Edit tour

Windows Analysis Report
zyeX8bTkky.dll

Overview

General Information

Sample name:	zyeX8bTkky.dll renamed because original name is a hash value
Original sample name:	64bb708b31b4b043018457c1098465ea83da7d6408c7029b2f68c333fc25891c.dll
Analysis ID:	1453832
MD5:	0ab2aeda90221832167e5127332dd702
SHA1:	f370045d8ac3f4ba78acf8bfe4c4d35758d5ea05
SHA256:	64bb708b31b4b043018457c1098465ea83da7d6408c7029b2f68c333fc25891c
Infos:

Detection

Wannacry

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Wannacry ransomware

Connects to many different private IPs (likely to spread or exploit)

Connects to many different private IPs via SMB (likely to spread or exploit)

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

HTTP GET or POST without a user agent

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 7264 cmdline: loaddll32.exe "C:\Users\user\Desktop\zyeX8bTkky.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 7272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7316 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\zyeX8bTkky.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 7340 cmdline: rundll32.exe "C:\Users\user\Desktop\zyeX8bTkky.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

mssecsvc.exe (PID: 7364 cmdline: C:\WINDOWS\mssecsvc.exe MD5: D724D8CC6420F06E8A48752F0DA11C66)

tasksche.exe (PID: 7464 cmdline: C:\WINDOWS\tasksche.exe /i MD5: 7F7CCAA16FB15EB1C7399D422F8363E8)

rundll32.exe (PID: 7324 cmdline: rundll32.exe C:\Users\user\Desktop\zyeX8bTkky.dll,PlayGame MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7628 cmdline: rundll32.exe "C:\Users\user\Desktop\zyeX8bTkky.dll",PlayGame MD5: 889B99C52A60DD49227C5E485A016679)

mssecsvc.exe (PID: 7644 cmdline: C:\WINDOWS\mssecsvc.exe MD5: D724D8CC6420F06E8A48752F0DA11C66)

tasksche.exe (PID: 7700 cmdline: C:\WINDOWS\tasksche.exe /i MD5: 7F7CCAA16FB15EB1C7399D422F8363E8)

mssecsvc.exe (PID: 7404 cmdline: C:\WINDOWS\mssecsvc.exe -m security MD5: D724D8CC6420F06E8A48752F0DA11C66)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
WannaCryptor, WannaCry, WannaCrypt		Lazarus Group	http://blog.emsisoft.com/2017/05/12/wcry-ransomware-outbreak/ http://www.independent.co.uk/news/uk/home-news/wannacry-malware-hack-nhs-report-cybercrime-north-korea-uk-ben-wallace-a8022491.html https://baesystemsai.blogspot.de/2017/05/wanacrypt0r-ransomworm.html https://blog.avast.com/ransomware-that-infected-telefonica-and-nhs-hospitals-is-spreading-aggressively-with-over-50000-attacks-so-far-today https://blog.comae.io/wannacry-decrypting-files-with-wanakiwi-demo-86bafb81112d	https://malpedia.caad.fkie.fraunhofer.de/details/win.wannacryptor

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
zyeX8bTkky.dll	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
zyeX8bTkky.dll	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x45604:$x1: icacls . /grant Everyone:F /T /C /Q 0x353d0:$x3: tasksche.exe 0x455e0:$x3: tasksche.exe 0x455bc:$x4: Global\MsWinZonesCacheCounterMutexA 0x45634:$x5: WNcry@2ol7 0x3028:$x7: mssecsvc.exe 0x120ac:$x7: mssecsvc.exe 0x1b3b4:$x7: mssecsvc.exe 0x353a8:$x8: C:\%s\qeriuwjhrf 0x45604:$x9: icacls . /grant Everyone:F /T /C /Q 0x3014:$s1: C:\%s\%s 0x12098:$s1: C:\%s\%s 0x1b39c:$s1: C:\%s\%s 0x353bc:$s1: C:\%s\%s 0x45534:$s3: cmd.exe /c "%s" 0x77a88:$s4: msg/m_portuguese.wnry 0x326f0:$s5: \\192.168.56.20\IPC$ 0x1fae5:$s6: \\172.16.99.5\IPC$ 0xd195:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x78da:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x5449:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
zyeX8bTkky.dll	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x455e0:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x45608:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\tasksche.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Windows\tasksche.exe	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
C:\Windows\tasksche.exe	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
C:\Windows\tasksche.exe	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000000.1771087188.000000000040E000.00000008.00000001.01000000.00000007.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000006.00000002.2381008713.000000000042E000.00000004.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000000.1740919746.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000A.00000002.1771622182.000000000040E000.00000008.00000001.01000000.00000007.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000005.00000002.1746036311.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000009.00000002.1772103594.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000009.00000000.1769264396.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000000.1745181034.000000000040E000.00000008.00000001.01000000.00000007.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000007.00000002.1745648748.000000000040E000.00000008.00000001.01000000.00000007.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000006.00000000.1742932598.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.1743069425.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.1743069425.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000006.00000002.2382337647.0000000001C30000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000002.2382337647.0000000001C30000.00000004.00000020.00020000.00000000.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x32600:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x32628:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000005.00000000.1741223971.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000000.1741223971.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000006.00000002.2382864755.0000000002159000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000002.2382864755.0000000002159000.00000004.00000020.00020000.00000000.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x32e44:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x32e6c:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000009.00000002.1772248520.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000009.00000002.1772248520.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000005.00000002.1746174387.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000002.1746174387.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000009.00000000.1769380606.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000009.00000000.1769380606.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000006.00000002.2381175056.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000002.2381175056.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
Process Memory Space: mssecsvc.exe PID: 7364	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvc.exe PID: 7404	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvc.exe PID: 7644	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 24 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: zyeX8bTkky.dll

Avira: detected

Antivirus detection for dropped file

Source: C:\Windows\tasksche.exe

Avira: detection malicious, Label: TR/AD.WannaCry.sewvt

Multi AV Scanner detection for dropped file

Source: C:\WINDOWS\qeriuwjhrf (copy)	ReversingLabs: Detection: 100%
Source: C:\Windows\tasksche.exe	ReversingLabs: Detection: 100%

Multi AV Scanner detection for submitted file

Source: zyeX8bTkky.dll

ReversingLabs: Detection: 91%

Machine Learning detection for dropped file

Source: C:\Windows\tasksche.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: zyeX8bTkky.dll

Joe Sandbox ML: detected

Exploits

Connects to many different private IPs (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior

Connects to many different private IPs via SMB (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior

Source: zyeX8bTkky.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:50178 version: TLS 1.2

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 136.232.217.176
Source: unknown	TCP traffic detected without corresponding DNS query: 136.232.217.176
Source: unknown	TCP traffic detected without corresponding DNS query: 136.232.217.176
Source: unknown	TCP traffic detected without corresponding DNS query: 136.232.217.1
Source: unknown	TCP traffic detected without corresponding DNS query: 136.232.217.176
Source: unknown	TCP traffic detected without corresponding DNS query: 136.232.217.1
Source: unknown	TCP traffic detected without corresponding DNS query: 136.232.217.1
Source: unknown	TCP traffic detected without corresponding DNS query: 136.232.217.1
Source: unknown	TCP traffic detected without corresponding DNS query: 136.232.217.1
Source: unknown	TCP traffic detected without corresponding DNS query: 136.232.217.1
Source: unknown	TCP traffic detected without corresponding DNS query: 136.232.217.1
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 102.224.158.0
Source: unknown	TCP traffic detected without corresponding DNS query: 102.224.158.0
Source: unknown	TCP traffic detected without corresponding DNS query: 102.224.158.0
Source: unknown	TCP traffic detected without corresponding DNS query: 102.224.158.1
Source: unknown	TCP traffic detected without corresponding DNS query: 102.224.158.1
Source: unknown	TCP traffic detected without corresponding DNS query: 102.224.158.1
Source: unknown	TCP traffic detected without corresponding DNS query: 102.224.158.0
Source: unknown	TCP traffic detected without corresponding DNS query: 102.224.158.1
Source: unknown	TCP traffic detected without corresponding DNS query: 102.224.158.1
Source: unknown	TCP traffic detected without corresponding DNS query: 102.224.158.1
Source: unknown	TCP traffic detected without corresponding DNS query: 102.224.158.1
Source: unknown	TCP traffic detected without corresponding DNS query: 201.130.185.58
Source: unknown	TCP traffic detected without corresponding DNS query: 201.130.185.58
Source: unknown	TCP traffic detected without corresponding DNS query: 201.130.185.58
Source: unknown	TCP traffic detected without corresponding DNS query: 201.130.185.1
Source: unknown	TCP traffic detected without corresponding DNS query: 201.130.185.1
Source: unknown	TCP traffic detected without corresponding DNS query: 201.130.185.1
Source: unknown	TCP traffic detected without corresponding DNS query: 201.130.185.1
Source: unknown	TCP traffic detected without corresponding DNS query: 201.130.185.58
Source: unknown	TCP traffic detected without corresponding DNS query: 201.130.185.1
Source: unknown	TCP traffic detected without corresponding DNS query: 201.130.185.1
Source: unknown	TCP traffic detected without corresponding DNS query: 201.130.185.1
Source: unknown	TCP traffic detected without corresponding DNS query: 161.80.213.193
Source: unknown	TCP traffic detected without corresponding DNS query: 161.80.213.193
Source: unknown	TCP traffic detected without corresponding DNS query: 161.80.213.193
Source: unknown	TCP traffic detected without corresponding DNS query: 161.80.213.1
Source: unknown	TCP traffic detected without corresponding DNS query: 161.80.213.1
Source: unknown	TCP traffic detected without corresponding DNS query: 161.80.213.1
Source: unknown	TCP traffic detected without corresponding DNS query: 161.80.213.193
Source: unknown	TCP traffic detected without corresponding DNS query: 161.80.213.1
Source: unknown	TCP traffic detected without corresponding DNS query: 161.80.213.1
Source: unknown	TCP traffic detected without corresponding DNS query: 161.80.213.1
Source: unknown	TCP traffic detected without corresponding DNS query: 161.80.213.1
Source: unknown	TCP traffic detected without corresponding DNS query: 99.75.135.104
Source: unknown	TCP traffic detected without corresponding DNS query: 99.75.135.104
Source: unknown	TCP traffic detected without corresponding DNS query: 99.75.135.104
Source: unknown	TCP traffic detected without corresponding DNS query: 99.75.135.1
Source: unknown	TCP traffic detected without corresponding DNS query: 99.75.135.104

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=EhCEaABa7yn1dF5&MD=LBry1Nn4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=EhCEaABa7yn1dF5&MD=LBry1Nn4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:50178 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Yara detected Wannacry ransomware

Source: Yara match	File source: zyeX8bTkky.dll, type: SAMPLE
Source: Yara match	File source: 00000006.00000002.2381008713.000000000042E000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.1740919746.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1746036311.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1772103594.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.1769264396.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.1742932598.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.1743069425.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2382337647.0000000001C30000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.1741223971.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2382864755.0000000002159000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1772248520.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1746174387.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.1769380606.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2381175056.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 7364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 7404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 7644, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\tasksche.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: zyeX8bTkky.dll, type: SAMPLE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: zyeX8bTkky.dll, type: SAMPLE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 0000000A.00000000.1771087188.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 0000000A.00000002.1771622182.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000007.00000000.1745181034.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000007.00000002.1745648748.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000006.00000000.1743069425.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000006.00000002.2382337647.0000000001C30000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000005.00000000.1741223971.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000006.00000002.2382864755.0000000002159000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000009.00000002.1772248520.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000005.00000002.1746174387.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000009.00000000.1769380606.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000006.00000002.2381175056.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\WINDOWS\mssecsvc.exe	Jump to behavior
Source: C:\Windows\mssecsvc.exe	File created: C:\WINDOWS\tasksche.exe	Jump to behavior
Source: C:\Windows\mssecsvc.exe	File created: C:\WINDOWS\tasksche.exe	Jump to behavior

Source: Joe Sandbox View	Dropped File: C:\WINDOWS\qeriuwjhrf (copy) 2584E1521065E45EC3C17767C065429038FC6291C091097EA8B22C8A502C41DD
Source: Joe Sandbox View	Dropped File: C:\Windows\tasksche.exe 2584E1521065E45EC3C17767C065429038FC6291C091097EA8B22C8A502C41DD

Source: tasksche.exe.5.dr

Static PE information: Resource name: XIA type: Zip archive data, at least v2.0 to extract, compression method=deflate

Source: zyeX8bTkky.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: zyeX8bTkky.dll, type: SAMPLE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: zyeX8bTkky.dll, type: SAMPLE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 0000000A.00000000.1771087188.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 0000000A.00000002.1771622182.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000007.00000000.1745181034.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000007.00000002.1745648748.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000006.00000000.1743069425.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000006.00000002.2382337647.0000000001C30000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000005.00000000.1741223971.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000006.00000002.2382864755.0000000002159000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000009.00000002.1772248520.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000005.00000002.1746174387.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000009.00000000.1769380606.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000006.00000002.2381175056.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware

Source: tasksche.exe, 00000007.00000000.1745181034.000000000040E000.00000008.00000001.01000000.00000007.sdmp, tasksche.exe, 0000000A.00000000.1771087188.000000000040E000.00000008.00000001.01000000.00000007.sdmp, zyeX8bTkky.dll, tasksche.exe.5.dr

Binary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll

Source: classification engine

Classification label: mal100.rans.expl.evad.winDLL@20/2@0/100

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7272:120:WilError_03

Source: zyeX8bTkky.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\zyeX8bTkky.dll,PlayGame

Source: zyeX8bTkky.dll

ReversingLabs: Detection: 91%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\zyeX8bTkky.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\zyeX8bTkky.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\zyeX8bTkky.dll,PlayGame
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\zyeX8bTkky.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
Source: unknown	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe -m security
Source: C:\Windows\mssecsvc.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\zyeX8bTkky.dll",PlayGame
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
Source: C:\Windows\mssecsvc.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\zyeX8bTkky.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\zyeX8bTkky.dll,PlayGame	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\zyeX8bTkky.dll",PlayGame	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\zyeX8bTkky.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winnsi.dll	Jump to behavior

Source: C:\Windows\mssecsvc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: zyeX8bTkky.dll

Static file information: File size 5267459 > 1048576

Source: zyeX8bTkky.dll

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x501000

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\rundll32.exe	Executable created and started: C:\WINDOWS\mssecsvc.exe			Jump to behavior
Source: C:\Windows\mssecsvc.exe	Executable created and started: C:\WINDOWS\tasksche.exe			Jump to behavior

Source: C:\Windows\mssecsvc.exe	File created: C:\WINDOWS\qeriuwjhrf (copy)			Jump to dropped file
Source: C:\Windows\mssecsvc.exe	File created: C:\Windows\tasksche.exe			Jump to dropped file

Source: C:\Windows\mssecsvc.exe	File created: C:\WINDOWS\qeriuwjhrf (copy)			Jump to dropped file
Source: C:\Windows\mssecsvc.exe	File created: C:\Windows\tasksche.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\mssecsvc.exe

Thread delayed: delay time: 86400000

Jump to behavior

Source: C:\Windows\mssecsvc.exe TID: 7428	Thread sleep count: 90 > 30	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 7428	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 7440	Thread sleep count: 116 > 30	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 7440	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 7428	Thread sleep time: -86400000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\mssecsvc.exe	Thread delayed: delay time: 86400000			Jump to behavior

Source: mssecsvc.exe, 00000009.00000002.1772737272.0000000000E25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlle
Source: mssecsvc.exe, 00000005.00000002.1746562311.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll=
Source: mssecsvc.exe, 00000006.00000002.2381845792.0000000000D28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\zyeX8bTkky.dll",#1

Jump to behavior

Source: C:\Windows\mssecsvc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	12 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Rundll32	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
zyeX8bTkky.dll	91%	ReversingLabs	Win32.Ransomware.WannaCry
zyeX8bTkky.dll	100%	Avira	TR/AD.WannaCry.zbqny
zyeX8bTkky.dll	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\tasksche.exe	100%	Avira	TR/AD.WannaCry.sewvt
C:\Windows\tasksche.exe	100%	Joe Sandbox ML
C:\WINDOWS\qeriuwjhrf (copy)	100%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Windows\tasksche.exe	100%	ReversingLabs	Win32.Ransomware.WannaCry

Source	Detection	Scanner	Label	Link
https://ipinfo.io/	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
136.232.217.1	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
136.232.217.2	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
136.232.217.3	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
136.232.217.4	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
155.86.233.2	unknown	United States	4010	DNIC-AS-04010US	false
155.86.233.1	unknown	United States	4010	DNIC-AS-04010US	false
184.153.104.69	unknown	United States	12271	TWC-12271-NYCUS	false
182.85.58.147	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
12.109.166.254	unknown	United States	12169	IBM-BRS-SERVICEUS	false
19.152.241.250	unknown	United States	3	MIT-GATEWAYSUS	false
124.233.139.2	unknown	China	4809	CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr	false
124.233.139.3	unknown	China	4809	CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr	false
124.233.139.220	unknown	China	4809	CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr	false
124.233.139.1	unknown	China	4809	CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr	false
201.130.185.58	unknown	Mexico	8151	UninetSAdeCVMX	false
201.130.185.3	unknown	Mexico	8151	UninetSAdeCVMX	false
3.135.174.160	unknown	United States	16509	AMAZON-02US	false
201.130.185.1	unknown	Mexico	8151	UninetSAdeCVMX	false
201.130.185.2	unknown	Mexico	8151	UninetSAdeCVMX	false
147.230.27.1	unknown	Czech Republic	2852	CESNET2CZ	false
98.247.99.2	unknown	United States	7922	COMCAST-7922US	false
146.93.6.114	unknown	United States	18709	BOTWUS	false
98.247.99.1	unknown	United States	7922	COMCAST-7922US	false
15.84.171.2	unknown	United States	13979	ATT-IPFRUS	false
15.84.171.1	unknown	United States	13979	ATT-IPFRUS	false
161.80.213.2	unknown	United States	14298	EPA-NETUS	false
161.80.213.3	unknown	United States	14298	EPA-NETUS	false
161.80.213.1	unknown	United States	14298	EPA-NETUS	false
15.84.171.3	unknown	United States	13979	ATT-IPFRUS	false

Private

IP
192.168.2.148
192.168.2.149
192.168.2.146
192.168.2.147
192.168.2.140
192.168.2.141
192.168.2.144
192.168.2.145
192.168.2.142
192.168.2.143
192.168.2.159
192.168.2.157
192.168.2.158
192.168.2.151
192.168.2.152
192.168.2.150
192.168.2.155
192.168.2.156
192.168.2.153
192.168.2.154
192.168.2.126
192.168.2.247
192.168.2.127
192.168.2.248
192.168.2.124
192.168.2.245
192.168.2.125
192.168.2.246
192.168.2.128
192.168.2.249
192.168.2.129
192.168.2.240
192.168.2.122
192.168.2.243
192.168.2.123
192.168.2.244
192.168.2.120
192.168.2.241
192.168.2.121
192.168.2.242
192.168.2.97
192.168.2.137
192.168.2.96
192.168.2.138
192.168.2.99
192.168.2.135
192.168.2.98
192.168.2.136
192.168.2.139
192.168.2.250
192.168.2.130
192.168.2.251
192.168.2.91
192.168.2.90
192.168.2.93
192.168.2.133
192.168.2.254
192.168.2.92
192.168.2.134
192.168.2.95
192.168.2.131
192.168.2.252
192.168.2.94
192.168.2.132
192.168.2.253
192.168.2.104
192.168.2.225
192.168.2.105
192.168.2.226
192.168.2.102
192.168.2.223

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1453832
Start date and time:	2024-06-07 20:27:23 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	zyeX8bTkky.dll renamed because original name is a hash value
Original Sample Name:	64bb708b31b4b043018457c1098465ea83da7d6408c7029b2f68c333fc25891c.dll
Detection:	MAL
Classification:	mal100.rans.expl.evad.winDLL@20/2@0/100
Cookbook Comments:	Found application associated with file extension: .dll Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 192.229.221.95
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: zyeX8bTkky.dll

Simulations

Behavior and APIs

Time	Type	Description
14:28:29	API Interceptor	1x Sleep call for process: loaddll32.exe modified
14:29:00	API Interceptor	112x Sleep call for process: mssecsvc.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RELIANCEJIO-INRelianceJioInfocommLimitedIN	arm.elf	Get hash	malicious	Mirai	Browse	157.37.190.88
	skid.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	49.33.244.115
	rcO18ocUnR.elf	Get hash	malicious	Mirai	Browse	157.37.77.211
	https://advaith07.github.io/Netflix_ui_clone	Get hash	malicious	Unknown	Browse	49.44.142.174
	4xGw66BS5c.elf	Get hash	malicious	Mirai	Browse	47.8.26.162
	z9BtNf1MSZ.elf	Get hash	malicious	Mirai	Browse	115.240.200.238
	ls0PnGaKLG.elf	Get hash	malicious	Unknown	Browse	115.246.85.20
	Lt9n9tfJhl.elf	Get hash	malicious	Unknown	Browse	115.241.102.161
	g4KkNl0StO.elf	Get hash	malicious	Unknown	Browse	157.51.244.206
	BubsjPHKSZ.elf	Get hash	malicious	Unknown	Browse	157.48.226.237
RELIANCEJIO-INRelianceJioInfocommLimitedIN	arm.elf	Get hash	malicious	Mirai	Browse	157.37.190.88
	skid.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	49.33.244.115
	rcO18ocUnR.elf	Get hash	malicious	Mirai	Browse	157.37.77.211
	https://advaith07.github.io/Netflix_ui_clone	Get hash	malicious	Unknown	Browse	49.44.142.174
	4xGw66BS5c.elf	Get hash	malicious	Mirai	Browse	47.8.26.162
	z9BtNf1MSZ.elf	Get hash	malicious	Mirai	Browse	115.240.200.238
	ls0PnGaKLG.elf	Get hash	malicious	Unknown	Browse	115.246.85.20
	Lt9n9tfJhl.elf	Get hash	malicious	Unknown	Browse	115.241.102.161
	g4KkNl0StO.elf	Get hash	malicious	Unknown	Browse	157.51.244.206
	BubsjPHKSZ.elf	Get hash	malicious	Unknown	Browse	157.48.226.237
RELIANCEJIO-INRelianceJioInfocommLimitedIN	arm.elf	Get hash	malicious	Mirai	Browse	157.37.190.88
	skid.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	49.33.244.115
	rcO18ocUnR.elf	Get hash	malicious	Mirai	Browse	157.37.77.211
	https://advaith07.github.io/Netflix_ui_clone	Get hash	malicious	Unknown	Browse	49.44.142.174
	4xGw66BS5c.elf	Get hash	malicious	Mirai	Browse	47.8.26.162
	z9BtNf1MSZ.elf	Get hash	malicious	Mirai	Browse	115.240.200.238
	ls0PnGaKLG.elf	Get hash	malicious	Unknown	Browse	115.246.85.20
	Lt9n9tfJhl.elf	Get hash	malicious	Unknown	Browse	115.241.102.161
	g4KkNl0StO.elf	Get hash	malicious	Unknown	Browse	157.51.244.206
	BubsjPHKSZ.elf	Get hash	malicious	Unknown	Browse	157.48.226.237
RELIANCEJIO-INRelianceJioInfocommLimitedIN	arm.elf	Get hash	malicious	Mirai	Browse	157.37.190.88
	skid.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	49.33.244.115
	rcO18ocUnR.elf	Get hash	malicious	Mirai	Browse	157.37.77.211
	https://advaith07.github.io/Netflix_ui_clone	Get hash	malicious	Unknown	Browse	49.44.142.174
	4xGw66BS5c.elf	Get hash	malicious	Mirai	Browse	47.8.26.162
	z9BtNf1MSZ.elf	Get hash	malicious	Mirai	Browse	115.240.200.238
	ls0PnGaKLG.elf	Get hash	malicious	Unknown	Browse	115.246.85.20
	Lt9n9tfJhl.elf	Get hash	malicious	Unknown	Browse	115.241.102.161
	g4KkNl0StO.elf	Get hash	malicious	Unknown	Browse	157.51.244.206
	BubsjPHKSZ.elf	Get hash	malicious	Unknown	Browse	157.48.226.237

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	qt680eucI4.dll	Get hash	malicious	Wannacry	Browse	20.12.23.50
	1w3BDu68Sg.dll	Get hash	malicious	Wannacry	Browse	20.12.23.50
	https://xtrfr.com/t/1/m3WHCF?p=1kpU6NUBF-6AZQCXRW_1kpU72q8p-6BdU97to	Get hash	malicious	Unknown	Browse	20.12.23.50
	http://myworkspace2f139.myclickfunnels.com/onlinereviews?preview=true	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	20.12.23.50
	https://cloud.letsignit.com/collect/bc/5e8451ea469b88b5cea97417?p=OjfPT7lREiUDLQp6d36aSXQolbQ31LL303XXq73c0LgCPRp2orT9jnqhLprOLL90LfaIzvzkFLCd3-2924eBGaNnzzdb2z0VcZL3eza6pD7Lvwp-E0If3Kq_h3YGcTVhXX2GI1pL-hkiu7mMH-yy70unDaTgV2kM4DQ-HStdqgkF7zy0WhQyMck9ofym3AGicaSsvd1nX6vBxj3Gigg-Jk5WTk6QhcYqtI7diLh8ciaTnz7P5Co45mD3SSBKwruGP56kB0EhGHeljKZvuOLe6ppx9ZBLT3k3gvWvTcJPtdA=	Get hash	malicious	Unknown	Browse	20.12.23.50
	http://norauto-dreux.myfreesites.net	Get hash	malicious	Unknown	Browse	20.12.23.50
	https://www.hsbcqh.com.cn/	Get hash	malicious	Unknown	Browse	20.12.23.50
	https://www.tcsfuel.com	Get hash	malicious	Unknown	Browse	20.12.23.50
	https://ykmm2k9z.r.us-west-1.awstrack.me/L0/https:%2F%2Fatpscan.global.hornetsecurity.com%2Findex.php%3Fatp_str=am_k8LOPbUbePsfY-hKWBmPaLDazKPnHG4jgTUQirWpga72hak_a5NKRFGbXRT_nnpgzPYdx0w8exXS55Fcp8WGYFJ9rF7NbP9YDx5XhnQonunOobszh2UUrWZZnge2pJMarfaiZAqQcCAma3qVy7myZYfRUSoSvz6VKZBX_08i44Tp25Hl13pzKSAeJxY4zGA5QdKIZ6jauqCQUDLNdxAOgf31Ce4RI2rjyAwtDmNxG7pu00VIybu_gNwipmx4F5IFfSxz7VEOKyp3CucZ5M5iqrPYqvlDRcg8jOjojL_P6Wr3_SQCB2Z0bIzo6I_ei1xQj27Yk9qwRXKzsKMs/1/0111018fef761e90-05d92175-04ab-45dc-b869-d508a2bdcd27-000000/Em26ZPrClpDT_ZVT_bHsu3LhDrM=162	Get hash	malicious	Unknown	Browse	20.12.23.50
	https://capitalaitechlab.pro/index.php?products=investgeniusaide&eng_click=297dc4e0ac4544d4a012eea865a19727&eng_website=238723&eng_creative=1029836897&eng_widget=228333&pixelid=240455&key=griss&eng_source=238723&eng_subid=null&eng_click=297dc4e0ac4544d4a012eea865a19727	Get hash	malicious	Unknown	Browse	20.12.23.50

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\WINDOWS\qeriuwjhrf (copy)	qt680eucI4.dll	Get hash	malicious	Wannacry	Browse
	1w3BDu68Sg.dll	Get hash	malicious	Wannacry	Browse
	qCc1a4w5YZ.exe	Get hash	malicious	Wannacry	Browse
	stN592INV6.exe	Get hash	malicious	Wannacry	Browse
	onq54JS79W.exe	Get hash	malicious	Wannacry	Browse
	mbXvGlj2dR.dll	Get hash	malicious	Wannacry	Browse
	MSNRf9dZ63.exe	Get hash	malicious	Wannacry	Browse
	7Qu8thR7WW.dll	Get hash	malicious	Wannacry, Virut	Browse
	MSmReFKunQ.dll	Get hash	malicious	Wannacry	Browse
	kXpnLUmuU2.dll	Get hash	malicious	Wannacry	Browse
C:\Windows\tasksche.exe	qt680eucI4.dll	Get hash	malicious	Wannacry	Browse
	1w3BDu68Sg.dll	Get hash	malicious	Wannacry	Browse
	qCc1a4w5YZ.exe	Get hash	malicious	Wannacry	Browse
	stN592INV6.exe	Get hash	malicious	Wannacry	Browse
	onq54JS79W.exe	Get hash	malicious	Wannacry	Browse
	mbXvGlj2dR.dll	Get hash	malicious	Wannacry	Browse
	MSNRf9dZ63.exe	Get hash	malicious	Wannacry	Browse
	7Qu8thR7WW.dll	Get hash	malicious	Wannacry, Virut	Browse
	MSmReFKunQ.dll	Get hash	malicious	Wannacry	Browse
	kXpnLUmuU2.dll	Get hash	malicious	Wannacry	Browse

Created / dropped Files

C:\WINDOWS\qeriuwjhrf (copy)

Download File

Process:	C:\Windows\mssecsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3514368
Entropy (8bit):	7.996072890929898
Encrypted:	true
SSDEEP:	98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hj:QqPe1Cxcxk3ZAEUadzR8yc4Hj
MD5:	7F7CCAA16FB15EB1C7399D422F8363E8
SHA1:	BD44D0AB543BF814D93B719C24E90D8DD7111234
SHA-256:	2584E1521065E45EC3C17767C065429038FC6291C091097EA8B22C8A502C41DD
SHA-512:	83E334B80DE08903CFA9891A3FA349C1ECE7E19F8E62B74A017512FA9A7989A0FD31929BF1FC13847BEE04F2DA3DACF6BC3F5EE58F0E4B9D495F4B9AF12ED2B7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Joe Sandbox View:	Filename: qt680eucI4.dll, Detection: malicious, Browse Filename: 1w3BDu68Sg.dll, Detection: malicious, Browse Filename: qCc1a4w5YZ.exe, Detection: malicious, Browse Filename: stN592INV6.exe, Detection: malicious, Browse Filename: onq54JS79W.exe, Detection: malicious, Browse Filename: mbXvGlj2dR.dll, Detection: malicious, Browse Filename: MSNRf9dZ63.exe, Detection: malicious, Browse Filename: 7Qu8thR7WW.dll, Detection: malicious, Browse Filename: MSmReFKunQ.dll, Detection: malicious, Browse Filename: kXpnLUmuU2.dll, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..T...T...T..X...T.._...T.'.Z...T..^...T..P...T.g.....T...U...T..._...T.c.R...T.Rich..T.........................PE..L...A..L.................p... 5......w............@...........................5.................................................d.........4..........................................................................................................text....i.......p.................. ..`.rdata..p_.......`..................@..@.data...X........ ..................@....rsrc.....4.......4.................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\tasksche.exe

Download File

Process:	C:\Windows\mssecsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3514368
Entropy (8bit):	7.996072890929898
Encrypted:	true
SSDEEP:	98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hj:QqPe1Cxcxk3ZAEUadzR8yc4Hj
MD5:	7F7CCAA16FB15EB1C7399D422F8363E8
SHA1:	BD44D0AB543BF814D93B719C24E90D8DD7111234
SHA-256:	2584E1521065E45EC3C17767C065429038FC6291C091097EA8B22C8A502C41DD
SHA-512:	83E334B80DE08903CFA9891A3FA349C1ECE7E19F8E62B74A017512FA9A7989A0FD31929BF1FC13847BEE04F2DA3DACF6BC3F5EE58F0E4B9D495F4B9AF12ED2B7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\tasksche.exe, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\tasksche.exe, Author: ReversingLabs
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Joe Sandbox View:	Filename: qt680eucI4.dll, Detection: malicious, Browse Filename: 1w3BDu68Sg.dll, Detection: malicious, Browse Filename: qCc1a4w5YZ.exe, Detection: malicious, Browse Filename: stN592INV6.exe, Detection: malicious, Browse Filename: onq54JS79W.exe, Detection: malicious, Browse Filename: mbXvGlj2dR.dll, Detection: malicious, Browse Filename: MSNRf9dZ63.exe, Detection: malicious, Browse Filename: 7Qu8thR7WW.dll, Detection: malicious, Browse Filename: MSmReFKunQ.dll, Detection: malicious, Browse Filename: kXpnLUmuU2.dll, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..T...T...T..X...T.._...T.'.Z...T..^...T..P...T.g.....T...U...T..._...T.c.R...T.Rich..T.........................PE..L...A..L.................p... 5......w............@...........................5.................................................d.........4..........................................................................................................text....i.......p.................. ..`.rdata..p_.......`..................@..@.data...X........ ..................@....rsrc.....4.......4.................@..@........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.412557581819131
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	zyeX8bTkky.dll
File size:	5'267'459 bytes
MD5:	0ab2aeda90221832167e5127332dd702
SHA1:	f370045d8ac3f4ba78acf8bfe4c4d35758d5ea05
SHA256:	64bb708b31b4b043018457c1098465ea83da7d6408c7029b2f68c333fc25891c
SHA512:	8062093734b11fdd2a8650bfcbc22f36aa679103e7a7ebee74db1ecfcdbf9d9bf76d105f395308db713746dbadacc5796db85ab883a4187587f03b2d3cf7b75b
SSDEEP:	98304:d8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:d8qPe1Cxcxk3ZAEUadzR8yc4H
TLSH:	AF363394622CB2FCF0440EB44463896BB7B73C6967BA5E1F8BC086670D43B5BAFD0641
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.r_9...9...9.......=...9...6.....A.:.......8.......8.......:...Rich9...........................PE..L...QW.Y...........!.......

