201	445	192.168.2.4	142.0.124.1
Jun 7, 2024 19:47:25.519952059 CEST	445	64201	142.0.124.1	192.168.2.4
Jun 7, 2024 19:47:25.520180941 CEST	64201	445	192.168.2.4	142.0.124.1
Jun 7, 2024 19:47:25.520181894 CEST	64201	445	192.168.2.4	142.0.124.1
Jun 7, 2024 19:47:25.520582914 CEST	445	64186	146.45.88.2	192.168.2.4
Jun 7, 2024 19:47:25.520653009 CEST	64186	445	192.168.2.4	146.45.88.2
Jun 7, 2024 19:47:25.520736933 CEST	64186	445	192.168.2.4	146.45.88.2
Jun 7, 2024 19:47:25.520736933 CEST	64186	445	192.168.2.4	146.45.88.2
Jun 7, 2024 19:47:25.525741100 CEST	445	64201	142.0.124.1	192.168.2.4
Jun 7, 2024 19:47:25.525892973 CEST	445	64186	146.45.88.2	192.168.2.4
Jun 7, 2024 19:47:25.525923014 CEST	445	64186	146.45.88.2	192.168.2.4
Jun 7, 2024 19:47:26.025829077 CEST	445	64164	140.23.22.1	192.168.2.4
Jun 7, 2024 19:47:26.025907040 CEST	64164	445	192.168.2.4	140.23.22.1
Jun 7, 2024 19:47:26.025947094 CEST	64164	445	192.168.2.4	140.23.22.1
Jun 7, 2024 19:47:26.025985003 CEST	64164	445	192.168.2.4	140.23.22.1
Jun 7, 2024 19:47:26.031136036 CEST	445	64164	140.23.22.1	192.168.2.4
Jun 7, 2024 19:47:26.031178951 CEST	445	64164	140.23.22.1	192.168.2.4
Jun 7, 2024 19:47:26.082747936 CEST	64202	445	192.168.2.4	140.23.22.2
Jun 7, 2024 19:47:26.087969065 CEST	445	64202	140.23.22.2	192.168.2.4
Jun 7, 2024 19:47:26.088078976 CEST	64202	445	192.168.2.4	140.23.22.2
Jun 7, 2024 19:47:26.088120937 CEST	64202	445	192.168.2.4	140.23.22.2
Jun 7, 2024 19:47:26.088618040 CEST	64203	445	192.168.2.4	140.23.22.2
Jun 7, 2024 19:47:26.093900919 CEST	445	64202	140.23.22.2	192.168.2.4
Jun 7, 2024 19:47:26.093946934 CEST	445	64203	140.23.22.2	192.168.2.4
Jun 7, 2024 19:47:26.093975067 CEST	64202	445	192.168.2.4	140.23.22.2
Jun 7, 2024 19:47:26.094044924 CEST	64203	445	192.168.2.4	140.23.22.2
Jun 7, 2024 19:47:26.094119072 CEST	64203	445	192.168.2.4	140.23.22.2
Jun 7, 2024 19:47:26.099318981 CEST	445	64203	140.23.22.2	192.168.2.4
Jun 7, 2024 19:47:26.103642941 CEST	445	64165	73.148.167.2	192.168.2.4
Jun 7, 2024 19:47:26.103713989 CEST	64165	445	192.168.2.4	73.148.167.2
Jun 7, 2024 19:47:26.103746891 CEST	64165	445	192.168.2.4	73.148.167.2
Jun 7, 2024 19:47:26.103766918 CEST	64165	445	192.168.2.4	73.148.167.2
Jun 7, 2024 19:47:26.109164000 CEST	445	64165	73.148.167.2	192.168.2.4
Jun 7, 2024 19:47:26.109205961 CEST	445	64165	73.148.167.2	192.168.2.4
Jun 7, 2024 19:47:26.154902935 CEST	64204	445	192.168.2.4	73.148.167.3
Jun 7, 2024 19:47:26.160248995 CEST	445	64204	73.148.167.3	192.168.2.4
Jun 7, 2024 19:47:26.160324097 CEST	64204	445	192.168.2.4	73.148.167.3
Jun 7, 2024 19:47:26.160365105 CEST	64204	445	192.168.2.4	73.148.167.3
Jun 7, 2024 19:47:26.160654068 CEST	64205	445	192.168.2.4	73.148.167.3
Jun 7, 2024 19:47:26.165966034 CEST	445	64204	73.148.167.3	192.168.2.4
Jun 7, 2024 19:47:26.166011095 CEST	445	64205	73.148.167.3	192.168.2.4
Jun 7, 2024 19:47:26.166032076 CEST	64204	445	192.168.2.4	73.148.167.3
Jun 7, 2024 19:47:26.166187048 CEST	64205	445	192.168.2.4	73.148.167.3
Jun 7, 2024 19:47:26.166188002 CEST	64205	445	192.168.2.4	73.148.167.3
Jun 7, 2024 19:47:26.171442032 CEST	445	64205	73.148.167.3	192.168.2.4
Jun 7, 2024 19:47:26.217533112 CEST	64206	445	192.168.2.4	102.44.235.2
Jun 7, 2024 19:47:26.223031044 CEST	445	64206	102.44.235.2	192.168.2.4
Jun 7, 2024 19:47:26.223326921 CEST	64206	445	192.168.2.4	102.44.235.2
Jun 7, 2024 19:47:26.223326921 CEST	64206	445	192.168.2.4	102.44.235.2
Jun 7, 2024 19:47:26.228648901 CEST	445	64206	102.44.235.2	192.168.2.4
Jun 7, 2024 19:47:26.233139992 CEST	64207	445	192.168.2.4	2.32.195.248
Jun 7, 2024 19:47:26.238478899 CEST	445	64207	2.32.195.248	192.168.2.4
Jun 7, 2024 19:47:26.238717079 CEST	64207	445	192.168.2.4	2.32.195.248
Jun 7, 2024 19:47:26.238717079 CEST	64207	445	192.168.2.4	2.32.195.248
Jun 7, 2024 19:47:26.238965988 CEST	64208	445	192.168.2.4	2.32.195.1
Jun 7, 2024 19:47:26.244183064 CEST	445	64208	2.32.195.1	192.168.2.4
Jun 7, 2024 19:47:26.244263887 CEST	64208	445	192.168.2.4	2.32.195.1
Jun 7, 2024 19:47:26.244275093 CEST	445	64207	2.32.195.248	192.168.2.4
Jun 7, 2024 19:47:26.244293928 CEST	64208	445	192.168.2.4	2.32.195.1
Jun 7, 2024 19:47:26.244473934 CEST	64207	445	192.168.2.4	2.32.195.248
Jun 7, 2024 19:47:26.244680882 CEST	64209	445	192.168.2.4	2.32.195.1
Jun 7, 2024 19:47:26.249578953 CEST	445	64208	2.32.195.1	192.168.2.4
Jun 7, 2024 19:47:26.249676943 CEST	64208	445	192.168.2.4	2.32.195.1
Jun 7, 2024 19:47:26.249758005 CEST	445	64209	2.32.195.1	192.168.2.4
Jun 7, 2024 19:47:26.249895096 CEST	64209	445	192.168.2.4	2.32.195.1
Jun 7, 2024 19:47:26.249895096 CEST	64209	445	192.168.2.4	2.32.195.1
Jun 7, 2024 19:47:26.255018950 CEST	445	64209	2.32.195.1	192.168.2.4
Jun 7, 2024 19:47:26.685959101 CEST	445	64170	215.114.241.2	192.168.2.4
Jun 7, 2024 19:47:26.686187029 CEST	64170	445	192.168.2.4	215.114.241.2
Jun 7, 2024 19:47:26.686280012 CEST	64170	445	192.168.2.4	215.114.241.2
Jun 7, 2024 19:47:26.686280012 CEST	64170	445	192.168.2.4	215.114.241.2
Jun 7, 2024 19:47:26.692958117 CEST	445	64170	215.114.241.2	192.168.2.4
Jun 7, 2024 19:47:26.692977905 CEST	445	64170	215.114.241.2	192.168.2.4
Jun 7, 2024 19:47:26.874286890 CEST	445	64206	102.44.235.2	192.168.2.4
Jun 7, 2024 19:47:26.874551058 CEST	64206	445	192.168.2.4	102.44.235.2
Jun 7, 2024 19:47:26.874551058 CEST	64206	445	192.168.2.4	102.44.235.2
Jun 7, 2024 19:47:26.874551058 CEST	64206	445	192.168.2.4	102.44.235.2
Jun 7, 2024 19:47:26.880116940 CEST	445	64206	102.44.235.2	192.168.2.4
Jun 7, 2024 19:47:26.880162001 CEST	445	64206	102.44.235.2	192.168.2.4
Jun 7, 2024 19:47:26.936301947 CEST	64210	445	192.168.2.4	102.44.235.3
Jun 7, 2024 19:47:26.941781044 CEST	445	64210	102.44.235.3	192.168.2.4
Jun 7, 2024 19:47:26.941921949 CEST	64210	445	192.168.2.4	102.44.235.3
Jun 7, 2024 19:47:26.942003012 CEST	64210	445	192.168.2.4	102.44.235.3
Jun 7, 2024 19:47:26.942292929 CEST	64211	445	192.168.2.4	102.44.235.3
Jun 7, 2024 19:47:26.947408915 CEST	445	64211	102.44.235.3	192.168.2.4
Jun 7, 2024 19:47:26.947451115 CEST	445	64210	102.44.235.3	192.168.2.4
Jun 7, 2024 19:47:26.947487116 CEST	64211	445	192.168.2.4	102.44.235.3
Jun 7, 2024 19:47:26.947576046 CEST	64211	445	192.168.2.4	102.44.235.3
Jun 7, 2024 19:47:26.947654963 CEST	64210	445	192.168.2.4	102.44.235.3
Jun 7, 2024 19:47:26.953082085 CEST	445	64211	102.44.235.3	192.168.2.4
Jun 7, 2024 19:47:27.436216116 CEST	64212	445	192.168.2.4	103.194.154.3
Jun 7, 2024 19:47:27.441765070 CEST	445	64212	103.194.154.3	192.168.2.4
Jun 7, 2024 19:47:27.441871881 CEST	64212	445	192.168.2.4	103.194.154.3
Jun 7, 2024 19:47:27.441912889 CEST	64212	445	192.168.2.4	103.194.154.3
Jun 7, 2024 19:47:27.447263956 CEST	445	64212	103.194.154.3	192.168.2.4
Jun 7, 2024 19:47:27.451841116 CEST	64213	445	192.168.2.4	83.55.32.2
Jun 7, 2024 19:47:27.457242012 CEST	445	64213	83.55.32.2	192.168.2.4
Jun 7, 2024 19:47:27.457446098 CEST	64213	445	192.168.2.4	83.55.32.2
Jun 7, 2024 19:47:27.457446098 CEST	64213	445	192.168.2.4	83.55.32.2
Jun 7, 2024 19:47:27.463427067 CEST	445	64213	83.55.32.2	192.168.2.4
Jun 7, 2024 19:47:27.514287949 CEST	64214	445	192.168.2.4	190.49.101.1
Jun 7, 2024 19:47:27.519843102 CEST	445	64214	190.49.101.1	192.168.2.4
Jun 7, 2024 19:47:27.520055056 CEST	64214	445	192.168.2.4	190.49.101.1
Jun 7, 2024 19:47:27.520055056 CEST	64214	445	192.168.2.4	190.49.101.1
Jun 7, 2024 19:47:27.525479078 CEST	445	64214	190.49.101.1	192.168.2.4
Jun 7, 2024 19:47:27.561728954 CEST	64215	445	192.168.2.4	208.90.116.74
Jun 7, 2024 19:47:27.568031073 CEST	445	64215	208.90.116.74	192.168.2.4
Jun 7, 2024 19:47:27.568233013 CEST	64215	445	192.168.2.4	208.90.116.74
Jun 7, 2024 19:47:27.568233013 CEST	64215	445	192.168.2.4	208.90.116.74
Jun 7, 2024 19:47:27.568321943 CEST	64216	445	192.168.2.4	208.90.116.1
Jun 7, 2024 19:47:27.573838949 CEST	445	64216	208.90.116.1	192.168.2.4
Jun 7, 2024 19:47:27.573887110 CEST	445	64215	208.90.116.74	192.168.2.4
Jun 7, 2024 19:47:27.574039936 CEST	64216	445	192.168.2.4	208.90.116.1
Jun 7, 2024 19:47:27.574039936 CEST	64216	445	192.168.2.4	208.90.116.1
Jun 7, 2024 19:47:27.574039936 CEST	64215	445	192.168.2.4	208.90.116.74
Jun 7, 2024 19:47:27.574160099 CEST	64217	445	192.168.2.4	208.90.116.1
Jun 7, 2024 19:47:27.579518080 CEST	445	64217	208.90.116.1	192.168.2.4
Jun 7, 2024 19:47:27.579586029 CEST	445	64216	208.90.116.1	192.168.2.4
Jun 7, 2024 19:47:27.579596996 CEST	64217	445	192.168.2.4	208.90.116.1
Jun 7, 2024 19:47:27.579629898 CEST	64217	445	192.168.2.4	208.90.116.1
Jun 7, 2024 19:47:27.579782009 CEST	64216	445	192.168.2.4	208.90.116.1
Jun 7, 2024 19:47:27.584693909 CEST	445	64217	208.90.116.1	192.168.2.4
Jun 7, 2024 19:47:27.623600006 CEST	64218	445	192.168.2.4	166.84.10.2
Jun 7, 2024 19:47:27.629040003 CEST	445	64218	166.84.10.2	192.168.2.4
Jun 7, 2024 19:47:27.629139900 CEST	64218	445	192.168.2.4	166.84.10.2
Jun 7, 2024 19:47:27.629199982 CEST	64218	445	192.168.2.4	166.84.10.2
Jun 7, 2024 19:47:27.634432077 CEST	445	64218	166.84.10.2	192.168.2.4
Jun 7, 2024 19:47:27.870944023 CEST	445	64172	189.66.242.2	192.168.2.4
Jun 7, 2024 19:47:27.871038914 CEST	64172	445	192.168.2.4	189.66.242.2
Jun 7, 2024 19:47:27.871131897 CEST	64172	445	192.168.2.4	189.66.242.2
Jun 7, 2024 19:47:27.871131897 CEST	64172	445	192.168.2.4	189.66.242.2
Jun 7, 2024 19:47:27.876513958 CEST	445	64172	189.66.242.2	192.168.2.4
Jun 7, 2024 19:47:27.876580000 CEST	445	64172	189.66.242.2	192.168.2.4
Jun 7, 2024 19:47:27.926573992 CEST	445	64209	2.32.195.1	192.168.2.4
Jun 7, 2024 19:47:27.926701069 CEST	64209	445	192.168.2.4	2.32.195.1
Jun 7, 2024 19:47:27.926767111 CEST	64209	445	192.168.2.4	2.32.195.1
Jun 7, 2024 19:47:27.926767111 CEST	64209	445	192.168.2.4	2.32.195.1
Jun 7, 2024 19:47:27.932245970 CEST	445	64209	2.32.195.1	192.168.2.4
Jun 7, 2024 19:47:27.932312012 CEST	445	64209	2.32.195.1	192.168.2.4
Jun 7, 2024 19:47:27.936248064 CEST	64219	445	192.168.2.4	189.66.242.3
Jun 7, 2024 19:47:27.941821098 CEST	445	64219	189.66.242.3	192.168.2.4
Jun 7, 2024 19:47:27.941917896 CEST	64219	445	192.168.2.4	189.66.242.3
Jun 7, 2024 19:47:27.941962004 CEST	64219	445	192.168.2.4	189.66.242.3
Jun 7, 2024 19:47:27.942298889 CEST	64220	445	192.168.2.4	189.66.242.3
Jun 7, 2024 19:47:27.947382927 CEST	445	64173	205.222.42.1	192.168.2.4
Jun 7, 2024 19:47:27.947469950 CEST	64173	445	192.168.2.4	205.222.42.1
Jun 7, 2024 19:47:27.947503090 CEST	64173	445	192.168.2.4	205.222.42.1
Jun 7, 2024 19:47:27.947524071 CEST	64173	445	192.168.2.4	205.222.42.1
Jun 7, 2024 19:47:27.947557926 CEST	445	64220	189.66.242.3	192.168.2.4
Jun 7, 2024 19:47:27.947648048 CEST	445	64219	189.66.242.3	192.168.2.4
Jun 7, 2024 19:47:27.947756052 CEST	64219	445	192.168.2.4	189.66.242.3
Jun 7, 2024 19:47:27.947760105 CEST	64220	445	192.168.2.4	189.66.242.3
Jun 7, 2024 19:47:27.947760105 CEST	64220	445	192.168.2.4	189.66.242.3
Jun 7, 2024 19:47:27.953013897 CEST	445	64173	205.222.42.1	192.168.2.4
Jun 7, 2024 19:47:27.953079939 CEST	445	64173	205.222.42.1	192.168.2.4
Jun 7, 2024 19:47:27.953130007 CEST	445	64220	189.66.242.3	192.168.2.4
Jun 7, 2024 19:47:27.998810053 CEST	64221	445	192.168.2.4	205.222.42.2
Jun 7, 2024 19:47:28.004731894 CEST	445	64221	205.222.42.2	192.168.2.4
Jun 7, 2024 19:47:28.005086899 CEST	64221	445	192.168.2.4	205.222.42.2
Jun 7, 2024 19:47:28.005086899 CEST	64221	445	192.168.2.4	205.222.42.2
Jun 7, 2024 19:47:28.005495071 CEST	64222	445	192.168.2.4	205.222.42.2
Jun 7, 2024 19:47:28.010632038 CEST	445	64222	205.222.42.2	192.168.2.4
Jun 7, 2024 19:47:28.010865927 CEST	64222	445	192.168.2.4	205.222.42.2
Jun 7, 2024 19:47:28.010865927 CEST	64222	445	192.168.2.4	205.222.42.2
Jun 7, 2024 19:47:28.011070967 CEST	445	64221	205.222.42.2	192.168.2.4
Jun 7, 2024 19:47:28.011279106 CEST	64221	445	192.168.2.4	205.222.42.2
Jun 7, 2024 19:47:28.016110897 CEST	445	64222	205.222.42.2	192.168.2.4
Jun 7, 2024 19:47:28.091350079 CEST	445	64217	208.90.116.1	192.168.2.4
Jun 7, 2024 19:47:28.091490030 CEST	64217	445	192.168.2.4	208.90.116.1
Jun 7, 2024 19:47:28.091583014 CEST	64217	445	192.168.2.4	208.90.116.1
Jun 7, 2024 19:47:28.091583014 CEST	64217	445	192.168.2.4	208.90.116.1
Jun 7, 2024 19:47:28.097055912 CEST	445	64217	208.90.116.1	192.168.2.4
Jun 7, 2024 19:47:28.097121954 CEST	445	64217	208.90.116.1	192.168.2.4
Jun 7, 2024 19:47:28.390341997 CEST	445	64176	213.63.222.1	192.168.2.4
Jun 7, 2024 19:47:28.390451908 CEST	64176	445	192.168.2.4	213.63.222.1
Jun 7, 2024 19:47:28.390556097 CEST	64176	445	192.168.2.4	213.63.222.1
Jun 7, 2024 19:47:28.390556097 CEST	64176	445	192.168.2.4	213.63.222.1
Jun 7, 2024 19:47:28.396038055 CEST	445	64176	213.63.222.1	192.168.2.4
Jun 7, 2024 19:47:28.396102905 CEST	445	64176	213.63.222.1	192.168.2.4
Jun 7, 2024 19:47:28.460872889 CEST	445	64178	125.190.126.2	192.168.2.4
Jun 7, 2024 19:47:28.460944891 CEST	64178	445	192.168.2.4	125.190.126.2
Jun 7, 2024 19:47:28.460974932 CEST	64178	445	192.168.2.4	125.190.126.2
Jun 7, 2024 19:47:28.460984945 CEST	64178	445	192.168.2.4	125.190.126.2
Jun 7, 2024 19:47:28.466455936 CEST	445	64178	125.190.126.2	192.168.2.4
Jun 7, 2024 19:47:28.466521025 CEST	445	64178	125.190.126.2	192.168.2.4
Jun 7, 2024 19:47:28.529918909 CEST	64223	445	192.168.2.4	146.45.88.2
Jun 7, 2024 19:47:28.535567999 CEST	445	64223	146.45.88.2	192.168.2.4
Jun 7, 2024 19:47:28.535732985 CEST	64223	445	192.168.2.4	146.45.88.2
Jun 7, 2024 19:47:28.535777092 CEST	64223	445	192.168.2.4	146.45.88.2
Jun 7, 2024 19:47:28.541127920 CEST	445	64223	146.45.88.2	192.168.2.4
Jun 7, 2024 19:47:28.795876980 CEST	64224	445	192.168.2.4	62.225.190.236
Jun 7, 2024 19:47:28.801357985 CEST	445	64224	62.225.190.236	192.168.2.4
Jun 7, 2024 19:47:28.801578045 CEST	64224	445	192.168.2.4	62.225.190.236
Jun 7, 2024 19:47:28.801578045 CEST	64224	445	192.168.2.4	62.225.190.236
Jun 7, 2024 19:47:28.801593065 CEST	64225	445	192.168.2.4	62.225.190.1
Jun 7, 2024 19:47:28.807086945 CEST	445	64225	62.225.190.1	192.168.2.4
Jun 7, 2024 19:47:28.807157040 CEST	64225	445	192.168.2.4	62.225.190.1
Jun 7, 2024 19:47:28.807178020 CEST	445	64224	62.225.190.236	192.168.2.4
Jun 7, 2024 19:47:28.807233095 CEST	64225	445	192.168.2.4	62.225.190.1
Jun 7, 2024 19:47:28.807235956 CEST	64224	445	192.168.2.4	62.225.190.236
Jun 7, 2024 19:47:28.807483912 CEST	64226	445	192.168.2.4	62.225.190.1
Jun 7, 2024 19:47:28.812479019 CEST	445	64225	62.225.190.1	192.168.2.4
Jun 7, 2024 19:47:28.812575102 CEST	64225	445	192.168.2.4	62.225.190.1
Jun 7, 2024 19:47:28.812669992 CEST	445	64226	62.225.190.1	192.168.2.4
Jun 7, 2024 19:47:28.812782049 CEST	64226	445	192.168.2.4	62.225.190.1
Jun 7, 2024 19:47:28.812839031 CEST	64226	445	192.168.2.4	62.225.190.1
Jun 7, 2024 19:47:28.818000078 CEST	445	64226	62.225.190.1	192.168.2.4
Jun 7, 2024 19:47:29.703895092 CEST	64227	445	192.168.2.4	215.114.241.2
Jun 7, 2024 19:47:29.709377050 CEST	445	64227	215.114.241.2	192.168.2.4
Jun 7, 2024 19:47:29.709526062 CEST	64227	445	192.168.2.4	215.114.241.2
Jun 7, 2024 19:47:29.709526062 CEST	64227	445	192.168.2.4	215.114.241.2
Jun 7, 2024 19:47:29.715162039 CEST	445	64227	215.114.241.2	192.168.2.4
Jun 7, 2024 19:47:29.896939993 CEST	445	64180	134.136.111.2	192.168.2.4
Jun 7, 2024 19:47:29.897171974 CEST	64180	445	192.168.2.4	134.136.111.2
Jun 7, 2024 19:47:29.897392988 CEST	64180	445	192.168.2.4	134.136.111.2
Jun 7, 2024 19:47:29.897492886 CEST	64180	445	192.168.2.4	134.136.111.2
Jun 7, 2024 19:47:29.902677059 CEST	445	64180	134.136.111.2	192.168.2.4
Jun 7, 2024 19:47:29.902796984 CEST	445	64180	134.136.111.2	192.168.2.4
Jun 7, 2024 19:47:29.951890945 CEST	64228	445	192.168.2.4	134.136.111.3
Jun 7, 2024 19:47:29.952240944 CEST	64229	445	192.168.2.4	147.68.73.170
Jun 7, 2024 19:47:29.957380056 CEST	445	64228	134.136.111.3	192.168.2.4
Jun 7, 2024 19:47:29.957444906 CEST	445	64229	147.68.73.170	192.168.2.4
Jun 7, 2024 19:47:29.957468033 CEST	64228	445	192.168.2.4	134.136.111.3
Jun 7, 2024 19:47:29.957688093 CEST	64228	445	192.168.2.4	134.136.111.3
Jun 7, 2024 19:47:29.957689047 CEST	64230	445	192.168.2.4	147.68.73.1
Jun 7, 2024 19:47:29.957691908 CEST	64229	445	192.168.2.4	147.68.73.170
Jun 7, 2024 19:47:29.957691908 CEST	64229	445	192.168.2.4	147.68.73.170
Jun 7, 2024 19:47:29.957844019 CEST	64231	445	192.168.2.4	134.136.111.3
Jun 7, 2024 19:47:29.963264942 CEST	445	64230	147.68.73.1	192.168.2.4
Jun 7, 2024 19:47:29.963331938 CEST	445	64231	134.136.111.3	192.168.2.4
Jun 7, 2024 19:47:29.963383913 CEST	445	64228	134.136.111.3	192.168.2.4
Jun 7, 2024 19:47:29.963457108 CEST	64230	445	192.168.2.4	147.68.73.1
Jun 7, 2024 19:47:29.963458061 CEST	64231	445	192.168.2.4	134.136.111.3
Jun 7, 2024 19:47:29.963476896 CEST	445	64229	147.68.73.170	192.168.2.4
Jun 7, 2024 19:47:29.963634968 CEST	64228	445	192.168.2.4	134.136.111.3
Jun 7, 2024 19:47:29.963634968 CEST	64231	445	192.168.2.4	134.136.111.3
Jun 7, 2024 19:47:29.963634968 CEST	64230	445	192.168.2.4	147.68.73.1
Jun 7, 2024 19:47:29.963735104 CEST	64229	445	192.168.2.4	147.68.73.170
Jun 7, 2024 19:47:29.963958979 CEST	64232	445	192.168.2.4	147.68.73.1
Jun 7, 2024 19:47:29.969034910 CEST	445	64231	134.136.111.3	192.168.2.4
Jun 7, 2024 19:47:29.969152927 CEST	445	64232	147.68.73.1	192.168.2.4
Jun 7, 2024 19:47:29.969196081 CEST	445	64230	147.68.73.1	192.168.2.4
Jun 7, 2024 19:47:29.969392061 CEST	64230	445	192.168.2.4	147.68.73.1
Jun 7, 2024 19:47:29.969398022 CEST	64232	445	192.168.2.4	147.68.73.1
Jun 7, 2024 19:47:29.969398022 CEST	64232	445	192.168.2.4	147.68.73.1
Jun 7, 2024 19:47:29.974921942 CEST	445	64232	147.68.73.1	192.168.2.4
Jun 7, 2024 19:47:30.365535975 CEST	445	64184	57.1.47.1	192.168.2.4
Jun 7, 2024 19:47:30.365768909 CEST	64184	445	192.168.2.4	57.1.47.1
Jun 7, 2024 19:47:30.365770102 CEST	64184	445	192.168.2.4	57.1.47.1
Jun 7, 2024 19:47:30.365770102 CEST	64184	445	192.168.2.4	57.1.47.1
Jun 7, 2024 19:47:30.371303082 CEST	445	64184	57.1.47.1	192.168.2.4
Jun 7, 2024 19:47:30.371368885 CEST	445	64184	57.1.47.1	192.168.2.4
Jun 7, 2024 19:47:30.535027981 CEST	445	64188	146.209.254.2	192.168.2.4
Jun 7, 2024 19:47:30.535113096 CEST	64188	445	192.168.2.4	146.209.254.2
Jun 7, 2024 19:47:30.535172939 CEST	64188	445	192.168.2.4	146.209.254.2
Jun 7, 2024 19:47:30.535212994 CEST	64188	445	192.168.2.4	146.209.254.2
Jun 7, 2024 19:47:30.540566921 CEST	445	64188	146.209.254.2	192.168.2.4
Jun 7, 2024 19:47:30.540608883 CEST	445	64188	146.209.254.2	192.168.2.4
Jun 7, 2024 19:47:30.936141014 CEST	64233	445	192.168.2.4	2.32.195.1
Jun 7, 2024 19:47:30.941368103 CEST	445	64233	2.32.195.1	192.168.2.4
Jun 7, 2024 19:47:30.941534996 CEST	64233	445	192.168.2.4	2.32.195.1
Jun 7, 2024 19:47:30.941575050 CEST	64233	445	192.168.2.4	2.32.195.1
Jun 7, 2024 19:47:30.946934938 CEST	445	64233	2.32.195.1	192.168.2.4
Jun 7, 2024 19:47:31.030518055 CEST	64234	445	192.168.2.4	220.152.113.23
Jun 7, 2024 19:47:31.036473989 CEST	445	64234	220.152.113.23	192.168.2.4
Jun 7, 2024 19:47:31.036955118 CEST	64234	445	192.168.2.4	220.152.113.23
Jun 7, 2024 19:47:31.037050962 CEST	64234	445	192.168.2.4	220.152.113.23
Jun 7, 2024 19:47:31.037293911 CEST	64235	445	192.168.2.4	220.152.113.1
Jun 7, 2024 19:47:31.042748928 CEST	445	64235	220.152.113.1	192.168.2.4
Jun 7, 2024 19:47:31.042941093 CEST	64235	445	192.168.2.4	220.152.113.1
Jun 7, 2024 19:47:31.042949915 CEST	445	64234	220.152.113.23	192.168.2.4
Jun 7, 2024 19:47:31.043024063 CEST	64235	445	192.168.2.4	220.152.113.1
Jun 7, 2024 19:47:31.043042898 CEST	64234	445	192.168.2.4	220.152.113.23
Jun 7, 2024 19:47:31.043725967 CEST	64236	445	192.168.2.4	220.152.113.1
Jun 7, 2024 19:47:31.048655033 CEST	445	64235	220.152.113.1	192.168.2.4
Jun 7, 2024 19:47:31.048753023 CEST	64235	445	192.168.2.4	220.152.113.1
Jun 7, 2024 19:47:31.048897982 CEST	445	64236	220.152.113.1	192.168.2.4
Jun 7, 2024 19:47:31.049218893 CEST	64236	445	192.168.2.4	220.152.113.1
Jun 7, 2024 19:47:31.049220085 CEST	64236	445	192.168.2.4	220.152.113.1
Jun 7, 2024 19:47:31.054902077 CEST	445	64236	220.152.113.1	192.168.2.4
Jun 7, 2024 19:47:31.092803001 CEST	64237	445	192.168.2.4	208.90.116.1
Jun 7, 2024 19:47:31.098134041 CEST	445	64237	208.90.116.1	192.168.2.4
Jun 7, 2024 19:47:31.098475933 CEST	64237	445	192.168.2.4	208.90.116.1
Jun 7, 2024 19:47:31.098475933 CEST	64237	445	192.168.2.4	208.90.116.1
Jun 7, 2024 19:47:31.103769064 CEST	445	64237	208.90.116.1	192.168.2.4
Jun 7, 2024 19:47:31.405030966 CEST	64238	445	192.168.2.4	213.63.222.1
Jun 7, 2024 19:47:31.410744905 CEST	445	64238	213.63.222.1	192.168.2.4
Jun 7, 2024 19:47:31.411010027 CEST	64238	445	192.168.2.4	213.63.222.1
Jun 7, 2024 19:47:31.411010981 CEST	64238	445	192.168.2.4	213.63.222.1
Jun 7, 2024 19:47:31.416450024 CEST	445	64238	213.63.222.1	192.168.2.4
Jun 7, 2024 19:47:31.467622042 CEST	64239	445	192.168.2.4	125.190.126.2
Jun 7, 2024 19:47:31.472995996 CEST	445	64239	125.190.126.2	192.168.2.4
Jun 7, 2024 19:47:31.473088026 CEST	64239	445	192.168.2.4	125.190.126.2
Jun 7, 2024 19:47:31.473129988 CEST	64239	445	192.168.2.4	125.190.126.2
Jun 7, 2024 19:47:31.478626966 CEST	445	64239	125.190.126.2	192.168.2.4
Jun 7, 2024 19:47:31.591846943 CEST	445	64233	2.32.195.1	192.168.2.4
Jun 7, 2024 19:47:31.592258930 CEST	64233	445	192.168.2.4	2.32.195.1
Jun 7, 2024 19:47:31.592317104 CEST	64233	445	192.168.2.4	2.32.195.1
Jun 7, 2024 19:47:31.592360020 CEST	64233	445	192.168.2.4	2.32.195.1
Jun 7, 2024 19:47:31.597878933 CEST	445	64233	2.32.195.1	192.168.2.4
Jun 7, 2024 19:47:31.597920895 CEST	445	64233	2.32.195.1	192.168.2.4
Jun 7, 2024 19:47:31.609558105 CEST	445	64237	208.90.116.1	192.168.2.4
Jun 7, 2024 19:47:31.609836102 CEST	64237	445	192.168.2.4	208.90.116.1
Jun 7, 2024 19:47:31.609925985 CEST	64237	445	192.168.2.4	208.90.116.1
Jun 7, 2024 19:47:31.610152960 CEST	64237	445	192.168.2.4	208.90.116.1
Jun 7, 2024 19:47:31.615324974 CEST	445	64237	208.90.116.1	192.168.2.4
Jun 7, 2024 19:47:31.615366936 CEST	445	64237	208.90.116.1	192.168.2.4
Jun 7, 2024 19:47:31.655102968 CEST	64240	445	192.168.2.4	2.32.195.2
Jun 7, 2024 19:47:31.660588980 CEST	445	64240	2.32.195.2	192.168.2.4
Jun 7, 2024 19:47:31.660826921 CEST	64240	445	192.168.2.4	2.32.195.2
Jun 7, 2024 19:47:31.660826921 CEST	64240	445	192.168.2.4	2.32.195.2
Jun 7, 2024 19:47:31.661113977 CEST	64241	445	192.168.2.4	2.32.195.2
Jun 7, 2024 19:47:31.666229010 CEST	445	64241	2.32.195.2	192.168.2.4
Jun 7, 2024 19:47:31.666371107 CEST	64241	445	192.168.2.4	2.32.195.2
Jun 7, 2024 19:47:31.666415930 CEST	64241	445	192.168.2.4	2.32.195.2
Jun 7, 2024 19:47:31.666533947 CEST	445	64240	2.32.195.2	192.168.2.4
Jun 7, 2024 19:47:31.666716099 CEST	64240	445	192.168.2.4	2.32.195.2
Jun 7, 2024 19:47:31.670841932 CEST	64242	445	192.168.2.4	208.90.116.2
Jun 7, 2024 19:47:31.671741962 CEST	445	64241	2.32.195.2	192.168.2.4
Jun 7, 2024 19:47:31.676372051 CEST	445	64242	208.90.116.2	192.168.2.4
Jun 7, 2024 19:47:31.676453114 CEST	64242	445	192.168.2.4	208.90.116.2
Jun 7, 2024 19:47:31.676548004 CEST	64242	445	192.168.2.4	208.90.116.2
Jun 7, 2024 19:47:31.677037954 CEST	64243	445	192.168.2.4	208.90.116.2
Jun 7, 2024 19:47:31.682140112 CEST	445	64242	208.90.116.2	192.168.2.4