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x100011e9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x59145751 [Thu May 11 12:21:37 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2e5708ae5fed0403e8117c645fb23e5b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ebx
mov ebx, dword ptr [ebp+08h]
push esi
mov esi, dword ptr [ebp+0Ch]
push edi
mov edi, dword ptr [ebp+10h]
test esi, esi
jne 00007FD4987EB92Bh
cmp dword ptr [10003140h], 00000000h
jmp 00007FD4987EB948h
cmp esi, 01h
je 00007FD4987EB927h
cmp esi, 02h
jne 00007FD4987EB944h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007FD4987EB92Bh
push edi
push esi
push ebx
call eax
test eax, eax
je 00007FD4987EB92Eh
push edi
push esi
push ebx
call 00007FD4987EB83Ah
test eax, eax
jne 00007FD4987EB926h
xor eax, eax
jmp 00007FD4987EB970h
push edi
push esi
push ebx
call 00007FD4987EB6ECh
cmp esi, 01h
mov dword ptr [ebp+0Ch], eax
jne 00007FD4987EB92Eh
test eax, eax
jne 00007FD4987EB959h
push edi
push eax
push ebx
call 00007FD4987EB816h
test esi, esi
je 00007FD4987EB927h
cmp esi, 03h
jne 00007FD4987EB948h
push edi
push esi
push ebx
call 00007FD4987EB805h
test eax, eax
jne 00007FD4987EB925h
and dword ptr [ebp+0Ch], eax
cmp dword ptr [ebp+0Ch], 00000000h
je 00007FD4987EB933h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007FD4987EB92Ah
push edi
push esi
push ebx
call eax
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
pop esi
pop ebx
pop ebp
retn 000Ch
jmp dword ptr [10002028h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[C++] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2190	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x203c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x500060	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x505000	0x5c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28c	0x1000	8de9a2cb31e4c74bd008b871d14bfafc	False	0.13037109375	data	1.4429971244731552	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x1d8	0x1000	3dd394f95ab218593f2bc8eb65184db4	False	0.072509765625	data	0.7346018133622799	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x154	0x1000	fe5022c5b5d015ad38b2b77fc437a5cb	False	0.016845703125	Matlab v4 mat-file (little endian) C:\%s\%s, numeric, rows 0, columns 0	0.085238686413312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x500060	0x501000	51ff0b3795452d4282a3d45796d17af6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x505000	0x2ac	0x1000	620f0b67a91f7f74151bc5be745b7110	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
W	0x4060	0x500000	data	English	United States	0.8770351409912109

Imports

DLL	Import
KERNEL32.dll	CloseHandle, WriteFile, CreateFileA, SizeofResource, LockResource, LoadResource, FindResourceA, CreateProcessA
MSVCRT.dll	free, _initterm, malloc, _adjust_fdiv, sprintf