Jun 7, 2024 19:47:31.682179928 CEST	445	64242	208.90.116.2	192.168.2.4
Jun 7, 2024 19:47:31.682212114 CEST	445	64243	208.90.116.2	192.168.2.4
Jun 7, 2024 19:47:31.682250023 CEST	64242	445	192.168.2.4	208.90.116.2
Jun 7, 2024 19:47:31.682337046 CEST	64243	445	192.168.2.4	208.90.116.2
Jun 7, 2024 19:47:31.682337046 CEST	64243	445	192.168.2.4	208.90.116.2
Jun 7, 2024 19:47:31.687278032 CEST	445	64243	208.90.116.2	192.168.2.4
Jun 7, 2024 19:47:31.796658039 CEST	445	64193	11.204.88.1	192.168.2.4
Jun 7, 2024 19:47:31.796809912 CEST	64193	445	192.168.2.4	11.204.88.1
Jun 7, 2024 19:47:31.798486948 CEST	64193	445	192.168.2.4	11.204.88.1
Jun 7, 2024 19:47:31.798532009 CEST	64193	445	192.168.2.4	11.204.88.1
Jun 7, 2024 19:47:31.803826094 CEST	445	64193	11.204.88.1	192.168.2.4
Jun 7, 2024 19:47:31.803872108 CEST	445	64193	11.204.88.1	192.168.2.4
Jun 7, 2024 19:47:31.894969940 CEST	445	64194	172.183.28.2	192.168.2.4
Jun 7, 2024 19:47:31.895345926 CEST	64194	445	192.168.2.4	172.183.28.2
Jun 7, 2024 19:47:31.897975922 CEST	64194	445	192.168.2.4	172.183.28.2
Jun 7, 2024 19:47:31.898021936 CEST	64194	445	192.168.2.4	172.183.28.2
Jun 7, 2024 19:47:31.903387070 CEST	445	64194	172.183.28.2	192.168.2.4
Jun 7, 2024 19:47:31.903429985 CEST	445	64194	172.183.28.2	192.168.2.4
Jun 7, 2024 19:47:31.952100039 CEST	64244	445	192.168.2.4	172.183.28.3
Jun 7, 2024 19:47:31.957473040 CEST	445	64244	172.183.28.3	192.168.2.4
Jun 7, 2024 19:47:31.957711935 CEST	64244	445	192.168.2.4	172.183.28.3
Jun 7, 2024 19:47:31.957711935 CEST	64244	445	192.168.2.4	172.183.28.3
Jun 7, 2024 19:47:31.957863092 CEST	64245	445	192.168.2.4	172.183.28.3
Jun 7, 2024 19:47:31.963120937 CEST	445	64245	172.183.28.3	192.168.2.4
Jun 7, 2024 19:47:31.963267088 CEST	64245	445	192.168.2.4	172.183.28.3
Jun 7, 2024 19:47:31.963409901 CEST	64245	445	192.168.2.4	172.183.28.3
Jun 7, 2024 19:47:31.965954065 CEST	445	64244	172.183.28.3	192.168.2.4
Jun 7, 2024 19:47:31.966136932 CEST	64244	445	192.168.2.4	172.183.28.3
Jun 7, 2024 19:47:31.968458891 CEST	445	64245	172.183.28.3	192.168.2.4
Jun 7, 2024 19:47:32.048559904 CEST	64246	445	192.168.2.4	218.42.144.47
Jun 7, 2024 19:47:32.054224968 CEST	445	64246	218.42.144.47	192.168.2.4
Jun 7, 2024 19:47:32.054337025 CEST	64246	445	192.168.2.4	218.42.144.47
Jun 7, 2024 19:47:32.054373980 CEST	64246	445	192.168.2.4	218.42.144.47
Jun 7, 2024 19:47:32.054620981 CEST	64247	445	192.168.2.4	218.42.144.1
Jun 7, 2024 19:47:32.060002089 CEST	445	64247	218.42.144.1	192.168.2.4
Jun 7, 2024 19:47:32.060045958 CEST	445	64246	218.42.144.47	192.168.2.4
Jun 7, 2024 19:47:32.060193062 CEST	64247	445	192.168.2.4	218.42.144.1
Jun 7, 2024 19:47:32.060209990 CEST	64246	445	192.168.2.4	218.42.144.47
Jun 7, 2024 19:47:32.060261965 CEST	64247	445	192.168.2.4	218.42.144.1
Jun 7, 2024 19:47:32.060559988 CEST	64248	445	192.168.2.4	218.42.144.1
Jun 7, 2024 19:47:32.065861940 CEST	445	64248	218.42.144.1	192.168.2.4
Jun 7, 2024 19:47:32.065905094 CEST	445	64247	218.42.144.1	192.168.2.4
Jun 7, 2024 19:47:32.066095114 CEST	64248	445	192.168.2.4	218.42.144.1
Jun 7, 2024 19:47:32.066096067 CEST	64248	445	192.168.2.4	218.42.144.1
Jun 7, 2024 19:47:32.066096067 CEST	64247	445	192.168.2.4	218.42.144.1
Jun 7, 2024 19:47:32.071377039 CEST	445	64248	218.42.144.1	192.168.2.4
Jun 7, 2024 19:47:32.499362946 CEST	445	64196	56.152.161.2	192.168.2.4
Jun 7, 2024 19:47:32.499982119 CEST	64196	445	192.168.2.4	56.152.161.2
Jun 7, 2024 19:47:32.499983072 CEST	64196	445	192.168.2.4	56.152.161.2
Jun 7, 2024 19:47:32.499983072 CEST	64196	445	192.168.2.4	56.152.161.2
Jun 7, 2024 19:47:32.505784035 CEST	445	64196	56.152.161.2	192.168.2.4
Jun 7, 2024 19:47:32.505826950 CEST	445	64196	56.152.161.2	192.168.2.4
Jun 7, 2024 19:47:32.689800978 CEST	445	64248	218.42.144.1	192.168.2.4
Jun 7, 2024 19:47:32.690078974 CEST	64248	445	192.168.2.4	218.42.144.1
Jun 7, 2024 19:47:32.690167904 CEST	64248	445	192.168.2.4	218.42.144.1
Jun 7, 2024 19:47:32.690191984 CEST	64248	445	192.168.2.4	218.42.144.1
Jun 7, 2024 19:47:32.695542097 CEST	445	64248	218.42.144.1	192.168.2.4
Jun 7, 2024 19:47:32.695586920 CEST	445	64248	218.42.144.1	192.168.2.4
Jun 7, 2024 19:47:32.983658075 CEST	64249	445	192.168.2.4	31.109.231.212
Jun 7, 2024 19:47:32.989434004 CEST	445	64249	31.109.231.212	192.168.2.4
Jun 7, 2024 19:47:32.989873886 CEST	64249	445	192.168.2.4	31.109.231.212
Jun 7, 2024 19:47:32.989873886 CEST	64249	445	192.168.2.4	31.109.231.212
Jun 7, 2024 19:47:32.990195036 CEST	64250	445	192.168.2.4	31.109.231.1
Jun 7, 2024 19:47:32.995655060 CEST	445	64250	31.109.231.1	192.168.2.4
Jun 7, 2024 19:47:32.995698929 CEST	445	64249	31.109.231.212	192.168.2.4
Jun 7, 2024 19:47:32.995878935 CEST	64249	445	192.168.2.4	31.109.231.212
Jun 7, 2024 19:47:32.995971918 CEST	64250	445	192.168.2.4	31.109.231.1
Jun 7, 2024 19:47:32.996047974 CEST	64250	445	192.168.2.4	31.109.231.1
Jun 7, 2024 19:47:32.996367931 CEST	64251	445	192.168.2.4	31.109.231.1
Jun 7, 2024 19:47:33.001506090 CEST	445	64250	31.109.231.1	192.168.2.4
Jun 7, 2024 19:47:33.001580000 CEST	445	64251	31.109.231.1	192.168.2.4
Jun 7, 2024 19:47:33.001687050 CEST	64250	445	192.168.2.4	31.109.231.1
Jun 7, 2024 19:47:33.001759052 CEST	64251	445	192.168.2.4	31.109.231.1
Jun 7, 2024 19:47:33.001759052 CEST	64251	445	192.168.2.4	31.109.231.1
Jun 7, 2024 19:47:33.007009983 CEST	445	64251	31.109.231.1	192.168.2.4
Jun 7, 2024 19:47:33.325193882 CEST	445	64199	144.144.246.1	192.168.2.4
Jun 7, 2024 19:47:33.325650930 CEST	64199	445	192.168.2.4	144.144.246.1
Jun 7, 2024 19:47:33.325651884 CEST	64199	445	192.168.2.4	144.144.246.1
Jun 7, 2024 19:47:33.325651884 CEST	64199	445	192.168.2.4	144.144.246.1
Jun 7, 2024 19:47:33.331428051 CEST	445	64199	144.144.246.1	192.168.2.4
Jun 7, 2024 19:47:33.331470013 CEST	445	64199	144.144.246.1	192.168.2.4
Jun 7, 2024 19:47:33.373977900 CEST	64252	445	192.168.2.4	57.1.47.1
Jun 7, 2024 19:47:33.379751921 CEST	445	64252	57.1.47.1	192.168.2.4
Jun 7, 2024 19:47:33.379949093 CEST	64252	445	192.168.2.4	57.1.47.1
Jun 7, 2024 19:47:33.379950047 CEST	64252	445	192.168.2.4	57.1.47.1
Jun 7, 2024 19:47:33.385420084 CEST	445	64252	57.1.47.1	192.168.2.4
Jun 7, 2024 19:47:33.545630932 CEST	64253	445	192.168.2.4	146.209.254.2
Jun 7, 2024 19:47:33.551239967 CEST	445	64253	146.209.254.2	192.168.2.4
Jun 7, 2024 19:47:33.551457882 CEST	64253	445	192.168.2.4	146.209.254.2
Jun 7, 2024 19:47:33.551549911 CEST	64253	445	192.168.2.4	146.209.254.2
Jun 7, 2024 19:47:33.556952000 CEST	445	64253	146.209.254.2	192.168.2.4
Jun 7, 2024 19:47:33.858546019 CEST	64254	445	192.168.2.4	35.246.127.247
Jun 7, 2024 19:47:33.864408016 CEST	445	64254	35.246.127.247	192.168.2.4
Jun 7, 2024 19:47:33.864609957 CEST	64254	445	192.168.2.4	35.246.127.247
Jun 7, 2024 19:47:33.864725113 CEST	64254	445	192.168.2.4	35.246.127.247
Jun 7, 2024 19:47:33.864873886 CEST	64255	445	192.168.2.4	35.246.127.1
Jun 7, 2024 19:47:33.870240927 CEST	445	64255	35.246.127.1	192.168.2.4
Jun 7, 2024 19:47:33.870273113 CEST	445	64254	35.246.127.247	192.168.2.4
Jun 7, 2024 19:47:33.870290041 CEST	445	64254	35.246.127.247	192.168.2.4
Jun 7, 2024 19:47:33.870569944 CEST	64254	445	192.168.2.4	35.246.127.247
Jun 7, 2024 19:47:33.870599985 CEST	64255	445	192.168.2.4	35.246.127.1
Jun 7, 2024 19:47:33.870718002 CEST	64255	445	192.168.2.4	35.246.127.1
Jun 7, 2024 19:47:33.871146917 CEST	64256	445	192.168.2.4	35.246.127.1
Jun 7, 2024 19:47:33.876622915 CEST	445	64256	35.246.127.1	192.168.2.4
Jun 7, 2024 19:47:33.876667023 CEST	445	64255	35.246.127.1	192.168.2.4
Jun 7, 2024 19:47:33.876707077 CEST	64256	445	192.168.2.4	35.246.127.1
Jun 7, 2024 19:47:33.876739979 CEST	64255	445	192.168.2.4	35.246.127.1
Jun 7, 2024 19:47:33.876929045 CEST	64256	445	192.168.2.4	35.246.127.1
Jun 7, 2024 19:47:33.882441998 CEST	445	64256	35.246.127.1	192.168.2.4
Jun 7, 2024 19:47:33.930084944 CEST	445	64200	78.235.15.2	192.168.2.4
Jun 7, 2024 19:47:33.930416107 CEST	64200	445	192.168.2.4	78.235.15.2
Jun 7, 2024 19:47:33.930536985 CEST	64200	445	192.168.2.4	78.235.15.2
Jun 7, 2024 19:47:33.930566072 CEST	64200	445	192.168.2.4	78.235.15.2
Jun 7, 2024 19:47:33.936136961 CEST	445	64200	78.235.15.2	192.168.2.4
Jun 7, 2024 19:47:33.936180115 CEST	445	64200	78.235.15.2	192.168.2.4
Jun 7, 2024 19:47:33.983323097 CEST	64257	445	192.168.2.4	78.235.15.3
Jun 7, 2024 19:47:33.988670111 CEST	445	64257	78.235.15.3	192.168.2.4
Jun 7, 2024 19:47:33.988790035 CEST	64257	445	192.168.2.4	78.235.15.3
Jun 7, 2024 19:47:33.988869905 CEST	64257	445	192.168.2.4	78.235.15.3
Jun 7, 2024 19:47:33.989207983 CEST	64258	445	192.168.2.4	78.235.15.3
Jun 7, 2024 19:47:33.994530916 CEST	445	64258	78.235.15.3	192.168.2.4
Jun 7, 2024 19:47:33.994575977 CEST	445	64257	78.235.15.3	192.168.2.4
Jun 7, 2024 19:47:33.994666100 CEST	64258	445	192.168.2.4	78.235.15.3
Jun 7, 2024 19:47:33.994667053 CEST	64257	445	192.168.2.4	78.235.15.3
Jun 7, 2024 19:47:33.994764090 CEST	64258	445	192.168.2.4	78.235.15.3
Jun 7, 2024 19:47:34.000293016 CEST	445	64258	78.235.15.3	192.168.2.4
Jun 7, 2024 19:47:34.018666029 CEST	445	64201	142.0.124.1	192.168.2.4
Jun 7, 2024 19:47:34.018889904 CEST	64201	445	192.168.2.4	142.0.124.1
Jun 7, 2024 19:47:34.018889904 CEST	64201	445	192.168.2.4	142.0.124.1
Jun 7, 2024 19:47:34.018889904 CEST	64201	445	192.168.2.4	142.0.124.1
Jun 7, 2024 19:47:34.024460077 CEST	445	64201	142.0.124.1	192.168.2.4
Jun 7, 2024 19:47:34.024522066 CEST	445	64201	142.0.124.1	192.168.2.4
Jun 7, 2024 19:47:34.082520962 CEST	64259	445	192.168.2.4	142.0.124.2
Jun 7, 2024 19:47:34.088340998 CEST	445	64259	142.0.124.2	192.168.2.4
Jun 7, 2024 19:47:34.088839054 CEST	64259	445	192.168.2.4	142.0.124.2
Jun 7, 2024 19:47:34.088839054 CEST	64259	445	192.168.2.4	142.0.124.2
Jun 7, 2024 19:47:34.089190006 CEST	64260	445	192.168.2.4	142.0.124.2
Jun 7, 2024 19:47:34.094568968 CEST	445	64260	142.0.124.2	192.168.2.4
Jun 7, 2024 19:47:34.094743013 CEST	64260	445	192.168.2.4	142.0.124.2
Jun 7, 2024 19:47:34.094805002 CEST	445	64259	142.0.124.2	192.168.2.4
Jun 7, 2024 19:47:34.094933987 CEST	64260	445	192.168.2.4	142.0.124.2
Jun 7, 2024 19:47:34.098165035 CEST	64259	445	192.168.2.4	142.0.124.2
Jun 7, 2024 19:47:34.100115061 CEST	445	64260	142.0.124.2	192.168.2.4
Jun 7, 2024 19:47:34.582709074 CEST	445	64203	140.23.22.2	192.168.2.4
Jun 7, 2024 19:47:34.582807064 CEST	64203	445	192.168.2.4	140.23.22.2
Jun 7, 2024 19:47:34.582988024 CEST	64203	445	192.168.2.4	140.23.22.2
Jun 7, 2024 19:47:34.583041906 CEST	64203	445	192.168.2.4	140.23.22.2
Jun 7, 2024 19:47:34.587949038 CEST	445	64203	140.23.22.2	192.168.2.4
Jun 7, 2024 19:47:34.587979078 CEST	445	64203	140.23.22.2	192.168.2.4
Jun 7, 2024 19:47:34.658329010 CEST	445	64205	73.148.167.3	192.168.2.4
Jun 7, 2024 19:47:34.658413887 CEST	64205	445	192.168.2.4	73.148.167.3
Jun 7, 2024 19:47:34.658494949 CEST	64205	445	192.168.2.4	73.148.167.3
Jun 7, 2024 19:47:34.658494949 CEST	64205	445	192.168.2.4	73.148.167.3
Jun 7, 2024 19:47:34.663435936 CEST	445	64205	73.148.167.3	192.168.2.4
Jun 7, 2024 19:47:34.663465977 CEST	445	64205	73.148.167.3	192.168.2.4
Jun 7, 2024 19:47:34.686506987 CEST	64261	445	192.168.2.4	185.133.177.14
Jun 7, 2024 19:47:34.691935062 CEST	445	64261	185.133.177.14	192.168.2.4
Jun 7, 2024 19:47:34.692101955 CEST	64261	445	192.168.2.4	185.133.177.14
Jun 7, 2024 19:47:34.692101955 CEST	64261	445	192.168.2.4	185.133.177.14
Jun 7, 2024 19:47:34.692281961 CEST	64262	445	192.168.2.4	185.133.177.1
Jun 7, 2024 19:47:34.697339058 CEST	445	64262	185.133.177.1	192.168.2.4
Jun 7, 2024 19:47:34.697494984 CEST	64262	445	192.168.2.4	185.133.177.1
Jun 7, 2024 19:47:34.697495937 CEST	64262	445	192.168.2.4	185.133.177.1
Jun 7, 2024 19:47:34.697819948 CEST	64263	445	192.168.2.4	185.133.177.1
Jun 7, 2024 19:47:34.697860003 CEST	445	64261	185.133.177.14	192.168.2.4
Jun 7, 2024 19:47:34.698107958 CEST	64261	445	192.168.2.4	185.133.177.14
Jun 7, 2024 19:47:34.703092098 CEST	445	64263	185.133.177.1	192.168.2.4
Jun 7, 2024 19:47:34.703181982 CEST	445	64262	185.133.177.1	192.168.2.4
Jun 7, 2024 19:47:34.703197956 CEST	64263	445	192.168.2.4	185.133.177.1
Jun 7, 2024 19:47:34.703269005 CEST	64262	445	192.168.2.4	185.133.177.1
Jun 7, 2024 19:47:34.703296900 CEST	64263	445	192.168.2.4	185.133.177.1
Jun 7, 2024 19:47:34.708414078 CEST	445	64263	185.133.177.1	192.168.2.4
Jun 7, 2024 19:47:34.811208010 CEST	64264	445	192.168.2.4	11.204.88.1
Jun 7, 2024 19:47:34.816930056 CEST	445	64264	11.204.88.1	192.168.2.4
Jun 7, 2024 19:47:34.817145109 CEST	64264	445	192.168.2.4	11.204.88.1
Jun 7, 2024 19:47:34.817169905 CEST	64264	445	192.168.2.4	11.204.88.1
Jun 7, 2024 19:47:34.822182894 CEST	445	64264	11.204.88.1	192.168.2.4
Jun 7, 2024 19:47:35.430007935 CEST	445	64211	102.44.235.3	192.168.2.4
Jun 7, 2024 19:47:35.430118084 CEST	64211	445	192.168.2.4	102.44.235.3
Jun 7, 2024 19:47:35.430214882 CEST	64211	445	192.168.2.4	102.44.235.3
Jun 7, 2024 19:47:35.430242062 CEST	64211	445	192.168.2.4	102.44.235.3
Jun 7, 2024 19:47:35.435270071 CEST	445	64211	102.44.235.3	192.168.2.4
Jun 7, 2024 19:47:35.435317039 CEST	445	64211	102.44.235.3	192.168.2.4
Jun 7, 2024 19:47:35.452322960 CEST	64265	445	192.168.2.4	9.135.254.205
Jun 7, 2024 19:47:35.457978964 CEST	445	64265	9.135.254.205	192.168.2.4
Jun 7, 2024 19:47:35.458230019 CEST	64265	445	192.168.2.4	9.135.254.205
Jun 7, 2024 19:47:35.458230019 CEST	64265	445	192.168.2.4	9.135.254.205
Jun 7, 2024 19:47:35.458374977 CEST	64266	445	192.168.2.4	9.135.254.1
Jun 7, 2024 19:47:35.463522911 CEST	445	64266	9.135.254.1	192.168.2.4
Jun 7, 2024 19:47:35.463615894 CEST	64266	445	192.168.2.4	9.135.254.1
Jun 7, 2024 19:47:35.463643074 CEST	64266	445	192.168.2.4	9.135.254.1
Jun 7, 2024 19:47:35.463880062 CEST	445	64265	9.135.254.205	192.168.2.4
Jun 7, 2024 19:47:35.464065075 CEST	64265	445	192.168.2.4	9.135.254.205
Jun 7, 2024 19:47:35.464195013 CEST	64267	445	192.168.2.4	9.135.254.1
Jun 7, 2024 19:47:35.469247103 CEST	445	64266	9.135.254.1	192.168.2.4
Jun 7, 2024 19:47:35.469268084 CEST	445	64267	9.135.254.1	192.168.2.4
Jun 7, 2024 19:47:35.469305038 CEST	64266	445	192.168.2.4	9.135.254.1
Jun 7, 2024 19:47:35.469357967 CEST	64267	445	192.168.2.4	9.135.254.1
Jun 7, 2024 19:47:35.469423056 CEST	64267	445	192.168.2.4	9.135.254.1
Jun 7, 2024 19:47:35.475469112 CEST	445	64267	9.135.254.1	192.168.2.4
Jun 7, 2024 19:47:35.514631987 CEST	64268	445	192.168.2.4	56.152.161.2
Jun 7, 2024 19:47:35.519988060 CEST	445	64268	56.152.161.2	192.168.2.4
Jun 7, 2024 19:47:35.520524979 CEST	64268	445	192.168.2.4	56.152.161.2
Jun 7, 2024 19:47:35.520524979 CEST	64268	445	192.168.2.4	56.152.161.2
Jun 7, 2024 19:47:35.526340008 CEST	445	64268	56.152.161.2	192.168.2.4
Jun 7, 2024 19:47:35.702229023 CEST	64269	445	192.168.2.4	218.42.144.1
Jun 7, 2024 19:47:35.707798004 CEST	445	64269	218.42.144.1	192.168.2.4
Jun 7, 2024 19:47:35.708175898 CEST	64269	445	192.168.2.4	218.42.144.1
Jun 7, 2024 19:47:35.708265066 CEST	64269	445	192.168.2.4	218.42.144.1
Jun 7, 2024 19:47:35.713571072 CEST	445	64269	218.42.144.1	192.168.2.4
Jun 7, 2024 19:47:35.931657076 CEST	445	64212	103.194.154.3	192.168.2.4
Jun 7, 2024 19:47:35.931757927 CEST	64212	445	192.168.2.4	103.194.154.3
Jun 7, 2024 19:47:35.931854010 CEST	64212	445	192.168.2.4	103.194.154.3
Jun 7, 2024 19:47:35.931977034 CEST	64212	445	192.168.2.4	103.194.154.3
Jun 7, 2024 19:47:35.937027931 CEST	445	64212	103.194.154.3	192.168.2.4
Jun 7, 2024 19:47:35.937058926 CEST	445	64212	103.194.154.3	192.168.2.4
Jun 7, 2024 19:47:35.955688000 CEST	445	64213	83.55.32.2	192.168.2.4
Jun 7, 2024 19:47:35.955799103 CEST	64213	445	192.168.2.4	83.55.32.2
Jun 7, 2024 19:47:35.955800056 CEST	64213	445	192.168.2.4	83.55.32.2
Jun 7, 2024 19:47:35.955883026 CEST	64213	445	192.168.2.4	83.55.32.2
Jun 7, 2024 19:47:35.964585066 CEST	445	64213	83.55.32.2	192.168.2.4
Jun 7, 2024 19:47:35.964617014 CEST	445	64213	83.55.32.2	192.168.2.4
Jun 7, 2024 19:47:35.983092070 CEST	64270	445	192.168.2.4	103.194.154.4
Jun 7, 2024 19:47:35.991950035 CEST	445	64270	103.194.154.4	192.168.2.4
Jun 7, 2024 19:47:35.992260933 CEST	64270	445	192.168.2.4	103.194.154.4
Jun 7, 2024 19:47:35.992288113 CEST	64270	445	192.168.2.4	103.194.154.4
Jun 7, 2024 19:47:35.992568016 CEST	64271	445	192.168.2.4	103.194.154.4
Jun 7, 2024 19:47:36.000448942 CEST	445	64271	103.194.154.4	192.168.2.4
Jun 7, 2024 19:47:36.000556946 CEST	445	64270	103.194.154.4	192.168.2.4
Jun 7, 2024 19:47:36.000781059 CEST	64271	445	192.168.2.4	103.194.154.4
Jun 7, 2024 19:47:36.000782013 CEST	64270	445	192.168.2.4	103.194.154.4
Jun 7, 2024 19:47:36.000782013 CEST	64271	445	192.168.2.4	103.194.154.4
Jun 7, 2024 19:47:36.009963036 CEST	445	64271	103.194.154.4	192.168.2.4
Jun 7, 2024 19:47:36.014249086 CEST	64272	445	192.168.2.4	83.55.32.3
Jun 7, 2024 19:47:36.019623041 CEST	445	64214	190.49.101.1	192.168.2.4
Jun 7, 2024 19:47:36.019849062 CEST	64214	445	192.168.2.4	190.49.101.1
Jun 7, 2024 19:47:36.019849062 CEST	64214	445	192.168.2.4	190.49.101.1
Jun 7, 2024 19:47:36.019946098 CEST	64214	445	192.168.2.4	190.49.101.1
Jun 7, 2024 19:47:36.023664951 CEST	445	64272	83.55.32.3	192.168.2.4
Jun 7, 2024 19:47:36.023741961 CEST	64272	445	192.168.2.4	83.55.32.3
Jun 7, 2024 19:47:36.023778915 CEST	64272	445	192.168.2.4	83.55.32.3
Jun 7, 2024 19:47:36.024091959 CEST	64273	445	192.168.2.4	83.55.32.3
Jun 7, 2024 19:47:36.028974056 CEST	445	64214	190.49.101.1	192.168.2.4
Jun 7, 2024 19:47:36.029038906 CEST	445	64214	190.49.101.1	192.168.2.4
Jun 7, 2024 19:47:36.033236027 CEST	445	64273	83.55.32.3	192.168.2.4
Jun 7, 2024 19:47:36.033302069 CEST	445	64272	83.55.32.3	192.168.2.4
Jun 7, 2024 19:47:36.033355951 CEST	64272	445	192.168.2.4	83.55.32.3
Jun 7, 2024 19:47:36.033457994 CEST	64273	445	192.168.2.4	83.55.32.3
Jun 7, 2024 19:47:36.033458948 CEST	64273	445	192.168.2.4	83.55.32.3
Jun 7, 2024 19:47:36.041923046 CEST	445	64273	83.55.32.3	192.168.2.4
Jun 7, 2024 19:47:36.081537962 CEST	64274	445	192.168.2.4	190.49.101.2
Jun 7, 2024 19:47:36.086882114 CEST	445	64274	190.49.101.2	192.168.2.4
Jun 7, 2024 19:47:36.087022066 CEST	64274	445	192.168.2.4	190.49.101.2
Jun 7, 2024 19:47:36.087055922 CEST	64274	445	192.168.2.4	190.49.101.2
Jun 7, 2024 19:47:36.087512016 CEST	64275	445	192.168.2.4	190.49.101.2
Jun 7, 2024 19:47:36.092592955 CEST	445	64275	190.49.101.2	192.168.2.4
Jun 7, 2024 19:47:36.092852116 CEST	64275	445	192.168.2.4	190.49.101.2
Jun 7, 2024 19:47:36.092852116 CEST	64275	445	192.168.2.4	190.49.101.2
Jun 7, 2024 19:47:36.093035936 CEST	445	64274	190.49.101.2	192.168.2.4
Jun 7, 2024 19:47:36.093102932 CEST	64274	445	192.168.2.4	190.49.101.2
Jun 7, 2024 19:47:36.098084927 CEST	445	64275	190.49.101.2	192.168.2.4
Jun 7, 2024 19:47:36.123876095 CEST	445	64218	166.84.10.2	192.168.2.4
Jun 7, 2024 19:47:36.124103069 CEST	64218	445	192.168.2.4	166.84.10.2
Jun 7, 2024 19:47:36.124186993 CEST	64218	445	192.168.2.4	166.84.10.2
Jun 7, 2024 19:47:36.124253988 CEST	64218	445	192.168.2.4	166.84.10.2
Jun 7, 2024 19:47:36.129228115 CEST	445	64218	166.84.10.2	192.168.2.4
Jun 7, 2024 19:47:36.129272938 CEST	445	64218	166.84.10.2	192.168.2.4
Jun 7, 2024 19:47:36.186296940 CEST	64277	445	192.168.2.4	166.84.10.3
Jun 7, 2024 19:47:36.191704035 CEST	445	64277	166.84.10.3	192.168.2.4
Jun 7, 2024 19:47:36.191848040 CEST	64277	445	192.168.2.4	166.84.10.3
Jun 7, 2024 19:47:36.191848993 CEST	64277	445	192.168.2.4	166.84.10.3
Jun 7, 2024 19:47:36.192270041 CEST	64278	445	192.168.2.4	166.84.10.3
Jun 7, 2024 19:47:36.197447062 CEST	445	64278	166.84.10.3	192.168.2.4
Jun 7, 2024 19:47:36.197535992 CEST	445	64277	166.84.10.3	192.168.2.4
Jun 7, 2024 19:47:36.197540045 CEST	64278	445	192.168.2.4	166.84.10.3
Jun 7, 2024 19:47:36.197623014 CEST	64278	445	192.168.2.4	166.84.10.3
Jun 7, 2024 19:47:36.197623968 CEST	64277	445	192.168.2.4	166.84.10.3
Jun 7, 2024 19:47:36.202750921 CEST	445	64278	166.84.10.3	192.168.2.4
Jun 7, 2024 19:47:36.326997042 CEST	64279	445	192.168.2.4	144.144.246.1
Jun 7, 2024 19:47:36.332705975 CEST	445	64279	144.144.246.1	192.168.2.4
Jun 7, 2024 19:47:36.333004951 CEST	64279	445	192.168.2.4	144.144.246.1
Jun 7, 2024 19:47:36.333004951 CEST	64279	445	192.168.2.4	144.144.246.1
Jun 7, 2024 19:47:36.338525057 CEST	445	64279	144.144.246.1	192.168.2.4
Jun 7, 2024 19:47:36.339584112 CEST	445	64269	218.42.144.1	192.168.2.4
Jun 7, 2024 19:47:36.339896917 CEST	64269	445	192.168.2.4	218.42.144.1
Jun 7, 2024 19:47:36.339896917 CEST	64269	445	192.168.2.4	218.42.144.1
Jun 7, 2024 19:47:36.339987993 CEST	64269	445	192.168.2.4	218.42.144.1
Jun 7, 2024 19:47:36.345217943 CEST	445	64269	218.42.144.1	192.168.2.4
Jun 7, 2024 19:47:36.345261097 CEST	445	64269	218.42.144.1	192.168.2.4
Jun 7, 2024 19:47:36.404882908 CEST	64280	445	192.168.2.4	218.42.144.2
Jun 7, 2024 19:47:36.410346031 CEST	445	64280	218.42.144.2	192.168.2.4
Jun 7, 2024 19:47:36.410552025 CEST	64280	445	192.168.2.4	218.42.144.2
Jun 7, 2024 19:47:36.410648108 CEST	64280	445	192.168.2.4	218.42.144.2
Jun 7, 2024 19:47:36.411021948 CEST	64281	445	192.168.2.4	218.42.144.2
Jun 7, 2024 19:47:36.416018009 CEST	445	64281	218.42.144.2	192.168.2.4
Jun 7, 2024 19:47:36.416152954 CEST	64281	445	192.168.2.4	218.42.144.2
Jun 7, 2024 19:47:36.416193008 CEST	64281	445	192.168.2.4	218.42.144.2
Jun 7, 2024 19:47:36.416241884 CEST	445	64280	218.42.144.2	192.168.2.4
Jun 7, 2024 19:47:36.416302919 CEST	64280	445	192.168.2.4	218.42.144.2
Jun 7, 2024 19:47:36.421154976 CEST	445	64281	218.42.144.2	192.168.2.4
Jun 7, 2024 19:47:36.450486898 CEST	445	64220	189.66.242.3	192.168.2.4
Jun 7, 2024 19:47:36.450944901 CEST	64220	445	192.168.2.4	189.66.242.3
Jun 7, 2024 19:47:36.450944901 CEST	64220	445	192.168.2.4	189.66.242.3
Jun 7, 2024 19:47:36.450944901 CEST	64220	445	192.168.2.4	189.66.242.3
Jun 7, 2024 19:47:36.456414938 CEST	445	64220	189.66.242.3	192.168.2.4
Jun 7, 2024 19:47:36.456478119 CEST	445	64220	189.66.242.3	192.168.2.4
Jun 7, 2024 19:47:36.508939028 CEST	445	64222	205.222.42.2	192.168.2.4
Jun 7, 2024 19:47:36.509095907 CEST	64222	445	192.168.2.4	205.222.42.2
Jun 7, 2024 19:47:36.509095907 CEST	64222	445	192.168.2.4	205.222.42.2
Jun 7, 2024 19:47:36.509183884 CEST	64222	445	192.168.2.4	205.222.42.2
Jun 7, 2024 19:47:36.514312983 CEST	445	64222	205.222.42.2	192.168.2.4
Jun 7, 2024 19:47:36.514482021 CEST	445	64222	205.222.42.2	192.168.2.4
Jun 7, 2024 19:47:36.723421097 CEST	445	64278	166.84.10.3	192.168.2.4
Jun 7, 2024 19:47:36.723567009 CEST	64278	445	192.168.2.4	166.84.10.3
Jun 7, 2024 19:47:36.723654985 CEST	64278	445	192.168.2.4	166.84.10.3
Jun 7, 2024 19:47:36.723654985 CEST	64278	445	192.168.2.4	166.84.10.3
Jun 7, 2024 19:47:36.728632927 CEST	445	64278	166.84.10.3	192.168.2.4
Jun 7, 2024 19:47:36.728677988 CEST	445	64278	166.84.10.3	192.168.2.4
Jun 7, 2024 19:47:37.033864021 CEST	445	64223	146.45.88.2	192.168.2.4
Jun 7, 2024 19:47:37.034049034 CEST	64223	445	192.168.2.4	146.45.88.2
Jun 7, 2024 19:47:37.034159899 CEST	64223	445	192.168.2.4	146.45.88.2
Jun 7, 2024 19:47:37.034159899 CEST	64223	445	192.168.2.4	146.45.88.2
Jun 7, 2024 19:47:37.040657043 CEST	445	64223	146.45.88.2	192.168.2.4