Exports

Name	Ordinal	Address
PlayGame	1	0x10001114

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 7, 2024 20:28:27.763334036 CEST	49731	445	192.168.2.4	136.232.217.176
Jun 7, 2024 20:28:27.768358946 CEST	445	49731	136.232.217.176	192.168.2.4
Jun 7, 2024 20:28:27.768429995 CEST	49731	445	192.168.2.4	136.232.217.176
Jun 7, 2024 20:28:27.768477917 CEST	49731	445	192.168.2.4	136.232.217.176
Jun 7, 2024 20:28:27.768696070 CEST	49732	445	192.168.2.4	136.232.217.1
Jun 7, 2024 20:28:27.773622990 CEST	445	49731	136.232.217.176	192.168.2.4
Jun 7, 2024 20:28:27.773657084 CEST	445	49732	136.232.217.1	192.168.2.4
Jun 7, 2024 20:28:27.773686886 CEST	49731	445	192.168.2.4	136.232.217.176
Jun 7, 2024 20:28:27.773724079 CEST	49732	445	192.168.2.4	136.232.217.1
Jun 7, 2024 20:28:27.774490118 CEST	49732	445	192.168.2.4	136.232.217.1
Jun 7, 2024 20:28:27.779484987 CEST	445	49732	136.232.217.1	192.168.2.4
Jun 7, 2024 20:28:27.779531002 CEST	49732	445	192.168.2.4	136.232.217.1
Jun 7, 2024 20:28:27.781095028 CEST	49733	445	192.168.2.4	136.232.217.1
Jun 7, 2024 20:28:27.786014080 CEST	445	49733	136.232.217.1	192.168.2.4
Jun 7, 2024 20:28:27.786070108 CEST	49733	445	192.168.2.4	136.232.217.1
Jun 7, 2024 20:28:27.786103964 CEST	49733	445	192.168.2.4	136.232.217.1
Jun 7, 2024 20:28:27.790985107 CEST	445	49733	136.232.217.1	192.168.2.4
Jun 7, 2024 20:28:29.715553045 CEST	49675	443	192.168.2.4	173.222.162.32
Jun 7, 2024 20:28:29.764230013 CEST	49756	445	192.168.2.4	102.224.158.0
Jun 7, 2024 20:28:29.769433975 CEST	445	49756	102.224.158.0	192.168.2.4
Jun 7, 2024 20:28:29.769577980 CEST	49756	445	192.168.2.4	102.224.158.0
Jun 7, 2024 20:28:29.769707918 CEST	49756	445	192.168.2.4	102.224.158.0
Jun 7, 2024 20:28:29.769841909 CEST	49757	445	192.168.2.4	102.224.158.1
Jun 7, 2024 20:28:29.774753094 CEST	445	49757	102.224.158.1	192.168.2.4
Jun 7, 2024 20:28:29.774837971 CEST	49757	445	192.168.2.4	102.224.158.1
Jun 7, 2024 20:28:29.774933100 CEST	445	49756	102.224.158.0	192.168.2.4
Jun 7, 2024 20:28:29.774961948 CEST	49757	445	192.168.2.4	102.224.158.1
Jun 7, 2024 20:28:29.774985075 CEST	49756	445	192.168.2.4	102.224.158.0
Jun 7, 2024 20:28:29.776083946 CEST	49758	445	192.168.2.4	102.224.158.1
Jun 7, 2024 20:28:29.780029058 CEST	445	49757	102.224.158.1	192.168.2.4
Jun 7, 2024 20:28:29.780107021 CEST	49757	445	192.168.2.4	102.224.158.1
Jun 7, 2024 20:28:29.780998945 CEST	445	49758	102.224.158.1	192.168.2.4
Jun 7, 2024 20:28:29.781061888 CEST	49758	445	192.168.2.4	102.224.158.1
Jun 7, 2024 20:28:29.781708002 CEST	49758	445	192.168.2.4	102.224.158.1
Jun 7, 2024 20:28:29.786587954 CEST	445	49758	102.224.158.1	192.168.2.4
Jun 7, 2024 20:28:31.779576063 CEST	49781	445	192.168.2.4	201.130.185.58
Jun 7, 2024 20:28:31.784717083 CEST	445	49781	201.130.185.58	192.168.2.4
Jun 7, 2024 20:28:31.784797907 CEST	49781	445	192.168.2.4	201.130.185.58
Jun 7, 2024 20:28:31.784842014 CEST	49781	445	192.168.2.4	201.130.185.58
Jun 7, 2024 20:28:31.785135031 CEST	49782	445	192.168.2.4	201.130.185.1
Jun 7, 2024 20:28:31.790138960 CEST	445	49782	201.130.185.1	192.168.2.4
Jun 7, 2024 20:28:31.790204048 CEST	49782	445	192.168.2.4	201.130.185.1
Jun 7, 2024 20:28:31.790236950 CEST	49782	445	192.168.2.4	201.130.185.1
Jun 7, 2024 20:28:31.790533066 CEST	445	49781	201.130.185.58	192.168.2.4
Jun 7, 2024 20:28:31.791354895 CEST	49783	445	192.168.2.4	201.130.185.1
Jun 7, 2024 20:28:31.791378975 CEST	49781	445	192.168.2.4	201.130.185.58
Jun 7, 2024 20:28:31.795802116 CEST	445	49782	201.130.185.1	192.168.2.4
Jun 7, 2024 20:28:31.795856953 CEST	49782	445	192.168.2.4	201.130.185.1
Jun 7, 2024 20:28:31.796266079 CEST	445	49783	201.130.185.1	192.168.2.4
Jun 7, 2024 20:28:31.796319962 CEST	49783	445	192.168.2.4	201.130.185.1
Jun 7, 2024 20:28:31.796355963 CEST	49783	445	192.168.2.4	201.130.185.1
Jun 7, 2024 20:28:31.801188946 CEST	445	49783	201.130.185.1	192.168.2.4
Jun 7, 2024 20:28:33.795034885 CEST	49805	445	192.168.2.4	161.80.213.193
Jun 7, 2024 20:28:33.800044060 CEST	445	49805	161.80.213.193	192.168.2.4
Jun 7, 2024 20:28:33.800117016 CEST	49805	445	192.168.2.4	161.80.213.193
Jun 7, 2024 20:28:33.800164938 CEST	49805	445	192.168.2.4	161.80.213.193
Jun 7, 2024 20:28:33.800369978 CEST	49806	445	192.168.2.4	161.80.213.1
Jun 7, 2024 20:28:33.805248976 CEST	445	49806	161.80.213.1	192.168.2.4
Jun 7, 2024 20:28:33.805304050 CEST	49806	445	192.168.2.4	161.80.213.1
Jun 7, 2024 20:28:33.805335045 CEST	49806	445	192.168.2.4	161.80.213.1
Jun 7, 2024 20:28:33.805598974 CEST	445	49805	161.80.213.193	192.168.2.4
Jun 7, 2024 20:28:33.805641890 CEST	49805	445	192.168.2.4	161.80.213.193
Jun 7, 2024 20:28:33.806533098 CEST	49807	445	192.168.2.4	161.80.213.1
Jun 7, 2024 20:28:33.810726881 CEST	445	49806	161.80.213.1	192.168.2.4
Jun 7, 2024 20:28:33.810801029 CEST	49806	445	192.168.2.4	161.80.213.1
Jun 7, 2024 20:28:33.811352015 CEST	445	49807	161.80.213.1	192.168.2.4
Jun 7, 2024 20:28:33.811412096 CEST	49807	445	192.168.2.4	161.80.213.1
Jun 7, 2024 20:28:33.811491966 CEST	49807	445	192.168.2.4	161.80.213.1
Jun 7, 2024 20:28:33.816302061 CEST	445	49807	161.80.213.1	192.168.2.4
Jun 7, 2024 20:28:35.810877085 CEST	49830	445	192.168.2.4	99.75.135.104
Jun 7, 2024 20:28:35.818723917 CEST	445	49830	99.75.135.104	192.168.2.4
Jun 7, 2024 20:28:35.818845987 CEST	49830	445	192.168.2.4	99.75.135.104
Jun 7, 2024 20:28:35.819056034 CEST	49830	445	192.168.2.4	99.75.135.104
Jun 7, 2024 20:28:35.819331884 CEST	49831	445	192.168.2.4	99.75.135.1
Jun 7, 2024 20:28:35.824039936 CEST	445	49830	99.75.135.104	192.168.2.4
Jun 7, 2024 20:28:35.824101925 CEST	49830	445	192.168.2.4	99.75.135.104
Jun 7, 2024 20:28:35.824219942 CEST	445	49831	99.75.135.1	192.168.2.4
Jun 7, 2024 20:28:35.824398994 CEST	49831	445	192.168.2.4	99.75.135.1
Jun 7, 2024 20:28:35.824469090 CEST	49831	445	192.168.2.4	99.75.135.1
Jun 7, 2024 20:28:35.825530052 CEST	49832	445	192.168.2.4	99.75.135.1
Jun 7, 2024 20:28:35.829468012 CEST	445	49831	99.75.135.1	192.168.2.4
Jun 7, 2024 20:28:35.829523087 CEST	49831	445	192.168.2.4	99.75.135.1
Jun 7, 2024 20:28:35.830517054 CEST	445	49832	99.75.135.1	192.168.2.4
Jun 7, 2024 20:28:35.830579996 CEST	49832	445	192.168.2.4	99.75.135.1
Jun 7, 2024 20:28:35.830616951 CEST	49832	445	192.168.2.4	99.75.135.1
Jun 7, 2024 20:28:35.835517883 CEST	445	49832	99.75.135.1	192.168.2.4
Jun 7, 2024 20:28:36.284351110 CEST	445	49733	136.232.217.1	192.168.2.4
Jun 7, 2024 20:28:36.284432888 CEST	49733	445	192.168.2.4	136.232.217.1
Jun 7, 2024 20:28:36.284499884 CEST	49733	445	192.168.2.4	136.232.217.1
Jun 7, 2024 20:28:36.284544945 CEST	49733	445	192.168.2.4	136.232.217.1
Jun 7, 2024 20:28:36.289544106 CEST	445	49733	136.232.217.1	192.168.2.4
Jun 7, 2024 20:28:36.289575100 CEST	445	49733	136.232.217.1	192.168.2.4
Jun 7, 2024 20:28:37.826375961 CEST	49853	445	192.168.2.4	15.84.171.54
Jun 7, 2024 20:28:38.449836016 CEST	445	49758	102.224.158.1	192.168.2.4
Jun 7, 2024 20:28:38.452215910 CEST	445	49853	15.84.171.54	192.168.2.4
Jun 7, 2024 20:28:38.452306986 CEST	49758	445	192.168.2.4	102.224.158.1
Jun 7, 2024 20:28:38.452349901 CEST	49853	445	192.168.2.4	15.84.171.54
Jun 7, 2024 20:28:38.452405930 CEST	49758	445	192.168.2.4	102.224.158.1
Jun 7, 2024 20:28:38.452488899 CEST	49758	445	192.168.2.4	102.224.158.1
Jun 7, 2024 20:28:38.452528000 CEST	49853	445	192.168.2.4	15.84.171.54
Jun 7, 2024 20:28:38.452613115 CEST	49863	445	192.168.2.4	15.84.171.1
Jun 7, 2024 20:28:38.458487034 CEST	445	49758	102.224.158.1	192.168.2.4
Jun 7, 2024 20:28:38.458533049 CEST	445	49758	102.224.158.1	192.168.2.4
Jun 7, 2024 20:28:38.458566904 CEST	445	49863	15.84.171.1	192.168.2.4
Jun 7, 2024 20:28:38.458663940 CEST	49863	445	192.168.2.4	15.84.171.1
Jun 7, 2024 20:28:38.458686113 CEST	49863	445	192.168.2.4	15.84.171.1
Jun 7, 2024 20:28:38.460433006 CEST	49864	445	192.168.2.4	15.84.171.1
Jun 7, 2024 20:28:38.461541891 CEST	445	49853	15.84.171.54	192.168.2.4
Jun 7, 2024 20:28:38.465941906 CEST	445	49864	15.84.171.1	192.168.2.4
Jun 7, 2024 20:28:38.466020107 CEST	49853	445	192.168.2.4	15.84.171.54
Jun 7, 2024 20:28:38.466038942 CEST	49864	445	192.168.2.4	15.84.171.1
Jun 7, 2024 20:28:38.466078043 CEST	49864	445	192.168.2.4	15.84.171.1
Jun 7, 2024 20:28:38.469425917 CEST	445	49863	15.84.171.1	192.168.2.4
Jun 7, 2024 20:28:38.471157074 CEST	445	49864	15.84.171.1	192.168.2.4
Jun 7, 2024 20:28:38.471375942 CEST	445	49863	15.84.171.1	192.168.2.4
Jun 7, 2024 20:28:38.471611023 CEST	49863	445	192.168.2.4	15.84.171.1
Jun 7, 2024 20:28:39.293957949 CEST	49873	445	192.168.2.4	136.232.217.1
Jun 7, 2024 20:28:39.299108982 CEST	445	49873	136.232.217.1	192.168.2.4
Jun 7, 2024 20:28:39.300822020 CEST	49873	445	192.168.2.4	136.232.217.1
Jun 7, 2024 20:28:39.300898075 CEST	49873	445	192.168.2.4	136.232.217.1
Jun 7, 2024 20:28:39.305860043 CEST	445	49873	136.232.217.1	192.168.2.4
Jun 7, 2024 20:28:39.841550112 CEST	49879	445	192.168.2.4	8.191.246.20
Jun 7, 2024 20:28:39.846795082 CEST	445	49879	8.191.246.20	192.168.2.4
Jun 7, 2024 20:28:39.847019911 CEST	49879	445	192.168.2.4	8.191.246.20
Jun 7, 2024 20:28:39.852786064 CEST	49879	445	192.168.2.4	8.191.246.20
Jun 7, 2024 20:28:39.852974892 CEST	49880	445	192.168.2.4	8.191.246.1
Jun 7, 2024 20:28:39.857777119 CEST	445	49879	8.191.246.20	192.168.2.4
Jun 7, 2024 20:28:39.857846975 CEST	49879	445	192.168.2.4	8.191.246.20
Jun 7, 2024 20:28:39.857939959 CEST	445	49880	8.191.246.1	192.168.2.4
Jun 7, 2024 20:28:39.857999086 CEST	49880	445	192.168.2.4	8.191.246.1
Jun 7, 2024 20:28:39.858042955 CEST	49880	445	192.168.2.4	8.191.246.1
Jun 7, 2024 20:28:39.858335018 CEST	49881	445	192.168.2.4	8.191.246.1
Jun 7, 2024 20:28:39.863321066 CEST	445	49881	8.191.246.1	192.168.2.4
Jun 7, 2024 20:28:39.863373995 CEST	445	49880	8.191.246.1	192.168.2.4
Jun 7, 2024 20:28:39.863385916 CEST	49881	445	192.168.2.4	8.191.246.1
Jun 7, 2024 20:28:39.863401890 CEST	49881	445	192.168.2.4	8.191.246.1
Jun 7, 2024 20:28:39.863430977 CEST	49880	445	192.168.2.4	8.191.246.1
Jun 7, 2024 20:28:39.868370056 CEST	445	49881	8.191.246.1	192.168.2.4
Jun 7, 2024 20:28:40.294850111 CEST	445	49783	201.130.185.1	192.168.2.4
Jun 7, 2024 20:28:40.294955969 CEST	49783	445	192.168.2.4	201.130.185.1
Jun 7, 2024 20:28:40.295008898 CEST	49783	445	192.168.2.4	201.130.185.1
Jun 7, 2024 20:28:40.295075893 CEST	49783	445	192.168.2.4	201.130.185.1
Jun 7, 2024 20:28:40.299974918 CEST	445	49783	201.130.185.1	192.168.2.4
Jun 7, 2024 20:28:40.299984932 CEST	445	49783	201.130.185.1	192.168.2.4
Jun 7, 2024 20:28:41.465939045 CEST	49899	445	192.168.2.4	102.224.158.1
Jun 7, 2024 20:28:41.471088886 CEST	445	49899	102.224.158.1	192.168.2.4
Jun 7, 2024 20:28:41.471200943 CEST	49899	445	192.168.2.4	102.224.158.1
Jun 7, 2024 20:28:41.471250057 CEST	49899	445	192.168.2.4	102.224.158.1
Jun 7, 2024 20:28:41.477077961 CEST	445	49899	102.224.158.1	192.168.2.4
Jun 7, 2024 20:28:41.857038021 CEST	49905	445	192.168.2.4	53.251.193.102
Jun 7, 2024 20:28:41.861974955 CEST	445	49905	53.251.193.102	192.168.2.4
Jun 7, 2024 20:28:41.862049103 CEST	49905	445	192.168.2.4	53.251.193.102
Jun 7, 2024 20:28:41.862315893 CEST	49905	445	192.168.2.4	53.251.193.102
Jun 7, 2024 20:28:41.862451077 CEST	49906	445	192.168.2.4	53.251.193.1
Jun 7, 2024 20:28:41.867319107 CEST	445	49906	53.251.193.1	192.168.2.4
Jun 7, 2024 20:28:41.867374897 CEST	445	49905	53.251.193.102	192.168.2.4
Jun 7, 2024 20:28:41.867377996 CEST	49906	445	192.168.2.4	53.251.193.1
Jun 7, 2024 20:28:41.867429972 CEST	49905	445	192.168.2.4	53.251.193.102
Jun 7, 2024 20:28:41.867531061 CEST	49906	445	192.168.2.4	53.251.193.1
Jun 7, 2024 20:28:41.867935896 CEST	49907	445	192.168.2.4	53.251.193.1
Jun 7, 2024 20:28:41.872565985 CEST	445	49906	53.251.193.1	192.168.2.4
Jun 7, 2024 20:28:41.872622013 CEST	49906	445	192.168.2.4	53.251.193.1
Jun 7, 2024 20:28:41.872958899 CEST	445	49907	53.251.193.1	192.168.2.4
Jun 7, 2024 20:28:41.873018980 CEST	49907	445	192.168.2.4	53.251.193.1
Jun 7, 2024 20:28:41.873032093 CEST	49907	445	192.168.2.4	53.251.193.1
Jun 7, 2024 20:28:41.877948046 CEST	445	49907	53.251.193.1	192.168.2.4
Jun 7, 2024 20:28:42.302598953 CEST	445	49807	161.80.213.1	192.168.2.4
Jun 7, 2024 20:28:42.302666903 CEST	49807	445	192.168.2.4	161.80.213.1
Jun 7, 2024 20:28:42.302733898 CEST	49807	445	192.168.2.4	161.80.213.1
Jun 7, 2024 20:28:42.302812099 CEST	49807	445	192.168.2.4	161.80.213.1
Jun 7, 2024 20:28:42.307725906 CEST	445	49807	161.80.213.1	192.168.2.4
Jun 7, 2024 20:28:42.307744026 CEST	445	49807	161.80.213.1	192.168.2.4
Jun 7, 2024 20:28:42.498662949 CEST	49913	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:28:42.498692989 CEST	443	49913	20.12.23.50	192.168.2.4
Jun 7, 2024 20:28:42.501789093 CEST	49913	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:28:42.503495932 CEST	49913	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:28:42.503516912 CEST	443	49913	20.12.23.50	192.168.2.4
Jun 7, 2024 20:28:43.312792063 CEST	49923	445	192.168.2.4	201.130.185.1
Jun 7, 2024 20:28:43.317792892 CEST	445	49923	201.130.185.1	192.168.2.4
Jun 7, 2024 20:28:43.317944050 CEST	49923	445	192.168.2.4	201.130.185.1
Jun 7, 2024 20:28:43.317944050 CEST	49923	445	192.168.2.4	201.130.185.1
Jun 7, 2024 20:28:43.322841883 CEST	445	49923	201.130.185.1	192.168.2.4
Jun 7, 2024 20:28:43.397345066 CEST	443	49913	20.12.23.50	192.168.2.4
Jun 7, 2024 20:28:43.397557020 CEST	49913	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:28:43.401019096 CEST	49913	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:28:43.401025057 CEST	443	49913	20.12.23.50	192.168.2.4
Jun 7, 2024 20:28:43.401277065 CEST	443	49913	20.12.23.50	192.168.2.4
Jun 7, 2024 20:28:43.449984074 CEST	49913	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:28:43.881002903 CEST	49933	445	192.168.2.4	3.135.174.160
Jun 7, 2024 20:28:43.886742115 CEST	445	49933	3.135.174.160	192.168.2.4
Jun 7, 2024 20:28:43.887487888 CEST	49933	445	192.168.2.4	3.135.174.160
Jun 7, 2024 20:28:43.889035940 CEST	49933	445	192.168.2.4	3.135.174.160
Jun 7, 2024 20:28:43.889394045 CEST	49934	445	192.168.2.4	3.135.174.1
Jun 7, 2024 20:28:43.895272970 CEST	445	49934	3.135.174.1	192.168.2.4
Jun 7, 2024 20:28:43.895286083 CEST	445	49933	3.135.174.160	192.168.2.4
Jun 7, 2024 20:28:43.895350933 CEST	49933	445	192.168.2.4	3.135.174.160
Jun 7, 2024 20:28:43.895364046 CEST	49934	445	192.168.2.4	3.135.174.1
Jun 7, 2024 20:28:43.896507025 CEST	49934	445	192.168.2.4	3.135.174.1
Jun 7, 2024 20:28:43.896733999 CEST	49935	445	192.168.2.4	3.135.174.1
Jun 7, 2024 20:28:43.901408911 CEST	445	49934	3.135.174.1	192.168.2.4
Jun 7, 2024 20:28:43.901602983 CEST	445	49935	3.135.174.1	192.168.2.4
Jun 7, 2024 20:28:43.901659966 CEST	49934	445	192.168.2.4	3.135.174.1
Jun 7, 2024 20:28:43.901684999 CEST	49935	445	192.168.2.4	3.135.174.1
Jun 7, 2024 20:28:43.912292004 CEST	49935	445	192.168.2.4	3.135.174.1
Jun 7, 2024 20:28:43.918225050 CEST	445	49935	3.135.174.1	192.168.2.4
Jun 7, 2024 20:28:44.109523058 CEST	49913	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:28:44.152523994 CEST	443	49913	20.12.23.50	192.168.2.4
Jun 7, 2024 20:28:44.321082115 CEST	445	49832	99.75.135.1	192.168.2.4
Jun 7, 2024 20:28:44.321160078 CEST	49832	445	192.168.2.4	99.75.135.1
Jun 7, 2024 20:28:44.321197987 CEST	49832	445	192.168.2.4	99.75.135.1
Jun 7, 2024 20:28:44.321268082 CEST	49832	445	192.168.2.4	99.75.135.1
Jun 7, 2024 20:28:44.326216936 CEST	445	49832	99.75.135.1	192.168.2.4
Jun 7, 2024 20:28:44.326246023 CEST	445	49832	99.75.135.1	192.168.2.4
Jun 7, 2024 20:28:44.403455973 CEST	443	49913	20.12.23.50	192.168.2.4
Jun 7, 2024 20:28:44.403479099 CEST	443	49913	20.12.23.50	192.168.2.4
Jun 7, 2024 20:28:44.403486013 CEST	443	49913	20.12.23.50	192.168.2.4
Jun 7, 2024 20:28:44.403496981 CEST	443	49913	20.12.23.50	192.168.2.4
Jun 7, 2024 20:28:44.403502941 CEST	443	49913	20.12.23.50	192.168.2.4
Jun 7, 2024 20:28:44.403508902 CEST	443	49913	20.12.23.50	192.168.2.4
Jun 7, 2024 20:28:44.403546095 CEST	49913	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:28:44.403565884 CEST	443	49913	20.12.23.50	192.168.2.4
Jun 7, 2024 20:28:44.403589964 CEST	49913	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:28:44.403610945 CEST	49913	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:28:44.404148102 CEST	443	49913	20.12.23.50	192.168.2.4
Jun 7, 2024 20:28:44.404212952 CEST	49913	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:28:44.404218912 CEST	443	49913	20.12.23.50	192.168.2.4
Jun 7, 2024 20:28:44.404639959 CEST	443	49913	20.12.23.50	192.168.2.4
Jun 7, 2024 20:28:44.404752970 CEST	49913	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:28:45.058784962 CEST	49913	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:28:45.058804035 CEST	443	49913	20.12.23.50	192.168.2.4
Jun 7, 2024 20:28:45.310081959 CEST	49950	445	192.168.2.4	161.80.213.1
Jun 7, 2024 20:28:45.491971970 CEST	445	49950	161.80.213.1	192.168.2.4
Jun 7, 2024 20:28:45.492055893 CEST	49950	445	192.168.2.4	161.80.213.1
Jun 7, 2024 20:28:45.492152929 CEST	49950	445	192.168.2.4	161.80.213.1
Jun 7, 2024 20:28:45.497081041 CEST	445	49950	161.80.213.1	192.168.2.4
Jun 7, 2024 20:28:45.887865067 CEST	49959	445	192.168.2.4	124.233.139.220
Jun 7, 2024 20:28:45.892787933 CEST	445	49959	124.233.139.220	192.168.2.4
Jun 7, 2024 20:28:45.892936945 CEST	49959	445	192.168.2.4	124.233.139.220
Jun 7, 2024 20:28:45.892936945 CEST	49959	445	192.168.2.4	124.233.139.220
Jun 7, 2024 20:28:45.893054008 CEST	49961	445	192.168.2.4	124.233.139.1
Jun 7, 2024 20:28:45.898099899 CEST	445	49961	124.233.139.1	192.168.2.4
Jun 7, 2024 20:28:45.898211956 CEST	49961	445	192.168.2.4	124.233.139.1
Jun 7, 2024 20:28:45.898252010 CEST	49961	445	192.168.2.4	124.233.139.1
Jun 7, 2024 20:28:45.898475885 CEST	49962	445	192.168.2.4	124.233.139.1
Jun 7, 2024 20:28:45.898555040 CEST	445	49959	124.233.139.220	192.168.2.4
Jun 7, 2024 20:28:45.898675919 CEST	49959	445	192.168.2.4	124.233.139.220
Jun 7, 2024 20:28:45.903511047 CEST	445	49961	124.233.139.1	192.168.2.4
Jun 7, 2024 20:28:45.903616905 CEST	445	49962	124.233.139.1	192.168.2.4
Jun 7, 2024 20:28:45.903683901 CEST	49961	445	192.168.2.4	124.233.139.1
Jun 7, 2024 20:28:45.903721094 CEST	49962	445	192.168.2.4	124.233.139.1
Jun 7, 2024 20:28:45.903759003 CEST	49962	445	192.168.2.4	124.233.139.1
Jun 7, 2024 20:28:45.908770084 CEST	445	49962	124.233.139.1	192.168.2.4
Jun 7, 2024 20:28:46.958391905 CEST	445	49864	15.84.171.1	192.168.2.4
Jun 7, 2024 20:28:46.958442926 CEST	49864	445	192.168.2.4	15.84.171.1
Jun 7, 2024 20:28:46.958501101 CEST	49864	445	192.168.2.4	15.84.171.1
Jun 7, 2024 20:28:46.958571911 CEST	49864	445	192.168.2.4	15.84.171.1
Jun 7, 2024 20:28:46.963376999 CEST	445	49864	15.84.171.1	192.168.2.4
Jun 7, 2024 20:28:46.963390112 CEST	445	49864	15.84.171.1	192.168.2.4
Jun 7, 2024 20:28:47.325247049 CEST	49977	445	192.168.2.4	99.75.135.1
Jun 7, 2024 20:28:47.330368042 CEST	445	49977	99.75.135.1	192.168.2.4
Jun 7, 2024 20:28:47.330451012 CEST	49977	445	192.168.2.4	99.75.135.1
Jun 7, 2024 20:28:47.330493927 CEST	49977	445	192.168.2.4	99.75.135.1
Jun 7, 2024 20:28:47.335448027 CEST	445	49977	99.75.135.1	192.168.2.4
Jun 7, 2024 20:28:47.799225092 CEST	445	49873	136.232.217.1	192.168.2.4
Jun 7, 2024 20:28:47.800842047 CEST	49873	445	192.168.2.4	136.232.217.1
Jun 7, 2024 20:28:47.800842047 CEST	49873	445	192.168.2.4	136.232.217.1
Jun 7, 2024 20:28:47.800915003 CEST	49873	445	192.168.2.4	136.232.217.1
Jun 7, 2024 20:28:47.807607889 CEST	445	49873	136.232.217.1	192.168.2.4
Jun 7, 2024 20:28:47.807681084 CEST	445	49873	136.232.217.1	192.168.2.4
Jun 7, 2024 20:28:47.858753920 CEST	49985	445	192.168.2.4	136.232.217.2
Jun 7, 2024 20:28:47.863785982 CEST	445	49985	136.232.217.2	192.168.2.4
Jun 7, 2024 20:28:47.863899946 CEST	49985	445	192.168.2.4	136.232.217.2
Jun 7, 2024 20:28:47.864012003 CEST	49985	445	192.168.2.4	136.232.217.2
Jun 7, 2024 20:28:47.865607977 CEST	49986	445	192.168.2.4	136.232.217.2
Jun 7, 2024 20:28:47.869230032 CEST	445	49985	136.232.217.2	192.168.2.4
Jun 7, 2024 20:28:47.869301081 CEST	49985	445	192.168.2.4	136.232.217.2
Jun 7, 2024 20:28:47.870501995 CEST	445	49986	136.232.217.2	192.168.2.4
Jun 7, 2024 20:28:47.870750904 CEST	49986	445	192.168.2.4	136.232.217.2
Jun 7, 2024 20:28:47.870815992 CEST	49986	445	192.168.2.4	136.232.217.2
Jun 7, 2024 20:28:47.875682116 CEST	445	49986	136.232.217.2	192.168.2.4
Jun 7, 2024 20:28:47.903422117 CEST	49988	445	192.168.2.4	60.66.137.219
Jun 7, 2024 20:28:47.909188986 CEST	445	49988	60.66.137.219	192.168.2.4
Jun 7, 2024 20:28:47.909950018 CEST	49988	445	192.168.2.4	60.66.137.219
Jun 7, 2024 20:28:47.910046101 CEST	49988	445	192.168.2.4	60.66.137.219
Jun 7, 2024 20:28:47.910243988 CEST	49989	445	192.168.2.4	60.66.137.1
Jun 7, 2024 20:28:47.915282011 CEST	445	49989	60.66.137.1	192.168.2.4
Jun 7, 2024 20:28:47.915421009 CEST	49989	445	192.168.2.4	60.66.137.1
Jun 7, 2024 20:28:47.915430069 CEST	445	49988	60.66.137.219	192.168.2.4
Jun 7, 2024 20:28:47.915463924 CEST	49989	445	192.168.2.4	60.66.137.1
Jun 7, 2024 20:28:47.915699959 CEST	49990	445	192.168.2.4	60.66.137.1
Jun 7, 2024 20:28:47.915703058 CEST	49988	445	192.168.2.4	60.66.137.219
Jun 7, 2024 20:28:47.921389103 CEST	445	49990	60.66.137.1	192.168.2.4
Jun 7, 2024 20:28:47.921468019 CEST	445	49989	60.66.137.1	192.168.2.4
Jun 7, 2024 20:28:47.921555042 CEST	49989	445	192.168.2.4	60.66.137.1
Jun 7, 2024 20:28:47.921555042 CEST	49990	445	192.168.2.4	60.66.137.1
Jun 7, 2024 20:28:47.921623945 CEST	49990	445	192.168.2.4	60.66.137.1
Jun 7, 2024 20:28:47.927237988 CEST	445	49990	60.66.137.1	192.168.2.4
Jun 7, 2024 20:28:48.350341082 CEST	445	49881	8.191.246.1	192.168.2.4
Jun 7, 2024 20:28:48.350445032 CEST	49881	445	192.168.2.4	8.191.246.1
Jun 7, 2024 20:28:48.350445032 CEST	49881	445	192.168.2.4	8.191.246.1
Jun 7, 2024 20:28:48.350568056 CEST	49881	445	192.168.2.4	8.191.246.1
Jun 7, 2024 20:28:48.355477095 CEST	445	49881	8.191.246.1	192.168.2.4
Jun 7, 2024 20:28:48.355489016 CEST	445	49881	8.191.246.1	192.168.2.4
Jun 7, 2024 20:28:49.919490099 CEST	50012	445	192.168.2.4	146.93.6.114
Jun 7, 2024 20:28:49.924496889 CEST	445	50012	146.93.6.114	192.168.2.4
Jun 7, 2024 20:28:49.924943924 CEST	50012	445	192.168.2.4	146.93.6.114
Jun 7, 2024 20:28:49.925103903 CEST	50012	445	192.168.2.4	146.93.6.114
Jun 7, 2024 20:28:49.925301075 CEST	50013	445	192.168.2.4	146.93.6.1
Jun 7, 2024 20:28:49.930162907 CEST	445	50012	146.93.6.114	192.168.2.4
Jun 7, 2024 20:28:49.930243969 CEST	445	50013	146.93.6.1	192.168.2.4
Jun 7, 2024 20:28:49.930299997 CEST	50012	445	192.168.2.4	146.93.6.114
Jun 7, 2024 20:28:49.930329084 CEST	50013	445	192.168.2.4	146.93.6.1
Jun 7, 2024 20:28:49.930417061 CEST	50013	445	192.168.2.4	146.93.6.1
Jun 7, 2024 20:28:49.930664062 CEST	50014	445	192.168.2.4	146.93.6.1
Jun 7, 2024 20:28:49.935516119 CEST	445	50014	146.93.6.1	192.168.2.4
Jun 7, 2024 20:28:49.935595989 CEST	50014	445	192.168.2.4	146.93.6.1
Jun 7, 2024 20:28:49.935614109 CEST	50014	445	192.168.2.4	146.93.6.1
Jun 7, 2024 20:28:49.935758114 CEST	445	50013	146.93.6.1	192.168.2.4
Jun 7, 2024 20:28:49.935813904 CEST	50013	445	192.168.2.4	146.93.6.1
Jun 7, 2024 20:28:49.940666914 CEST	445	50014	146.93.6.1	192.168.2.4
Jun 7, 2024 20:28:49.966001034 CEST	50016	445	192.168.2.4	15.84.171.1
Jun 7, 2024 20:28:49.970802069 CEST	445	49899	102.224.158.1	192.168.2.4
Jun 7, 2024 20:28:49.970861912 CEST	49899	445	192.168.2.4	102.224.158.1
Jun 7, 2024 20:28:49.970931053 CEST	49899	445	192.168.2.4	102.224.158.1
Jun 7, 2024 20:28:49.970987082 CEST	49899	445	192.168.2.4	102.224.158.1
Jun 7, 2024 20:28:49.971002102 CEST	445	50016	15.84.171.1	192.168.2.4
Jun 7, 2024 20:28:49.971549034 CEST	50016	445	192.168.2.4	15.84.171.1
Jun 7, 2024 20:28:49.971582890 CEST	50016	445	192.168.2.4	15.84.171.1
Jun 7, 2024 20:28:49.975778103 CEST	445	49899	102.224.158.1	192.168.2.4
Jun 7, 2024 20:28:49.975830078 CEST	445	49899	102.224.158.1	192.168.2.4
Jun 7, 2024 20:28:49.976550102 CEST	445	50016	15.84.171.1	192.168.2.4
Jun 7, 2024 20:28:50.028429985 CEST	50018	445	192.168.2.4	102.224.158.2
Jun 7, 2024 20:28:50.033440113 CEST	445	50018	102.224.158.2	192.168.2.4
Jun 7, 2024 20:28:50.033504009 CEST	50018	445	192.168.2.4	102.224.158.2
Jun 7, 2024 20:28:50.033541918 CEST	50018	445	192.168.2.4	102.224.158.2
Jun 7, 2024 20:28:50.034193039 CEST	50019	445	192.168.2.4	102.224.158.2
Jun 7, 2024 20:28:50.039144039 CEST	445	50018	102.224.158.2	192.168.2.4
Jun 7, 2024 20:28:50.039203882 CEST	50018	445	192.168.2.4	102.224.158.2
Jun 7, 2024 20:28:50.039211988 CEST	445	50019	102.224.158.2	192.168.2.4
Jun 7, 2024 20:28:50.039302111 CEST	50019	445	192.168.2.4	102.224.158.2
Jun 7, 2024 20:28:50.039401054 CEST	50019	445	192.168.2.4	102.224.158.2
Jun 7, 2024 20:28:50.044302940 CEST	445	50019	102.224.158.2	192.168.2.4
Jun 7, 2024 20:28:50.360188007 CEST	445	49907	53.251.193.1	192.168.2.4
Jun 7, 2024 20:28:50.360281944 CEST	49907	445	192.168.2.4	53.251.193.1
Jun 7, 2024 20:28:50.360321999 CEST	49907	445	192.168.2.4	53.251.193.1
Jun 7, 2024 20:28:50.360430956 CEST	49907	445	192.168.2.4	53.251.193.1
Jun 7, 2024 20:28:50.365319967 CEST	445	49907	53.251.193.1	192.168.2.4
Jun 7, 2024 20:28:50.365369081 CEST	445	49907	53.251.193.1	192.168.2.4
Jun 7, 2024 20:28:51.356477976 CEST	50033	445	192.168.2.4	8.191.246.1
Jun 7, 2024 20:28:51.364732981 CEST	445	50033	8.191.246.1	192.168.2.4
Jun 7, 2024 20:28:51.366729975 CEST	50033	445	192.168.2.4	8.191.246.1
Jun 7, 2024 20:28:51.366792917 CEST	50033	445	192.168.2.4	8.191.246.1
Jun 7, 2024 20:28:51.374912024 CEST	445	50033	8.191.246.1	192.168.2.4
Jun 7, 2024 20:28:51.813710928 CEST	445	49923	201.130.185.1	192.168.2.4
Jun 7, 2024 20:28:51.813849926 CEST	49923	445	192.168.2.4	201.130.185.1
Jun 7, 2024 20:28:51.813944101 CEST	49923	445	192.168.2.4	201.130.185.1
Jun 7, 2024 20:28:51.813945055 CEST	49923	445	192.168.2.4	201.130.185.1
Jun 7, 2024 20:28:51.822664976 CEST	445	49923	201.130.185.1	192.168.2.4
Jun 7, 2024 20:28:51.822801113 CEST	445	49923	201.130.185.1	192.168.2.4
Jun 7, 2024 20:28:51.873208046 CEST	50037	445	192.168.2.4	201.130.185.2
Jun 7, 2024 20:28:51.882121086 CEST	445	50037	201.130.185.2	192.168.2.4
Jun 7, 2024 20:28:51.882244110 CEST	50037	445	192.168.2.4	201.130.185.2
Jun 7, 2024 20:28:51.882283926 CEST	50037	445	192.168.2.4	201.130.185.2
Jun 7, 2024 20:28:51.882714987 CEST	50039	445	192.168.2.4	201.130.185.2
Jun 7, 2024 20:28:51.890660048 CEST	445	50037	201.130.185.2	192.168.2.4
Jun 7, 2024 20:28:51.890671015 CEST	445	50039	201.130.185.2	192.168.2.4
Jun 7, 2024 20:28:51.890728951 CEST	50037	445	192.168.2.4	201.130.185.2
Jun 7, 2024 20:28:51.890758991 CEST	50039	445	192.168.2.4	201.130.185.2
Jun 7, 2024 20:28:51.890834093 CEST	50039	445	192.168.2.4	201.130.185.2
Jun 7, 2024 20:28:51.899863958 CEST	445	50039	201.130.185.2	192.168.2.4
Jun 7, 2024 20:28:51.935647011 CEST	50041	445	192.168.2.4	50.241.97.73
Jun 7, 2024 20:28:51.940857887 CEST	445	50041	50.241.97.73	192.168.2.4
Jun 7, 2024 20:28:51.941032887 CEST	50041	445	192.168.2.4	50.241.97.73
Jun 7, 2024 20:28:51.941032887 CEST	50041	445	192.168.2.4	50.241.97.73
Jun 7, 2024 20:28:51.941154957 CEST	50042	445	192.168.2.4	50.241.97.1
Jun 7, 2024 20:28:51.946047068 CEST	445	50042	50.241.97.1	192.168.2.4
Jun 7, 2024 20:28:51.946110010 CEST	50042	445	192.168.2.4	50.241.97.1
Jun 7, 2024 20:28:51.946322918 CEST	50042	445	192.168.2.4	50.241.97.1
Jun 7, 2024 20:28:51.946408987 CEST	445	50041	50.241.97.73	192.168.2.4
Jun 7, 2024 20:28:51.946455002 CEST	50043	445	192.168.2.4	50.241.97.1
Jun 7, 2024 20:28:51.946480989 CEST	50041	445	192.168.2.4	50.241.97.73
Jun 7, 2024 20:28:51.956321001 CEST	445	50042	50.241.97.1	192.168.2.4
Jun 7, 2024 20:28:51.956345081 CEST	445	50043	50.241.97.1	192.168.2.4
Jun 7, 2024 20:28:51.956429005 CEST	50043	445	192.168.2.4	50.241.97.1
Jun 7, 2024 20:28:51.956464052 CEST	50043	445	192.168.2.4	50.241.97.1
Jun 7, 2024 20:28:51.956485033 CEST	50042	445	192.168.2.4	50.241.97.1
Jun 7, 2024 20:28:51.965482950 CEST	445	50043	50.241.97.1	192.168.2.4
Jun 7, 2024 20:28:52.390626907 CEST	445	49935	3.135.174.1	192.168.2.4
Jun 7, 2024 20:28:52.390714884 CEST	49935	445	192.168.2.4	3.135.174.1
Jun 7, 2024 20:28:52.390788078 CEST	49935	445	192.168.2.4	3.135.174.1
Jun 7, 2024 20:28:52.390836954 CEST	49935	445	192.168.2.4	3.135.174.1
Jun 7, 2024 20:28:52.395637989 CEST	445	49935	3.135.174.1	192.168.2.4
Jun 7, 2024 20:28:52.395678043 CEST	445	49935	3.135.174.1	192.168.2.4
Jun 7, 2024 20:28:53.372108936 CEST	50047	445	192.168.2.4	53.251.193.1
Jun 7, 2024 20:28:53.377165079 CEST	445	50047	53.251.193.1	192.168.2.4
Jun 7, 2024 20:28:53.377293110 CEST	50047	445	192.168.2.4	53.251.193.1
Jun 7, 2024 20:28:53.377370119 CEST	50047	445	192.168.2.4	53.251.193.1
Jun 7, 2024 20:28:53.382244110 CEST	445	50047	53.251.193.1	192.168.2.4
Jun 7, 2024 20:28:53.950741053 CEST	50048	445	192.168.2.4	184.153.104.69
Jun 7, 2024 20:28:53.955904007 CEST	445	50048	184.153.104.69	192.168.2.4
Jun 7, 2024 20:28:53.955993891 CEST	50048	445	192.168.2.4	184.153.104.69
Jun 7, 2024 20:28:53.956033945 CEST	50048	445	192.168.2.4	184.153.104.69
Jun 7, 2024 20:28:53.956223965 CEST	50049	445	192.168.2.4	184.153.104.1
Jun 7, 2024 20:28:53.961184978 CEST	445	50049	184.153.104.1	192.168.2.4
Jun 7, 2024 20:28:53.961263895 CEST	50049	445	192.168.2.4	184.153.104.1
Jun 7, 2024 20:28:53.961345911 CEST	50049	445	192.168.2.4	184.153.104.1
Jun 7, 2024 20:28:53.961438894 CEST	445	50048	184.153.104.69	192.168.2.4
Jun 7, 2024 20:28:53.961498976 CEST	50048	445	192.168.2.4	184.153.104.69
Jun 7, 2024 20:28:53.961680889 CEST	50050	445	192.168.2.4	184.153.104.1
Jun 7, 2024 20:28:53.966392994 CEST	445	50049	184.153.104.1	192.168.2.4
Jun 7, 2024 20:28:53.966440916 CEST	50049	445	192.168.2.4	184.153.104.1
Jun 7, 2024 20:28:53.966573954 CEST	445	50050	184.153.104.1	192.168.2.4
Jun 7, 2024 20:28:53.966634989 CEST	50050	445	192.168.2.4	184.153.104.1
Jun 7, 2024 20:28:53.966686964 CEST	50050	445	192.168.2.4	184.153.104.1
Jun 7, 2024 20:28:53.971546888 CEST	445	50050	184.153.104.1	192.168.2.4
Jun 7, 2024 20:28:53.983680010 CEST	445	49950	161.80.213.1	192.168.2.4
Jun 7, 2024 20:28:53.983737946 CEST	49950	445	192.168.2.4	161.80.213.1
Jun 7, 2024 20:28:53.983803988 CEST	49950	445	192.168.2.4	161.80.213.1
Jun 7, 2024 20:28:53.983882904 CEST	49950	445	192.168.2.4	161.80.213.1
Jun 7, 2024 20:28:53.988647938 CEST	445	49950	161.80.213.1	192.168.2.4
Jun 7, 2024 20:28:53.988795042 CEST	445	49950	161.80.213.1	192.168.2.4
Jun 7, 2024 20:28:54.044080973 CEST	50051	445	192.168.2.4	161.80.213.2
Jun 7, 2024 20:28:54.049148083 CEST	445	50051	161.80.213.2	192.168.2.4
Jun 7, 2024 20:28:54.049232960 CEST	50051	445	192.168.2.4	161.80.213.2
Jun 7, 2024 20:28:54.049264908 CEST	50051	445	192.168.2.4	161.80.213.2
Jun 7, 2024 20:28:54.049640894 CEST	50052	445	192.168.2.4	161.80.213.2
Jun 7, 2024 20:28:54.054583073 CEST	445	50052	161.80.213.2	192.168.2.4
Jun 7, 2024 20:28:54.054656029 CEST	50052	445	192.168.2.4	161.80.213.2
Jun 7, 2024 20:28:54.054722071 CEST	50052	445	192.168.2.4	161.80.213.2
Jun 7, 2024 20:28:54.055525064 CEST	445	50051	161.80.213.2	192.168.2.4
Jun 7, 2024 20:28:54.055584908 CEST	50051	445	192.168.2.4	161.80.213.2
Jun 7, 2024 20:28:54.059658051 CEST	445	50052	161.80.213.2	192.168.2.4
Jun 7, 2024 20:28:54.391079903 CEST	445	49962	124.233.139.1	192.168.2.4
Jun 7, 2024 20:28:54.391146898 CEST	49962	445	192.168.2.4	124.233.139.1
Jun 7, 2024 20:28:54.391236067 CEST	49962	445	192.168.2.4	124.233.139.1
Jun 7, 2024 20:28:54.391278982 CEST	49962	445	192.168.2.4	124.233.139.1
Jun 7, 2024 20:28:54.396137953 CEST	445	49962	124.233.139.1	192.168.2.4
Jun 7, 2024 20:28:54.396152973 CEST	445	49962	124.233.139.1	192.168.2.4
Jun 7, 2024 20:28:55.403386116 CEST	50053	445	192.168.2.4	3.135.174.1
Jun 7, 2024 20:28:55.408432007 CEST	445	50053	3.135.174.1	192.168.2.4
Jun 7, 2024 20:28:55.409384012 CEST	50053	445	192.168.2.4	3.135.174.1
Jun 7, 2024 20:28:55.409430027 CEST	50053	445	192.168.2.4	3.135.174.1
Jun 7, 2024 20:28:55.414303064 CEST	445	50053	3.135.174.1	192.168.2.4
Jun 7, 2024 20:28:55.824899912 CEST	445	49977	99.75.135.1	192.168.2.4
Jun 7, 2024 20:28:55.824966908 CEST	49977	445	192.168.2.4	99.75.135.1
Jun 7, 2024 20:28:55.825110912 CEST	49977	445	192.168.2.4	99.75.135.1
Jun 7, 2024 20:28:55.825278044 CEST	49977	445	192.168.2.4	99.75.135.1
Jun 7, 2024 20:28:55.829948902 CEST	445	49977	99.75.135.1	192.168.2.4
Jun 7, 2024 20:28:55.830115080 CEST	445	49977	99.75.135.1	192.168.2.4
Jun 7, 2024 20:28:55.888091087 CEST	50054	445	192.168.2.4	99.75.135.2
Jun 7, 2024 20:28:55.893054008 CEST	445	50054	99.75.135.2	192.168.2.4
Jun 7, 2024 20:28:55.893141031 CEST	50054	445	192.168.2.4	99.75.135.2
Jun 7, 2024 20:28:55.893300056 CEST	50054	445	192.168.2.4	99.75.135.2
Jun 7, 2024 20:28:55.893667936 CEST	50055	445	192.168.2.4	99.75.135.2
Jun 7, 2024 20:28:55.898327112 CEST	445	50054	99.75.135.2	192.168.2.4
Jun 7, 2024 20:28:55.898381948 CEST	50054	445	192.168.2.4	99.75.135.2
Jun 7, 2024 20:28:55.898550987 CEST	445	50055	99.75.135.2	192.168.2.4
Jun 7, 2024 20:28:55.898605108 CEST	50055	445	192.168.2.4	99.75.135.2
Jun 7, 2024 20:28:55.898674965 CEST	50055	445	192.168.2.4	99.75.135.2
Jun 7, 2024 20:28:55.903470993 CEST	445	50055	99.75.135.2	192.168.2.4
Jun 7, 2024 20:28:55.986185074 CEST	50056	445	192.168.2.4	155.86.233.124
Jun 7, 2024 20:28:55.991172075 CEST	445	50056	155.86.233.124	192.168.2.4
Jun 7, 2024 20:28:55.991249084 CEST	50056	445	192.168.2.4	155.86.233.124
Jun 7, 2024 20:28:55.991369009 CEST	50056	445	192.168.2.4	155.86.233.124
Jun 7, 2024 20:28:55.991576910 CEST	50057	445	192.168.2.4	155.86.233.1
Jun 7, 2024 20:28:55.996412992 CEST	445	50056	155.86.233.124	192.168.2.4
Jun 7, 2024 20:28:55.996470928 CEST	50056	445	192.168.2.4	155.86.233.124
Jun 7, 2024 20:28:55.996565104 CEST	445	50057	155.86.233.1	192.168.2.4
Jun 7, 2024 20:28:55.996629953 CEST	50057	445	192.168.2.4	155.86.233.1
Jun 7, 2024 20:28:55.996685028 CEST	50057	445	192.168.2.4	155.86.233.1
Jun 7, 2024 20:28:56.001846075 CEST	445	50057	155.86.233.1	192.168.2.4
Jun 7, 2024 20:28:56.001909018 CEST	50057	445	192.168.2.4	155.86.233.1
Jun 7, 2024 20:28:56.007359028 CEST	50058	445	192.168.2.4	155.86.233.1
Jun 7, 2024 20:28:56.012259960 CEST	445	50058	155.86.233.1	192.168.2.4
Jun 7, 2024 20:28:56.012325048 CEST	50058	445	192.168.2.4	155.86.233.1
Jun 7, 2024 20:28:56.012358904 CEST	50058	445	192.168.2.4	155.86.233.1
Jun 7, 2024 20:28:56.017194986 CEST	445	50058	155.86.233.1	192.168.2.4
Jun 7, 2024 20:28:56.362653971 CEST	445	49986	136.232.217.2	192.168.2.4
Jun 7, 2024 20:28:56.362916946 CEST	49986	445	192.168.2.4	136.232.217.2
Jun 7, 2024 20:28:56.362916946 CEST	49986	445	192.168.2.4	136.232.217.2
Jun 7, 2024 20:28:56.362916946 CEST	49986	445	192.168.2.4	136.232.217.2
Jun 7, 2024 20:28:56.368347883 CEST	445	49986	136.232.217.2	192.168.2.4
Jun 7, 2024 20:28:56.368392944 CEST	445	49986	136.232.217.2	192.168.2.4
Jun 7, 2024 20:28:56.414602041 CEST	445	49990	60.66.137.1	192.168.2.4
Jun 7, 2024 20:28:56.414859056 CEST	49990	445	192.168.2.4	60.66.137.1
Jun 7, 2024 20:28:56.414859056 CEST	49990	445	192.168.2.4	60.66.137.1
Jun 7, 2024 20:28:56.414859056 CEST	49990	445	192.168.2.4	60.66.137.1
Jun 7, 2024 20:28:56.419852972 CEST	445	49990	60.66.137.1	192.168.2.4
Jun 7, 2024 20:28:56.419867039 CEST	445	49990	60.66.137.1	192.168.2.4
Jun 7, 2024 20:28:57.403330088 CEST	50059	445	192.168.2.4	124.233.139.1
Jun 7, 2024 20:28:57.408314943 CEST	445	50059	124.233.139.1	192.168.2.4
Jun 7, 2024 20:28:57.410742998 CEST	50059	445	192.168.2.4	124.233.139.1
Jun 7, 2024 20:28:57.410775900 CEST	50059	445	192.168.2.4	124.233.139.1
Jun 7, 2024 20:28:57.415736914 CEST	445	50059	124.233.139.1	192.168.2.4
Jun 7, 2024 20:28:57.997267008 CEST	50060	445	192.168.2.4	19.152.241.250
Jun 7, 2024 20:28:58.002393961 CEST	445	50060	19.152.241.250	192.168.2.4
Jun 7, 2024 20:28:58.002501965 CEST	50060	445	192.168.2.4	19.152.241.250
Jun 7, 2024 20:28:58.002501965 CEST	50060	445	192.168.2.4	19.152.241.250
Jun 7, 2024 20:28:58.002851009 CEST	50061	445	192.168.2.4	19.152.241.1
Jun 7, 2024 20:28:58.007884026 CEST	445	50061	19.152.241.1	192.168.2.4
Jun 7, 2024 20:28:58.007982016 CEST	445	50060	19.152.241.250	192.168.2.4
Jun 7, 2024 20:28:58.007988930 CEST	50061	445	192.168.2.4	19.152.241.1
Jun 7, 2024 20:28:58.007988930 CEST	50061	445	192.168.2.4	19.152.241.1
Jun 7, 2024 20:28:58.008148909 CEST	50060	445	192.168.2.4	19.152.241.250
Jun 7, 2024 20:28:58.008323908 CEST	50062	445	192.168.2.4	19.152.241.1
Jun 7, 2024 20:28:58.014080048 CEST	445	50061	19.152.241.1	192.168.2.4
Jun 7, 2024 20:28:58.014157057 CEST	50061	445	192.168.2.4	19.152.241.1
Jun 7, 2024 20:28:58.014636040 CEST	445	50062	19.152.241.1	192.168.2.4
Jun 7, 2024 20:28:58.014746904 CEST	50062	445	192.168.2.4	19.152.241.1
Jun 7, 2024 20:28:58.014766932 CEST	50062	445	192.168.2.4	19.152.241.1
Jun 7, 2024 20:28:58.020751953 CEST	445	50062	19.152.241.1	192.168.2.4
Jun 7, 2024 20:28:58.420614004 CEST	445	50014	146.93.6.1	192.168.2.4
Jun 7, 2024 20:28:58.420727015 CEST	50014	445	192.168.2.4	146.93.6.1
Jun 7, 2024 20:28:58.420814037 CEST	50014	445	192.168.2.4	146.93.6.1
Jun 7, 2024 20:28:58.420855045 CEST	50014	445	192.168.2.4	146.93.6.1
Jun 7, 2024 20:28:58.426043034 CEST	445	50014	146.93.6.1	192.168.2.4
Jun 7, 2024 20:28:58.426146984 CEST	445	50014	146.93.6.1	192.168.2.4
Jun 7, 2024 20:28:58.475569963 CEST	445	50016	15.84.171.1	192.168.2.4
Jun 7, 2024 20:28:58.475873947 CEST	50016	445	192.168.2.4	15.84.171.1
Jun 7, 2024 20:28:58.475970030 CEST	50016	445	192.168.2.4	15.84.171.1
Jun 7, 2024 20:28:58.476010084 CEST	50016	445	192.168.2.4	15.84.171.1
Jun 7, 2024 20:28:58.480858088 CEST	445	50016	15.84.171.1	192.168.2.4
Jun 7, 2024 20:28:58.480882883 CEST	445	50016	15.84.171.1	192.168.2.4
Jun 7, 2024 20:28:58.528358936 CEST	50063	445	192.168.2.4	15.84.171.2
Jun 7, 2024 20:28:58.533240080 CEST	445	50063	15.84.171.2	192.168.2.4
Jun 7, 2024 20:28:58.533303976 CEST	50063	445	192.168.2.4	15.84.171.2
Jun 7, 2024 20:28:58.533338070 CEST	50063	445	192.168.2.4	15.84.171.2
Jun 7, 2024 20:28:58.533690929 CEST	50064	445	192.168.2.4	15.84.171.2
Jun 7, 2024 20:28:58.536220074 CEST	445	50019	102.224.158.2	192.168.2.4
Jun 7, 2024 20:28:58.536731958 CEST	50019	445	192.168.2.4	102.224.158.2
Jun 7, 2024 20:28:58.536782980 CEST	50019	445	192.168.2.4	102.224.158.2
Jun 7, 2024 20:28:58.536782980 CEST	50019	445	192.168.2.4	102.224.158.2
Jun 7, 2024 20:28:58.538408995 CEST	445	50063	15.84.171.2	192.168.2.4
Jun 7, 2024 20:28:58.538461924 CEST	50063	445	192.168.2.4	15.84.171.2
Jun 7, 2024 20:28:58.538537025 CEST	445	50064	15.84.171.2	192.168.2.4
Jun 7, 2024 20:28:58.538647890 CEST	50064	445	192.168.2.4	15.84.171.2
Jun 7, 2024 20:28:58.538749933 CEST	50064	445	192.168.2.4	15.84.171.2
Jun 7, 2024 20:28:58.541639090 CEST	445	50019	102.224.158.2	192.168.2.4
Jun 7, 2024 20:28:58.541666031 CEST	445	50019	102.224.158.2	192.168.2.4
Jun 7, 2024 20:28:58.543582916 CEST	445	50064	15.84.171.2	192.168.2.4
Jun 7, 2024 20:28:59.372199059 CEST	50065	445	192.168.2.4	136.232.217.2
Jun 7, 2024 20:28:59.377136946 CEST	445	50065	136.232.217.2	192.168.2.4
Jun 7, 2024 20:28:59.377279997 CEST	50065	445	192.168.2.4	136.232.217.2
Jun 7, 2024 20:28:59.377280951 CEST	50065	445	192.168.2.4	136.232.217.2
Jun 7, 2024 20:28:59.382147074 CEST	445	50065	136.232.217.2	192.168.2.4
Jun 7, 2024 20:28:59.419315100 CEST	50066	445	192.168.2.4	60.66.137.1
Jun 7, 2024 20:28:59.424249887 CEST	445	50066	60.66.137.1	192.168.2.4
Jun 7, 2024 20:28:59.425101995 CEST	50066	445	192.168.2.4	60.66.137.1
Jun 7, 2024 20:28:59.425137997 CEST	50066	445	192.168.2.4	60.66.137.1
Jun 7, 2024 20:28:59.430054903 CEST	445	50066	60.66.137.1	192.168.2.4
Jun 7, 2024 20:28:59.860616922 CEST	445	50033	8.191.246.1	192.168.2.4
Jun 7, 2024 20:28:59.860702038 CEST	50033	445	192.168.2.4	8.191.246.1
Jun 7, 2024 20:28:59.860809088 CEST	50033	445	192.168.2.4	8.191.246.1
Jun 7, 2024 20:28:59.860856056 CEST	50033	445	192.168.2.4	8.191.246.1
Jun 7, 2024 20:28:59.865797043 CEST	445	50033	8.191.246.1	192.168.2.4
Jun 7, 2024 20:28:59.865849972 CEST	445	50033	8.191.246.1	192.168.2.4
Jun 7, 2024 20:28:59.919040918 CEST	50067	445	192.168.2.4	8.191.246.2
Jun 7, 2024 20:29:00.012913942 CEST	50068	445	192.168.2.4	110.10.245.244
Jun 7, 2024 20:29:00.073071957 CEST	445	50067	8.191.246.2	192.168.2.4
Jun 7, 2024 20:29:00.073112965 CEST	445	50068	110.10.245.244	192.168.2.4
Jun 7, 2024 20:29:00.073143959 CEST	50067	445	192.168.2.4	8.191.246.2
Jun 7, 2024 20:29:00.073185921 CEST	50068	445	192.168.2.4	110.10.245.244
Jun 7, 2024 20:29:00.073262930 CEST	50067	445	192.168.2.4	8.191.246.2
Jun 7, 2024 20:29:00.073441029 CEST	50068	445	192.168.2.4	110.10.245.244
Jun 7, 2024 20:29:00.073571920 CEST	50069	445	192.168.2.4	110.10.245.1
Jun 7, 2024 20:29:00.073611021 CEST	50070	445	192.168.2.4	8.191.246.2
Jun 7, 2024 20:29:00.081506968 CEST	445	50069	110.10.245.1	192.168.2.4
Jun 7, 2024 20:29:00.081537962 CEST	445	50070	8.191.246.2	192.168.2.4
Jun 7, 2024 20:29:00.081585884 CEST	50069	445	192.168.2.4	110.10.245.1
Jun 7, 2024 20:29:00.081619978 CEST	50070	445	192.168.2.4	8.191.246.2
Jun 7, 2024 20:29:00.081866980 CEST	50069	445	192.168.2.4	110.10.245.1
Jun 7, 2024 20:29:00.081975937 CEST	50070	445	192.168.2.4	8.191.246.2
Jun 7, 2024 20:29:00.082216024 CEST	445	50067	8.191.246.2	192.168.2.4
Jun 7, 2024 20:29:00.082274914 CEST	50067	445	192.168.2.4	8.191.246.2
Jun 7, 2024 20:29:00.082359076 CEST	50071	445	192.168.2.4	110.10.245.1
Jun 7, 2024 20:29:00.082429886 CEST	445	50068	110.10.245.244	192.168.2.4
Jun 7, 2024 20:29:00.082499981 CEST	50068	445	192.168.2.4	110.10.245.244
Jun 7, 2024 20:29:00.086930037 CEST	445	50070	8.191.246.2	192.168.2.4
Jun 7, 2024 20:29:00.087299109 CEST	445	50071	110.10.245.1	192.168.2.4
Jun 7, 2024 20:29:00.087378025 CEST	50071	445	192.168.2.4	110.10.245.1
Jun 7, 2024 20:29:00.087460041 CEST	50071	445	192.168.2.4	110.10.245.1
Jun 7, 2024 20:29:00.087481976 CEST	445	50069	110.10.245.1	192.168.2.4
Jun 7, 2024 20:29:00.087543964 CEST	50069	445	192.168.2.4	110.10.245.1
Jun 7, 2024 20:29:00.092324972 CEST	445	50071	110.10.245.1	192.168.2.4
Jun 7, 2024 20:29:00.375271082 CEST	445	50039	201.130.185.2	192.168.2.4
Jun 7, 2024 20:29:00.375349998 CEST	50039	445	192.168.2.4	201.130.185.2
Jun 7, 2024 20:29:00.375395060 CEST	50039	445	192.168.2.4	201.130.185.2
Jun 7, 2024 20:29:00.375418901 CEST	50039	445	192.168.2.4	201.130.185.2
Jun 7, 2024 20:29:00.380261898 CEST	445	50039	201.130.185.2	192.168.2.4
Jun 7, 2024 20:29:00.380296946 CEST	445	50039	201.130.185.2	192.168.2.4
Jun 7, 2024 20:29:00.455009937 CEST	445	50043	50.241.97.1	192.168.2.4
Jun 7, 2024 20:29:00.457798004 CEST	50043	445	192.168.2.4	50.241.97.1
Jun 7, 2024 20:29:00.459532022 CEST	50043	445	192.168.2.4	50.241.97.1
Jun 7, 2024 20:29:00.459592104 CEST	50043	445	192.168.2.4	50.241.97.1
Jun 7, 2024 20:29:00.464380980 CEST	445	50043	50.241.97.1	192.168.2.4
Jun 7, 2024 20:29:00.464401960 CEST	445	50043	50.241.97.1	192.168.2.4
Jun 7, 2024 20:29:01.434608936 CEST	50072	445	192.168.2.4	146.93.6.1
Jun 7, 2024 20:29:01.439645052 CEST	445	50072	146.93.6.1	192.168.2.4
Jun 7, 2024 20:29:01.441087961 CEST	50072	445	192.168.2.4	146.93.6.1
Jun 7, 2024 20:29:01.441140890 CEST	50072	445	192.168.2.4	146.93.6.1
Jun 7, 2024 20:29:01.446268082 CEST	445	50072	146.93.6.1	192.168.2.4
Jun 7, 2024 20:29:01.543941021 CEST	50073	445	192.168.2.4	102.224.158.2
Jun 7, 2024 20:29:01.548990965 CEST	445	50073	102.224.158.2	192.168.2.4
Jun 7, 2024 20:29:01.549114943 CEST	50073	445	192.168.2.4	102.224.158.2
Jun 7, 2024 20:29:01.549114943 CEST	50073	445	192.168.2.4	102.224.158.2
Jun 7, 2024 20:29:01.554125071 CEST	445	50073	102.224.158.2	192.168.2.4
Jun 7, 2024 20:29:01.867183924 CEST	445	50047	53.251.193.1	192.168.2.4
Jun 7, 2024 20:29:01.867266893 CEST	50047	445	192.168.2.4	53.251.193.1
Jun 7, 2024 20:29:01.867296934 CEST	50047	445	192.168.2.4	53.251.193.1
Jun 7, 2024 20:29:01.867317915 CEST	50047	445	192.168.2.4	53.251.193.1
Jun 7, 2024 20:29:01.872287035 CEST	445	50047	53.251.193.1	192.168.2.4
Jun 7, 2024 20:29:01.872332096 CEST	445	50047	53.251.193.1	192.168.2.4
Jun 7, 2024 20:29:01.919217110 CEST	50074	445	192.168.2.4	53.251.193.2
Jun 7, 2024 20:29:01.924364090 CEST	445	50074	53.251.193.2	192.168.2.4
Jun 7, 2024 20:29:01.924451113 CEST	50074	445	192.168.2.4	53.251.193.2
Jun 7, 2024 20:29:01.924519062 CEST	50074	445	192.168.2.4	53.251.193.2
Jun 7, 2024 20:29:01.924948931 CEST	50075	445	192.168.2.4	53.251.193.2
Jun 7, 2024 20:29:01.929904938 CEST	445	50075	53.251.193.2	192.168.2.4
Jun 7, 2024 20:29:01.930114985 CEST	50075	445	192.168.2.4	53.251.193.2
Jun 7, 2024 20:29:01.930114985 CEST	50075	445	192.168.2.4	53.251.193.2
Jun 7, 2024 20:29:01.930126905 CEST	445	50074	53.251.193.2	192.168.2.4
Jun 7, 2024 20:29:01.930190086 CEST	50074	445	192.168.2.4	53.251.193.2
Jun 7, 2024 20:29:01.935084105 CEST	445	50075	53.251.193.2	192.168.2.4
Jun 7, 2024 20:29:02.028673887 CEST	50076	445	192.168.2.4	182.85.58.147
Jun 7, 2024 20:29:02.033644915 CEST	445	50076	182.85.58.147	192.168.2.4
Jun 7, 2024 20:29:02.033718109 CEST	50076	445	192.168.2.4	182.85.58.147
Jun 7, 2024 20:29:02.033792019 CEST	50076	445	192.168.2.4	182.85.58.147
Jun 7, 2024 20:29:02.033952951 CEST	50077	445	192.168.2.4	182.85.58.1
Jun 7, 2024 20:29:02.038830042 CEST	445	50077	182.85.58.1	192.168.2.4
Jun 7, 2024 20:29:02.038901091 CEST	50077	445	192.168.2.4	182.85.58.1
Jun 7, 2024 20:29:02.038902998 CEST	445	50076	182.85.58.147	192.168.2.4
Jun 7, 2024 20:29:02.038949013 CEST	50077	445	192.168.2.4	182.85.58.1
Jun 7, 2024 20:29:02.038961887 CEST	50076	445	192.168.2.4	182.85.58.147
Jun 7, 2024 20:29:02.039311886 CEST	50078	445	192.168.2.4	182.85.58.1
Jun 7, 2024 20:29:02.044091940 CEST	445	50077	182.85.58.1	192.168.2.4
Jun 7, 2024 20:29:02.044169903 CEST	445	50078	182.85.58.1	192.168.2.4
Jun 7, 2024 20:29:02.044198036 CEST	50077	445	192.168.2.4	182.85.58.1
Jun 7, 2024 20:29:02.044228077 CEST	50078	445	192.168.2.4	182.85.58.1
Jun 7, 2024 20:29:02.044296026 CEST	50078	445	192.168.2.4	182.85.58.1
Jun 7, 2024 20:29:02.049299955 CEST	445	50078	182.85.58.1	192.168.2.4
Jun 7, 2024 20:29:02.454657078 CEST	445	50050	184.153.104.1	192.168.2.4
Jun 7, 2024 20:29:02.458724976 CEST	50050	445	192.168.2.4	184.153.104.1
Jun 7, 2024 20:29:02.458798885 CEST	50050	445	192.168.2.4	184.153.104.1
Jun 7, 2024 20:29:02.458821058 CEST	50050	445	192.168.2.4	184.153.104.1
Jun 7, 2024 20:29:02.463831902 CEST	445	50050	184.153.104.1	192.168.2.4
Jun 7, 2024 20:29:02.463862896 CEST	445	50050	184.153.104.1	192.168.2.4
Jun 7, 2024 20:29:02.546710968 CEST	445	50052	161.80.213.2	192.168.2.4
Jun 7, 2024 20:29:02.550725937 CEST	50052	445	192.168.2.4	161.80.213.2
Jun 7, 2024 20:29:02.550761938 CEST	50052	445	192.168.2.4	161.80.213.2
Jun 7, 2024 20:29:02.550811052 CEST	50052	445	192.168.2.4	161.80.213.2
Jun 7, 2024 20:29:02.555705070 CEST	445	50052	161.80.213.2	192.168.2.4
Jun 7, 2024 20:29:02.555736065 CEST	445	50052	161.80.213.2	192.168.2.4
Jun 7, 2024 20:29:03.388501883 CEST	50079	445	192.168.2.4	201.130.185.2
Jun 7, 2024 20:29:03.393665075 CEST	445	50079	201.130.185.2	192.168.2.4
Jun 7, 2024 20:29:03.393750906 CEST	50079	445	192.168.2.4	201.130.185.2
Jun 7, 2024 20:29:03.393768072 CEST	50079	445	192.168.2.4	201.130.185.2
Jun 7, 2024 20:29:03.398724079 CEST	445	50079	201.130.185.2	192.168.2.4
Jun 7, 2024 20:29:03.465881109 CEST	50080	445	192.168.2.4	50.241.97.1
Jun 7, 2024 20:29:03.471055984 CEST	445	50080	50.241.97.1	192.168.2.4
Jun 7, 2024 20:29:03.471159935 CEST	50080	445	192.168.2.4	50.241.97.1
Jun 7, 2024 20:29:03.471216917 CEST	50080	445	192.168.2.4	50.241.97.1
Jun 7, 2024 20:29:03.476205111 CEST	445	50080	50.241.97.1	192.168.2.4
Jun 7, 2024 20:29:03.903541088 CEST	50081	445	192.168.2.4	87.45.211.10
Jun 7, 2024 20:29:03.907042980 CEST	445	50053	3.135.174.1	192.168.2.4
Jun 7, 2024 20:29:03.907119036 CEST	50053	445	192.168.2.4	3.135.174.1
Jun 7, 2024 20:29:03.907161951 CEST	50053	445	192.168.2.4	3.135.174.1
Jun 7, 2024 20:29:03.907305002 CEST	50053	445	192.168.2.4	3.135.174.1
Jun 7, 2024 20:29:03.908628941 CEST	445	50081	87.45.211.10	192.168.2.4
Jun 7, 2024 20:29:03.908696890 CEST	50081	445	192.168.2.4	87.45.211.10
Jun 7, 2024 20:29:03.908721924 CEST	50081	445	192.168.2.4	87.45.211.10
Jun 7, 2024 20:29:03.908876896 CEST	50082	445	192.168.2.4	87.45.211.1
Jun 7, 2024 20:29:03.912332058 CEST	445	50053	3.135.174.1	192.168.2.4
Jun 7, 2024 20:29:03.912362099 CEST	445	50053	3.135.174.1	192.168.2.4
Jun 7, 2024 20:29:03.913800001 CEST	445	50082	87.45.211.1	192.168.2.4
Jun 7, 2024 20:29:03.913888931 CEST	50082	445	192.168.2.4	87.45.211.1
Jun 7, 2024 20:29:03.913888931 CEST	50082	445	192.168.2.4	87.45.211.1
Jun 7, 2024 20:29:03.914002895 CEST	445	50081	87.45.211.10	192.168.2.4
Jun 7, 2024 20:29:03.914057016 CEST	50081	445	192.168.2.4	87.45.211.10
Jun 7, 2024 20:29:03.914402008 CEST	50083	445	192.168.2.4	87.45.211.1
Jun 7, 2024 20:29:03.919080019 CEST	445	50082	87.45.211.1	192.168.2.4
Jun 7, 2024 20:29:03.919311047 CEST	445	50083	87.45.211.1	192.168.2.4
Jun 7, 2024 20:29:03.919365883 CEST	50083	445	192.168.2.4	87.45.211.1
Jun 7, 2024 20:29:03.919390917 CEST	50083	445	192.168.2.4	87.45.211.1
Jun 7, 2024 20:29:03.919672012 CEST	50082	445	192.168.2.4	87.45.211.1
Jun 7, 2024 20:29:03.924319983 CEST	445	50083	87.45.211.1	192.168.2.4
Jun 7, 2024 20:29:03.965935946 CEST	50084	445	192.168.2.4	3.135.174.2
Jun 7, 2024 20:29:03.970942974 CEST	445	50084	3.135.174.2	192.168.2.4
Jun 7, 2024 20:29:03.971045017 CEST	50084	445	192.168.2.4	3.135.174.2
Jun 7, 2024 20:29:03.971127987 CEST	50084	445	192.168.2.4	3.135.174.2
Jun 7, 2024 20:29:03.971621037 CEST	50085	445	192.168.2.4	3.135.174.2
Jun 7, 2024 20:29:03.976368904 CEST	445	50084	3.135.174.2	192.168.2.4
Jun 7, 2024 20:29:03.976423979 CEST	50084	445	192.168.2.4	3.135.174.2
Jun 7, 2024 20:29:03.976686001 CEST	445	50085	3.135.174.2	192.168.2.4
Jun 7, 2024 20:29:03.976746082 CEST	50085	445	192.168.2.4	3.135.174.2
Jun 7, 2024 20:29:03.976773977 CEST	50085	445	192.168.2.4	3.135.174.2
Jun 7, 2024 20:29:03.981714010 CEST	445	50085	3.135.174.2	192.168.2.4
Jun 7, 2024 20:29:04.396192074 CEST	445	50055	99.75.135.2	192.168.2.4
Jun 7, 2024 20:29:04.396300077 CEST	50055	445	192.168.2.4	99.75.135.2
Jun 7, 2024 20:29:04.396389961 CEST	50055	445	192.168.2.4	99.75.135.2
Jun 7, 2024 20:29:04.396389961 CEST	50055	445	192.168.2.4	99.75.135.2
Jun 7, 2024 20:29:04.401294947 CEST	445	50055	99.75.135.2	192.168.2.4
Jun 7, 2024 20:29:04.401428938 CEST	445	50055	99.75.135.2	192.168.2.4
Jun 7, 2024 20:29:04.494853973 CEST	445	50058	155.86.233.1	192.168.2.4
Jun 7, 2024 20:29:04.494926929 CEST	50058	445	192.168.2.4	155.86.233.1
Jun 7, 2024 20:29:04.494966984 CEST	50058	445	192.168.2.4	155.86.233.1
Jun 7, 2024 20:29:04.495018005 CEST	50058	445	192.168.2.4	155.86.233.1
Jun 7, 2024 20:29:04.500101089 CEST	445	50058	155.86.233.1	192.168.2.4
Jun 7, 2024 20:29:04.500133038 CEST	445	50058	155.86.233.1	192.168.2.4
Jun 7, 2024 20:29:05.465857983 CEST	50086	445	192.168.2.4	184.153.104.1
Jun 7, 2024 20:29:05.471059084 CEST	445	50086	184.153.104.1	192.168.2.4
Jun 7, 2024 20:29:05.471159935 CEST	50086	445	192.168.2.4	184.153.104.1
Jun 7, 2024 20:29:05.471236944 CEST	50086	445	192.168.2.4	184.153.104.1
Jun 7, 2024 20:29:05.476174116 CEST	445	50086	184.153.104.1	192.168.2.4
Jun 7, 2024 20:29:05.559581041 CEST	50087	445	192.168.2.4	161.80.213.2
Jun 7, 2024 20:29:05.564534903 CEST	445	50087	161.80.213.2	192.168.2.4
Jun 7, 2024 20:29:05.564630032 CEST	50087	445	192.168.2.4	161.80.213.2
Jun 7, 2024 20:29:05.564694881 CEST	50087	445	192.168.2.4	161.80.213.2
Jun 7, 2024 20:29:05.569634914 CEST	445	50087	161.80.213.2	192.168.2.4
Jun 7, 2024 20:29:05.653678894 CEST	50088	445	192.168.2.4	5.26.5.138
Jun 7, 2024 20:29:05.658641100 CEST	445	50088	5.26.5.138	192.168.2.4
Jun 7, 2024 20:29:05.658730030 CEST	50088	445	192.168.2.4	5.26.5.138
Jun 7, 2024 20:29:05.658792019 CEST	50088	445	192.168.2.4	5.26.5.138
Jun 7, 2024 20:29:05.658963919 CEST	50089	445	192.168.2.4	5.26.5.1
Jun 7, 2024 20:29:05.663938999 CEST	445	50089	5.26.5.1	192.168.2.4
Jun 7, 2024 20:29:05.664051056 CEST	50089	445	192.168.2.4	5.26.5.1
Jun 7, 2024 20:29:05.664093018 CEST	50089	445	192.168.2.4	5.26.5.1
Jun 7, 2024 20:29:05.664156914 CEST	445	50088	5.26.5.138	192.168.2.4
Jun 7, 2024 20:29:05.664212942 CEST	50088	445	192.168.2.4	5.26.5.138
Jun 7, 2024 20:29:05.664500952 CEST	50090	445	192.168.2.4	5.26.5.1
Jun 7, 2024 20:29:05.669290066 CEST	445	50089	5.26.5.1	192.168.2.4
Jun 7, 2024 20:29:05.669352055 CEST	50089	445	192.168.2.4	5.26.5.1
Jun 7, 2024 20:29:05.669388056 CEST	445	50090	5.26.5.1	192.168.2.4
Jun 7, 2024 20:29:05.669450998 CEST	50090	445	192.168.2.4	5.26.5.1
Jun 7, 2024 20:29:05.669507027 CEST	50090	445	192.168.2.4	5.26.5.1
Jun 7, 2024 20:29:05.674484968 CEST	445	50090	5.26.5.1	192.168.2.4
Jun 7, 2024 20:29:05.901308060 CEST	445	50059	124.233.139.1	192.168.2.4
Jun 7, 2024 20:29:05.901457071 CEST	50059	445	192.168.2.4	124.233.139.1
Jun 7, 2024 20:29:05.901457071 CEST	50059	445	192.168.2.4	124.233.139.1
Jun 7, 2024 20:29:05.901500940 CEST	50059	445	192.168.2.4	124.233.139.1
Jun 7, 2024 20:29:05.906583071 CEST	445	50059	124.233.139.1	192.168.2.4
Jun 7, 2024 20:29:05.906614065 CEST	445	50059	124.233.139.1	192.168.2.4
Jun 7, 2024 20:29:05.965996027 CEST	50091	445	192.168.2.4	124.233.139.2
Jun 7, 2024 20:29:05.971062899 CEST	445	50091	124.233.139.2	192.168.2.4
Jun 7, 2024 20:29:05.971185923 CEST	50091	445	192.168.2.4	124.233.139.2
Jun 7, 2024 20:29:05.971362114 CEST	50091	445	192.168.2.4	124.233.139.2
Jun 7, 2024 20:29:05.971781969 CEST	50092	445	192.168.2.4	124.233.139.2
Jun 7, 2024 20:29:05.976655960 CEST	445	50091	124.233.139.2	192.168.2.4
Jun 7, 2024 20:29:05.976742983 CEST	50091	445	192.168.2.4	124.233.139.2
Jun 7, 2024 20:29:05.976752043 CEST	445	50092	124.233.139.2	192.168.2.4
Jun 7, 2024 20:29:05.976881981 CEST	50092	445	192.168.2.4	124.233.139.2
Jun 7, 2024 20:29:05.976881981 CEST	50092	445	192.168.2.4	124.233.139.2
Jun 7, 2024 20:29:05.981847048 CEST	445	50092	124.233.139.2	192.168.2.4
Jun 7, 2024 20:29:06.502326965 CEST	445	50062	19.152.241.1	192.168.2.4
Jun 7, 2024 20:29:06.502420902 CEST	50062	445	192.168.2.4	19.152.241.1
Jun 7, 2024 20:29:06.502456903 CEST	50062	445	192.168.2.4	19.152.241.1
Jun 7, 2024 20:29:06.502511978 CEST	50062	445	192.168.2.4	19.152.241.1
Jun 7, 2024 20:29:06.508549929 CEST	445	50062	19.152.241.1	192.168.2.4
Jun 7, 2024 20:29:06.508583069 CEST	445	50062	19.152.241.1	192.168.2.4
Jun 7, 2024 20:29:07.022437096 CEST	445	50064	15.84.171.2	192.168.2.4
Jun 7, 2024 20:29:07.022572994 CEST	50064	445	192.168.2.4	15.84.171.2
Jun 7, 2024 20:29:07.022665977 CEST	50064	445	192.168.2.4	15.84.171.2
Jun 7, 2024 20:29:07.022718906 CEST	50064	445	192.168.2.4	15.84.171.2
Jun 7, 2024 20:29:07.027532101 CEST	445	50064	15.84.171.2	192.168.2.4
Jun 7, 2024 20:29:07.027585030 CEST	445	50064	15.84.171.2	192.168.2.4