Jun 7, 2024 19:47:37.040719032 CEST	445	64223	146.45.88.2	192.168.2.4
Jun 7, 2024 19:47:37.092689991 CEST	64283	445	192.168.2.4	146.45.88.3
Jun 7, 2024 19:47:37.097743034 CEST	445	64283	146.45.88.3	192.168.2.4
Jun 7, 2024 19:47:37.097826004 CEST	64283	445	192.168.2.4	146.45.88.3
Jun 7, 2024 19:47:37.097860098 CEST	64283	445	192.168.2.4	146.45.88.3
Jun 7, 2024 19:47:37.098227024 CEST	64284	445	192.168.2.4	146.45.88.3
Jun 7, 2024 19:47:37.103019953 CEST	445	64283	146.45.88.3	192.168.2.4
Jun 7, 2024 19:47:37.103075027 CEST	64283	445	192.168.2.4	146.45.88.3
Jun 7, 2024 19:47:37.103159904 CEST	445	64284	146.45.88.3	192.168.2.4
Jun 7, 2024 19:47:37.103241920 CEST	64284	445	192.168.2.4	146.45.88.3
Jun 7, 2024 19:47:37.103302002 CEST	64284	445	192.168.2.4	146.45.88.3
Jun 7, 2024 19:47:37.108185053 CEST	445	64284	146.45.88.3	192.168.2.4
Jun 7, 2024 19:47:37.303947926 CEST	445	64226	62.225.190.1	192.168.2.4
Jun 7, 2024 19:47:37.304054976 CEST	64226	445	192.168.2.4	62.225.190.1
Jun 7, 2024 19:47:37.304109097 CEST	64226	445	192.168.2.4	62.225.190.1
Jun 7, 2024 19:47:37.304109097 CEST	64226	445	192.168.2.4	62.225.190.1
Jun 7, 2024 19:47:37.309705019 CEST	445	64226	62.225.190.1	192.168.2.4
Jun 7, 2024 19:47:37.309770107 CEST	445	64226	62.225.190.1	192.168.2.4
Jun 7, 2024 19:47:37.592588902 CEST	64287	445	192.168.2.4	140.23.22.2
Jun 7, 2024 19:47:37.647104025 CEST	445	64287	140.23.22.2	192.168.2.4
Jun 7, 2024 19:47:37.647368908 CEST	64287	445	192.168.2.4	140.23.22.2
Jun 7, 2024 19:47:37.647500992 CEST	64287	445	192.168.2.4	140.23.22.2
Jun 7, 2024 19:47:37.652951002 CEST	445	64287	140.23.22.2	192.168.2.4
Jun 7, 2024 19:47:37.670753956 CEST	64288	445	192.168.2.4	73.148.167.3
Jun 7, 2024 19:47:37.675836086 CEST	445	64288	73.148.167.3	192.168.2.4
Jun 7, 2024 19:47:37.675956011 CEST	64288	445	192.168.2.4	73.148.167.3
Jun 7, 2024 19:47:37.676024914 CEST	64288	445	192.168.2.4	73.148.167.3
Jun 7, 2024 19:47:37.681154966 CEST	445	64288	73.148.167.3	192.168.2.4
Jun 7, 2024 19:47:38.209274054 CEST	445	64227	215.114.241.2	192.168.2.4
Jun 7, 2024 19:47:38.209556103 CEST	64227	445	192.168.2.4	215.114.241.2
Jun 7, 2024 19:47:38.209557056 CEST	64227	445	192.168.2.4	215.114.241.2
Jun 7, 2024 19:47:38.209692001 CEST	64227	445	192.168.2.4	215.114.241.2
Jun 7, 2024 19:47:38.215106010 CEST	445	64227	215.114.241.2	192.168.2.4
Jun 7, 2024 19:47:38.215168953 CEST	445	64227	215.114.241.2	192.168.2.4
Jun 7, 2024 19:47:38.264887094 CEST	64291	445	192.168.2.4	215.114.241.3
Jun 7, 2024 19:47:38.270365953 CEST	445	64291	215.114.241.3	192.168.2.4
Jun 7, 2024 19:47:38.270613909 CEST	64291	445	192.168.2.4	215.114.241.3
Jun 7, 2024 19:47:38.270745039 CEST	64291	445	192.168.2.4	215.114.241.3
Jun 7, 2024 19:47:38.271552086 CEST	64292	445	192.168.2.4	215.114.241.3
Jun 7, 2024 19:47:38.275873899 CEST	445	64291	215.114.241.3	192.168.2.4
Jun 7, 2024 19:47:38.276068926 CEST	64291	445	192.168.2.4	215.114.241.3
Jun 7, 2024 19:47:38.276462078 CEST	445	64292	215.114.241.3	192.168.2.4
Jun 7, 2024 19:47:38.276568890 CEST	64292	445	192.168.2.4	215.114.241.3
Jun 7, 2024 19:47:38.276614904 CEST	64292	445	192.168.2.4	215.114.241.3
Jun 7, 2024 19:47:38.281725883 CEST	445	64292	215.114.241.3	192.168.2.4
Jun 7, 2024 19:47:38.436441898 CEST	64294	445	192.168.2.4	102.44.235.3
Jun 7, 2024 19:47:38.441868067 CEST	445	64294	102.44.235.3	192.168.2.4
Jun 7, 2024 19:47:38.441977978 CEST	64294	445	192.168.2.4	102.44.235.3
Jun 7, 2024 19:47:38.442193031 CEST	64294	445	192.168.2.4	102.44.235.3
Jun 7, 2024 19:47:38.447380066 CEST	445	64294	102.44.235.3	192.168.2.4
Jun 7, 2024 19:47:38.458457947 CEST	445	64232	147.68.73.1	192.168.2.4
Jun 7, 2024 19:47:38.458707094 CEST	64232	445	192.168.2.4	147.68.73.1
Jun 7, 2024 19:47:38.458707094 CEST	64232	445	192.168.2.4	147.68.73.1
Jun 7, 2024 19:47:38.458822966 CEST	64232	445	192.168.2.4	147.68.73.1
Jun 7, 2024 19:47:38.459439039 CEST	445	64231	134.136.111.3	192.168.2.4
Jun 7, 2024 19:47:38.459505081 CEST	64231	445	192.168.2.4	134.136.111.3
Jun 7, 2024 19:47:38.459546089 CEST	64231	445	192.168.2.4	134.136.111.3
Jun 7, 2024 19:47:38.459647894 CEST	64231	445	192.168.2.4	134.136.111.3
Jun 7, 2024 19:47:38.464116096 CEST	445	64232	147.68.73.1	192.168.2.4
Jun 7, 2024 19:47:38.464184046 CEST	445	64232	147.68.73.1	192.168.2.4
Jun 7, 2024 19:47:38.464683056 CEST	445	64231	134.136.111.3	192.168.2.4
Jun 7, 2024 19:47:38.464744091 CEST	445	64231	134.136.111.3	192.168.2.4
Jun 7, 2024 19:47:39.451981068 CEST	64300	445	192.168.2.4	189.66.242.3
Jun 7, 2024 19:47:39.457277060 CEST	445	64300	189.66.242.3	192.168.2.4
Jun 7, 2024 19:47:39.457387924 CEST	64300	445	192.168.2.4	189.66.242.3
Jun 7, 2024 19:47:39.457432985 CEST	64300	445	192.168.2.4	189.66.242.3
Jun 7, 2024 19:47:39.462723970 CEST	445	64300	189.66.242.3	192.168.2.4
Jun 7, 2024 19:47:39.514533043 CEST	64301	445	192.168.2.4	205.222.42.2
Jun 7, 2024 19:47:39.520184994 CEST	445	64301	205.222.42.2	192.168.2.4
Jun 7, 2024 19:47:39.520539045 CEST	64301	445	192.168.2.4	205.222.42.2
Jun 7, 2024 19:47:39.520817995 CEST	64301	445	192.168.2.4	205.222.42.2
Jun 7, 2024 19:47:39.526253939 CEST	445	64301	205.222.42.2	192.168.2.4
Jun 7, 2024 19:47:39.534756899 CEST	445	64236	220.152.113.1	192.168.2.4
Jun 7, 2024 19:47:39.534986019 CEST	64236	445	192.168.2.4	220.152.113.1
Jun 7, 2024 19:47:39.534986019 CEST	64236	445	192.168.2.4	220.152.113.1
Jun 7, 2024 19:47:39.534986973 CEST	64236	445	192.168.2.4	220.152.113.1
Jun 7, 2024 19:47:39.540385008 CEST	445	64236	220.152.113.1	192.168.2.4
Jun 7, 2024 19:47:39.540446043 CEST	445	64236	220.152.113.1	192.168.2.4
Jun 7, 2024 19:47:39.733295918 CEST	64306	445	192.168.2.4	166.84.10.3
Jun 7, 2024 19:47:39.738621950 CEST	445	64306	166.84.10.3	192.168.2.4
Jun 7, 2024 19:47:39.738969088 CEST	64306	445	192.168.2.4	166.84.10.3
Jun 7, 2024 19:47:39.738969088 CEST	64306	445	192.168.2.4	166.84.10.3
Jun 7, 2024 19:47:39.744318008 CEST	445	64306	166.84.10.3	192.168.2.4
Jun 7, 2024 19:47:39.897260904 CEST	445	64238	213.63.222.1	192.168.2.4
Jun 7, 2024 19:47:39.897692919 CEST	64238	445	192.168.2.4	213.63.222.1
Jun 7, 2024 19:47:39.897692919 CEST	64238	445	192.168.2.4	213.63.222.1
Jun 7, 2024 19:47:39.897799969 CEST	64238	445	192.168.2.4	213.63.222.1
Jun 7, 2024 19:47:39.903146029 CEST	445	64238	213.63.222.1	192.168.2.4
Jun 7, 2024 19:47:39.903284073 CEST	445	64238	213.63.222.1	192.168.2.4
Jun 7, 2024 19:47:39.951914072 CEST	64307	445	192.168.2.4	213.63.222.2
Jun 7, 2024 19:47:39.957475901 CEST	445	64307	213.63.222.2	192.168.2.4
Jun 7, 2024 19:47:39.957942963 CEST	64307	445	192.168.2.4	213.63.222.2
Jun 7, 2024 19:47:39.957943916 CEST	64307	445	192.168.2.4	213.63.222.2
Jun 7, 2024 19:47:39.958134890 CEST	64308	445	192.168.2.4	213.63.222.2
Jun 7, 2024 19:47:39.963551044 CEST	445	64308	213.63.222.2	192.168.2.4
Jun 7, 2024 19:47:39.963628054 CEST	64308	445	192.168.2.4	213.63.222.2
Jun 7, 2024 19:47:39.963658094 CEST	64308	445	192.168.2.4	213.63.222.2
Jun 7, 2024 19:47:39.967511892 CEST	445	64307	213.63.222.2	192.168.2.4
Jun 7, 2024 19:47:39.967773914 CEST	64307	445	192.168.2.4	213.63.222.2
Jun 7, 2024 19:47:39.968143940 CEST	445	64239	125.190.126.2	192.168.2.4
Jun 7, 2024 19:47:39.968210936 CEST	64239	445	192.168.2.4	125.190.126.2
Jun 7, 2024 19:47:39.968245983 CEST	64239	445	192.168.2.4	125.190.126.2
Jun 7, 2024 19:47:39.968275070 CEST	64239	445	192.168.2.4	125.190.126.2
Jun 7, 2024 19:47:39.968609095 CEST	445	64308	213.63.222.2	192.168.2.4
Jun 7, 2024 19:47:39.973459959 CEST	445	64239	125.190.126.2	192.168.2.4
Jun 7, 2024 19:47:39.973525047 CEST	445	64239	125.190.126.2	192.168.2.4
Jun 7, 2024 19:47:40.029923916 CEST	64309	445	192.168.2.4	125.190.126.3
Jun 7, 2024 19:47:40.035490036 CEST	445	64309	125.190.126.3	192.168.2.4
Jun 7, 2024 19:47:40.035620928 CEST	64309	445	192.168.2.4	125.190.126.3
Jun 7, 2024 19:47:40.037966013 CEST	64309	445	192.168.2.4	125.190.126.3
Jun 7, 2024 19:47:40.038239002 CEST	64310	445	192.168.2.4	125.190.126.3
Jun 7, 2024 19:47:40.043139935 CEST	445	64309	125.190.126.3	192.168.2.4
Jun 7, 2024 19:47:40.043217897 CEST	64309	445	192.168.2.4	125.190.126.3
Jun 7, 2024 19:47:40.043262005 CEST	445	64310	125.190.126.3	192.168.2.4
Jun 7, 2024 19:47:40.043325901 CEST	64310	445	192.168.2.4	125.190.126.3
Jun 7, 2024 19:47:40.043342113 CEST	64310	445	192.168.2.4	125.190.126.3
Jun 7, 2024 19:47:40.048398018 CEST	445	64310	125.190.126.3	192.168.2.4
Jun 7, 2024 19:47:40.164346933 CEST	445	64241	2.32.195.2	192.168.2.4
Jun 7, 2024 19:47:40.164594889 CEST	64241	445	192.168.2.4	2.32.195.2
Jun 7, 2024 19:47:40.164639950 CEST	64241	445	192.168.2.4	2.32.195.2
Jun 7, 2024 19:47:40.164688110 CEST	64241	445	192.168.2.4	2.32.195.2
Jun 7, 2024 19:47:40.170006037 CEST	445	64241	2.32.195.2	192.168.2.4
Jun 7, 2024 19:47:40.170120955 CEST	445	64241	2.32.195.2	192.168.2.4
Jun 7, 2024 19:47:40.181628942 CEST	445	64243	208.90.116.2	192.168.2.4
Jun 7, 2024 19:47:40.181727886 CEST	64243	445	192.168.2.4	208.90.116.2
Jun 7, 2024 19:47:40.181790113 CEST	64243	445	192.168.2.4	208.90.116.2
Jun 7, 2024 19:47:40.181790113 CEST	64243	445	192.168.2.4	208.90.116.2
Jun 7, 2024 19:47:40.187022924 CEST	445	64243	208.90.116.2	192.168.2.4
Jun 7, 2024 19:47:40.187088013 CEST	445	64243	208.90.116.2	192.168.2.4
Jun 7, 2024 19:47:40.269624949 CEST	445	64306	166.84.10.3	192.168.2.4
Jun 7, 2024 19:47:40.269723892 CEST	64306	445	192.168.2.4	166.84.10.3
Jun 7, 2024 19:47:40.269723892 CEST	64306	445	192.168.2.4	166.84.10.3
Jun 7, 2024 19:47:40.269768953 CEST	64306	445	192.168.2.4	166.84.10.3
Jun 7, 2024 19:47:40.275172949 CEST	445	64306	166.84.10.3	192.168.2.4
Jun 7, 2024 19:47:40.275238991 CEST	445	64306	166.84.10.3	192.168.2.4
Jun 7, 2024 19:47:40.311295033 CEST	64315	445	192.168.2.4	62.225.190.1
Jun 7, 2024 19:47:40.316870928 CEST	445	64315	62.225.190.1	192.168.2.4
Jun 7, 2024 19:47:40.316992998 CEST	64315	445	192.168.2.4	62.225.190.1
Jun 7, 2024 19:47:40.316993952 CEST	64315	445	192.168.2.4	62.225.190.1
Jun 7, 2024 19:47:40.322650909 CEST	445	64315	62.225.190.1	192.168.2.4
Jun 7, 2024 19:47:40.326906919 CEST	64316	445	192.168.2.4	166.84.10.4
Jun 7, 2024 19:47:40.332443953 CEST	445	64316	166.84.10.4	192.168.2.4
Jun 7, 2024 19:47:40.332844019 CEST	64316	445	192.168.2.4	166.84.10.4
Jun 7, 2024 19:47:40.332844019 CEST	64316	445	192.168.2.4	166.84.10.4
Jun 7, 2024 19:47:40.333102942 CEST	64317	445	192.168.2.4	166.84.10.4
Jun 7, 2024 19:47:40.338340998 CEST	445	64317	166.84.10.4	192.168.2.4
Jun 7, 2024 19:47:40.338422060 CEST	64317	445	192.168.2.4	166.84.10.4
Jun 7, 2024 19:47:40.338449955 CEST	64317	445	192.168.2.4	166.84.10.4
Jun 7, 2024 19:47:40.338457108 CEST	445	64316	166.84.10.4	192.168.2.4
Jun 7, 2024 19:47:40.338669062 CEST	64316	445	192.168.2.4	166.84.10.4
Jun 7, 2024 19:47:40.343538046 CEST	445	64317	166.84.10.4	192.168.2.4
Jun 7, 2024 19:47:40.454608917 CEST	445	64245	172.183.28.3	192.168.2.4
Jun 7, 2024 19:47:40.454704046 CEST	64245	445	192.168.2.4	172.183.28.3
Jun 7, 2024 19:47:40.454746008 CEST	64245	445	192.168.2.4	172.183.28.3
Jun 7, 2024 19:47:40.454798937 CEST	64245	445	192.168.2.4	172.183.28.3
Jun 7, 2024 19:47:40.460375071 CEST	445	64245	172.183.28.3	192.168.2.4
Jun 7, 2024 19:47:40.460441113 CEST	445	64245	172.183.28.3	192.168.2.4
Jun 7, 2024 19:47:41.467394114 CEST	64329	445	192.168.2.4	134.136.111.3
Jun 7, 2024 19:47:41.467607021 CEST	64330	445	192.168.2.4	147.68.73.1
Jun 7, 2024 19:47:41.473047018 CEST	445	64329	134.136.111.3	192.168.2.4
Jun 7, 2024 19:47:41.473114967 CEST	445	64330	147.68.73.1	192.168.2.4