Jun 7, 2024 20:29:07.294365883 CEST	50093	445	192.168.2.4	98.247.99.77
Jun 7, 2024 20:29:07.299346924 CEST	445	50093	98.247.99.77	192.168.2.4
Jun 7, 2024 20:29:07.299458027 CEST	50093	445	192.168.2.4	98.247.99.77
Jun 7, 2024 20:29:07.299458027 CEST	50093	445	192.168.2.4	98.247.99.77
Jun 7, 2024 20:29:07.299685001 CEST	50094	445	192.168.2.4	98.247.99.1
Jun 7, 2024 20:29:07.304728985 CEST	445	50093	98.247.99.77	192.168.2.4
Jun 7, 2024 20:29:07.304799080 CEST	50093	445	192.168.2.4	98.247.99.77
Jun 7, 2024 20:29:07.304864883 CEST	445	50094	98.247.99.1	192.168.2.4
Jun 7, 2024 20:29:07.305001020 CEST	50094	445	192.168.2.4	98.247.99.1
Jun 7, 2024 20:29:07.305099010 CEST	50094	445	192.168.2.4	98.247.99.1
Jun 7, 2024 20:29:07.305371046 CEST	50095	445	192.168.2.4	98.247.99.1
Jun 7, 2024 20:29:07.310246944 CEST	445	50095	98.247.99.1	192.168.2.4
Jun 7, 2024 20:29:07.310386896 CEST	50095	445	192.168.2.4	98.247.99.1
Jun 7, 2024 20:29:07.310400009 CEST	50095	445	192.168.2.4	98.247.99.1
Jun 7, 2024 20:29:07.310455084 CEST	445	50094	98.247.99.1	192.168.2.4
Jun 7, 2024 20:29:07.310579062 CEST	50094	445	192.168.2.4	98.247.99.1
Jun 7, 2024 20:29:07.315402985 CEST	445	50095	98.247.99.1	192.168.2.4
Jun 7, 2024 20:29:07.403299093 CEST	50096	445	192.168.2.4	99.75.135.2
Jun 7, 2024 20:29:07.408232927 CEST	445	50096	99.75.135.2	192.168.2.4
Jun 7, 2024 20:29:07.408340931 CEST	50096	445	192.168.2.4	99.75.135.2
Jun 7, 2024 20:29:07.408432961 CEST	50096	445	192.168.2.4	99.75.135.2
Jun 7, 2024 20:29:07.413384914 CEST	445	50096	99.75.135.2	192.168.2.4
Jun 7, 2024 20:29:07.497174025 CEST	50097	445	192.168.2.4	155.86.233.1
Jun 7, 2024 20:29:07.502274990 CEST	445	50097	155.86.233.1	192.168.2.4
Jun 7, 2024 20:29:07.502365112 CEST	50097	445	192.168.2.4	155.86.233.1
Jun 7, 2024 20:29:07.502381086 CEST	50097	445	192.168.2.4	155.86.233.1
Jun 7, 2024 20:29:07.507282972 CEST	445	50097	155.86.233.1	192.168.2.4
Jun 7, 2024 20:29:07.870239019 CEST	445	50065	136.232.217.2	192.168.2.4
Jun 7, 2024 20:29:07.870421886 CEST	50065	445	192.168.2.4	136.232.217.2
Jun 7, 2024 20:29:07.870520115 CEST	50065	445	192.168.2.4	136.232.217.2
Jun 7, 2024 20:29:07.870521069 CEST	50065	445	192.168.2.4	136.232.217.2
Jun 7, 2024 20:29:07.876183033 CEST	445	50065	136.232.217.2	192.168.2.4
Jun 7, 2024 20:29:07.876215935 CEST	445	50065	136.232.217.2	192.168.2.4
Jun 7, 2024 20:29:07.922801018 CEST	445	50066	60.66.137.1	192.168.2.4
Jun 7, 2024 20:29:07.922920942 CEST	50066	445	192.168.2.4	60.66.137.1
Jun 7, 2024 20:29:07.922996998 CEST	50066	445	192.168.2.4	60.66.137.1
Jun 7, 2024 20:29:07.923086882 CEST	50066	445	192.168.2.4	60.66.137.1
Jun 7, 2024 20:29:07.927911997 CEST	445	50066	60.66.137.1	192.168.2.4
Jun 7, 2024 20:29:07.927922964 CEST	445	50066	60.66.137.1	192.168.2.4
Jun 7, 2024 20:29:07.934712887 CEST	50098	445	192.168.2.4	136.232.217.3
Jun 7, 2024 20:29:07.939610004 CEST	445	50098	136.232.217.3	192.168.2.4
Jun 7, 2024 20:29:07.939693928 CEST	50098	445	192.168.2.4	136.232.217.3
Jun 7, 2024 20:29:07.939769030 CEST	50098	445	192.168.2.4	136.232.217.3
Jun 7, 2024 20:29:07.940093040 CEST	50099	445	192.168.2.4	136.232.217.3
Jun 7, 2024 20:29:07.944838047 CEST	445	50098	136.232.217.3	192.168.2.4
Jun 7, 2024 20:29:07.944899082 CEST	50098	445	192.168.2.4	136.232.217.3
Jun 7, 2024 20:29:07.944998026 CEST	445	50099	136.232.217.3	192.168.2.4
Jun 7, 2024 20:29:07.945075035 CEST	50099	445	192.168.2.4	136.232.217.3
Jun 7, 2024 20:29:07.945075035 CEST	50099	445	192.168.2.4	136.232.217.3
Jun 7, 2024 20:29:07.949945927 CEST	445	50099	136.232.217.3	192.168.2.4
Jun 7, 2024 20:29:07.981584072 CEST	50100	445	192.168.2.4	60.66.137.2
Jun 7, 2024 20:29:07.986568928 CEST	445	50100	60.66.137.2	192.168.2.4
Jun 7, 2024 20:29:07.989131927 CEST	50100	445	192.168.2.4	60.66.137.2
Jun 7, 2024 20:29:07.989236116 CEST	50100	445	192.168.2.4	60.66.137.2
Jun 7, 2024 20:29:07.989698887 CEST	50101	445	192.168.2.4	60.66.137.2
Jun 7, 2024 20:29:07.994309902 CEST	445	50100	60.66.137.2	192.168.2.4
Jun 7, 2024 20:29:07.994539976 CEST	445	50101	60.66.137.2	192.168.2.4
Jun 7, 2024 20:29:07.994623899 CEST	50100	445	192.168.2.4	60.66.137.2
Jun 7, 2024 20:29:07.994684935 CEST	50101	445	192.168.2.4	60.66.137.2
Jun 7, 2024 20:29:07.994752884 CEST	50101	445	192.168.2.4	60.66.137.2
Jun 7, 2024 20:29:07.999528885 CEST	445	50101	60.66.137.2	192.168.2.4
Jun 7, 2024 20:29:08.579943895 CEST	445	50071	110.10.245.1	192.168.2.4
Jun 7, 2024 20:29:08.580012083 CEST	50071	445	192.168.2.4	110.10.245.1
Jun 7, 2024 20:29:08.580049992 CEST	50071	445	192.168.2.4	110.10.245.1
Jun 7, 2024 20:29:08.580065966 CEST	50071	445	192.168.2.4	110.10.245.1
Jun 7, 2024 20:29:08.580697060 CEST	445	50070	8.191.246.2	192.168.2.4
Jun 7, 2024 20:29:08.580750942 CEST	50070	445	192.168.2.4	8.191.246.2
Jun 7, 2024 20:29:08.580843925 CEST	50070	445	192.168.2.4	8.191.246.2
Jun 7, 2024 20:29:08.580903053 CEST	50070	445	192.168.2.4	8.191.246.2
Jun 7, 2024 20:29:08.584943056 CEST	445	50071	110.10.245.1	192.168.2.4
Jun 7, 2024 20:29:08.584969997 CEST	445	50071	110.10.245.1	192.168.2.4
Jun 7, 2024 20:29:08.585652113 CEST	445	50070	8.191.246.2	192.168.2.4
Jun 7, 2024 20:29:08.585702896 CEST	445	50070	8.191.246.2	192.168.2.4
Jun 7, 2024 20:29:08.830132008 CEST	50102	445	192.168.2.4	12.109.166.254
Jun 7, 2024 20:29:08.835150957 CEST	445	50102	12.109.166.254	192.168.2.4
Jun 7, 2024 20:29:08.835230112 CEST	50102	445	192.168.2.4	12.109.166.254
Jun 7, 2024 20:29:08.835310936 CEST	50102	445	192.168.2.4	12.109.166.254
Jun 7, 2024 20:29:08.835448027 CEST	50103	445	192.168.2.4	12.109.166.1
Jun 7, 2024 20:29:08.840647936 CEST	445	50103	12.109.166.1	192.168.2.4
Jun 7, 2024 20:29:08.840706110 CEST	445	50102	12.109.166.254	192.168.2.4
Jun 7, 2024 20:29:08.840712070 CEST	50103	445	192.168.2.4	12.109.166.1
Jun 7, 2024 20:29:08.840749979 CEST	50102	445	192.168.2.4	12.109.166.254
Jun 7, 2024 20:29:08.840751886 CEST	50103	445	192.168.2.4	12.109.166.1
Jun 7, 2024 20:29:08.841223001 CEST	50104	445	192.168.2.4	12.109.166.1
Jun 7, 2024 20:29:08.846149921 CEST	445	50103	12.109.166.1	192.168.2.4
Jun 7, 2024 20:29:08.846194029 CEST	50103	445	192.168.2.4	12.109.166.1
Jun 7, 2024 20:29:08.846234083 CEST	445	50104	12.109.166.1	192.168.2.4
Jun 7, 2024 20:29:08.846321106 CEST	50104	445	192.168.2.4	12.109.166.1
Jun 7, 2024 20:29:08.846363068 CEST	50104	445	192.168.2.4	12.109.166.1
Jun 7, 2024 20:29:08.851227999 CEST	445	50104	12.109.166.1	192.168.2.4
Jun 7, 2024 20:29:09.512712002 CEST	50105	445	192.168.2.4	19.152.241.1
Jun 7, 2024 20:29:09.517738104 CEST	445	50105	19.152.241.1	192.168.2.4
Jun 7, 2024 20:29:09.517860889 CEST	50105	445	192.168.2.4	19.152.241.1
Jun 7, 2024 20:29:09.517995119 CEST	50105	445	192.168.2.4	19.152.241.1
Jun 7, 2024 20:29:09.522933006 CEST	445	50105	19.152.241.1	192.168.2.4
Jun 7, 2024 20:29:09.933279991 CEST	445	50072	146.93.6.1	192.168.2.4
Jun 7, 2024 20:29:09.933362007 CEST	50072	445	192.168.2.4	146.93.6.1
Jun 7, 2024 20:29:09.933408976 CEST	50072	445	192.168.2.4	146.93.6.1
Jun 7, 2024 20:29:09.933429956 CEST	50072	445	192.168.2.4	146.93.6.1
Jun 7, 2024 20:29:09.939709902 CEST	445	50072	146.93.6.1	192.168.2.4
Jun 7, 2024 20:29:09.939723969 CEST	445	50072	146.93.6.1	192.168.2.4
Jun 7, 2024 20:29:09.997148037 CEST	50106	445	192.168.2.4	146.93.6.2
Jun 7, 2024 20:29:10.003824949 CEST	445	50106	146.93.6.2	192.168.2.4
Jun 7, 2024 20:29:10.003973961 CEST	50106	445	192.168.2.4	146.93.6.2
Jun 7, 2024 20:29:10.004379988 CEST	50106	445	192.168.2.4	146.93.6.2
Jun 7, 2024 20:29:10.004384995 CEST	50107	445	192.168.2.4	146.93.6.2
Jun 7, 2024 20:29:10.011055946 CEST	445	50107	146.93.6.2	192.168.2.4
Jun 7, 2024 20:29:10.011158943 CEST	50107	445	192.168.2.4	146.93.6.2
Jun 7, 2024 20:29:10.011183023 CEST	50107	445	192.168.2.4	146.93.6.2
Jun 7, 2024 20:29:10.011207104 CEST	445	50106	146.93.6.2	192.168.2.4
Jun 7, 2024 20:29:10.011301041 CEST	50106	445	192.168.2.4	146.93.6.2
Jun 7, 2024 20:29:10.018606901 CEST	445	50107	146.93.6.2	192.168.2.4
Jun 7, 2024 20:29:10.028289080 CEST	50108	445	192.168.2.4	15.84.171.2
Jun 7, 2024 20:29:10.034095049 CEST	445	50108	15.84.171.2	192.168.2.4
Jun 7, 2024 20:29:10.034230947 CEST	50108	445	192.168.2.4	15.84.171.2
Jun 7, 2024 20:29:10.034279108 CEST	50108	445	192.168.2.4	15.84.171.2
Jun 7, 2024 20:29:10.035945892 CEST	445	50073	102.224.158.2	192.168.2.4
Jun 7, 2024 20:29:10.036039114 CEST	50073	445	192.168.2.4	102.224.158.2
Jun 7, 2024 20:29:10.036039114 CEST	50073	445	192.168.2.4	102.224.158.2
Jun 7, 2024 20:29:10.036088943 CEST	50073	445	192.168.2.4	102.224.158.2
Jun 7, 2024 20:29:10.039417982 CEST	445	50108	15.84.171.2	192.168.2.4
Jun 7, 2024 20:29:10.041137934 CEST	445	50073	102.224.158.2	192.168.2.4
Jun 7, 2024 20:29:10.041148901 CEST	445	50073	102.224.158.2	192.168.2.4
Jun 7, 2024 20:29:10.090998888 CEST	50109	445	192.168.2.4	102.224.158.3
Jun 7, 2024 20:29:10.099308968 CEST	445	50109	102.224.158.3	192.168.2.4
Jun 7, 2024 20:29:10.099396944 CEST	50109	445	192.168.2.4	102.224.158.3
Jun 7, 2024 20:29:10.099436998 CEST	50109	445	192.168.2.4	102.224.158.3
Jun 7, 2024 20:29:10.099817991 CEST	50110	445	192.168.2.4	102.224.158.3
Jun 7, 2024 20:29:10.106583118 CEST	445	50110	102.224.158.3	192.168.2.4
Jun 7, 2024 20:29:10.106642008 CEST	50110	445	192.168.2.4	102.224.158.3
Jun 7, 2024 20:29:10.106753111 CEST	445	50109	102.224.158.3	192.168.2.4
Jun 7, 2024 20:29:10.106822968 CEST	50110	445	192.168.2.4	102.224.158.3
Jun 7, 2024 20:29:10.106834888 CEST	50109	445	192.168.2.4	102.224.158.3
Jun 7, 2024 20:29:10.113809109 CEST	445	50110	102.224.158.3	192.168.2.4
Jun 7, 2024 20:29:10.247371912 CEST	50111	445	192.168.2.4	115.42.153.75
Jun 7, 2024 20:29:10.253375053 CEST	445	50111	115.42.153.75	192.168.2.4
Jun 7, 2024 20:29:10.253463030 CEST	50111	445	192.168.2.4	115.42.153.75
Jun 7, 2024 20:29:10.253473997 CEST	50111	445	192.168.2.4	115.42.153.75
Jun 7, 2024 20:29:10.253580093 CEST	50112	445	192.168.2.4	115.42.153.1
Jun 7, 2024 20:29:10.258501053 CEST	445	50112	115.42.153.1	192.168.2.4
Jun 7, 2024 20:29:10.258564949 CEST	50112	445	192.168.2.4	115.42.153.1
Jun 7, 2024 20:29:10.258583069 CEST	50112	445	192.168.2.4	115.42.153.1
Jun 7, 2024 20:29:10.258635044 CEST	445	50111	115.42.153.75	192.168.2.4
Jun 7, 2024 20:29:10.258914948 CEST	50113	445	192.168.2.4	115.42.153.1
Jun 7, 2024 20:29:10.258939028 CEST	50111	445	192.168.2.4	115.42.153.75
Jun 7, 2024 20:29:10.264578104 CEST	445	50112	115.42.153.1	192.168.2.4
Jun 7, 2024 20:29:10.264957905 CEST	50112	445	192.168.2.4	115.42.153.1
Jun 7, 2024 20:29:10.265011072 CEST	445	50113	115.42.153.1	192.168.2.4
Jun 7, 2024 20:29:10.268951893 CEST	50113	445	192.168.2.4	115.42.153.1
Jun 7, 2024 20:29:10.268991947 CEST	50113	445	192.168.2.4	115.42.153.1
Jun 7, 2024 20:29:10.273931980 CEST	445	50113	115.42.153.1	192.168.2.4
Jun 7, 2024 20:29:10.419869900 CEST	445	50075	53.251.193.2	192.168.2.4
Jun 7, 2024 20:29:10.419948101 CEST	50075	445	192.168.2.4	53.251.193.2
Jun 7, 2024 20:29:10.420139074 CEST	50075	445	192.168.2.4	53.251.193.2
Jun 7, 2024 20:29:10.420183897 CEST	50075	445	192.168.2.4	53.251.193.2
Jun 7, 2024 20:29:10.425115108 CEST	445	50075	53.251.193.2	192.168.2.4
Jun 7, 2024 20:29:10.425148964 CEST	445	50075	53.251.193.2	192.168.2.4
Jun 7, 2024 20:29:10.537225962 CEST	445	50078	182.85.58.1	192.168.2.4
Jun 7, 2024 20:29:10.537281990 CEST	50078	445	192.168.2.4	182.85.58.1
Jun 7, 2024 20:29:10.537358046 CEST	50078	445	192.168.2.4	182.85.58.1
Jun 7, 2024 20:29:10.537415981 CEST	50078	445	192.168.2.4	182.85.58.1
Jun 7, 2024 20:29:10.543154955 CEST	445	50078	182.85.58.1	192.168.2.4
Jun 7, 2024 20:29:10.543169022 CEST	445	50078	182.85.58.1	192.168.2.4
Jun 7, 2024 20:29:11.575457096 CEST	50114	445	192.168.2.4	81.230.11.93
Jun 7, 2024 20:29:11.580826998 CEST	445	50114	81.230.11.93	192.168.2.4
Jun 7, 2024 20:29:11.582710028 CEST	50114	445	192.168.2.4	81.230.11.93
Jun 7, 2024 20:29:11.582792044 CEST	50114	445	192.168.2.4	81.230.11.93
Jun 7, 2024 20:29:11.582897902 CEST	50115	445	192.168.2.4	81.230.11.1
Jun 7, 2024 20:29:11.587872028 CEST	445	50115	81.230.11.1	192.168.2.4
Jun 7, 2024 20:29:11.587944984 CEST	50115	445	192.168.2.4	81.230.11.1
Jun 7, 2024 20:29:11.587970972 CEST	50115	445	192.168.2.4	81.230.11.1
Jun 7, 2024 20:29:11.588272095 CEST	50116	445	192.168.2.4	81.230.11.1
Jun 7, 2024 20:29:11.588774920 CEST	445	50114	81.230.11.93	192.168.2.4
Jun 7, 2024 20:29:11.588840961 CEST	50114	445	192.168.2.4	81.230.11.93
Jun 7, 2024 20:29:11.590702057 CEST	50117	445	192.168.2.4	110.10.245.1
Jun 7, 2024 20:29:11.590727091 CEST	50118	445	192.168.2.4	8.191.246.2
Jun 7, 2024 20:29:11.592941999 CEST	445	50115	81.230.11.1	192.168.2.4
Jun 7, 2024 20:29:11.593225002 CEST	445	50116	81.230.11.1	192.168.2.4
Jun 7, 2024 20:29:11.593285084 CEST	50116	445	192.168.2.4	81.230.11.1
Jun 7, 2024 20:29:11.593302965 CEST	50116	445	192.168.2.4	81.230.11.1
Jun 7, 2024 20:29:11.593494892 CEST	445	50115	81.230.11.1	192.168.2.4
Jun 7, 2024 20:29:11.593544960 CEST	50115	445	192.168.2.4	81.230.11.1
Jun 7, 2024 20:29:11.595690012 CEST	445	50117	110.10.245.1	192.168.2.4
Jun 7, 2024 20:29:11.595746040 CEST	445	50118	8.191.246.2	192.168.2.4
Jun 7, 2024 20:29:11.595748901 CEST	50117	445	192.168.2.4	110.10.245.1
Jun 7, 2024 20:29:11.595769882 CEST	50117	445	192.168.2.4	110.10.245.1
Jun 7, 2024 20:29:11.595803022 CEST	50118	445	192.168.2.4	8.191.246.2
Jun 7, 2024 20:29:11.595834970 CEST	50118	445	192.168.2.4	8.191.246.2
Jun 7, 2024 20:29:11.598257065 CEST	445	50116	81.230.11.1	192.168.2.4
Jun 7, 2024 20:29:11.600739002 CEST	445	50117	110.10.245.1	192.168.2.4
Jun 7, 2024 20:29:11.600830078 CEST	445	50118	8.191.246.2	192.168.2.4
Jun 7, 2024 20:29:11.884942055 CEST	445	50079	201.130.185.2	192.168.2.4
Jun 7, 2024 20:29:11.885082006 CEST	50079	445	192.168.2.4	201.130.185.2
Jun 7, 2024 20:29:11.885118961 CEST	50079	445	192.168.2.4	201.130.185.2
Jun 7, 2024 20:29:11.885147095 CEST	50079	445	192.168.2.4	201.130.185.2
Jun 7, 2024 20:29:11.890140057 CEST	445	50079	201.130.185.2	192.168.2.4
Jun 7, 2024 20:29:11.890172958 CEST	445	50079	201.130.185.2	192.168.2.4
Jun 7, 2024 20:29:11.950427055 CEST	50119	445	192.168.2.4	201.130.185.3
Jun 7, 2024 20:29:12.165496111 CEST	445	50080	50.241.97.1	192.168.2.4
Jun 7, 2024 20:29:12.166341066 CEST	50080	445	192.168.2.4	50.241.97.1
Jun 7, 2024 20:29:12.166379929 CEST	50080	445	192.168.2.4	50.241.97.1
Jun 7, 2024 20:29:12.166414022 CEST	50080	445	192.168.2.4	50.241.97.1
Jun 7, 2024 20:29:12.166790009 CEST	445	50119	201.130.185.3	192.168.2.4
Jun 7, 2024 20:29:12.166879892 CEST	50119	445	192.168.2.4	201.130.185.3
Jun 7, 2024 20:29:12.166971922 CEST	50119	445	192.168.2.4	201.130.185.3
Jun 7, 2024 20:29:12.167323112 CEST	50120	445	192.168.2.4	201.130.185.3
Jun 7, 2024 20:29:12.172497034 CEST	445	50080	50.241.97.1	192.168.2.4
Jun 7, 2024 20:29:12.172528028 CEST	445	50080	50.241.97.1	192.168.2.4
Jun 7, 2024 20:29:12.173154116 CEST	445	50119	201.130.185.3	192.168.2.4
Jun 7, 2024 20:29:12.173185110 CEST	445	50120	201.130.185.3	192.168.2.4
Jun 7, 2024 20:29:12.173213005 CEST	50119	445	192.168.2.4	201.130.185.3
Jun 7, 2024 20:29:12.173351049 CEST	50120	445	192.168.2.4	201.130.185.3
Jun 7, 2024 20:29:12.173393011 CEST	50120	445	192.168.2.4	201.130.185.3
Jun 7, 2024 20:29:12.178294897 CEST	445	50120	201.130.185.3	192.168.2.4
Jun 7, 2024 20:29:12.231538057 CEST	50121	445	192.168.2.4	50.241.97.2
Jun 7, 2024 20:29:12.237349987 CEST	445	50121	50.241.97.2	192.168.2.4
Jun 7, 2024 20:29:12.237452984 CEST	50121	445	192.168.2.4	50.241.97.2
Jun 7, 2024 20:29:12.237548113 CEST	50121	445	192.168.2.4	50.241.97.2
Jun 7, 2024 20:29:12.237876892 CEST	50122	445	192.168.2.4	50.241.97.2
Jun 7, 2024 20:29:12.243808985 CEST	445	50121	50.241.97.2	192.168.2.4
Jun 7, 2024 20:29:12.243880987 CEST	50121	445	192.168.2.4	50.241.97.2
Jun 7, 2024 20:29:12.243956089 CEST	445	50122	50.241.97.2	192.168.2.4
Jun 7, 2024 20:29:12.244024038 CEST	50122	445	192.168.2.4	50.241.97.2
Jun 7, 2024 20:29:12.244055033 CEST	50122	445	192.168.2.4	50.241.97.2
Jun 7, 2024 20:29:12.250032902 CEST	445	50122	50.241.97.2	192.168.2.4
Jun 7, 2024 20:29:12.403522015 CEST	445	50083	87.45.211.1	192.168.2.4
Jun 7, 2024 20:29:12.403594017 CEST	50083	445	192.168.2.4	87.45.211.1
Jun 7, 2024 20:29:12.403623104 CEST	50083	445	192.168.2.4	87.45.211.1
Jun 7, 2024 20:29:12.403667927 CEST	50083	445	192.168.2.4	87.45.211.1
Jun 7, 2024 20:29:12.408582926 CEST	445	50083	87.45.211.1	192.168.2.4
Jun 7, 2024 20:29:12.408597946 CEST	445	50083	87.45.211.1	192.168.2.4
Jun 7, 2024 20:29:12.462718964 CEST	445	50085	3.135.174.2	192.168.2.4
Jun 7, 2024 20:29:12.463995934 CEST	50085	445	192.168.2.4	3.135.174.2
Jun 7, 2024 20:29:12.467467070 CEST	50085	445	192.168.2.4	3.135.174.2
Jun 7, 2024 20:29:12.467514992 CEST	50085	445	192.168.2.4	3.135.174.2
Jun 7, 2024 20:29:12.472579956 CEST	445	50085	3.135.174.2	192.168.2.4
Jun 7, 2024 20:29:12.472630978 CEST	445	50085	3.135.174.2	192.168.2.4
Jun 7, 2024 20:29:12.810090065 CEST	50123	445	192.168.2.4	159.26.251.87
Jun 7, 2024 20:29:12.815110922 CEST	445	50123	159.26.251.87	192.168.2.4
Jun 7, 2024 20:29:12.815208912 CEST	50123	445	192.168.2.4	159.26.251.87
Jun 7, 2024 20:29:12.815352917 CEST	50123	445	192.168.2.4	159.26.251.87
Jun 7, 2024 20:29:12.815480947 CEST	50124	445	192.168.2.4	159.26.251.1
Jun 7, 2024 20:29:12.820322990 CEST	445	50124	159.26.251.1	192.168.2.4
Jun 7, 2024 20:29:12.820396900 CEST	50124	445	192.168.2.4	159.26.251.1
Jun 7, 2024 20:29:12.820470095 CEST	445	50123	159.26.251.87	192.168.2.4
Jun 7, 2024 20:29:12.820522070 CEST	50123	445	192.168.2.4	159.26.251.87
Jun 7, 2024 20:29:12.820600033 CEST	50124	445	192.168.2.4	159.26.251.1
Jun 7, 2024 20:29:12.821084023 CEST	50125	445	192.168.2.4	159.26.251.1
Jun 7, 2024 20:29:12.825462103 CEST	445	50124	159.26.251.1	192.168.2.4
Jun 7, 2024 20:29:12.825520039 CEST	50124	445	192.168.2.4	159.26.251.1
Jun 7, 2024 20:29:12.826056957 CEST	445	50125	159.26.251.1	192.168.2.4
Jun 7, 2024 20:29:12.826148987 CEST	50125	445	192.168.2.4	159.26.251.1
Jun 7, 2024 20:29:12.826268911 CEST	50125	445	192.168.2.4	159.26.251.1
Jun 7, 2024 20:29:12.831175089 CEST	445	50125	159.26.251.1	192.168.2.4
Jun 7, 2024 20:29:13.434961081 CEST	50126	445	192.168.2.4	53.251.193.2
Jun 7, 2024 20:29:13.439982891 CEST	445	50126	53.251.193.2	192.168.2.4
Jun 7, 2024 20:29:13.440099955 CEST	50126	445	192.168.2.4	53.251.193.2
Jun 7, 2024 20:29:13.440099955 CEST	50126	445	192.168.2.4	53.251.193.2
Jun 7, 2024 20:29:13.445077896 CEST	445	50126	53.251.193.2	192.168.2.4
Jun 7, 2024 20:29:13.544226885 CEST	50127	445	192.168.2.4	182.85.58.1
Jun 7, 2024 20:29:13.549108982 CEST	445	50127	182.85.58.1	192.168.2.4
Jun 7, 2024 20:29:13.550755024 CEST	50127	445	192.168.2.4	182.85.58.1
Jun 7, 2024 20:29:13.569574118 CEST	50127	445	192.168.2.4	182.85.58.1
Jun 7, 2024 20:29:13.574501991 CEST	445	50127	182.85.58.1	192.168.2.4
Jun 7, 2024 20:29:13.966017008 CEST	50128	445	192.168.2.4	206.199.41.34
Jun 7, 2024 20:29:14.074799061 CEST	445	50086	184.153.104.1	192.168.2.4
Jun 7, 2024 20:29:14.075584888 CEST	445	50087	161.80.213.2	192.168.2.4
Jun 7, 2024 20:29:14.075670004 CEST	50086	445	192.168.2.4	184.153.104.1
Jun 7, 2024 20:29:14.075715065 CEST	50087	445	192.168.2.4	161.80.213.2
Jun 7, 2024 20:29:14.075715065 CEST	50087	445	192.168.2.4	161.80.213.2
Jun 7, 2024 20:29:14.075781107 CEST	50086	445	192.168.2.4	184.153.104.1
Jun 7, 2024 20:29:14.075781107 CEST	50086	445	192.168.2.4	184.153.104.1
Jun 7, 2024 20:29:14.075819016 CEST	50087	445	192.168.2.4	161.80.213.2
Jun 7, 2024 20:29:14.076881886 CEST	445	50128	206.199.41.34	192.168.2.4
Jun 7, 2024 20:29:14.078737020 CEST	50128	445	192.168.2.4	206.199.41.34
Jun 7, 2024 20:29:14.078758001 CEST	50128	445	192.168.2.4	206.199.41.34
Jun 7, 2024 20:29:14.078941107 CEST	50129	445	192.168.2.4	206.199.41.1
Jun 7, 2024 20:29:14.080743074 CEST	445	50087	161.80.213.2	192.168.2.4
Jun 7, 2024 20:29:14.080774069 CEST	445	50086	184.153.104.1	192.168.2.4
Jun 7, 2024 20:29:14.080805063 CEST	445	50086	184.153.104.1	192.168.2.4
Jun 7, 2024 20:29:14.080837011 CEST	445	50087	161.80.213.2	192.168.2.4
Jun 7, 2024 20:29:14.083920002 CEST	445	50129	206.199.41.1	192.168.2.4
Jun 7, 2024 20:29:14.084347010 CEST	445	50128	206.199.41.34	192.168.2.4
Jun 7, 2024 20:29:14.084424019 CEST	50128	445	192.168.2.4	206.199.41.34
Jun 7, 2024 20:29:14.084541082 CEST	50129	445	192.168.2.4	206.199.41.1
Jun 7, 2024 20:29:14.084541082 CEST	50129	445	192.168.2.4	206.199.41.1
Jun 7, 2024 20:29:14.084861994 CEST	50130	445	192.168.2.4	206.199.41.1
Jun 7, 2024 20:29:14.089811087 CEST	445	50130	206.199.41.1	192.168.2.4
Jun 7, 2024 20:29:14.089842081 CEST	445	50129	206.199.41.1	192.168.2.4
Jun 7, 2024 20:29:14.089926004 CEST	50129	445	192.168.2.4	206.199.41.1
Jun 7, 2024 20:29:14.089967966 CEST	50130	445	192.168.2.4	206.199.41.1
Jun 7, 2024 20:29:14.089967966 CEST	50130	445	192.168.2.4	206.199.41.1
Jun 7, 2024 20:29:14.094953060 CEST	445	50130	206.199.41.1	192.168.2.4
Jun 7, 2024 20:29:14.137887955 CEST	50132	445	192.168.2.4	184.153.104.2
Jun 7, 2024 20:29:14.138691902 CEST	50131	445	192.168.2.4	161.80.213.3
Jun 7, 2024 20:29:14.142807961 CEST	445	50132	184.153.104.2	192.168.2.4
Jun 7, 2024 20:29:14.143616915 CEST	445	50131	161.80.213.3	192.168.2.4
Jun 7, 2024 20:29:14.143692017 CEST	50132	445	192.168.2.4	184.153.104.2
Jun 7, 2024 20:29:14.143748045 CEST	50131	445	192.168.2.4	161.80.213.3
Jun 7, 2024 20:29:14.143748045 CEST	50131	445	192.168.2.4	161.80.213.3
Jun 7, 2024 20:29:14.143749952 CEST	50132	445	192.168.2.4	184.153.104.2
Jun 7, 2024 20:29:14.144010067 CEST	50133	445	192.168.2.4	184.153.104.2
Jun 7, 2024 20:29:14.144049883 CEST	50134	445	192.168.2.4	161.80.213.3
Jun 7, 2024 20:29:14.149024963 CEST	445	50133	184.153.104.2	192.168.2.4
Jun 7, 2024 20:29:14.149055958 CEST	445	50131	161.80.213.3	192.168.2.4
Jun 7, 2024 20:29:14.149085045 CEST	445	50132	184.153.104.2	192.168.2.4
Jun 7, 2024 20:29:14.149125099 CEST	50133	445	192.168.2.4	184.153.104.2
Jun 7, 2024 20:29:14.149137974 CEST	445	50134	161.80.213.3	192.168.2.4
Jun 7, 2024 20:29:14.149167061 CEST	50133	445	192.168.2.4	184.153.104.2
Jun 7, 2024 20:29:14.149171114 CEST	445	50132	184.153.104.2	192.168.2.4
Jun 7, 2024 20:29:14.149204969 CEST	50134	445	192.168.2.4	161.80.213.3
Jun 7, 2024 20:29:14.149226904 CEST	50132	445	192.168.2.4	184.153.104.2
Jun 7, 2024 20:29:14.149226904 CEST	50134	445	192.168.2.4	161.80.213.3
Jun 7, 2024 20:29:14.149236917 CEST	445	50131	161.80.213.3	192.168.2.4
Jun 7, 2024 20:29:14.150701046 CEST	50131	445	192.168.2.4	161.80.213.3
Jun 7, 2024 20:29:14.154103041 CEST	445	50133	184.153.104.2	192.168.2.4
Jun 7, 2024 20:29:14.154184103 CEST	445	50134	161.80.213.3	192.168.2.4
Jun 7, 2024 20:29:14.167969942 CEST	445	50090	5.26.5.1	192.168.2.4
Jun 7, 2024 20:29:14.170737982 CEST	50090	445	192.168.2.4	5.26.5.1
Jun 7, 2024 20:29:14.170790911 CEST	50090	445	192.168.2.4	5.26.5.1
Jun 7, 2024 20:29:14.170790911 CEST	50090	445	192.168.2.4	5.26.5.1
Jun 7, 2024 20:29:14.175852060 CEST	445	50090	5.26.5.1	192.168.2.4
Jun 7, 2024 20:29:14.175904036 CEST	445	50090	5.26.5.1	192.168.2.4
Jun 7, 2024 20:29:14.471126080 CEST	445	50092	124.233.139.2	192.168.2.4
Jun 7, 2024 20:29:14.471191883 CEST	50092	445	192.168.2.4	124.233.139.2
Jun 7, 2024 20:29:14.471230984 CEST	50092	445	192.168.2.4	124.233.139.2
Jun 7, 2024 20:29:14.471328974 CEST	50092	445	192.168.2.4	124.233.139.2
Jun 7, 2024 20:29:14.476171017 CEST	445	50092	124.233.139.2	192.168.2.4
Jun 7, 2024 20:29:14.476228952 CEST	445	50092	124.233.139.2	192.168.2.4
Jun 7, 2024 20:29:15.044421911 CEST	50135	445	192.168.2.4	54.6.208.123
Jun 7, 2024 20:29:15.051729918 CEST	445	50135	54.6.208.123	192.168.2.4
Jun 7, 2024 20:29:15.051812887 CEST	50135	445	192.168.2.4	54.6.208.123
Jun 7, 2024 20:29:15.051897049 CEST	50135	445	192.168.2.4	54.6.208.123
Jun 7, 2024 20:29:15.052337885 CEST	50136	445	192.168.2.4	54.6.208.1
Jun 7, 2024 20:29:15.058413029 CEST	445	50135	54.6.208.123	192.168.2.4
Jun 7, 2024 20:29:15.058475018 CEST	50135	445	192.168.2.4	54.6.208.123
Jun 7, 2024 20:29:15.058609962 CEST	445	50136	54.6.208.1	192.168.2.4
Jun 7, 2024 20:29:15.058684111 CEST	50136	445	192.168.2.4	54.6.208.1
Jun 7, 2024 20:29:15.058751106 CEST	50136	445	192.168.2.4	54.6.208.1
Jun 7, 2024 20:29:15.058999062 CEST	50137	445	192.168.2.4	54.6.208.1
Jun 7, 2024 20:29:15.065187931 CEST	445	50136	54.6.208.1	192.168.2.4
Jun 7, 2024 20:29:15.065326929 CEST	445	50137	54.6.208.1	192.168.2.4
Jun 7, 2024 20:29:15.065326929 CEST	50136	445	192.168.2.4	54.6.208.1
Jun 7, 2024 20:29:15.065438032 CEST	50137	445	192.168.2.4	54.6.208.1
Jun 7, 2024 20:29:15.065490007 CEST	50137	445	192.168.2.4	54.6.208.1
Jun 7, 2024 20:29:15.070323944 CEST	445	50137	54.6.208.1	192.168.2.4
Jun 7, 2024 20:29:15.418917894 CEST	50138	445	192.168.2.4	87.45.211.1
Jun 7, 2024 20:29:15.425340891 CEST	445	50138	87.45.211.1	192.168.2.4
Jun 7, 2024 20:29:15.425426006 CEST	50138	445	192.168.2.4	87.45.211.1
Jun 7, 2024 20:29:15.425442934 CEST	50138	445	192.168.2.4	87.45.211.1
Jun 7, 2024 20:29:15.431931973 CEST	445	50138	87.45.211.1	192.168.2.4
Jun 7, 2024 20:29:15.481362104 CEST	50139	445	192.168.2.4	3.135.174.2
Jun 7, 2024 20:29:15.487859964 CEST	445	50139	3.135.174.2	192.168.2.4
Jun 7, 2024 20:29:15.487947941 CEST	50139	445	192.168.2.4	3.135.174.2
Jun 7, 2024 20:29:15.487958908 CEST	50139	445	192.168.2.4	3.135.174.2
Jun 7, 2024 20:29:15.492822886 CEST	445	50139	3.135.174.2	192.168.2.4
Jun 7, 2024 20:29:15.802181005 CEST	445	50095	98.247.99.1	192.168.2.4
Jun 7, 2024 20:29:15.802258015 CEST	50095	445	192.168.2.4	98.247.99.1
Jun 7, 2024 20:29:15.802288055 CEST	50095	445	192.168.2.4	98.247.99.1
Jun 7, 2024 20:29:15.802336931 CEST	50095	445	192.168.2.4	98.247.99.1
Jun 7, 2024 20:29:15.807316065 CEST	445	50095	98.247.99.1	192.168.2.4
Jun 7, 2024 20:29:15.807337046 CEST	445	50095	98.247.99.1	192.168.2.4
Jun 7, 2024 20:29:15.899960995 CEST	445	50096	99.75.135.2	192.168.2.4
Jun 7, 2024 20:29:15.900074005 CEST	50096	445	192.168.2.4	99.75.135.2
Jun 7, 2024 20:29:15.900109053 CEST	50096	445	192.168.2.4	99.75.135.2
Jun 7, 2024 20:29:15.900139093 CEST	50096	445	192.168.2.4	99.75.135.2
Jun 7, 2024 20:29:15.905050993 CEST	445	50096	99.75.135.2	192.168.2.4
Jun 7, 2024 20:29:15.905067921 CEST	445	50096	99.75.135.2	192.168.2.4
Jun 7, 2024 20:29:15.966046095 CEST	50140	445	192.168.2.4	99.75.135.3
Jun 7, 2024 20:29:15.970993996 CEST	445	50140	99.75.135.3	192.168.2.4
Jun 7, 2024 20:29:15.971146107 CEST	50140	445	192.168.2.4	99.75.135.3
Jun 7, 2024 20:29:15.971146107 CEST	50140	445	192.168.2.4	99.75.135.3
Jun 7, 2024 20:29:15.971560001 CEST	50141	445	192.168.2.4	99.75.135.3
Jun 7, 2024 20:29:15.976469994 CEST	445	50141	99.75.135.3	192.168.2.4
Jun 7, 2024 20:29:15.976547956 CEST	50141	445	192.168.2.4	99.75.135.3
Jun 7, 2024 20:29:15.976581097 CEST	445	50140	99.75.135.3	192.168.2.4
Jun 7, 2024 20:29:15.976614952 CEST	50141	445	192.168.2.4	99.75.135.3
Jun 7, 2024 20:29:15.976644993 CEST	50140	445	192.168.2.4	99.75.135.3
Jun 7, 2024 20:29:15.981441975 CEST	445	50141	99.75.135.3	192.168.2.4
Jun 7, 2024 20:29:15.990888119 CEST	445	50097	155.86.233.1	192.168.2.4
Jun 7, 2024 20:29:15.990972042 CEST	50097	445	192.168.2.4	155.86.233.1
Jun 7, 2024 20:29:15.991028070 CEST	50097	445	192.168.2.4	155.86.233.1
Jun 7, 2024 20:29:15.991067886 CEST	50097	445	192.168.2.4	155.86.233.1
Jun 7, 2024 20:29:15.996067047 CEST	445	50097	155.86.233.1	192.168.2.4
Jun 7, 2024 20:29:15.996082067 CEST	445	50097	155.86.233.1	192.168.2.4