Jun 7, 2024 19:47:41.473153114 CEST	64329	445	192.168.2.4	134.136.111.3
Jun 7, 2024 19:47:41.473187923 CEST	64329	445	192.168.2.4	134.136.111.3
Jun 7, 2024 19:47:41.473340988 CEST	64330	445	192.168.2.4	147.68.73.1
Jun 7, 2024 19:47:41.473340988 CEST	64330	445	192.168.2.4	147.68.73.1
Jun 7, 2024 19:47:41.478490114 CEST	445	64329	134.136.111.3	192.168.2.4
Jun 7, 2024 19:47:41.478600979 CEST	445	64330	147.68.73.1	192.168.2.4
Jun 7, 2024 19:47:41.500677109 CEST	445	64251	31.109.231.1	192.168.2.4
Jun 7, 2024 19:47:41.500770092 CEST	64251	445	192.168.2.4	31.109.231.1
Jun 7, 2024 19:47:41.500798941 CEST	64251	445	192.168.2.4	31.109.231.1
Jun 7, 2024 19:47:41.500829935 CEST	64251	445	192.168.2.4	31.109.231.1
Jun 7, 2024 19:47:41.506277084 CEST	445	64251	31.109.231.1	192.168.2.4
Jun 7, 2024 19:47:41.506341934 CEST	445	64251	31.109.231.1	192.168.2.4
Jun 7, 2024 19:47:41.884654999 CEST	445	64252	57.1.47.1	192.168.2.4
Jun 7, 2024 19:47:41.884964943 CEST	64252	445	192.168.2.4	57.1.47.1
Jun 7, 2024 19:47:41.884964943 CEST	64252	445	192.168.2.4	57.1.47.1
Jun 7, 2024 19:47:41.885061026 CEST	64252	445	192.168.2.4	57.1.47.1
Jun 7, 2024 19:47:41.890625954 CEST	445	64252	57.1.47.1	192.168.2.4
Jun 7, 2024 19:47:41.890691996 CEST	445	64252	57.1.47.1	192.168.2.4
Jun 7, 2024 19:47:41.936378956 CEST	64337	445	192.168.2.4	57.1.47.2
Jun 7, 2024 19:47:41.941692114 CEST	445	64337	57.1.47.2	192.168.2.4
Jun 7, 2024 19:47:41.941883087 CEST	64337	445	192.168.2.4	57.1.47.2
Jun 7, 2024 19:47:41.941977978 CEST	64337	445	192.168.2.4	57.1.47.2
Jun 7, 2024 19:47:41.942265987 CEST	64338	445	192.168.2.4	57.1.47.2
Jun 7, 2024 19:47:41.947988987 CEST	445	64337	57.1.47.2	192.168.2.4
Jun 7, 2024 19:47:41.948034048 CEST	445	64338	57.1.47.2	192.168.2.4
Jun 7, 2024 19:47:41.948303938 CEST	64337	445	192.168.2.4	57.1.47.2
Jun 7, 2024 19:47:41.948304892 CEST	64338	445	192.168.2.4	57.1.47.2
Jun 7, 2024 19:47:41.948304892 CEST	64338	445	192.168.2.4	57.1.47.2
Jun 7, 2024 19:47:41.953658104 CEST	445	64338	57.1.47.2	192.168.2.4
Jun 7, 2024 19:47:42.043623924 CEST	445	64253	146.209.254.2	192.168.2.4
Jun 7, 2024 19:47:42.043895006 CEST	64253	445	192.168.2.4	146.209.254.2
Jun 7, 2024 19:47:42.043976068 CEST	64253	445	192.168.2.4	146.209.254.2
Jun 7, 2024 19:47:42.043998957 CEST	64253	445	192.168.2.4	146.209.254.2
Jun 7, 2024 19:47:42.049150944 CEST	445	64253	146.209.254.2	192.168.2.4
Jun 7, 2024 19:47:42.049196005 CEST	445	64253	146.209.254.2	192.168.2.4
Jun 7, 2024 19:47:42.109647989 CEST	64341	445	192.168.2.4	146.209.254.3
Jun 7, 2024 19:47:42.115039110 CEST	445	64341	146.209.254.3	192.168.2.4
Jun 7, 2024 19:47:42.115132093 CEST	64341	445	192.168.2.4	146.209.254.3
Jun 7, 2024 19:47:42.115210056 CEST	64341	445	192.168.2.4	146.209.254.3
Jun 7, 2024 19:47:42.115677118 CEST	64342	445	192.168.2.4	146.209.254.3
Jun 7, 2024 19:47:42.120697975 CEST	445	64341	146.209.254.3	192.168.2.4
Jun 7, 2024 19:47:42.120784998 CEST	64341	445	192.168.2.4	146.209.254.3
Jun 7, 2024 19:47:42.120912075 CEST	445	64342	146.209.254.3	192.168.2.4
Jun 7, 2024 19:47:42.120981932 CEST	64342	445	192.168.2.4	146.209.254.3
Jun 7, 2024 19:47:42.121016979 CEST	64342	445	192.168.2.4	146.209.254.3
Jun 7, 2024 19:47:42.126063108 CEST	445	64342	146.209.254.3	192.168.2.4
Jun 7, 2024 19:47:42.374485016 CEST	445	64256	35.246.127.1	192.168.2.4
Jun 7, 2024 19:47:42.374702930 CEST	64256	445	192.168.2.4	35.246.127.1
Jun 7, 2024 19:47:42.374703884 CEST	64256	445	192.168.2.4	35.246.127.1
Jun 7, 2024 19:47:42.374756098 CEST	64256	445	192.168.2.4	35.246.127.1
Jun 7, 2024 19:47:42.380167961 CEST	445	64256	35.246.127.1	192.168.2.4
Jun 7, 2024 19:47:42.380229950 CEST	445	64256	35.246.127.1	192.168.2.4
Jun 7, 2024 19:47:42.488249063 CEST	445	64258	78.235.15.3	192.168.2.4
Jun 7, 2024 19:47:42.488406897 CEST	64258	445	192.168.2.4	78.235.15.3
Jun 7, 2024 19:47:42.488406897 CEST	64258	445	192.168.2.4	78.235.15.3
Jun 7, 2024 19:47:42.488535881 CEST	64258	445	192.168.2.4	78.235.15.3
Jun 7, 2024 19:47:42.493911982 CEST	445	64258	78.235.15.3	192.168.2.4
Jun 7, 2024 19:47:42.493976116 CEST	445	64258	78.235.15.3	192.168.2.4
Jun 7, 2024 19:47:42.545574903 CEST	64350	445	192.168.2.4	220.152.113.1
Jun 7, 2024 19:47:42.551089048 CEST	445	64350	220.152.113.1	192.168.2.4
Jun 7, 2024 19:47:42.551182032 CEST	64350	445	192.168.2.4	220.152.113.1
Jun 7, 2024 19:47:42.551251888 CEST	64350	445	192.168.2.4	220.152.113.1
Jun 7, 2024 19:47:42.556426048 CEST	445	64350	220.152.113.1	192.168.2.4
Jun 7, 2024 19:47:42.591685057 CEST	445	64260	142.0.124.2	192.168.2.4
Jun 7, 2024 19:47:42.591762066 CEST	64260	445	192.168.2.4	142.0.124.2
Jun 7, 2024 19:47:42.591788054 CEST	64260	445	192.168.2.4	142.0.124.2
Jun 7, 2024 19:47:42.591835976 CEST	64260	445	192.168.2.4	142.0.124.2
Jun 7, 2024 19:47:42.597336054 CEST	445	64260	142.0.124.2	192.168.2.4
Jun 7, 2024 19:47:42.597451925 CEST	445	64260	142.0.124.2	192.168.2.4
Jun 7, 2024 19:47:43.170706987 CEST	64361	445	192.168.2.4	2.32.195.2
Jun 7, 2024 19:47:43.176562071 CEST	445	64361	2.32.195.2	192.168.2.4
Jun 7, 2024 19:47:43.176706076 CEST	64361	445	192.168.2.4	2.32.195.2
Jun 7, 2024 19:47:43.176755905 CEST	64361	445	192.168.2.4	2.32.195.2
Jun 7, 2024 19:47:43.182334900 CEST	445	64361	2.32.195.2	192.168.2.4
Jun 7, 2024 19:47:43.186134100 CEST	64362	445	192.168.2.4	208.90.116.2
Jun 7, 2024 19:47:43.191451073 CEST	445	64362	208.90.116.2	192.168.2.4
Jun 7, 2024 19:47:43.191543102 CEST	64362	445	192.168.2.4	208.90.116.2
Jun 7, 2024 19:47:43.191623926 CEST	64362	445	192.168.2.4	208.90.116.2
Jun 7, 2024 19:47:43.193375111 CEST	445	64263	185.133.177.1	192.168.2.4
Jun 7, 2024 19:47:43.193451881 CEST	64263	445	192.168.2.4	185.133.177.1
Jun 7, 2024 19:47:43.193480968 CEST	64263	445	192.168.2.4	185.133.177.1
Jun 7, 2024 19:47:43.193526983 CEST	64263	445	192.168.2.4	185.133.177.1
Jun 7, 2024 19:47:43.196926117 CEST	445	64362	208.90.116.2	192.168.2.4
Jun 7, 2024 19:47:43.198510885 CEST	445	64263	185.133.177.1	192.168.2.4
Jun 7, 2024 19:47:43.198580027 CEST	445	64263	185.133.177.1	192.168.2.4
Jun 7, 2024 19:47:43.316473007 CEST	445	64264	11.204.88.1	192.168.2.4
Jun 7, 2024 19:47:43.316715956 CEST	64264	445	192.168.2.4	11.204.88.1
Jun 7, 2024 19:47:43.316715956 CEST	64264	445	192.168.2.4	11.204.88.1
Jun 7, 2024 19:47:43.316715956 CEST	64264	445	192.168.2.4	11.204.88.1
Jun 7, 2024 19:47:43.322175980 CEST	445	64264	11.204.88.1	192.168.2.4
Jun 7, 2024 19:47:43.322240114 CEST	445	64264	11.204.88.1	192.168.2.4
Jun 7, 2024 19:47:43.373792887 CEST	64366	445	192.168.2.4	11.204.88.2
Jun 7, 2024 19:47:43.379441977 CEST	445	64366	11.204.88.2	192.168.2.4
Jun 7, 2024 19:47:43.379673004 CEST	64366	445	192.168.2.4	11.204.88.2
Jun 7, 2024 19:47:43.379673004 CEST	64366	445	192.168.2.4	11.204.88.2
Jun 7, 2024 19:47:43.379977942 CEST	64367	445	192.168.2.4	11.204.88.2
Jun 7, 2024 19:47:43.385260105 CEST	445	64367	11.204.88.2	192.168.2.4
Jun 7, 2024 19:47:43.385327101 CEST	445	64366	11.204.88.2	192.168.2.4
Jun 7, 2024 19:47:43.385365963 CEST	64367	445	192.168.2.4	11.204.88.2
Jun 7, 2024 19:47:43.385411978 CEST	64367	445	192.168.2.4	11.204.88.2
Jun 7, 2024 19:47:43.385530949 CEST	64366	445	192.168.2.4	11.204.88.2
Jun 7, 2024 19:47:43.390562057 CEST	445	64367	11.204.88.2	192.168.2.4
Jun 7, 2024 19:47:43.467694044 CEST	64370	445	192.168.2.4	172.183.28.3
Jun 7, 2024 19:47:43.473217964 CEST	445	64370	172.183.28.3	192.168.2.4
Jun 7, 2024 19:47:43.473439932 CEST	64370	445	192.168.2.4	172.183.28.3
Jun 7, 2024 19:47:43.473440886 CEST	64370	445	192.168.2.4	172.183.28.3
Jun 7, 2024 19:47:43.478818893 CEST	445	64370	172.183.28.3	192.168.2.4
Jun 7, 2024 19:47:43.958376884 CEST	445	64267	9.135.254.1	192.168.2.4
Jun 7, 2024 19:47:43.958489895 CEST	64267	445	192.168.2.4	9.135.254.1
Jun 7, 2024 19:47:43.958489895 CEST	64267	445	192.168.2.4	9.135.254.1
Jun 7, 2024 19:47:43.958581924 CEST	64267	445	192.168.2.4	9.135.254.1
Jun 7, 2024 19:47:43.963867903 CEST	445	64267	9.135.254.1	192.168.2.4
Jun 7, 2024 19:47:43.963932037 CEST	445	64267	9.135.254.1	192.168.2.4
Jun 7, 2024 19:47:44.016681910 CEST	445	64268	56.152.161.2	192.168.2.4
Jun 7, 2024 19:47:44.016762972 CEST	64268	445	192.168.2.4	56.152.161.2
Jun 7, 2024 19:47:44.016786098 CEST	64268	445	192.168.2.4	56.152.161.2
Jun 7, 2024 19:47:44.016804934 CEST	64268	445	192.168.2.4	56.152.161.2
Jun 7, 2024 19:47:44.022145033 CEST	445	64268	56.152.161.2	192.168.2.4
Jun 7, 2024 19:47:44.022208929 CEST	445	64268	56.152.161.2	192.168.2.4
Jun 7, 2024 19:47:44.082747936 CEST	64384	445	192.168.2.4	56.152.161.3
Jun 7, 2024 19:47:44.088243008 CEST	445	64384	56.152.161.3	192.168.2.4
Jun 7, 2024 19:47:44.088438988 CEST	64384	445	192.168.2.4	56.152.161.3
Jun 7, 2024 19:47:44.088534117 CEST	64384	445	192.168.2.4	56.152.161.3
Jun 7, 2024 19:47:44.089174986 CEST	64385	445	192.168.2.4	56.152.161.3
Jun 7, 2024 19:47:44.094105959 CEST	445	64384	56.152.161.3	192.168.2.4
Jun 7, 2024 19:47:44.094279051 CEST	445	64385	56.152.161.3	192.168.2.4
Jun 7, 2024 19:47:44.094286919 CEST	64384	445	192.168.2.4	56.152.161.3
Jun 7, 2024 19:47:44.094372988 CEST	64385	445	192.168.2.4	56.152.161.3
Jun 7, 2024 19:47:44.094496965 CEST	64385	445	192.168.2.4	56.152.161.3
Jun 7, 2024 19:47:44.099572897 CEST	445	64385	56.152.161.3	192.168.2.4
Jun 7, 2024 19:47:44.487731934 CEST	445	64271	103.194.154.4	192.168.2.4
Jun 7, 2024 19:47:44.488048077 CEST	64271	445	192.168.2.4	103.194.154.4
Jun 7, 2024 19:47:44.488048077 CEST	64271	445	192.168.2.4	103.194.154.4
Jun 7, 2024 19:47:44.488171101 CEST	64271	445	192.168.2.4	103.194.154.4
Jun 7, 2024 19:47:44.493588924 CEST	445	64271	103.194.154.4	192.168.2.4
Jun 7, 2024 19:47:44.493654013 CEST	445	64271	103.194.154.4	192.168.2.4
Jun 7, 2024 19:47:44.514357090 CEST	64396	445	192.168.2.4	31.109.231.1
Jun 7, 2024 19:47:44.520056963 CEST	445	64396	31.109.231.1	192.168.2.4
Jun 7, 2024 19:47:44.520278931 CEST	64396	445	192.168.2.4	31.109.231.1
Jun 7, 2024 19:47:44.520278931 CEST	64396	445	192.168.2.4	31.109.231.1
Jun 7, 2024 19:47:44.525693893 CEST	445	64396	31.109.231.1	192.168.2.4
Jun 7, 2024 19:47:44.526854038 CEST	445	64273	83.55.32.3	192.168.2.4
Jun 7, 2024 19:47:44.527112007 CEST	64273	445	192.168.2.4	83.55.32.3
Jun 7, 2024 19:47:44.527112007 CEST	64273	445	192.168.2.4	83.55.32.3
Jun 7, 2024 19:47:44.527112007 CEST	64273	445	192.168.2.4	83.55.32.3
Jun 7, 2024 19:47:44.532341003 CEST	445	64273	83.55.32.3	192.168.2.4
Jun 7, 2024 19:47:44.532386065 CEST	445	64273	83.55.32.3	192.168.2.4
Jun 7, 2024 19:47:44.583848000 CEST	445	64275	190.49.101.2	192.168.2.4
Jun 7, 2024 19:47:44.584064007 CEST	64275	445	192.168.2.4	190.49.101.2
Jun 7, 2024 19:47:44.584064007 CEST	64275	445	192.168.2.4	190.49.101.2
Jun 7, 2024 19:47:44.584160089 CEST	64275	445	192.168.2.4	190.49.101.2
Jun 7, 2024 19:47:44.589677095 CEST	445	64275	190.49.101.2	192.168.2.4
Jun 7, 2024 19:47:44.589740992 CEST	445	64275	190.49.101.2	192.168.2.4
Jun 7, 2024 19:47:44.819541931 CEST	445	64279	144.144.246.1	192.168.2.4
Jun 7, 2024 19:47:44.819853067 CEST	64279	445	192.168.2.4	144.144.246.1
Jun 7, 2024 19:47:44.819854021 CEST	64279	445	192.168.2.4	144.144.246.1
Jun 7, 2024 19:47:44.819854021 CEST	64279	445	192.168.2.4	144.144.246.1
Jun 7, 2024 19:47:44.825567007 CEST	445	64279	144.144.246.1	192.168.2.4
Jun 7, 2024 19:47:44.825630903 CEST	445	64279	144.144.246.1	192.168.2.4
Jun 7, 2024 19:47:44.874015093 CEST	64407	445	192.168.2.4	144.144.246.2
Jun 7, 2024 19:47:44.879578114 CEST	445	64407	144.144.246.2	192.168.2.4
Jun 7, 2024 19:47:44.879827023 CEST	64407	445	192.168.2.4	144.144.246.2