Jun 7, 2024 20:29:16.044023037 CEST	50142	445	192.168.2.4	155.86.233.2
Jun 7, 2024 20:29:16.049078941 CEST	445	50142	155.86.233.2	192.168.2.4
Jun 7, 2024 20:29:16.049309015 CEST	50142	445	192.168.2.4	155.86.233.2
Jun 7, 2024 20:29:16.049896955 CEST	50142	445	192.168.2.4	155.86.233.2
Jun 7, 2024 20:29:16.049896955 CEST	50143	445	192.168.2.4	155.86.233.2
Jun 7, 2024 20:29:16.054805040 CEST	445	50143	155.86.233.2	192.168.2.4
Jun 7, 2024 20:29:16.054905891 CEST	50143	445	192.168.2.4	155.86.233.2
Jun 7, 2024 20:29:16.054929018 CEST	50143	445	192.168.2.4	155.86.233.2
Jun 7, 2024 20:29:16.055042028 CEST	445	50142	155.86.233.2	192.168.2.4
Jun 7, 2024 20:29:16.055133104 CEST	50142	445	192.168.2.4	155.86.233.2
Jun 7, 2024 20:29:16.059801102 CEST	445	50143	155.86.233.2	192.168.2.4
Jun 7, 2024 20:29:16.059859991 CEST	50144	445	192.168.2.4	147.230.27.101
Jun 7, 2024 20:29:16.064718008 CEST	445	50144	147.230.27.101	192.168.2.4
Jun 7, 2024 20:29:16.064794064 CEST	50144	445	192.168.2.4	147.230.27.101
Jun 7, 2024 20:29:16.064815044 CEST	50144	445	192.168.2.4	147.230.27.101
Jun 7, 2024 20:29:16.064949989 CEST	50145	445	192.168.2.4	147.230.27.1
Jun 7, 2024 20:29:16.069746971 CEST	445	50145	147.230.27.1	192.168.2.4
Jun 7, 2024 20:29:16.069825888 CEST	50145	445	192.168.2.4	147.230.27.1
Jun 7, 2024 20:29:16.069856882 CEST	50145	445	192.168.2.4	147.230.27.1
Jun 7, 2024 20:29:16.070154905 CEST	445	50144	147.230.27.101	192.168.2.4
Jun 7, 2024 20:29:16.070199966 CEST	50146	445	192.168.2.4	147.230.27.1
Jun 7, 2024 20:29:16.070214987 CEST	50144	445	192.168.2.4	147.230.27.101
Jun 7, 2024 20:29:16.075028896 CEST	445	50145	147.230.27.1	192.168.2.4
Jun 7, 2024 20:29:16.075122118 CEST	50145	445	192.168.2.4	147.230.27.1
Jun 7, 2024 20:29:16.075371027 CEST	445	50146	147.230.27.1	192.168.2.4
Jun 7, 2024 20:29:16.075447083 CEST	50146	445	192.168.2.4	147.230.27.1
Jun 7, 2024 20:29:16.075470924 CEST	50146	445	192.168.2.4	147.230.27.1
Jun 7, 2024 20:29:16.080809116 CEST	445	50146	147.230.27.1	192.168.2.4
Jun 7, 2024 20:29:16.430985928 CEST	445	50099	136.232.217.3	192.168.2.4
Jun 7, 2024 20:29:16.431066036 CEST	50099	445	192.168.2.4	136.232.217.3
Jun 7, 2024 20:29:16.431108952 CEST	50099	445	192.168.2.4	136.232.217.3
Jun 7, 2024 20:29:16.431143045 CEST	50099	445	192.168.2.4	136.232.217.3
Jun 7, 2024 20:29:16.436100006 CEST	445	50099	136.232.217.3	192.168.2.4
Jun 7, 2024 20:29:16.436114073 CEST	445	50099	136.232.217.3	192.168.2.4
Jun 7, 2024 20:29:16.480742931 CEST	445	50101	60.66.137.2	192.168.2.4
Jun 7, 2024 20:29:16.480804920 CEST	50101	445	192.168.2.4	60.66.137.2
Jun 7, 2024 20:29:16.480828047 CEST	50101	445	192.168.2.4	60.66.137.2
Jun 7, 2024 20:29:16.480874062 CEST	50101	445	192.168.2.4	60.66.137.2
Jun 7, 2024 20:29:16.485717058 CEST	445	50101	60.66.137.2	192.168.2.4
Jun 7, 2024 20:29:16.485776901 CEST	445	50101	60.66.137.2	192.168.2.4
Jun 7, 2024 20:29:16.997345924 CEST	50147	445	192.168.2.4	80.128.41.149
Jun 7, 2024 20:29:17.002271891 CEST	445	50147	80.128.41.149	192.168.2.4
Jun 7, 2024 20:29:17.002409935 CEST	50147	445	192.168.2.4	80.128.41.149
Jun 7, 2024 20:29:17.002537012 CEST	50147	445	192.168.2.4	80.128.41.149
Jun 7, 2024 20:29:17.002737045 CEST	50148	445	192.168.2.4	80.128.41.1
Jun 7, 2024 20:29:17.007559061 CEST	445	50148	80.128.41.1	192.168.2.4
Jun 7, 2024 20:29:17.007646084 CEST	50148	445	192.168.2.4	80.128.41.1
Jun 7, 2024 20:29:17.007672071 CEST	50148	445	192.168.2.4	80.128.41.1
Jun 7, 2024 20:29:17.007961035 CEST	445	50147	80.128.41.149	192.168.2.4
Jun 7, 2024 20:29:17.007970095 CEST	50149	445	192.168.2.4	80.128.41.1
Jun 7, 2024 20:29:17.008016109 CEST	50147	445	192.168.2.4	80.128.41.149
Jun 7, 2024 20:29:17.012866020 CEST	445	50149	80.128.41.1	192.168.2.4
Jun 7, 2024 20:29:17.012892962 CEST	445	50148	80.128.41.1	192.168.2.4
Jun 7, 2024 20:29:17.012944937 CEST	50149	445	192.168.2.4	80.128.41.1
Jun 7, 2024 20:29:17.012995958 CEST	50149	445	192.168.2.4	80.128.41.1
Jun 7, 2024 20:29:17.013112068 CEST	445	50148	80.128.41.1	192.168.2.4
Jun 7, 2024 20:29:17.013153076 CEST	50148	445	192.168.2.4	80.128.41.1
Jun 7, 2024 20:29:17.017851114 CEST	445	50149	80.128.41.1	192.168.2.4
Jun 7, 2024 20:29:17.194936037 CEST	50150	445	192.168.2.4	5.26.5.1
Jun 7, 2024 20:29:17.199980974 CEST	445	50150	5.26.5.1	192.168.2.4
Jun 7, 2024 20:29:17.200089931 CEST	50150	445	192.168.2.4	5.26.5.1
Jun 7, 2024 20:29:17.200242043 CEST	50150	445	192.168.2.4	5.26.5.1
Jun 7, 2024 20:29:17.205117941 CEST	445	50150	5.26.5.1	192.168.2.4
Jun 7, 2024 20:29:17.345053911 CEST	445	50104	12.109.166.1	192.168.2.4
Jun 7, 2024 20:29:17.345169067 CEST	50104	445	192.168.2.4	12.109.166.1
Jun 7, 2024 20:29:17.357491970 CEST	50104	445	192.168.2.4	12.109.166.1
Jun 7, 2024 20:29:17.357534885 CEST	50104	445	192.168.2.4	12.109.166.1
Jun 7, 2024 20:29:17.362683058 CEST	445	50104	12.109.166.1	192.168.2.4
Jun 7, 2024 20:29:17.362704039 CEST	445	50104	12.109.166.1	192.168.2.4
Jun 7, 2024 20:29:17.481559038 CEST	50151	445	192.168.2.4	124.233.139.2
Jun 7, 2024 20:29:17.486677885 CEST	445	50151	124.233.139.2	192.168.2.4
Jun 7, 2024 20:29:17.486762047 CEST	50151	445	192.168.2.4	124.233.139.2
Jun 7, 2024 20:29:17.486974001 CEST	50151	445	192.168.2.4	124.233.139.2
Jun 7, 2024 20:29:17.491813898 CEST	445	50151	124.233.139.2	192.168.2.4
Jun 7, 2024 20:29:17.679598093 CEST	445	50149	80.128.41.1	192.168.2.4
Jun 7, 2024 20:29:17.679686069 CEST	50149	445	192.168.2.4	80.128.41.1
Jun 7, 2024 20:29:17.679796934 CEST	50149	445	192.168.2.4	80.128.41.1
Jun 7, 2024 20:29:17.679796934 CEST	50149	445	192.168.2.4	80.128.41.1
Jun 7, 2024 20:29:17.684720993 CEST	445	50149	80.128.41.1	192.168.2.4
Jun 7, 2024 20:29:17.684861898 CEST	445	50149	80.128.41.1	192.168.2.4
Jun 7, 2024 20:29:17.872414112 CEST	50152	445	192.168.2.4	1.30.233.135
Jun 7, 2024 20:29:17.877377033 CEST	445	50152	1.30.233.135	192.168.2.4
Jun 7, 2024 20:29:17.877474070 CEST	50152	445	192.168.2.4	1.30.233.135
Jun 7, 2024 20:29:17.877491951 CEST	50152	445	192.168.2.4	1.30.233.135
Jun 7, 2024 20:29:17.877604961 CEST	50153	445	192.168.2.4	1.30.233.1
Jun 7, 2024 20:29:17.882875919 CEST	445	50152	1.30.233.135	192.168.2.4
Jun 7, 2024 20:29:17.882929087 CEST	445	50153	1.30.233.1	192.168.2.4
Jun 7, 2024 20:29:17.882944107 CEST	50152	445	192.168.2.4	1.30.233.135
Jun 7, 2024 20:29:17.882986069 CEST	50153	445	192.168.2.4	1.30.233.1
Jun 7, 2024 20:29:17.883055925 CEST	50153	445	192.168.2.4	1.30.233.1
Jun 7, 2024 20:29:17.883325100 CEST	50154	445	192.168.2.4	1.30.233.1
Jun 7, 2024 20:29:17.888267994 CEST	445	50154	1.30.233.1	192.168.2.4
Jun 7, 2024 20:29:17.888329029 CEST	50154	445	192.168.2.4	1.30.233.1
Jun 7, 2024 20:29:17.888370991 CEST	50154	445	192.168.2.4	1.30.233.1
Jun 7, 2024 20:29:17.888626099 CEST	445	50153	1.30.233.1	192.168.2.4
Jun 7, 2024 20:29:17.888674021 CEST	50153	445	192.168.2.4	1.30.233.1
Jun 7, 2024 20:29:17.893291950 CEST	445	50154	1.30.233.1	192.168.2.4
Jun 7, 2024 20:29:18.012387037 CEST	445	50105	19.152.241.1	192.168.2.4
Jun 7, 2024 20:29:18.012720108 CEST	50105	445	192.168.2.4	19.152.241.1
Jun 7, 2024 20:29:18.012759924 CEST	50105	445	192.168.2.4	19.152.241.1
Jun 7, 2024 20:29:18.012789965 CEST	50105	445	192.168.2.4	19.152.241.1
Jun 7, 2024 20:29:18.017781973 CEST	445	50105	19.152.241.1	192.168.2.4
Jun 7, 2024 20:29:18.017792940 CEST	445	50105	19.152.241.1	192.168.2.4
Jun 7, 2024 20:29:18.075191021 CEST	50155	445	192.168.2.4	19.152.241.2
Jun 7, 2024 20:29:18.080094099 CEST	445	50155	19.152.241.2	192.168.2.4
Jun 7, 2024 20:29:18.080164909 CEST	50155	445	192.168.2.4	19.152.241.2
Jun 7, 2024 20:29:18.080209970 CEST	50155	445	192.168.2.4	19.152.241.2
Jun 7, 2024 20:29:18.080555916 CEST	50156	445	192.168.2.4	19.152.241.2
Jun 7, 2024 20:29:18.085392952 CEST	445	50156	19.152.241.2	192.168.2.4
Jun 7, 2024 20:29:18.085464954 CEST	50156	445	192.168.2.4	19.152.241.2
Jun 7, 2024 20:29:18.085506916 CEST	50156	445	192.168.2.4	19.152.241.2
Jun 7, 2024 20:29:18.085602045 CEST	445	50155	19.152.241.2	192.168.2.4
Jun 7, 2024 20:29:18.085650921 CEST	50155	445	192.168.2.4	19.152.241.2
Jun 7, 2024 20:29:18.090312958 CEST	445	50156	19.152.241.2	192.168.2.4
Jun 7, 2024 20:29:18.499011993 CEST	445	50107	146.93.6.2	192.168.2.4
Jun 7, 2024 20:29:18.499087095 CEST	50107	445	192.168.2.4	146.93.6.2
Jun 7, 2024 20:29:18.499124050 CEST	50107	445	192.168.2.4	146.93.6.2
Jun 7, 2024 20:29:18.499156952 CEST	50107	445	192.168.2.4	146.93.6.2
Jun 7, 2024 20:29:18.504024982 CEST	445	50107	146.93.6.2	192.168.2.4
Jun 7, 2024 20:29:18.504060984 CEST	445	50107	146.93.6.2	192.168.2.4
Jun 7, 2024 20:29:18.527967930 CEST	445	50108	15.84.171.2	192.168.2.4
Jun 7, 2024 20:29:18.528023958 CEST	50108	445	192.168.2.4	15.84.171.2
Jun 7, 2024 20:29:18.528192043 CEST	50108	445	192.168.2.4	15.84.171.2
Jun 7, 2024 20:29:18.528250933 CEST	50108	445	192.168.2.4	15.84.171.2
Jun 7, 2024 20:29:18.533047915 CEST	445	50108	15.84.171.2	192.168.2.4
Jun 7, 2024 20:29:18.533076048 CEST	445	50108	15.84.171.2	192.168.2.4
Jun 7, 2024 20:29:18.590888977 CEST	50157	445	192.168.2.4	15.84.171.3
Jun 7, 2024 20:29:18.595882893 CEST	445	50157	15.84.171.3	192.168.2.4
Jun 7, 2024 20:29:18.595962048 CEST	50157	445	192.168.2.4	15.84.171.3
Jun 7, 2024 20:29:18.596041918 CEST	50157	445	192.168.2.4	15.84.171.3
Jun 7, 2024 20:29:18.596436024 CEST	50158	445	192.168.2.4	15.84.171.3
Jun 7, 2024 20:29:18.599369049 CEST	445	50110	102.224.158.3	192.168.2.4
Jun 7, 2024 20:29:18.599438906 CEST	50110	445	192.168.2.4	102.224.158.3
Jun 7, 2024 20:29:18.599534988 CEST	50110	445	192.168.2.4	102.224.158.3
Jun 7, 2024 20:29:18.599534988 CEST	50110	445	192.168.2.4	102.224.158.3
Jun 7, 2024 20:29:18.600892067 CEST	445	50157	15.84.171.3	192.168.2.4
Jun 7, 2024 20:29:18.601289034 CEST	445	50158	15.84.171.3	192.168.2.4
Jun 7, 2024 20:29:18.601349115 CEST	50158	445	192.168.2.4	15.84.171.3
Jun 7, 2024 20:29:18.601366043 CEST	50158	445	192.168.2.4	15.84.171.3
Jun 7, 2024 20:29:18.604381084 CEST	445	50110	102.224.158.3	192.168.2.4
Jun 7, 2024 20:29:18.604429960 CEST	445	50110	102.224.158.3	192.168.2.4
Jun 7, 2024 20:29:18.606198072 CEST	445	50158	15.84.171.3	192.168.2.4
Jun 7, 2024 20:29:18.622425079 CEST	445	50157	15.84.171.3	192.168.2.4
Jun 7, 2024 20:29:18.622473955 CEST	50157	445	192.168.2.4	15.84.171.3
Jun 7, 2024 20:29:18.700653076 CEST	50159	445	192.168.2.4	105.138.251.2
Jun 7, 2024 20:29:18.705579042 CEST	445	50159	105.138.251.2	192.168.2.4
Jun 7, 2024 20:29:18.705652952 CEST	50159	445	192.168.2.4	105.138.251.2
Jun 7, 2024 20:29:18.705729008 CEST	50159	445	192.168.2.4	105.138.251.2
Jun 7, 2024 20:29:18.706021070 CEST	50160	445	192.168.2.4	105.138.251.1
Jun 7, 2024 20:29:18.710922956 CEST	445	50160	105.138.251.1	192.168.2.4
Jun 7, 2024 20:29:18.710978031 CEST	50160	445	192.168.2.4	105.138.251.1
Jun 7, 2024 20:29:18.711013079 CEST	445	50159	105.138.251.2	192.168.2.4
Jun 7, 2024 20:29:18.711026907 CEST	50160	445	192.168.2.4	105.138.251.1
Jun 7, 2024 20:29:18.711072922 CEST	50159	445	192.168.2.4	105.138.251.2
Jun 7, 2024 20:29:18.711464882 CEST	50161	445	192.168.2.4	105.138.251.1
Jun 7, 2024 20:29:18.716371059 CEST	445	50161	105.138.251.1	192.168.2.4
Jun 7, 2024 20:29:18.716383934 CEST	445	50160	105.138.251.1	192.168.2.4
Jun 7, 2024 20:29:18.716442108 CEST	50161	445	192.168.2.4	105.138.251.1
Jun 7, 2024 20:29:18.716464043 CEST	50160	445	192.168.2.4	105.138.251.1
Jun 7, 2024 20:29:18.716527939 CEST	50161	445	192.168.2.4	105.138.251.1
Jun 7, 2024 20:29:18.721410036 CEST	445	50161	105.138.251.1	192.168.2.4
Jun 7, 2024 20:29:18.758929014 CEST	445	50113	115.42.153.1	192.168.2.4
Jun 7, 2024 20:29:18.759030104 CEST	50113	445	192.168.2.4	115.42.153.1
Jun 7, 2024 20:29:18.759059906 CEST	50113	445	192.168.2.4	115.42.153.1
Jun 7, 2024 20:29:18.759100914 CEST	50113	445	192.168.2.4	115.42.153.1
Jun 7, 2024 20:29:18.764030933 CEST	445	50113	115.42.153.1	192.168.2.4
Jun 7, 2024 20:29:18.764060020 CEST	445	50113	115.42.153.1	192.168.2.4
Jun 7, 2024 20:29:18.809575081 CEST	50162	445	192.168.2.4	98.247.99.1
Jun 7, 2024 20:29:18.814518929 CEST	445	50162	98.247.99.1	192.168.2.4
Jun 7, 2024 20:29:18.814587116 CEST	50162	445	192.168.2.4	98.247.99.1
Jun 7, 2024 20:29:18.814605951 CEST	50162	445	192.168.2.4	98.247.99.1
Jun 7, 2024 20:29:18.819610119 CEST	445	50162	98.247.99.1	192.168.2.4
Jun 7, 2024 20:29:19.434581041 CEST	50163	445	192.168.2.4	136.232.217.3
Jun 7, 2024 20:29:19.439845085 CEST	445	50163	136.232.217.3	192.168.2.4
Jun 7, 2024 20:29:19.439940929 CEST	50163	445	192.168.2.4	136.232.217.3
Jun 7, 2024 20:29:19.440064907 CEST	50163	445	192.168.2.4	136.232.217.3
Jun 7, 2024 20:29:19.445101976 CEST	445	50163	136.232.217.3	192.168.2.4
Jun 7, 2024 20:29:19.481420994 CEST	50165	445	192.168.2.4	60.66.137.2
Jun 7, 2024 20:29:19.486426115 CEST	445	50165	60.66.137.2	192.168.2.4
Jun 7, 2024 20:29:19.486540079 CEST	50165	445	192.168.2.4	60.66.137.2
Jun 7, 2024 20:29:19.486578941 CEST	50165	445	192.168.2.4	60.66.137.2
Jun 7, 2024 20:29:19.491538048 CEST	445	50165	60.66.137.2	192.168.2.4
Jun 7, 2024 20:29:20.080962896 CEST	445	50116	81.230.11.1	192.168.2.4
Jun 7, 2024 20:29:20.081789017 CEST	50116	445	192.168.2.4	81.230.11.1
Jun 7, 2024 20:29:20.084280014 CEST	50116	445	192.168.2.4	81.230.11.1
Jun 7, 2024 20:29:20.084335089 CEST	50116	445	192.168.2.4	81.230.11.1
Jun 7, 2024 20:29:20.089782953 CEST	445	50116	81.230.11.1	192.168.2.4
Jun 7, 2024 20:29:20.089813948 CEST	445	50116	81.230.11.1	192.168.2.4
Jun 7, 2024 20:29:20.102902889 CEST	445	50118	8.191.246.2	192.168.2.4
Jun 7, 2024 20:29:20.103601933 CEST	445	50117	110.10.245.1	192.168.2.4
Jun 7, 2024 20:29:20.103717089 CEST	50118	445	192.168.2.4	8.191.246.2
Jun 7, 2024 20:29:20.103769064 CEST	50118	445	192.168.2.4	8.191.246.2
Jun 7, 2024 20:29:20.103780031 CEST	50117	445	192.168.2.4	110.10.245.1
Jun 7, 2024 20:29:20.103833914 CEST	50117	445	192.168.2.4	110.10.245.1
Jun 7, 2024 20:29:20.103835106 CEST	50118	445	192.168.2.4	8.191.246.2
Jun 7, 2024 20:29:20.103861094 CEST	50117	445	192.168.2.4	110.10.245.1
Jun 7, 2024 20:29:20.108716011 CEST	445	50118	8.191.246.2	192.168.2.4
Jun 7, 2024 20:29:20.108769894 CEST	445	50117	110.10.245.1	192.168.2.4
Jun 7, 2024 20:29:20.108928919 CEST	445	50118	8.191.246.2	192.168.2.4
Jun 7, 2024 20:29:20.108958960 CEST	445	50117	110.10.245.1	192.168.2.4
Jun 7, 2024 20:29:20.168993950 CEST	50166	445	192.168.2.4	110.10.245.2
Jun 7, 2024 20:29:20.169122934 CEST	50167	445	192.168.2.4	8.191.246.3
Jun 7, 2024 20:29:20.174160004 CEST	445	50166	110.10.245.2	192.168.2.4
Jun 7, 2024 20:29:20.174192905 CEST	445	50167	8.191.246.3	192.168.2.4
Jun 7, 2024 20:29:20.174235106 CEST	50166	445	192.168.2.4	110.10.245.2
Jun 7, 2024 20:29:20.174267054 CEST	50166	445	192.168.2.4	110.10.245.2
Jun 7, 2024 20:29:20.174362898 CEST	50167	445	192.168.2.4	8.191.246.3
Jun 7, 2024 20:29:20.174362898 CEST	50167	445	192.168.2.4	8.191.246.3
Jun 7, 2024 20:29:20.174593925 CEST	50169	445	192.168.2.4	8.191.246.3
Jun 7, 2024 20:29:20.174606085 CEST	50168	445	192.168.2.4	110.10.245.2
Jun 7, 2024 20:29:20.179549932 CEST	445	50169	8.191.246.3	192.168.2.4
Jun 7, 2024 20:29:20.179606915 CEST	445	50168	110.10.245.2	192.168.2.4
Jun 7, 2024 20:29:20.179621935 CEST	50169	445	192.168.2.4	8.191.246.3
Jun 7, 2024 20:29:20.179642916 CEST	445	50166	110.10.245.2	192.168.2.4
Jun 7, 2024 20:29:20.179646969 CEST	50169	445	192.168.2.4	8.191.246.3
Jun 7, 2024 20:29:20.179692984 CEST	50166	445	192.168.2.4	110.10.245.2
Jun 7, 2024 20:29:20.179712057 CEST	50168	445	192.168.2.4	110.10.245.2
Jun 7, 2024 20:29:20.179836035 CEST	50168	445	192.168.2.4	110.10.245.2
Jun 7, 2024 20:29:20.179913998 CEST	445	50167	8.191.246.3	192.168.2.4
Jun 7, 2024 20:29:20.180032015 CEST	50167	445	192.168.2.4	8.191.246.3
Jun 7, 2024 20:29:20.184590101 CEST	445	50169	8.191.246.3	192.168.2.4
Jun 7, 2024 20:29:20.184683084 CEST	445	50168	110.10.245.2	192.168.2.4
Jun 7, 2024 20:29:20.372107983 CEST	50171	445	192.168.2.4	12.109.166.1
Jun 7, 2024 20:29:20.377079964 CEST	445	50171	12.109.166.1	192.168.2.4
Jun 7, 2024 20:29:20.377162933 CEST	50171	445	192.168.2.4	12.109.166.1
Jun 7, 2024 20:29:20.377194881 CEST	50171	445	192.168.2.4	12.109.166.1
Jun 7, 2024 20:29:20.382189035 CEST	445	50171	12.109.166.1	192.168.2.4
Jun 7, 2024 20:29:20.575333118 CEST	50172	445	192.168.2.4	212.60.2.40
Jun 7, 2024 20:29:20.580432892 CEST	445	50172	212.60.2.40	192.168.2.4
Jun 7, 2024 20:29:20.580537081 CEST	50172	445	192.168.2.4	212.60.2.40
Jun 7, 2024 20:29:20.580571890 CEST	50172	445	192.168.2.4	212.60.2.40
Jun 7, 2024 20:29:20.580739021 CEST	50173	445	192.168.2.4	212.60.2.1
Jun 7, 2024 20:29:20.585728884 CEST	445	50173	212.60.2.1	192.168.2.4
Jun 7, 2024 20:29:20.585809946 CEST	50173	445	192.168.2.4	212.60.2.1
Jun 7, 2024 20:29:20.585834026 CEST	50173	445	192.168.2.4	212.60.2.1
Jun 7, 2024 20:29:20.585916042 CEST	445	50172	212.60.2.40	192.168.2.4
Jun 7, 2024 20:29:20.585973024 CEST	50172	445	192.168.2.4	212.60.2.40
Jun 7, 2024 20:29:20.586186886 CEST	50174	445	192.168.2.4	212.60.2.1
Jun 7, 2024 20:29:20.590867996 CEST	445	50173	212.60.2.1	192.168.2.4
Jun 7, 2024 20:29:20.590924025 CEST	50173	445	192.168.2.4	212.60.2.1
Jun 7, 2024 20:29:20.591057062 CEST	445	50174	212.60.2.1	192.168.2.4
Jun 7, 2024 20:29:20.591120958 CEST	50174	445	192.168.2.4	212.60.2.1
Jun 7, 2024 20:29:20.591134071 CEST	50174	445	192.168.2.4	212.60.2.1
Jun 7, 2024 20:29:20.596055984 CEST	445	50174	212.60.2.1	192.168.2.4
Jun 7, 2024 20:29:20.660053968 CEST	445	50120	201.130.185.3	192.168.2.4
Jun 7, 2024 20:29:20.660165071 CEST	50120	445	192.168.2.4	201.130.185.3
Jun 7, 2024 20:29:20.660165071 CEST	50120	445	192.168.2.4	201.130.185.3
Jun 7, 2024 20:29:20.660250902 CEST	50120	445	192.168.2.4	201.130.185.3
Jun 7, 2024 20:29:20.665169001 CEST	445	50120	201.130.185.3	192.168.2.4
Jun 7, 2024 20:29:20.665185928 CEST	445	50120	201.130.185.3	192.168.2.4
Jun 7, 2024 20:29:20.684649944 CEST	50175	445	192.168.2.4	80.128.41.1
Jun 7, 2024 20:29:20.689616919 CEST	445	50175	80.128.41.1	192.168.2.4
Jun 7, 2024 20:29:20.689708948 CEST	50175	445	192.168.2.4	80.128.41.1
Jun 7, 2024 20:29:20.689754009 CEST	50175	445	192.168.2.4	80.128.41.1
Jun 7, 2024 20:29:20.694612026 CEST	445	50175	80.128.41.1	192.168.2.4
Jun 7, 2024 20:29:20.744283915 CEST	445	50122	50.241.97.2	192.168.2.4
Jun 7, 2024 20:29:20.744354963 CEST	50122	445	192.168.2.4	50.241.97.2
Jun 7, 2024 20:29:20.744421959 CEST	50122	445	192.168.2.4	50.241.97.2
Jun 7, 2024 20:29:20.744421959 CEST	50122	445	192.168.2.4	50.241.97.2
Jun 7, 2024 20:29:20.749237061 CEST	445	50122	50.241.97.2	192.168.2.4
Jun 7, 2024 20:29:20.749336004 CEST	445	50122	50.241.97.2	192.168.2.4
Jun 7, 2024 20:29:21.309637070 CEST	445	50125	159.26.251.1	192.168.2.4
Jun 7, 2024 20:29:21.309743881 CEST	50125	445	192.168.2.4	159.26.251.1
Jun 7, 2024 20:29:21.309743881 CEST	50125	445	192.168.2.4	159.26.251.1
Jun 7, 2024 20:29:21.309834003 CEST	50125	445	192.168.2.4	159.26.251.1
Jun 7, 2024 20:29:21.315289021 CEST	445	50125	159.26.251.1	192.168.2.4
Jun 7, 2024 20:29:21.315323114 CEST	445	50125	159.26.251.1	192.168.2.4
Jun 7, 2024 20:29:21.348556995 CEST	445	50175	80.128.41.1	192.168.2.4
Jun 7, 2024 20:29:21.348634005 CEST	50175	445	192.168.2.4	80.128.41.1
Jun 7, 2024 20:29:21.348690033 CEST	50175	445	192.168.2.4	80.128.41.1
Jun 7, 2024 20:29:21.348745108 CEST	50175	445	192.168.2.4	80.128.41.1
Jun 7, 2024 20:29:21.354110956 CEST	445	50175	80.128.41.1	192.168.2.4
Jun 7, 2024 20:29:21.354429960 CEST	445	50175	80.128.41.1	192.168.2.4
Jun 7, 2024 20:29:21.354588985 CEST	50178	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:29:21.354625940 CEST	443	50178	20.12.23.50	192.168.2.4
Jun 7, 2024 20:29:21.354692936 CEST	50178	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:29:21.355178118 CEST	50178	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:29:21.355194092 CEST	443	50178	20.12.23.50	192.168.2.4
Jun 7, 2024 20:29:21.403362036 CEST	50179	445	192.168.2.4	80.128.41.2
Jun 7, 2024 20:29:21.408716917 CEST	445	50179	80.128.41.2	192.168.2.4
Jun 7, 2024 20:29:21.408845901 CEST	50179	445	192.168.2.4	80.128.41.2
Jun 7, 2024 20:29:21.408989906 CEST	50179	445	192.168.2.4	80.128.41.2
Jun 7, 2024 20:29:21.409240007 CEST	50180	445	192.168.2.4	80.128.41.2
Jun 7, 2024 20:29:21.414185047 CEST	445	50180	80.128.41.2	192.168.2.4
Jun 7, 2024 20:29:21.414280891 CEST	50180	445	192.168.2.4	80.128.41.2
Jun 7, 2024 20:29:21.414292097 CEST	445	50179	80.128.41.2	192.168.2.4
Jun 7, 2024 20:29:21.414309978 CEST	50180	445	192.168.2.4	80.128.41.2
Jun 7, 2024 20:29:21.414385080 CEST	50179	445	192.168.2.4	80.128.41.2
Jun 7, 2024 20:29:21.420207024 CEST	445	50180	80.128.41.2	192.168.2.4
Jun 7, 2024 20:29:21.512689114 CEST	50182	445	192.168.2.4	146.93.6.2
Jun 7, 2024 20:29:21.517749071 CEST	445	50182	146.93.6.2	192.168.2.4
Jun 7, 2024 20:29:21.517838955 CEST	50182	445	192.168.2.4	146.93.6.2
Jun 7, 2024 20:29:21.517855883 CEST	50182	445	192.168.2.4	146.93.6.2
Jun 7, 2024 20:29:21.522857904 CEST	445	50182	146.93.6.2	192.168.2.4
Jun 7, 2024 20:29:21.606379986 CEST	50183	445	192.168.2.4	102.224.158.3
Jun 7, 2024 20:29:21.611300945 CEST	445	50183	102.224.158.3	192.168.2.4
Jun 7, 2024 20:29:21.611363888 CEST	50183	445	192.168.2.4	102.224.158.3
Jun 7, 2024 20:29:21.611391068 CEST	50183	445	192.168.2.4	102.224.158.3
Jun 7, 2024 20:29:21.616329908 CEST	445	50183	102.224.158.3	192.168.2.4
Jun 7, 2024 20:29:21.762799025 CEST	50184	445	192.168.2.4	115.42.153.1
Jun 7, 2024 20:29:21.769042969 CEST	445	50184	115.42.153.1	192.168.2.4
Jun 7, 2024 20:29:21.769129038 CEST	50184	445	192.168.2.4	115.42.153.1
Jun 7, 2024 20:29:21.769233942 CEST	50184	445	192.168.2.4	115.42.153.1
Jun 7, 2024 20:29:21.775290966 CEST	445	50184	115.42.153.1	192.168.2.4
Jun 7, 2024 20:29:21.937714100 CEST	445	50126	53.251.193.2	192.168.2.4
Jun 7, 2024 20:29:21.937792063 CEST	50126	445	192.168.2.4	53.251.193.2
Jun 7, 2024 20:29:21.937829018 CEST	50126	445	192.168.2.4	53.251.193.2
Jun 7, 2024 20:29:21.937865973 CEST	50126	445	192.168.2.4	53.251.193.2
Jun 7, 2024 20:29:21.942806005 CEST	445	50126	53.251.193.2	192.168.2.4
Jun 7, 2024 20:29:21.942836046 CEST	445	50126	53.251.193.2	192.168.2.4
Jun 7, 2024 20:29:21.997050047 CEST	50186	445	192.168.2.4	53.251.193.3
Jun 7, 2024 20:29:22.002038002 CEST	445	50186	53.251.193.3	192.168.2.4
Jun 7, 2024 20:29:22.002120018 CEST	50186	445	192.168.2.4	53.251.193.3
Jun 7, 2024 20:29:22.002155066 CEST	50186	445	192.168.2.4	53.251.193.3
Jun 7, 2024 20:29:22.002516985 CEST	50187	445	192.168.2.4	53.251.193.3
Jun 7, 2024 20:29:22.007333040 CEST	445	50186	53.251.193.3	192.168.2.4
Jun 7, 2024 20:29:22.007410049 CEST	50186	445	192.168.2.4	53.251.193.3
Jun 7, 2024 20:29:22.007412910 CEST	445	50187	53.251.193.3	192.168.2.4
Jun 7, 2024 20:29:22.007473946 CEST	50187	445	192.168.2.4	53.251.193.3
Jun 7, 2024 20:29:22.007524014 CEST	50187	445	192.168.2.4	53.251.193.3
Jun 7, 2024 20:29:22.012392044 CEST	445	50187	53.251.193.3	192.168.2.4
Jun 7, 2024 20:29:22.041290998 CEST	445	50127	182.85.58.1	192.168.2.4
Jun 7, 2024 20:29:22.041357040 CEST	50127	445	192.168.2.4	182.85.58.1
Jun 7, 2024 20:29:22.041383982 CEST	50127	445	192.168.2.4	182.85.58.1
Jun 7, 2024 20:29:22.041429996 CEST	50127	445	192.168.2.4	182.85.58.1
Jun 7, 2024 20:29:22.046304941 CEST	445	50127	182.85.58.1	192.168.2.4
Jun 7, 2024 20:29:22.046334982 CEST	445	50127	182.85.58.1	192.168.2.4
Jun 7, 2024 20:29:22.106484890 CEST	50189	445	192.168.2.4	182.85.58.2
Jun 7, 2024 20:29:22.111459017 CEST	445	50189	182.85.58.2	192.168.2.4
Jun 7, 2024 20:29:22.111562967 CEST	50189	445	192.168.2.4	182.85.58.2
Jun 7, 2024 20:29:22.111589909 CEST	50189	445	192.168.2.4	182.85.58.2
Jun 7, 2024 20:29:22.111979008 CEST	50190	445	192.168.2.4	182.85.58.2
Jun 7, 2024 20:29:22.116902113 CEST	445	50190	182.85.58.2	192.168.2.4
Jun 7, 2024 20:29:22.116954088 CEST	445	50189	182.85.58.2	192.168.2.4
Jun 7, 2024 20:29:22.116980076 CEST	50190	445	192.168.2.4	182.85.58.2
Jun 7, 2024 20:29:22.117014885 CEST	50190	445	192.168.2.4	182.85.58.2
Jun 7, 2024 20:29:22.117197037 CEST	445	50189	182.85.58.2	192.168.2.4
Jun 7, 2024 20:29:22.117244959 CEST	50189	445	192.168.2.4	182.85.58.2
Jun 7, 2024 20:29:22.121866941 CEST	445	50190	182.85.58.2	192.168.2.4
Jun 7, 2024 20:29:22.238811016 CEST	443	50178	20.12.23.50	192.168.2.4
Jun 7, 2024 20:29:22.238892078 CEST	50178	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:29:22.242587090 CEST	50178	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:29:22.242594957 CEST	443	50178	20.12.23.50	192.168.2.4
Jun 7, 2024 20:29:22.242804050 CEST	443	50178	20.12.23.50	192.168.2.4
Jun 7, 2024 20:29:22.252114058 CEST	50178	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:29:22.296503067 CEST	443	50178	20.12.23.50	192.168.2.4
Jun 7, 2024 20:29:22.541845083 CEST	443	50178	20.12.23.50	192.168.2.4
Jun 7, 2024 20:29:22.541870117 CEST	443	50178	20.12.23.50	192.168.2.4
Jun 7, 2024 20:29:22.541906118 CEST	443	50178	20.12.23.50	192.168.2.4
Jun 7, 2024 20:29:22.541960955 CEST	50178	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:29:22.541977882 CEST	443	50178	20.12.23.50	192.168.2.4
Jun 7, 2024 20:29:22.542028904 CEST	50178	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:29:22.542028904 CEST	50178	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:29:22.542918921 CEST	443	50178	20.12.23.50	192.168.2.4
Jun 7, 2024 20:29:22.542954922 CEST	443	50178	20.12.23.50	192.168.2.4
Jun 7, 2024 20:29:22.542998075 CEST	443	50178	20.12.23.50	192.168.2.4
Jun 7, 2024 20:29:22.543016911 CEST	50178	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:29:22.543051958 CEST	50178	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:29:22.546514988 CEST	50178	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:29:22.546535015 CEST	443	50178	20.12.23.50	192.168.2.4
Jun 7, 2024 20:29:22.546550035 CEST	50178	443	192.168.2.4	20.12.23.50
Jun 7, 2024 20:29:22.546555996 CEST	443	50178	20.12.23.50	192.168.2.4
Jun 7, 2024 20:29:22.584861040 CEST	445	50130	206.199.41.1	192.168.2.4
Jun 7, 2024 20:29:22.584980011 CEST	50130	445	192.168.2.4	206.199.41.1
Jun 7, 2024 20:29:22.584980011 CEST	50130	445	192.168.2.4	206.199.41.1
Jun 7, 2024 20:29:22.585042953 CEST	50130	445	192.168.2.4	206.199.41.1
Jun 7, 2024 20:29:22.590059042 CEST	445	50130	206.199.41.1	192.168.2.4
Jun 7, 2024 20:29:22.590090990 CEST	445	50130	206.199.41.1	192.168.2.4
Jun 7, 2024 20:29:22.637356043 CEST	445	50133	184.153.104.2	192.168.2.4
Jun 7, 2024 20:29:22.637418032 CEST	50133	445	192.168.2.4	184.153.104.2
Jun 7, 2024 20:29:22.637456894 CEST	50133	445	192.168.2.4	184.153.104.2
Jun 7, 2024 20:29:22.637487888 CEST	50133	445	192.168.2.4	184.153.104.2
Jun 7, 2024 20:29:22.638881922 CEST	445	50134	161.80.213.3	192.168.2.4
Jun 7, 2024 20:29:22.638941050 CEST	50134	445	192.168.2.4	161.80.213.3
Jun 7, 2024 20:29:22.638974905 CEST	50134	445	192.168.2.4	161.80.213.3
Jun 7, 2024 20:29:22.639087915 CEST	50134	445	192.168.2.4	161.80.213.3
Jun 7, 2024 20:29:22.642568111 CEST	445	50133	184.153.104.2	192.168.2.4
Jun 7, 2024 20:29:22.642622948 CEST	445	50133	184.153.104.2	192.168.2.4
Jun 7, 2024 20:29:22.643901110 CEST	445	50134	161.80.213.3	192.168.2.4
Jun 7, 2024 20:29:22.643953085 CEST	445	50134	161.80.213.3	192.168.2.4
Jun 7, 2024 20:29:23.090781927 CEST	50194	445	192.168.2.4	81.230.11.1
Jun 7, 2024 20:29:23.095936060 CEST	445	50194	81.230.11.1	192.168.2.4
Jun 7, 2024 20:29:23.096021891 CEST	50194	445	192.168.2.4	81.230.11.1
Jun 7, 2024 20:29:23.096035004 CEST	50194	445	192.168.2.4	81.230.11.1
Jun 7, 2024 20:29:23.100971937 CEST	445	50194	81.230.11.1	192.168.2.4
Jun 7, 2024 20:29:23.564074993 CEST	445	50137	54.6.208.1	192.168.2.4
Jun 7, 2024 20:29:23.564162970 CEST	50137	445	192.168.2.4	54.6.208.1
Jun 7, 2024 20:29:23.564214945 CEST	50137	445	192.168.2.4	54.6.208.1
Jun 7, 2024 20:29:23.564250946 CEST	50137	445	192.168.2.4	54.6.208.1
Jun 7, 2024 20:29:23.569279909 CEST	445	50137	54.6.208.1	192.168.2.4
Jun 7, 2024 20:29:23.569310904 CEST	445	50137	54.6.208.1	192.168.2.4
Jun 7, 2024 20:29:23.668936014 CEST	50200	445	192.168.2.4	201.130.185.3
Jun 7, 2024 20:29:23.674216986 CEST	445	50200	201.130.185.3	192.168.2.4
Jun 7, 2024 20:29:23.674313068 CEST	50200	445	192.168.2.4	201.130.185.3
Jun 7, 2024 20:29:23.674365997 CEST	50200	445	192.168.2.4	201.130.185.3
Jun 7, 2024 20:29:23.679312944 CEST	445	50200	201.130.185.3	192.168.2.4
Jun 7, 2024 20:29:23.746958017 CEST	50203	445	192.168.2.4	50.241.97.2
Jun 7, 2024 20:29:23.751957893 CEST	445	50203	50.241.97.2	192.168.2.4
Jun 7, 2024 20:29:23.752052069 CEST	50203	445	192.168.2.4	50.241.97.2
Jun 7, 2024 20:29:23.752052069 CEST	50203	445	192.168.2.4	50.241.97.2
Jun 7, 2024 20:29:23.757093906 CEST	445	50203	50.241.97.2	192.168.2.4
Jun 7, 2024 20:29:23.917294025 CEST	445	50138	87.45.211.1	192.168.2.4
Jun 7, 2024 20:29:23.917418003 CEST	50138	445	192.168.2.4	87.45.211.1
Jun 7, 2024 20:29:23.917531013 CEST	50138	445	192.168.2.4	87.45.211.1
Jun 7, 2024 20:29:23.917531013 CEST	50138	445	192.168.2.4	87.45.211.1
Jun 7, 2024 20:29:23.922693968 CEST	445	50138	87.45.211.1	192.168.2.4
Jun 7, 2024 20:29:23.922801971 CEST	445	50138	87.45.211.1	192.168.2.4
Jun 7, 2024 20:29:23.981431007 CEST	50204	445	192.168.2.4	87.45.211.2
Jun 7, 2024 20:29:23.986388922 CEST	445	50204	87.45.211.2	192.168.2.4
Jun 7, 2024 20:29:23.986505985 CEST	50204	445	192.168.2.4	87.45.211.2
Jun 7, 2024 20:29:23.986529112 CEST	50204	445	192.168.2.4	87.45.211.2
Jun 7, 2024 20:29:23.986922026 CEST	50205	445	192.168.2.4	87.45.211.2
Jun 7, 2024 20:29:23.987988949 CEST	445	50139	3.135.174.2	192.168.2.4
Jun 7, 2024 20:29:23.988869905 CEST	50139	445	192.168.2.4	3.135.174.2
Jun 7, 2024 20:29:23.988869905 CEST	50139	445	192.168.2.4	3.135.174.2
Jun 7, 2024 20:29:23.988869905 CEST	50139	445	192.168.2.4	3.135.174.2
Jun 7, 2024 20:29:23.991745949 CEST	445	50204	87.45.211.2	192.168.2.4
Jun 7, 2024 20:29:23.991816044 CEST	50204	445	192.168.2.4	87.45.211.2
Jun 7, 2024 20:29:23.991878033 CEST	445	50205	87.45.211.2	192.168.2.4
Jun 7, 2024 20:29:23.991992950 CEST	50205	445	192.168.2.4	87.45.211.2
Jun 7, 2024 20:29:23.991992950 CEST	50205	445	192.168.2.4	87.45.211.2
Jun 7, 2024 20:29:23.993798018 CEST	445	50139	3.135.174.2	192.168.2.4
Jun 7, 2024 20:29:23.993853092 CEST	445	50139	3.135.174.2	192.168.2.4
Jun 7, 2024 20:29:23.996972084 CEST	445	50205	87.45.211.2	192.168.2.4
Jun 7, 2024 20:29:24.043934107 CEST	50206	445	192.168.2.4	3.135.174.3
Jun 7, 2024 20:29:24.048894882 CEST	445	50206	3.135.174.3	192.168.2.4
Jun 7, 2024 20:29:24.048986912 CEST	50206	445	192.168.2.4	3.135.174.3
Jun 7, 2024 20:29:24.049030066 CEST	50206	445	192.168.2.4	3.135.174.3
Jun 7, 2024 20:29:24.049293041 CEST	50207	445	192.168.2.4	3.135.174.3
Jun 7, 2024 20:29:24.054241896 CEST	445	50207	3.135.174.3	192.168.2.4
Jun 7, 2024 20:29:24.054312944 CEST	50207	445	192.168.2.4	3.135.174.3
Jun 7, 2024 20:29:24.054343939 CEST	50207	445	192.168.2.4	3.135.174.3
Jun 7, 2024 20:29:24.054580927 CEST	445	50206	3.135.174.3	192.168.2.4
Jun 7, 2024 20:29:24.054661989 CEST	50206	445	192.168.2.4	3.135.174.3
Jun 7, 2024 20:29:24.059329033 CEST	445	50207	3.135.174.3	192.168.2.4
Jun 7, 2024 20:29:24.325172901 CEST	50212	445	192.168.2.4	159.26.251.1
Jun 7, 2024 20:29:24.330399036 CEST	445	50212	159.26.251.1	192.168.2.4
Jun 7, 2024 20:29:24.330477953 CEST	50212	445	192.168.2.4	159.26.251.1
Jun 7, 2024 20:29:24.330502987 CEST	50212	445	192.168.2.4	159.26.251.1
Jun 7, 2024 20:29:24.335485935 CEST	445	50212	159.26.251.1	192.168.2.4
Jun 7, 2024 20:29:24.462430954 CEST	445	50141	99.75.135.3	192.168.2.4
Jun 7, 2024 20:29:24.464796066 CEST	50141	445	192.168.2.4	99.75.135.3
Jun 7, 2024 20:29:24.464855909 CEST	50141	445	192.168.2.4	99.75.135.3
Jun 7, 2024 20:29:24.464905024 CEST	50141	445	192.168.2.4	99.75.135.3
Jun 7, 2024 20:29:24.469825029 CEST	445	50141	99.75.135.3	192.168.2.4
Jun 7, 2024 20:29:24.469857931 CEST	445	50141	99.75.135.3	192.168.2.4
Jun 7, 2024 20:29:24.553137064 CEST	445	50143	155.86.233.2	192.168.2.4
Jun 7, 2024 20:29:24.553227901 CEST	50143	445	192.168.2.4	155.86.233.2
Jun 7, 2024 20:29:24.554925919 CEST	50143	445	192.168.2.4	155.86.233.2
Jun 7, 2024 20:29:24.554965973 CEST	50143	445	192.168.2.4	155.86.233.2
Jun 7, 2024 20:29:24.559767962 CEST	445	50143	155.86.233.2	192.168.2.4
Jun 7, 2024 20:29:24.559891939 CEST	445	50143	155.86.233.2	192.168.2.4
Jun 7, 2024 20:29:24.561055899 CEST	445	50146	147.230.27.1	192.168.2.4
Jun 7, 2024 20:29:24.561114073 CEST	50146	445	192.168.2.4	147.230.27.1
Jun 7, 2024 20:29:24.561147928 CEST	50146	445	192.168.2.4	147.230.27.1
Jun 7, 2024 20:29:24.561187983 CEST	50146	445	192.168.2.4	147.230.27.1
Jun 7, 2024 20:29:24.566203117 CEST	445	50146	147.230.27.1	192.168.2.4
Jun 7, 2024 20:29:24.566239119 CEST	445	50146	147.230.27.1	192.168.2.4
Jun 7, 2024 20:29:25.598681927 CEST	50224	445	192.168.2.4	206.199.41.1
Jun 7, 2024 20:29:25.604165077 CEST	445	50224	206.199.41.1	192.168.2.4
Jun 7, 2024 20:29:25.606322050 CEST	50224	445	192.168.2.4	206.199.41.1
Jun 7, 2024 20:29:25.633749008 CEST	50224	445	192.168.2.4	206.199.41.1
Jun 7, 2024 20:29:25.638623953 CEST	445	50224	206.199.41.1	192.168.2.4
Jun 7, 2024 20:29:25.661187887 CEST	50227	445	192.168.2.4	161.80.213.3
Jun 7, 2024 20:29:25.661278963 CEST	50228	445	192.168.2.4	184.153.104.2
Jun 7, 2024 20:29:25.666115999 CEST	445	50227	161.80.213.3	192.168.2.4
Jun 7, 2024 20:29:25.666171074 CEST	445	50228	184.153.104.2	192.168.2.4
Jun 7, 2024 20:29:25.666254044 CEST	50227	445	192.168.2.4	161.80.213.3
Jun 7, 2024 20:29:25.666312933 CEST	50227	445	192.168.2.4	161.80.213.3
Jun 7, 2024 20:29:25.666315079 CEST	50228	445	192.168.2.4	184.153.104.2
Jun 7, 2024 20:29:25.666342020 CEST	50228	445	192.168.2.4	184.153.104.2
Jun 7, 2024 20:29:25.671444893 CEST	445	50227	161.80.213.3	192.168.2.4
Jun 7, 2024 20:29:25.671475887 CEST	445	50228	184.153.104.2	192.168.2.4
Jun 7, 2024 20:29:25.700371981 CEST	445	50150	5.26.5.1	192.168.2.4
Jun 7, 2024 20:29:25.700459957 CEST	50150	445	192.168.2.4	5.26.5.1
Jun 7, 2024 20:29:25.700459957 CEST	50150	445	192.168.2.4	5.26.5.1
Jun 7, 2024 20:29:25.700500011 CEST	50150	445	192.168.2.4	5.26.5.1
Jun 7, 2024 20:29:25.705554008 CEST	445	50150	5.26.5.1	192.168.2.4
Jun 7, 2024 20:29:25.705621004 CEST	445	50150	5.26.5.1	192.168.2.4
Jun 7, 2024 20:29:25.771136999 CEST	50229	445	192.168.2.4	5.26.5.2
Jun 7, 2024 20:29:25.776130915 CEST	445	50229	5.26.5.2	192.168.2.4
Jun 7, 2024 20:29:25.776294947 CEST	50229	445	192.168.2.4	5.26.5.2
Jun 7, 2024 20:29:25.776314020 CEST	50229	445	192.168.2.4	5.26.5.2
Jun 7, 2024 20:29:25.776591063 CEST	50230	445	192.168.2.4	5.26.5.2
Jun 7, 2024 20:29:25.781482935 CEST	445	50230	5.26.5.2	192.168.2.4
Jun 7, 2024 20:29:25.781536102 CEST	445	50229	5.26.5.2	192.168.2.4
Jun 7, 2024 20:29:25.781624079 CEST	50229	445	192.168.2.4	5.26.5.2
Jun 7, 2024 20:29:25.781646013 CEST	50230	445	192.168.2.4	5.26.5.2
Jun 7, 2024 20:29:25.785188913 CEST	50230	445	192.168.2.4	5.26.5.2
Jun 7, 2024 20:29:25.790085077 CEST	445	50230	5.26.5.2	192.168.2.4
Jun 7, 2024 20:29:25.986756086 CEST	445	50151	124.233.139.2	192.168.2.4
Jun 7, 2024 20:29:25.990786076 CEST	50151	445	192.168.2.4	124.233.139.2
Jun 7, 2024 20:29:25.993439913 CEST	50151	445	192.168.2.4	124.233.139.2
Jun 7, 2024 20:29:25.993577957 CEST	50151	445	192.168.2.4	124.233.139.2
Jun 7, 2024 20:29:25.998356104 CEST	445	50151	124.233.139.2	192.168.2.4
Jun 7, 2024 20:29:25.998471022 CEST	445	50151	124.233.139.2	192.168.2.4
Jun 7, 2024 20:29:26.091144085 CEST	50237	445	192.168.2.4	124.233.139.3
Jun 7, 2024 20:29:26.096359968 CEST	445	50237	124.233.139.3	192.168.2.4
Jun 7, 2024 20:29:26.096460104 CEST	50237	445	192.168.2.4	124.233.139.3
Jun 7, 2024 20:29:26.096489906 CEST	50237	445	192.168.2.4	124.233.139.3
Jun 7, 2024 20:29:26.096803904 CEST	50238	445	192.168.2.4	124.233.139.3
Jun 7, 2024 20:29:26.101711035 CEST	445	50238	124.233.139.3	192.168.2.4
Jun 7, 2024 20:29:26.101777077 CEST	50238	445	192.168.2.4	124.233.139.3
Jun 7, 2024 20:29:26.101795912 CEST	50238	445	192.168.2.4	124.233.139.3
Jun 7, 2024 20:29:26.101855040 CEST	445	50237	124.233.139.3	192.168.2.4
Jun 7, 2024 20:29:26.101903915 CEST	50237	445	192.168.2.4	124.233.139.3
Jun 7, 2024 20:29:26.106806993 CEST	445	50238	124.233.139.3	192.168.2.4
Jun 7, 2024 20:29:26.386898994 CEST	445	50154	1.30.233.1	192.168.2.4
Jun 7, 2024 20:29:26.387077093 CEST	50154	445	192.168.2.4	1.30.233.1
Jun 7, 2024 20:29:26.387135983 CEST	50154	445	192.168.2.4	1.30.233.1
Jun 7, 2024 20:29:26.387171030 CEST	50154	445	192.168.2.4	1.30.233.1
Jun 7, 2024 20:29:26.392066956 CEST	445	50154	1.30.233.1	192.168.2.4
Jun 7, 2024 20:29:26.392119884 CEST	445	50154	1.30.233.1	192.168.2.4
Jun 7, 2024 20:29:26.575154066 CEST	50245	445	192.168.2.4	54.6.208.1
Jun 7, 2024 20:29:26.579931021 CEST	445	50156	19.152.241.2	192.168.2.4
Jun 7, 2024 20:29:26.580014944 CEST	50156	445	192.168.2.4	19.152.241.2
Jun 7, 2024 20:29:26.580055952 CEST	50156	445	192.168.2.4	19.152.241.2
Jun 7, 2024 20:29:26.580079079 CEST	50156	445	192.168.2.4	19.152.241.2
Jun 7, 2024 20:29:26.580352068 CEST	445	50245	54.6.208.1	192.168.2.4
Jun 7, 2024 20:29:26.580424070 CEST	50245	445	192.168.2.4	54.6.208.1
Jun 7, 2024 20:29:26.580440998 CEST	50245	445	192.168.2.4	54.6.208.1
Jun 7, 2024 20:29:26.585144997 CEST	445	50156	19.152.241.2	192.168.2.4
Jun 7, 2024 20:29:26.585200071 CEST	445	50156	19.152.241.2	192.168.2.4
Jun 7, 2024 20:29:26.585382938 CEST	445	50245	54.6.208.1	192.168.2.4
Jun 7, 2024 20:29:27.109009981 CEST	445	50158	15.84.171.3	192.168.2.4
Jun 7, 2024 20:29:27.109093904 CEST	50158	445	192.168.2.4	15.84.171.3
Jun 7, 2024 20:29:27.109185934 CEST	50158	445	192.168.2.4	15.84.171.3
Jun 7, 2024 20:29:27.109185934 CEST	50158	445	192.168.2.4	15.84.171.3
Jun 7, 2024 20:29:27.114120007 CEST	445	50158	15.84.171.3	192.168.2.4
Jun 7, 2024 20:29:27.114178896 CEST	445	50158	15.84.171.3	192.168.2.4
Jun 7, 2024 20:29:27.208905935 CEST	445	50161	105.138.251.1	192.168.2.4
Jun 7, 2024 20:29:27.208964109 CEST	50161	445	192.168.2.4	105.138.251.1
Jun 7, 2024 20:29:27.209000111 CEST	50161	445	192.168.2.4	105.138.251.1
Jun 7, 2024 20:29:27.209022045 CEST	50161	445	192.168.2.4	105.138.251.1
Jun 7, 2024 20:29:27.213963032 CEST	445	50161	105.138.251.1	192.168.2.4
Jun 7, 2024 20:29:27.213994026 CEST	445	50161	105.138.251.1	192.168.2.4
Jun 7, 2024 20:29:27.303544998 CEST	445	50162	98.247.99.1	192.168.2.4
Jun 7, 2024 20:29:27.303630114 CEST	50162	445	192.168.2.4	98.247.99.1
Jun 7, 2024 20:29:27.303729057 CEST	50162	445	192.168.2.4	98.247.99.1
Jun 7, 2024 20:29:27.303729057 CEST	50162	445	192.168.2.4	98.247.99.1
Jun 7, 2024 20:29:27.308779955 CEST	445	50162	98.247.99.1	192.168.2.4
Jun 7, 2024 20:29:27.308809996 CEST	445	50162	98.247.99.1	192.168.2.4
Jun 7, 2024 20:29:27.356539965 CEST	50257	445	192.168.2.4	98.247.99.2
Jun 7, 2024 20:29:27.361454964 CEST	445	50257	98.247.99.2	192.168.2.4
Jun 7, 2024 20:29:27.361532927 CEST	50257	445	192.168.2.4	98.247.99.2
Jun 7, 2024 20:29:27.361617088 CEST	50257	445	192.168.2.4	98.247.99.2
Jun 7, 2024 20:29:27.361943960 CEST	50258	445	192.168.2.4	98.247.99.2
Jun 7, 2024 20:29:27.366842031 CEST	445	50258	98.247.99.2	192.168.2.4
Jun 7, 2024 20:29:27.366911888 CEST	50258	445	192.168.2.4	98.247.99.2
Jun 7, 2024 20:29:27.366945028 CEST	50258	445	192.168.2.4	98.247.99.2
Jun 7, 2024 20:29:27.366957903 CEST	445	50257	98.247.99.2	192.168.2.4
Jun 7, 2024 20:29:27.367007971 CEST	50257	445	192.168.2.4	98.247.99.2
Jun 7, 2024 20:29:27.371846914 CEST	445	50258	98.247.99.2	192.168.2.4
Jun 7, 2024 20:29:27.465766907 CEST	50262	445	192.168.2.4	99.75.135.3
Jun 7, 2024 20:29:27.471072912 CEST	445	50262	99.75.135.3	192.168.2.4
Jun 7, 2024 20:29:27.471177101 CEST	50262	445	192.168.2.4	99.75.135.3
Jun 7, 2024 20:29:27.471177101 CEST	50262	445	192.168.2.4	99.75.135.3
Jun 7, 2024 20:29:27.476106882 CEST	445	50262	99.75.135.3	192.168.2.4
Jun 7, 2024 20:29:27.559674025 CEST	50264	445	192.168.2.4	155.86.233.2
Jun 7, 2024 20:29:27.564984083 CEST	445	50264	155.86.233.2	192.168.2.4
Jun 7, 2024 20:29:27.565058947 CEST	50264	445	192.168.2.4	155.86.233.2
Jun 7, 2024 20:29:27.565105915 CEST	50264	445	192.168.2.4	155.86.233.2
Jun 7, 2024 20:29:27.570019960 CEST	445	50264	155.86.233.2	192.168.2.4
Jun 7, 2024 20:29:27.575186014 CEST	50265	445	192.168.2.4	147.230.27.1
Jun 7, 2024 20:29:27.580136061 CEST	445	50265	147.230.27.1	192.168.2.4
Jun 7, 2024 20:29:27.580195904 CEST	50265	445	192.168.2.4	147.230.27.1
Jun 7, 2024 20:29:27.580239058 CEST	50265	445	192.168.2.4	147.230.27.1
Jun 7, 2024 20:29:27.585182905 CEST	445	50265	147.230.27.1	192.168.2.4
Jun 7, 2024 20:29:27.939893007 CEST	445	50163	136.232.217.3	192.168.2.4
Jun 7, 2024 20:29:27.939996958 CEST	50163	445	192.168.2.4	136.232.217.3
Jun 7, 2024 20:29:27.940030098 CEST	50163	445	192.168.2.4	136.232.217.3
Jun 7, 2024 20:29:27.940058947 CEST	50163	445	192.168.2.4	136.232.217.3
Jun 7, 2024 20:29:27.945103884 CEST	445	50163	136.232.217.3	192.168.2.4
Jun 7, 2024 20:29:27.945137978 CEST	445	50163	136.232.217.3	192.168.2.4
Jun 7, 2024 20:29:27.989983082 CEST	445	50165	60.66.137.2	192.168.2.4
Jun 7, 2024 20:29:27.990071058 CEST	50165	445	192.168.2.4	60.66.137.2
Jun 7, 2024 20:29:27.990107059 CEST	50165	445	192.168.2.4	60.66.137.2
Jun 7, 2024 20:29:27.990119934 CEST	50165	445	192.168.2.4	60.66.137.2
Jun 7, 2024 20:29:27.995071888 CEST	445	50165	60.66.137.2	192.168.2.4
Jun 7, 2024 20:29:27.995100975 CEST	445	50165	60.66.137.2	192.168.2.4
Jun 7, 2024 20:29:27.997173071 CEST	50275	445	192.168.2.4	136.232.217.4
Jun 7, 2024 20:29:28.002108097 CEST	445	50275	136.232.217.4	192.168.2.4
Jun 7, 2024 20:29:28.004798889 CEST	50275	445	192.168.2.4	136.232.217.4
Jun 7, 2024 20:29:28.004875898 CEST	50275	445	192.168.2.4	136.232.217.4
Jun 7, 2024 20:29:28.005212069 CEST	50276	445	192.168.2.4	136.232.217.4
Jun 7, 2024 20:29:28.010015011 CEST	445	50275	136.232.217.4	192.168.2.4
Jun 7, 2024 20:29:28.010071993 CEST	445	50276	136.232.217.4	192.168.2.4
Jun 7, 2024 20:29:28.010173082 CEST	50276	445	192.168.2.4	136.232.217.4
Jun 7, 2024 20:29:28.010195017 CEST	50275	445	192.168.2.4	136.232.217.4
Jun 7, 2024 20:29:28.010262012 CEST	50276	445	192.168.2.4	136.232.217.4
Jun 7, 2024 20:29:28.015074015 CEST	445	50276	136.232.217.4	192.168.2.4
Jun 7, 2024 20:29:28.044186115 CEST	50279	445	192.168.2.4	60.66.137.3
Jun 7, 2024 20:29:28.049225092 CEST	445	50279	60.66.137.3	192.168.2.4
Jun 7, 2024 20:29:28.049334049 CEST	50279	445	192.168.2.4	60.66.137.3
Jun 7, 2024 20:29:28.049369097 CEST	50279	445	192.168.2.4	60.66.137.3
Jun 7, 2024 20:29:28.049721956 CEST	50280	445	192.168.2.4	60.66.137.3
Jun 7, 2024 20:29:28.054620028 CEST	445	50280	60.66.137.3	192.168.2.4
Jun 7, 2024 20:29:28.054693937 CEST	50280	445	192.168.2.4	60.66.137.3
Jun 7, 2024 20:29:28.054729939 CEST	50280	445	192.168.2.4	60.66.137.3
Jun 7, 2024 20:29:28.055049896 CEST	445	50279	60.66.137.3	192.168.2.4
Jun 7, 2024 20:29:28.055115938 CEST	50279	445	192.168.2.4	60.66.137.3
Jun 7, 2024 20:29:28.059636116 CEST	445	50280	60.66.137.3	192.168.2.4
Jun 7, 2024 20:29:28.668395042 CEST	445	50169	8.191.246.3	192.168.2.4
Jun 7, 2024 20:29:28.670753956 CEST	50169	445	192.168.2.4	8.191.246.3
Jun 7, 2024 20:29:28.670787096 CEST	50169	445	192.168.2.4	8.191.246.3
Jun 7, 2024 20:29:28.670839071 CEST	50169	445	192.168.2.4	8.191.246.3
Jun 7, 2024 20:29:28.675723076 CEST	445	50169	8.191.246.3	192.168.2.4
Jun 7, 2024 20:29:28.675761938 CEST	445	50169	8.191.246.3	192.168.2.4
Jun 7, 2024 20:29:28.675776958 CEST	445	50168	110.10.245.2	192.168.2.4
Jun 7, 2024 20:29:28.675877094 CEST	50168	445	192.168.2.4	110.10.245.2
Jun 7, 2024 20:29:28.675909996 CEST	50168	445	192.168.2.4	110.10.245.2
Jun 7, 2024 20:29:28.675932884 CEST	50168	445	192.168.2.4	110.10.245.2
Jun 7, 2024 20:29:28.680958986 CEST	445	50168	110.10.245.2	192.168.2.4
Jun 7, 2024 20:29:28.681041002 CEST	445	50168	110.10.245.2	192.168.2.4
Jun 7, 2024 20:29:28.756582022 CEST	445	50276	136.232.217.4	192.168.2.4
Jun 7, 2024 20:29:28.756813049 CEST	50276	445	192.168.2.4	136.232.217.4
Jun 7, 2024 20:29:28.756844997 CEST	50276	445	192.168.2.4	136.232.217.4
Jun 7, 2024 20:29:28.756884098 CEST	50276	445	192.168.2.4	136.232.217.4
Jun 7, 2024 20:29:28.761818886 CEST	445	50276	136.232.217.4	192.168.2.4
Jun 7, 2024 20:29:28.761848927 CEST	445	50276	136.232.217.4	192.168.2.4
Jun 7, 2024 20:29:28.876456022 CEST	445	50171	12.109.166.1	192.168.2.4
Jun 7, 2024 20:29:28.877255917 CEST	50171	445	192.168.2.4	12.109.166.1
Jun 7, 2024 20:29:28.877304077 CEST	50171	445	192.168.2.4	12.109.166.1
Jun 7, 2024 20:29:28.877449036 CEST	50171	445	192.168.2.4	12.109.166.1
Jun 7, 2024 20:29:28.883553982 CEST	445	50171	12.109.166.1	192.168.2.4
Jun 7, 2024 20:29:28.883584023 CEST	445	50171	12.109.166.1	192.168.2.4
Jun 7, 2024 20:29:28.934562922 CEST	50304	445	192.168.2.4	12.109.166.2
Jun 7, 2024 20:29:28.939534903 CEST	445	50304	12.109.166.2	192.168.2.4
Jun 7, 2024 20:29:28.939605951 CEST	50304	445	192.168.2.4	12.109.166.2
Jun 7, 2024 20:29:28.939670086 CEST	50304	445	192.168.2.4	12.109.166.2
Jun 7, 2024 20:29:28.939960957 CEST	50305	445	192.168.2.4	12.109.166.2
Jun 7, 2024 20:29:28.945020914 CEST	445	50304	12.109.166.2	192.168.2.4
Jun 7, 2024 20:29:28.945055008 CEST	445	50305	12.109.166.2	192.168.2.4
Jun 7, 2024 20:29:28.945086956 CEST	50304	445	192.168.2.4	12.109.166.2
Jun 7, 2024 20:29:28.945130110 CEST	50305	445	192.168.2.4	12.109.166.2
Jun 7, 2024 20:29:28.945138931 CEST	50305	445	192.168.2.4	12.109.166.2
Jun 7, 2024 20:29:28.950077057 CEST	445	50305	12.109.166.2	192.168.2.4
Jun 7, 2024 20:29:29.091065884 CEST	445	50174	212.60.2.1	192.168.2.4
Jun 7, 2024 20:29:29.091217041 CEST	50174	445	192.168.2.4	212.60.2.1
Jun 7, 2024 20:29:29.091217041 CEST	50174	445	192.168.2.4	212.60.2.1
Jun 7, 2024 20:29:29.091217041 CEST	50174	445	192.168.2.4	212.60.2.1
Jun 7, 2024 20:29:29.096339941 CEST	445	50174	212.60.2.1	192.168.2.4
Jun 7, 2024 20:29:29.096374035 CEST	445	50174	212.60.2.1	192.168.2.4
Jun 7, 2024 20:29:29.388919115 CEST	50321	445	192.168.2.4	1.30.233.1
Jun 7, 2024 20:29:29.394442081 CEST	445	50321	1.30.233.1	192.168.2.4
Jun 7, 2024 20:29:29.394556999 CEST	50321	445	192.168.2.4	1.30.233.1
Jun 7, 2024 20:29:29.394671917 CEST	50321	445	192.168.2.4	1.30.233.1
Jun 7, 2024 20:29:29.399549007 CEST	445	50321	1.30.233.1	192.168.2.4
Jun 7, 2024 20:29:29.590924978 CEST	50327	445	192.168.2.4	19.152.241.2
Jun 7, 2024 20:29:29.595937014 CEST	445	50327	19.152.241.2	192.168.2.4
Jun 7, 2024 20:29:29.596049070 CEST	50327	445	192.168.2.4	19.152.241.2
Jun 7, 2024 20:29:29.596082926 CEST	50327	445	192.168.2.4	19.152.241.2
Jun 7, 2024 20:29:29.601006031 CEST	445	50327	19.152.241.2	192.168.2.4
Jun 7, 2024 20:29:29.904977083 CEST	445	50180	80.128.41.2	192.168.2.4
Jun 7, 2024 20:29:29.905092001 CEST	50180	445	192.168.2.4	80.128.41.2
Jun 7, 2024 20:29:29.905181885 CEST	50180	445	192.168.2.4	80.128.41.2
Jun 7, 2024 20:29:29.905181885 CEST	50180	445	192.168.2.4	80.128.41.2
Jun 7, 2024 20:29:29.910165071 CEST	445	50180	80.128.41.2	192.168.2.4
Jun 7, 2024 20:29:29.910198927 CEST	445	50180	80.128.41.2	192.168.2.4
Jun 7, 2024 20:29:30.010298014 CEST	445	50182	146.93.6.2	192.168.2.4
Jun 7, 2024 20:29:30.010402918 CEST	50182	445	192.168.2.4	146.93.6.2
Jun 7, 2024 20:29:30.010440111 CEST	50182	445	192.168.2.4	146.93.6.2
Jun 7, 2024 20:29:30.010449886 CEST	50182	445	192.168.2.4	146.93.6.2
Jun 7, 2024 20:29:30.015477896 CEST	445	50182	146.93.6.2	192.168.2.4
Jun 7, 2024 20:29:30.015511036 CEST	445	50182	146.93.6.2	192.168.2.4
Jun 7, 2024 20:29:30.075722933 CEST	50350	445	192.168.2.4	146.93.6.3
Jun 7, 2024 20:29:30.122169971 CEST	50353	445	192.168.2.4	15.84.171.3
Jun 7, 2024 20:29:30.215800047 CEST	50356	445	192.168.2.4	105.138.251.1
Jun 7, 2024 20:29:30.262361050 CEST	445	50183	102.224.158.3	192.168.2.4
Jun 7, 2024 20:29:30.263465881 CEST	50183	445	192.168.2.4	102.224.158.3
Jun 7, 2024 20:29:30.263465881 CEST	50183	445	192.168.2.4	102.224.158.3
Jun 7, 2024 20:29:30.263497114 CEST	50183	445	192.168.2.4	102.224.158.3
Jun 7, 2024 20:29:30.263878107 CEST	445	50350	146.93.6.3	192.168.2.4
Jun 7, 2024 20:29:30.263911009 CEST	445	50353	15.84.171.3	192.168.2.4
Jun 7, 2024 20:29:30.263942003 CEST	445	50356	105.138.251.1	192.168.2.4
Jun 7, 2024 20:29:30.263948917 CEST	50350	445	192.168.2.4	146.93.6.3
Jun 7, 2024 20:29:30.263978004 CEST	50353	445	192.168.2.4	15.84.171.3
Jun 7, 2024 20:29:30.264003038 CEST	50350	445	192.168.2.4	146.93.6.3
Jun 7, 2024 20:29:30.264003992 CEST	50356	445	192.168.2.4	105.138.251.1
Jun 7, 2024 20:29:30.264041901 CEST	50353	445	192.168.2.4	15.84.171.3
Jun 7, 2024 20:29:30.264056921 CEST	50356	445	192.168.2.4	105.138.251.1
Jun 7, 2024 20:29:30.264276981 CEST	50361	445	192.168.2.4	146.93.6.3
Jun 7, 2024 20:29:30.268440008 CEST	445	50183	102.224.158.3	192.168.2.4
Jun 7, 2024 20:29:30.268474102 CEST	445	50183	102.224.158.3	192.168.2.4
Jun 7, 2024 20:29:30.269001961 CEST	445	50350	146.93.6.3	192.168.2.4
Jun 7, 2024 20:29:30.269032001 CEST	445	50353	15.84.171.3	192.168.2.4
Jun 7, 2024 20:29:30.269061089 CEST	445	50356	105.138.251.1	192.168.2.4
Jun 7, 2024 20:29:30.269094944 CEST	445	50184	115.42.153.1	192.168.2.4
Jun 7, 2024 20:29:30.269221067 CEST	445	50361	146.93.6.3	192.168.2.4
Jun 7, 2024 20:29:30.269278049 CEST	50184	445	192.168.2.4	115.42.153.1
Jun 7, 2024 20:29:30.269320011 CEST	50361	445	192.168.2.4	146.93.6.3
Jun 7, 2024 20:29:30.269335985 CEST	50184	445	192.168.2.4	115.42.153.1
Jun 7, 2024 20:29:30.269361019 CEST	50361	445	192.168.2.4	146.93.6.3
Jun 7, 2024 20:29:30.269364119 CEST	50184	445	192.168.2.4	115.42.153.1
Jun 7, 2024 20:29:30.269849062 CEST	445	50350	146.93.6.3	192.168.2.4
Jun 7, 2024 20:29:30.269978046 CEST	50350	445	192.168.2.4	146.93.6.3
Jun 7, 2024 20:29:30.274146080 CEST	445	50184	115.42.153.1	192.168.2.4
Jun 7, 2024 20:29:30.274240017 CEST	445	50184	115.42.153.1	192.168.2.4
Jun 7, 2024 20:29:30.274322987 CEST	445	50361	146.93.6.3	192.168.2.4
Jun 7, 2024 20:29:30.325309992 CEST	50366	445	192.168.2.4	115.42.153.2
Jun 7, 2024 20:29:30.325562954 CEST	50367	445	192.168.2.4	102.224.158.4
Jun 7, 2024 20:29:30.330203056 CEST	445	50366	115.42.153.2	192.168.2.4
Jun 7, 2024 20:29:30.330281973 CEST	50366	445	192.168.2.4	115.42.153.2
Jun 7, 2024 20:29:30.330297947 CEST	50366	445	192.168.2.4	115.42.153.2
Jun 7, 2024 20:29:30.330430984 CEST	445	50367	102.224.158.4	192.168.2.4
Jun 7, 2024 20:29:30.330574036 CEST	50368	445	192.168.2.4	115.42.153.2
Jun 7, 2024 20:29:30.330607891 CEST	50367	445	192.168.2.4	102.224.158.4
Jun 7, 2024 20:29:30.330625057 CEST	50367	445	192.168.2.4	102.224.158.4
Jun 7, 2024 20:29:30.330785036 CEST	50369	445	192.168.2.4	102.224.158.4
Jun 7, 2024 20:29:30.335345030 CEST	445	50366	115.42.153.2	192.168.2.4
Jun 7, 2024 20:29:30.335402012 CEST	50366	445	192.168.2.4	115.42.153.2
Jun 7, 2024 20:29:30.335448027 CEST	445	50368	115.42.153.2	192.168.2.4
Jun 7, 2024 20:29:30.335500002 CEST	50368	445	192.168.2.4	115.42.153.2
Jun 7, 2024 20:29:30.335532904 CEST	50368	445	192.168.2.4	115.42.153.2
Jun 7, 2024 20:29:30.335577011 CEST	445	50369	102.224.158.4	192.168.2.4
Jun 7, 2024 20:29:30.335633039 CEST	50369	445	192.168.2.4	102.224.158.4
Jun 7, 2024 20:29:30.335656881 CEST	50369	445	192.168.2.4	102.224.158.4
Jun 7, 2024 20:29:30.335935116 CEST	445	50367	102.224.158.4	192.168.2.4
Jun 7, 2024 20:29:30.335990906 CEST	50367	445	192.168.2.4	102.224.158.4
Jun 7, 2024 20:29:30.340382099 CEST	445	50368	115.42.153.2	192.168.2.4
Jun 7, 2024 20:29:30.340533018 CEST	445	50369	102.224.158.4	192.168.2.4
Jun 7, 2024 20:29:30.498461962 CEST	445	50187	53.251.193.3	192.168.2.4
Jun 7, 2024 20:29:30.499802113 CEST	50187	445	192.168.2.4	53.251.193.3
Jun 7, 2024 20:29:30.499854088 CEST	50187	445	192.168.2.4	53.251.193.3
Jun 7, 2024 20:29:30.499907017 CEST	50187	445	192.168.2.4	53.251.193.3
Jun 7, 2024 20:29:30.504832029 CEST	445	50187	53.251.193.3	192.168.2.4
Jun 7, 2024 20:29:30.504916906 CEST	445	50187	53.251.193.3	192.168.2.4
Jun 7, 2024 20:29:30.615293980 CEST	445	50190	182.85.58.2	192.168.2.4
Jun 7, 2024 20:29:30.615411997 CEST	50190	445	192.168.2.4	182.85.58.2
Jun 7, 2024 20:29:30.617192030 CEST	50190	445	192.168.2.4	182.85.58.2
Jun 7, 2024 20:29:30.617341042 CEST	50190	445	192.168.2.4	182.85.58.2
Jun 7, 2024 20:29:30.622076035 CEST	445	50190	182.85.58.2	192.168.2.4
Jun 7, 2024 20:29:30.622209072 CEST	445	50190	182.85.58.2	192.168.2.4
Jun 7, 2024 20:29:31.582195997 CEST	445	50194	81.230.11.1	192.168.2.4
Jun 7, 2024 20:29:31.582262993 CEST	50194	445	192.168.2.4	81.230.11.1
Jun 7, 2024 20:29:32.172523022 CEST	445	50200	201.130.185.3	192.168.2.4
Jun 7, 2024 20:29:32.173460960 CEST	50200	445	192.168.2.4	201.130.185.3
Jun 7, 2024 20:29:32.239132881 CEST	445	50203	50.241.97.2	192.168.2.4
Jun 7, 2024 20:29:32.239325047 CEST	50203	445	192.168.2.4	50.241.97.2
Jun 7, 2024 20:29:32.487833977 CEST	445	50205	87.45.211.2	192.168.2.4
Jun 7, 2024 20:29:32.489929914 CEST	50205	445	192.168.2.4	87.45.211.2
Jun 7, 2024 20:29:32.547804117 CEST	445	50207	3.135.174.3	192.168.2.4
Jun 7, 2024 20:29:32.547878981 CEST	50207	445	192.168.2.4	3.135.174.3
Jun 7, 2024 20:29:32.841423988 CEST	445	50212	159.26.251.1	192.168.2.4
Jun 7, 2024 20:29:32.842755079 CEST	50212	445	192.168.2.4	159.26.251.1
Jun 7, 2024 20:29:32.932266951 CEST	50194	445	192.168.2.4	81.230.11.1
Jun 7, 2024 20:29:32.932306051 CEST	50258	445	192.168.2.4	98.247.99.2
Jun 7, 2024 20:29:32.932356119 CEST	50230	445	192.168.2.4	5.26.5.2
Jun 7, 2024 20:29:32.932447910 CEST	50361	445	192.168.2.4	146.93.6.3
Jun 7, 2024 20:29:32.932467937 CEST	50327	445	192.168.2.4	19.152.241.2
Jun 7, 2024 20:29:32.932501078 CEST	50205	445	192.168.2.4	87.45.211.2
Jun 7, 2024 20:29:32.932508945 CEST	50207	445	192.168.2.4	3.135.174.3
Jun 7, 2024 20:29:32.932538986 CEST	50264	445	192.168.2.4	155.86.233.2
Jun 7, 2024 20:29:32.932575941 CEST	50353	445	192.168.2.4	15.84.171.3
Jun 7, 2024 20:29:32.932610989 CEST	50265	445	192.168.2.4	147.230.27.1
Jun 7, 2024 20:29:32.932630062 CEST	50200	445	192.168.2.4	201.130.185.3
Jun 7, 2024 20:29:32.932648897 CEST	50203	445	192.168.2.4	50.241.97.2
Jun 7, 2024 20:29:32.932658911 CEST	50212	445	192.168.2.4	159.26.251.1
Jun 7, 2024 20:29:32.932686090 CEST	50262	445	192.168.2.4	99.75.135.3
Jun 7, 2024 20:29:32.932713032 CEST	50224	445	192.168.2.4	206.199.41.1
Jun 7, 2024 20:29:32.932768106 CEST	50228	445	192.168.2.4	184.153.104.2
Jun 7, 2024 20:29:32.932775021 CEST	50227	445	192.168.2.4	161.80.213.3
Jun 7, 2024 20:29:32.932785988 CEST	50238	445	192.168.2.4	124.233.139.3
Jun 7, 2024 20:29:32.932805061 CEST	50245	445	192.168.2.4	54.6.208.1
Jun 7, 2024 20:29:32.932846069 CEST	50280	445	192.168.2.4	60.66.137.3
Jun 7, 2024 20:29:32.932972908 CEST	50305	445	192.168.2.4	12.109.166.2
Jun 7, 2024 20:29:32.933000088 CEST	50321	445	192.168.2.4	1.30.233.1
Jun 7, 2024 20:29:32.933093071 CEST	50356	445	192.168.2.4	105.138.251.1
Jun 7, 2024 20:29:32.933109999 CEST	50368	445	192.168.2.4	115.42.153.2
Jun 7, 2024 20:29:32.933125019 CEST	50369	445	192.168.2.4	102.224.158.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 7, 2024 20:28:41.925806999 CEST	138	138	192.168.2.4	192.168.2.255