Jun 7, 2024 19:47:44.879920006 CEST	64407	445	192.168.2.4	144.144.246.2
Jun 7, 2024 19:47:44.880584002 CEST	64408	445	192.168.2.4	144.144.246.2
Jun 7, 2024 19:47:44.885827065 CEST	445	64408	144.144.246.2	192.168.2.4
Jun 7, 2024 19:47:44.885978937 CEST	64408	445	192.168.2.4	144.144.246.2
Jun 7, 2024 19:47:44.886013031 CEST	64408	445	192.168.2.4	144.144.246.2
Jun 7, 2024 19:47:44.886037111 CEST	445	64407	144.144.246.2	192.168.2.4
Jun 7, 2024 19:47:44.886109114 CEST	64407	445	192.168.2.4	144.144.246.2
Jun 7, 2024 19:47:44.891313076 CEST	445	64408	144.144.246.2	192.168.2.4
Jun 7, 2024 19:47:44.909621954 CEST	445	64281	218.42.144.2	192.168.2.4
Jun 7, 2024 19:47:44.909713030 CEST	64281	445	192.168.2.4	218.42.144.2
Jun 7, 2024 19:47:44.909759045 CEST	64281	445	192.168.2.4	218.42.144.2
Jun 7, 2024 19:47:44.909780025 CEST	64281	445	192.168.2.4	218.42.144.2
Jun 7, 2024 19:47:44.915163994 CEST	445	64281	218.42.144.2	192.168.2.4
Jun 7, 2024 19:47:44.915229082 CEST	445	64281	218.42.144.2	192.168.2.4
Jun 7, 2024 19:47:45.389266014 CEST	64427	445	192.168.2.4	35.246.127.1
Jun 7, 2024 19:47:45.394942999 CEST	445	64427	35.246.127.1	192.168.2.4
Jun 7, 2024 19:47:45.395056963 CEST	64427	445	192.168.2.4	35.246.127.1
Jun 7, 2024 19:47:45.395056963 CEST	64427	445	192.168.2.4	35.246.127.1
Jun 7, 2024 19:47:45.400510073 CEST	445	64427	35.246.127.1	192.168.2.4
Jun 7, 2024 19:47:45.498738050 CEST	64431	445	192.168.2.4	78.235.15.3
Jun 7, 2024 19:47:45.504141092 CEST	445	64431	78.235.15.3	192.168.2.4
Jun 7, 2024 19:47:45.504288912 CEST	64431	445	192.168.2.4	78.235.15.3
Jun 7, 2024 19:47:45.504364967 CEST	64431	445	192.168.2.4	78.235.15.3
Jun 7, 2024 19:47:45.509696960 CEST	445	64431	78.235.15.3	192.168.2.4
Jun 7, 2024 19:47:45.592514992 CEST	64436	445	192.168.2.4	142.0.124.2
Jun 7, 2024 19:47:45.598144054 CEST	445	64436	142.0.124.2	192.168.2.4
Jun 7, 2024 19:47:45.598274946 CEST	64436	445	192.168.2.4	142.0.124.2
Jun 7, 2024 19:47:45.598315954 CEST	64436	445	192.168.2.4	142.0.124.2
Jun 7, 2024 19:47:45.603583097 CEST	445	64436	142.0.124.2	192.168.2.4
Jun 7, 2024 19:47:45.617471933 CEST	445	64284	146.45.88.3	192.168.2.4
Jun 7, 2024 19:47:45.617567062 CEST	64284	445	192.168.2.4	146.45.88.3
Jun 7, 2024 19:47:45.617656946 CEST	64284	445	192.168.2.4	146.45.88.3
Jun 7, 2024 19:47:45.617656946 CEST	64284	445	192.168.2.4	146.45.88.3
Jun 7, 2024 19:47:45.622977018 CEST	445	64284	146.45.88.3	192.168.2.4
Jun 7, 2024 19:47:45.623040915 CEST	445	64284	146.45.88.3	192.168.2.4
Jun 7, 2024 19:47:46.141417027 CEST	445	64287	140.23.22.2	192.168.2.4
Jun 7, 2024 19:47:46.141658068 CEST	64287	445	192.168.2.4	140.23.22.2
Jun 7, 2024 19:47:46.141658068 CEST	64287	445	192.168.2.4	140.23.22.2
Jun 7, 2024 19:47:46.141658068 CEST	64287	445	192.168.2.4	140.23.22.2
Jun 7, 2024 19:47:46.147106886 CEST	445	64287	140.23.22.2	192.168.2.4
Jun 7, 2024 19:47:46.147169113 CEST	445	64287	140.23.22.2	192.168.2.4
Jun 7, 2024 19:47:46.160679102 CEST	445	64288	73.148.167.3	192.168.2.4
Jun 7, 2024 19:47:46.160792112 CEST	64288	445	192.168.2.4	73.148.167.3
Jun 7, 2024 19:47:46.160792112 CEST	64288	445	192.168.2.4	73.148.167.3
Jun 7, 2024 19:47:46.160849094 CEST	64288	445	192.168.2.4	73.148.167.3
Jun 7, 2024 19:47:46.166208982 CEST	445	64288	73.148.167.3	192.168.2.4
Jun 7, 2024 19:47:46.166273117 CEST	445	64288	73.148.167.3	192.168.2.4
Jun 7, 2024 19:47:46.219584942 CEST	64465	445	192.168.2.4	185.133.177.1
Jun 7, 2024 19:47:46.220508099 CEST	64468	445	192.168.2.4	140.23.22.3
Jun 7, 2024 19:47:46.220655918 CEST	64469	445	192.168.2.4	73.148.167.4
Jun 7, 2024 19:47:46.224709988 CEST	445	64465	185.133.177.1	192.168.2.4
Jun 7, 2024 19:47:46.224838018 CEST	64465	445	192.168.2.4	185.133.177.1
Jun 7, 2024 19:47:46.224838972 CEST	64465	445	192.168.2.4	185.133.177.1
Jun 7, 2024 19:47:46.225764990 CEST	445	64468	140.23.22.3	192.168.2.4
Jun 7, 2024 19:47:46.225883007 CEST	445	64469	73.148.167.4	192.168.2.4
Jun 7, 2024 19:47:46.225960016 CEST	64469	445	192.168.2.4	73.148.167.4
Jun 7, 2024 19:47:46.225971937 CEST	64468	445	192.168.2.4	140.23.22.3
Jun 7, 2024 19:47:46.225971937 CEST	64468	445	192.168.2.4	140.23.22.3
Jun 7, 2024 19:47:46.226016045 CEST	64469	445	192.168.2.4	73.148.167.4
Jun 7, 2024 19:47:46.226378918 CEST	64471	445	192.168.2.4	140.23.22.3
Jun 7, 2024 19:47:46.226424932 CEST	64472	445	192.168.2.4	73.148.167.4
Jun 7, 2024 19:47:46.230056047 CEST	445	64465	185.133.177.1	192.168.2.4
Jun 7, 2024 19:47:46.231523991 CEST	445	64469	73.148.167.4	192.168.2.4
Jun 7, 2024 19:47:46.231592894 CEST	445	64471	140.23.22.3	192.168.2.4
Jun 7, 2024 19:47:46.231600046 CEST	64469	445	192.168.2.4	73.148.167.4
Jun 7, 2024 19:47:46.231637001 CEST	445	64472	73.148.167.4	192.168.2.4
Jun 7, 2024 19:47:46.231678963 CEST	445	64468	140.23.22.3	192.168.2.4
Jun 7, 2024 19:47:46.231800079 CEST	64471	445	192.168.2.4	140.23.22.3
Jun 7, 2024 19:47:46.231800079 CEST	64468	445	192.168.2.4	140.23.22.3
Jun 7, 2024 19:47:46.231800079 CEST	64471	445	192.168.2.4	140.23.22.3
Jun 7, 2024 19:47:46.231844902 CEST	64472	445	192.168.2.4	73.148.167.4
Jun 7, 2024 19:47:46.231846094 CEST	64472	445	192.168.2.4	73.148.167.4
Jun 7, 2024 19:47:46.236871004 CEST	445	64471	140.23.22.3	192.168.2.4
Jun 7, 2024 19:47:46.236938000 CEST	445	64472	73.148.167.4	192.168.2.4
Jun 7, 2024 19:47:46.774344921 CEST	445	64292	215.114.241.3	192.168.2.4
Jun 7, 2024 19:47:46.774482012 CEST	64292	445	192.168.2.4	215.114.241.3
Jun 7, 2024 19:47:46.778621912 CEST	64292	445	192.168.2.4	215.114.241.3
Jun 7, 2024 19:47:46.778732061 CEST	64292	445	192.168.2.4	215.114.241.3
Jun 7, 2024 19:47:46.784118891 CEST	445	64292	215.114.241.3	192.168.2.4
Jun 7, 2024 19:47:46.784183025 CEST	445	64292	215.114.241.3	192.168.2.4
Jun 7, 2024 19:47:46.940119028 CEST	445	64294	102.44.235.3	192.168.2.4
Jun 7, 2024 19:47:46.940416098 CEST	64294	445	192.168.2.4	102.44.235.3
Jun 7, 2024 19:47:46.940416098 CEST	64294	445	192.168.2.4	102.44.235.3
Jun 7, 2024 19:47:46.940416098 CEST	64294	445	192.168.2.4	102.44.235.3
Jun 7, 2024 19:47:46.945944071 CEST	445	64294	102.44.235.3	192.168.2.4
Jun 7, 2024 19:47:46.946008921 CEST	445	64294	102.44.235.3	192.168.2.4
Jun 7, 2024 19:47:46.967438936 CEST	64537	445	192.168.2.4	9.135.254.1
Jun 7, 2024 19:47:46.972856045 CEST	445	64537	9.135.254.1	192.168.2.4
Jun 7, 2024 19:47:46.972976923 CEST	64537	445	192.168.2.4	9.135.254.1
Jun 7, 2024 19:47:46.973089933 CEST	64537	445	192.168.2.4	9.135.254.1
Jun 7, 2024 19:47:46.978219032 CEST	445	64537	9.135.254.1	192.168.2.4
Jun 7, 2024 19:47:46.998688936 CEST	64542	445	192.168.2.4	102.44.235.4
Jun 7, 2024 19:47:47.004441023 CEST	445	64542	102.44.235.4	192.168.2.4
Jun 7, 2024 19:47:47.004686117 CEST	64542	445	192.168.2.4	102.44.235.4
Jun 7, 2024 19:47:47.004781961 CEST	64542	445	192.168.2.4	102.44.235.4
Jun 7, 2024 19:47:47.004868984 CEST	64545	445	192.168.2.4	102.44.235.4
Jun 7, 2024 19:47:47.010117054 CEST	445	64545	102.44.235.4	192.168.2.4
Jun 7, 2024 19:47:47.010406017 CEST	64545	445	192.168.2.4	102.44.235.4
Jun 7, 2024 19:47:47.010406017 CEST	64545	445	192.168.2.4	102.44.235.4
Jun 7, 2024 19:47:47.010499954 CEST	445	64542	102.44.235.4	192.168.2.4
Jun 7, 2024 19:47:47.010708094 CEST	64542	445	192.168.2.4	102.44.235.4
Jun 7, 2024 19:47:47.015489101 CEST	445	64545	102.44.235.4	192.168.2.4
Jun 7, 2024 19:47:47.643292904 CEST	445	64545	102.44.235.4	192.168.2.4
Jun 7, 2024 19:47:47.643539906 CEST	64545	445	192.168.2.4	102.44.235.4
Jun 7, 2024 19:47:47.954446077 CEST	445	64300	189.66.242.3	192.168.2.4
Jun 7, 2024 19:47:47.954540968 CEST	64300	445	192.168.2.4	189.66.242.3
Jun 7, 2024 19:47:48.015651941 CEST	445	64301	205.222.42.2	192.168.2.4
Jun 7, 2024 19:47:48.015853882 CEST	64301	445	192.168.2.4	205.222.42.2
Jun 7, 2024 19:47:48.295176029 CEST	64350	445	192.168.2.4	220.152.113.1
Jun 7, 2024 19:47:48.295274973 CEST	64317	445	192.168.2.4	166.84.10.4
Jun 7, 2024 19:47:48.295362949 CEST	64315	445	192.168.2.4	62.225.190.1
Jun 7, 2024 19:47:48.295389891 CEST	64342	445	192.168.2.4	146.209.254.3
Jun 7, 2024 19:47:48.295484066 CEST	64310	445	192.168.2.4	125.190.126.3
Jun 7, 2024 19:47:48.295572996 CEST	64370	445	192.168.2.4	172.183.28.3
Jun 7, 2024 19:47:48.295572996 CEST	64338	445	192.168.2.4	57.1.47.2
Jun 7, 2024 19:47:48.295572996 CEST	64396	445	192.168.2.4	31.109.231.1
Jun 7, 2024 19:47:48.295628071 CEST	64367	445	192.168.2.4	11.204.88.2
Jun 7, 2024 19:47:48.295691013 CEST	64329	445	192.168.2.4	134.136.111.3
Jun 7, 2024 19:47:48.295692921 CEST	64330	445	192.168.2.4	147.68.73.1
Jun 7, 2024 19:47:48.295746088 CEST	64300	445	192.168.2.4	189.66.242.3
Jun 7, 2024 19:47:48.295788050 CEST	64301	445	192.168.2.4	205.222.42.2
Jun 7, 2024 19:47:48.295825958 CEST	64308	445	192.168.2.4	213.63.222.2
Jun 7, 2024 19:47:48.295825958 CEST	64385	445	192.168.2.4	56.152.161.3
Jun 7, 2024 19:47:48.295881033 CEST	64361	445	192.168.2.4	2.32.195.2
Jun 7, 2024 19:47:48.295907974 CEST	64362	445	192.168.2.4	208.90.116.2
Jun 7, 2024 19:47:48.295953989 CEST	64408	445	192.168.2.4	144.144.246.2
Jun 7, 2024 19:47:48.296083927 CEST	64431	445	192.168.2.4	78.235.15.3
Jun 7, 2024 19:47:48.296113968 CEST	64537	445	192.168.2.4	9.135.254.1
Jun 7, 2024 19:47:48.296216011 CEST	64465	445	192.168.2.4	185.133.177.1
Jun 7, 2024 19:47:48.296365976 CEST	64427	445	192.168.2.4	35.246.127.1
Jun 7, 2024 19:47:48.296427011 CEST	64436	445	192.168.2.4	142.0.124.2
Jun 7, 2024 19:47:48.296617031 CEST	64472	445	192.168.2.4	73.148.167.4
Jun 7, 2024 19:47:48.296730042 CEST	64471	445	192.168.2.4	140.23.22.3
Jun 7, 2024 19:47:48.297354937 CEST	64545	445	192.168.2.4	102.44.235.4
Jun 7, 2024 19:47:49.207473993 CEST	49724	80	192.168.2.4	93.184.221.240
Jun 7, 2024 19:47:49.212925911 CEST	80	49724	93.184.221.240	192.168.2.4
Jun 7, 2024 19:47:49.214186907 CEST	49724	80	192.168.2.4	93.184.221.240

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 7, 2024 19:46:41.674173117 CEST	55637	53	192.168.2.4	1.1.1.1
Jun 7, 2024 19:46:41.685606956 CEST	53	55637	1.1.1.1	192.168.2.4
Jun 7, 2024 19:47:00.804102898 CEST	138	138	192.168.2.4	192.168.2.255
Jun 7, 2024 19:47:13.615860939 CEST	53	61496	162.159.36.2	192.168.2.4
Jun 7, 2024 19:47:14.273881912 CEST	50688	53	192.168.2.4	1.1.1.1
Jun 7, 2024 19:47:14.283739090 CEST	53	50688	1.1.1.1	192.168.2.4
Jun 7, 2024 19:47:16.891366005 CEST	63579	53	192.168.2.4	1.1.1.1
Jun 7, 2024 19:47:16.900031090 CEST	53	63579	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 7, 2024 19:46:41.674173117 CEST	192.168.2.4	1.1.1.1	0x86ee	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	A (IP address)	IN (0x0001)	false
Jun 7, 2024 19:47:14.273881912 CEST	192.168.2.4	1.1.1.1	0xac8b	Standard query (0)	18.31.95.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jun 7, 2024 19:47:16.891366005 CEST	192.168.2.4	1.1.1.1	0x2038	Standard query (0)	157.123.68.40.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 7, 2024 19:46:41.685606956 CEST	1.1.1.1	192.168.2.4	0x86ee	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com		104.16.167.228	A (IP address)	IN (0x0001)	false
Jun 7, 2024 19:46:41.685606956 CEST	1.1.1.1	192.168.2.4	0x86ee	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com		104.16.166.228	A (IP address)	IN (0x0001)	false
Jun 7, 2024 19:47:14.283739090 CEST	1.1.1.1	192.168.2.4	0xac8b	Name error (3)	18.31.95.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jun 7, 2024 19:47:16.900031090 CEST	1.1.1.1	192.168.2.4	0x2038	Name error (3)	157.123.68.40.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

ipinfo.io

slscr.update.microsoft.com

fe3cr.delivery.mp.microsoft.com