HTTP Request Dependency Graph

ipinfo.io

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.4	49730	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-06-07 18:28:19 UTC	59	OUT	GET / HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
2024-06-07 18:28:19 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 07 Jun 2024 18:28:19 GMT content-type: application/json; charset=utf-8 Content-Length: 314 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 4 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-07 18:28:19 UTC	314	IN	Data Raw: 7b 0a 20 20 22 69 70 22 3a 20 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 31 22 2c 0a 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 31 2e 73 74 61 74 69 63 2e 71 75 61 64 72 61 6e 65 74 2e 63 6f 6d 22 2c 0a 20 20 22 63 69 74 79 22 3a 20 22 44 61 6c 6c 61 73 22 2c 0a 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 54 65 78 61 73 22 2c 0a 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 22 6c 6f 63 22 3a 20 22 33 32 2e 38 31 35 32 2c 2d 39 36 2e 38 37 30 33 22 2c 0a 20 20 22 6f 72 67 22 3a 20 22 41 53 38 31 30 30 20 51 75 61 64 72 61 4e 65 74 20 45 6e 74 65 72 70 72 69 73 65 73 20 4c 4c 43 22 2c 0a 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 37 35 32 34 37 22 2c 0a 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 Data Ascii: { "ip": "173.254.250.91", "hostname": "173.254.250.91.static.quadranet.com", "city": "Dallas", "region": "Texas", "country": "US", "loc": "32.8152,-96.8703", "org": "AS8100 QuadraNet Enterprises LLC", "postal": "75247", "timezone": "Amer

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49913	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-06-07 18:28:44 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=EhCEaABa7yn1dF5&MD=LBry1Nn4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-06-07 18:28:44 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: c20c4947-9705-4eeb-b5d8-6965a08ebca4 MS-RequestId: db9de26a-162f-49ae-806d-51730ca7f5eb MS-CV: SV5lUIecEkajJZJn.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 07 Jun 2024 18:28:43 GMT Connection: close Content-Length: 24490
2024-06-07 18:28:44 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-06-07 18:28:44 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	50178	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-06-07 18:29:22 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=EhCEaABa7yn1dF5&MD=LBry1Nn4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-06-07 18:29:22 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_1440" MS-CorrelationId: 51add253-9e3b-4af7-b73f-887c89f8d800 MS-RequestId: 8ec5eb0d-d7de-4117-80e3-5d8ce8f50ffe MS-CV: cnxtqy89jE+lipIx.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 07 Jun 2024 18:29:21 GMT Connection: close Content-Length: 25457
2024-06-07 18:29:22 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-06-07 18:29:22 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	14:28:25
Start date:	07/06/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\zyeX8bTkky.dll"
Imagebase:	0x290000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:28:26
Start date:	07/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:28:26
Start date:	07/06/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\zyeX8bTkky.dll",#1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:28:26
Start date:	07/06/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\zyeX8bTkky.dll,PlayGame
Imagebase:	0x9e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:28:26
Start date:	07/06/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\zyeX8bTkky.dll",#1
Imagebase:	0x9e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:28:26
Start date:	07/06/2024
Path:	C:\Windows\mssecsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvc.exe
Imagebase:	0x400000
File size:	3'723'264 bytes
MD5 hash:	D724D8CC6420F06E8A48752F0DA11C66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000000.1740919746.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000002.1746036311.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000000.1741223971.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000005.00000000.1741223971.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000002.1746174387.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000005.00000002.1746174387.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:28:26
Start date:	07/06/2024
Path:	C:\Windows\mssecsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvc.exe -m security
Imagebase:	0x400000
File size:	3'723'264 bytes
MD5 hash:	D724D8CC6420F06E8A48752F0DA11C66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000002.2381008713.000000000042E000.00000004.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.1742932598.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.1743069425.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000000.1743069425.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000002.2382337647.0000000001C30000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000002.2382337647.0000000001C30000.00000004.00000020.00020000.00000000.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000002.2382864755.0000000002159000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000002.2382864755.0000000002159000.00000004.00000020.00020000.00000000.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000002.2381175056.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000002.2381175056.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:28:26
Start date:	07/06/2024
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	false
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x400000
File size:	3'514'368 bytes
MD5 hash:	7F7CCAA16FB15EB1C7399D422F8363E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000007.00000000.1745181034.000000000040E000.00000008.00000001.01000000.00000007.sdmp, Author: us-cert code analysis team Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000007.00000002.1745648748.000000000040E000.00000008.00000001.01000000.00000007.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\tasksche.exe, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\tasksche.exe, Author: ReversingLabs
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:28:29
Start date:	07/06/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\zyeX8bTkky.dll",PlayGame
Imagebase:	0x9e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:28:29
Start date:	07/06/2024
Path:	C:\Windows\mssecsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvc.exe
Imagebase:	0x400000
File size:	3'723'264 bytes
MD5 hash:	D724D8CC6420F06E8A48752F0DA11C66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000009.00000002.1772103594.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000009.00000000.1769264396.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000009.00000002.1772248520.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000009.00000002.1772248520.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000009.00000000.1769380606.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000009.00000000.1769380606.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:28:29
Start date:	07/06/2024
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	false
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x400000
File size:	3'514'368 bytes
MD5 hash:	7F7CCAA16FB15EB1C7399D422F8363E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000A.00000000.1771087188.000000000040E000.00000008.00000001.01000000.00000007.sdmp, Author: us-cert code analysis team Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000A.00000002.1771622182.000000000040E000.00000008.00000001.01000000.00000007.sdmp, Author: us-cert code analysis team
Reputation:	moderate
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report zyeX8bTkky.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\WINDOWS\qeriuwjhrf (copy)

C:\Windows\tasksche.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
zyeX8bTkky.dll