www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.16.167.228	80	3328	C:\Windows\mssecsvc.exe

Timestamp	Bytes transferred	Direction	Data
Jun 7, 2024 19:46:41.695713997 CEST	100	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com Cache-Control: no-cache
Jun 7, 2024 19:46:42.331604958 CEST	778	IN	HTTP/1.1 200 OK Date: Fri, 07 Jun 2024 17:46:42 GMT Content-Type: text/html Content-Length: 607 Connection: close Server: cloudflare CF-RAY: 8902768e0c3f4796-DFW Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	104.16.167.228	80	6864	C:\Windows\mssecsvc.exe

Timestamp	Bytes transferred	Direction	Data
Jun 7, 2024 19:46:43.047996998 CEST	100	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com Cache-Control: no-cache
Jun 7, 2024 19:46:43.690290928 CEST	778	IN	HTTP/1.1 200 OK Date: Fri, 07 Jun 2024 17:46:43 GMT Content-Type: text/html Content-Length: 607 Connection: close Server: cloudflare CF-RAY: 89027696892f2e5d-DFW Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49749	104.16.167.228	80	7264	C:\Windows\mssecsvc.exe

Timestamp	Bytes transferred	Direction	Data
Jun 7, 2024 19:46:44.477490902 CEST	100	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com Cache-Control: no-cache
Jun 7, 2024 19:46:45.138221979 CEST	778	IN	HTTP/1.1 200 OK Date: Fri, 07 Jun 2024 17:46:45 GMT Content-Type: text/html Content-Length: 607 Connection: close Server: cloudflare CF-RAY: 8902769f5ea228e8-DFW Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.4	49730	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-06-07 17:46:34 UTC	59	OUT	GET / HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
2024-06-07 17:46:34 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 07 Jun 2024 17:46:34 GMT content-type: application/json; charset=utf-8 Content-Length: 314 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-07 17:46:34 UTC	314	IN	Data Raw: 7b 0a 20 20 22 69 70 22 3a 20 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 31 22 2c 0a 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 31 2e 73 74 61 74 69 63 2e 71 75 61 64 72 61 6e 65 74 2e 63 6f 6d 22 2c 0a 20 20 22 63 69 74 79 22 3a 20 22 44 61 6c 6c 61 73 22 2c 0a 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 54 65 78 61 73 22 2c 0a 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 22 6c 6f 63 22 3a 20 22 33 32 2e 38 31 35 32 2c 2d 39 36 2e 38 37 30 33 22 2c 0a 20 20 22 6f 72 67 22 3a 20 22 41 53 38 31 30 30 20 51 75 61 64 72 61 4e 65 74 20 45 6e 74 65 72 70 72 69 73 65 73 20 4c 4c 43 22 2c 0a 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 37 35 32 34 37 22 2c 0a 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 Data Ascii: { "ip": "173.254.250.91", "hostname": "173.254.250.91.static.quadranet.com", "city": "Dallas", "region": "Texas", "country": "US", "loc": "32.8152,-96.8703", "org": "AS8100 QuadraNet Enterprises LLC", "postal": "75247", "timezone": "Amer

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49897	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-06-07 17:46:59 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fyr8nFvVYcbgg5r&MD=tx7ud3pw HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-06-07 17:46:59 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 290e2a7d-2f04-4864-bb9c-69fa96c3f71e MS-RequestId: d5293be7-fd00-4f82-aec7-38bd3f577a82 MS-CV: 2h0zxd2vykOHOHiK.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 07 Jun 2024 17:46:58 GMT Connection: close Content-Length: 24490
2024-06-07 17:46:59 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-06-07 17:46:59 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	64150	13.95.31.18	443

Timestamp	Bytes transferred	Direction	Data
2024-06-07 17:47:15 UTC	142	OUT	GET /clientwebservice/ping HTTP/1.1 Connection: Keep-Alive User-Agent: DNS resiliency checker/1.0 Host: fe3cr.delivery.mp.microsoft.com
2024-06-07 17:47:15 UTC	234	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Expires: -1 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Content-Type-Options: nosniff Date: Fri, 07 Jun 2024 17:47:15 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	64163	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-06-07 17:47:18 UTC	124	OUT	GET /sls/ping HTTP/1.1 Connection: Keep-Alive User-Agent: DNS resiliency checker/1.0 Host: slscr.update.microsoft.com
2024-06-07 17:47:18 UTC	318	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Expires: -1 MS-CV: 1wBbpqkyEEKli0HV.0 MS-RequestId: 30cc6eec-2d15-4125-912d-ef07017dca21 MS-CorrelationId: 2d867498-29f4-48fe-9105-17c4e2d1479b X-Content-Type-Options: nosniff Date: Fri, 07 Jun 2024 17:47:17 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	64171	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-06-07 17:47:20 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fyr8nFvVYcbgg5r&MD=tx7ud3pw HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-06-07 17:47:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b5569f73-a3bc-454c-beae-8b594541c0d0 MS-RequestId: a6b68e9a-cef0-4c0e-a802-692bc72c226a MS-CV: CFMSTSsPmU6AV8Rs.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 07 Jun 2024 17:47:19 GMT Connection: close Content-Length: 24490
2024-06-07 17:47:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-06-07 17:47:20 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	64179	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-06-07 17:47:22 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fyr8nFvVYcbgg5r&MD=tx7ud3pw HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-06-07 17:47:22 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_1440" MS-CorrelationId: f7aa195f-45e0-4d5a-8cef-04a2139acee1 MS-RequestId: 5f82d956-61a2-4387-bf89-61081d55de0c MS-CV: +Z7Ua5r48Ua8wkWp.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 07 Jun 2024 17:47:21 GMT Connection: close Content-Length: 25457
2024-06-07 17:47:22 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-06-07 17:47:22 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	13:46:40
Start date:	07/06/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\qt680eucI4.dll"
Imagebase:	0x160000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:46:40
Start date:	07/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:46:40
Start date:	07/06/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\qt680eucI4.dll",#1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:46:40
Start date:	07/06/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\qt680eucI4.dll,PlayGame
Imagebase:	0xf90000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:46:40
Start date:	07/06/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\qt680eucI4.dll",#1
Imagebase:	0xf90000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:46:41
Start date:	07/06/2024
Path:	C:\Windows\mssecsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvc.exe
Imagebase:	0x400000
File size:	3'723'264 bytes
MD5 hash:	0C694193CEAC8BFB016491FFB534EB7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000002.1717308991.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000000.1693433039.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000000.1693543324.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000005.00000000.1693543324.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000002.1717442764.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000005.00000002.1717442764.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvc.exe, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (based on rule by US CERT) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvc.exe, Author: us-cert code analysis team Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\mssecsvc.exe, Author: ReversingLabs
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:46:41
Start date:	07/06/2024
Path:	C:\Windows\mssecsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvc.exe -m security
Imagebase:	0x400000
File size:	3'723'264 bytes
MD5 hash:	0C694193CEAC8BFB016491FFB534EB7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000002.2351367030.000000000042E000.00000004.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.1701768638.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.1701928491.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000000.1701928491.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000002.2351656922.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000002.2351656922.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000002.2352554988.0000000001EB4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000002.2352554988.0000000001EB4000.00000004.00000020.00020000.00000000.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000002.2352874636.00000000023D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000002.2352874636.00000000023D1000.00000004.00000020.00020000.00000000.sdmp, Author: us-cert code analysis team
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:46:43
Start date:	07/06/2024
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	false
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x400000
File size:	3'514'368 bytes
MD5 hash:	7F7CCAA16FB15EB1C7399D422F8363E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000007.00000002.1716722163.000000000040E000.00000008.00000001.01000000.00000007.sdmp, Author: us-cert code analysis team Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000007.00000000.1716262074.000000000040E000.00000008.00000001.01000000.00000007.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\tasksche.exe, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\tasksche.exe, Author: ReversingLabs
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:46:43
Start date:	07/06/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\qt680eucI4.dll",PlayGame
Imagebase:	0xf90000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:46:43
Start date:	07/06/2024
Path:	C:\Windows\mssecsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvc.exe
Imagebase:	0x400000
File size:	3'723'264 bytes
MD5 hash:	0C694193CEAC8BFB016491FFB534EB7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000009.00000002.1733349852.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000009.00000000.1721407931.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000009.00000000.1721552401.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000009.00000000.1721552401.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000009.00000002.1733511619.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000009.00000002.1733511619.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:46:44
Start date:	07/06/2024
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	false
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x400000
File size:	3'514'368 bytes
MD5 hash:	7F7CCAA16FB15EB1C7399D422F8363E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000A.00000000.1732074425.000000000040E000.00000008.00000001.01000000.00000007.sdmp, Author: us-cert code analysis team Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000A.00000002.1732756951.000000000040E000.00000008.00000001.01000000.00000007.sdmp, Author: us-cert code analysis team
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:47:01
Start date:	07/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report qt680eucI4.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\WINDOWS\qeriuwjhrf (copy)

C:\Windows\mssecsvc.exe

C:\Windows\tasksche.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Windows Analysis Report
qt680eucI4.dll