Edit tour

Windows Analysis Report
zbRmQrzaHY.dll

Overview

General Information

Sample name:	zbRmQrzaHY.dll renamed because original name is a hash value
Original sample name:	c05e2dab77349cd639aa837e7e121710b8a0718d8fc93fb4cc6458ae90e5c597.dll
Analysis ID:	1453841
MD5:	ae12bb54af31227017feffd9598a6f5e
SHA1:	f597a1cc16d42b7f02e077696e067cd3030a06d9
SHA256:	c05e2dab77349cd639aa837e7e121710b8a0718d8fc93fb4cc6458ae90e5c597
Infos:

Detection

Wannacry

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to download HTTP data from a sinkholed server

Yara detected Wannacry ransomware

AI detected suspicious sample

Connects to many different private IPs (likely to spread or exploit)

Connects to many different private IPs via SMB (likely to spread or exploit)

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w7x64

loaddll32.exe (PID: 1644 cmdline: loaddll32.exe "C:\Users\user\Desktop\zbRmQrzaHY.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

cmd.exe (PID: 2260 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\zbRmQrzaHY.dll",#1 MD5: AD7B9C14083B52BC532FBA5948342B98)

rundll32.exe (PID: 1964 cmdline: rundll32.exe "C:\Users\user\Desktop\zbRmQrzaHY.dll",#1 MD5: 51138BEEA3E2C21EC44D0932C71762A8)

rundll32.exe (PID: 2292 cmdline: rundll32.exe C:\Users\user\Desktop\zbRmQrzaHY.dll,PlayGame MD5: 51138BEEA3E2C21EC44D0932C71762A8)

mssecsvc.exe (PID: 1900 cmdline: C:\WINDOWS\mssecsvc.exe MD5: 0C694193CEAC8BFB016491FFB534EB7C)

tasksche.exe (PID: 3128 cmdline: C:\WINDOWS\tasksche.exe /i MD5: 7F7CCAA16FB15EB1C7399D422F8363E8)

rundll32.exe (PID: 1488 cmdline: rundll32.exe "C:\Users\user\Desktop\zbRmQrzaHY.dll",PlayGame MD5: 51138BEEA3E2C21EC44D0932C71762A8)

mssecsvc.exe (PID: 2504 cmdline: C:\WINDOWS\mssecsvc.exe MD5: 0C694193CEAC8BFB016491FFB534EB7C)

mssecsvc.exe (PID: 3016 cmdline: C:\WINDOWS\mssecsvc.exe -m security MD5: 0C694193CEAC8BFB016491FFB534EB7C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
WannaCryptor, WannaCry, WannaCrypt		Lazarus Group	http://blog.emsisoft.com/2017/05/12/wcry-ransomware-outbreak/ http://www.independent.co.uk/news/uk/home-news/wannacry-malware-hack-nhs-report-cybercrime-north-korea-uk-ben-wallace-a8022491.html https://baesystemsai.blogspot.de/2017/05/wanacrypt0r-ransomworm.html https://blog.avast.com/ransomware-that-infected-telefonica-and-nhs-hospitals-is-spreading-aggressively-with-over-50000-attacks-so-far-today https://blog.comae.io/wannacry-decrypting-files-with-wanakiwi-demo-86bafb81112d	https://malpedia.caad.fkie.fraunhofer.de/details/win.wannacryptor

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
zbRmQrzaHY.dll	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
zbRmQrzaHY.dll	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x45604:$x1: icacls . /grant Everyone:F /T /C /Q 0x353d0:$x3: tasksche.exe 0x455e0:$x3: tasksche.exe 0x455bc:$x4: Global\MsWinZonesCacheCounterMutexA 0x45634:$x5: WNcry@2ol7 0x3543b:$x6: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com 0x3028:$x7: mssecsvc.exe 0x120ac:$x7: mssecsvc.exe 0x1b3b4:$x7: mssecsvc.exe 0x353a8:$x8: C:\%s\qeriuwjhrf 0x45604:$x9: icacls . /grant Everyone:F /T /C /Q 0x3014:$s1: C:\%s\%s 0x12098:$s1: C:\%s\%s 0x1b39c:$s1: C:\%s\%s 0x353bc:$s1: C:\%s\%s 0x45534:$s3: cmd.exe /c "%s" 0x77a88:$s4: msg/m_portuguese.wnry 0x326f0:$s5: \\192.168.56.20\IPC$ 0x1fae5:$s6: \\172.16.99.5\IPC$ 0xd195:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x78da:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44
zbRmQrzaHY.dll	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x455e0:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x45608:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\tasksche.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Windows\tasksche.exe	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
C:\Windows\tasksche.exe	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
C:\Windows\tasksche.exe	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
C:\Windows\mssecsvc.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Windows\mssecsvc.exe	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x313d7:$x6: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com 0xe048:$x7: mssecsvc.exe 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0xe034:$s1: C:\%s\%s 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88 0x34aa6:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
C:\Windows\mssecsvc.exe	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
C:\Windows\mssecsvc.exe	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
C:\Windows\mssecsvc.exe	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x340ba:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x8090:$start_service_3: 83 EC 10 68 04 01 00 00 68 60 F7 70 00 6A 00 FF 15 6C A0 40 00 FF 15 2C A1 40 00 83 38 02 7D 09 E8 6B FE FF FF 83 C4 10 C3 57 68 3F 00 0F 00 6A 00 6A 00 FF 15 10 A0 40 00 8B F8 85 FF 74 32 53 ... 0x9a16:$entrypoint_all: 55 8B EC 6A FF 68 A0 A1 40 00 68 A2 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C0 A0 40 00 59 83 0D 94 F8 70 00 FF 83 0D 98 F8 70 ... 0x3985e:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
Click to see the 4 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000000.356244680.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000002.364040179.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000C.00000002.363896323.000000000040E000.00000008.00000001.01000000.00000006.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
0000000A.00000002.499667031.000000000042E000.00000004.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000B.00000000.361281172.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000B.00000002.363619536.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000C.00000000.363626200.000000000040E000.00000008.00000001.01000000.00000006.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
0000000A.00000000.361347736.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000B.00000000.361343499.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000B.00000000.361343499.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
0000000A.00000000.361392720.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000A.00000000.361392720.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000006.00000002.364067431.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000002.364067431.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
0000000A.00000002.500102417.000000000293B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000A.00000002.500102417.000000000293B000.00000004.00000020.00020000.00000000.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x32e44:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x32e6c:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000006.00000000.356298598.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.356298598.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
0000000A.00000002.500000036.0000000002423000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000A.00000002.500000036.0000000002423000.00000004.00000020.00020000.00000000.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x32600:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x32628:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
0000000A.00000002.499709795.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000A.00000002.499709795.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
0000000B.00000002.363662706.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000B.00000002.363662706.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
Process Memory Space: mssecsvc.exe PID: 1900	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvc.exe PID: 3016	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvc.exe PID: 2504	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 22 entries

Sigma Signatures

System Summary

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Windows\mssecsvc.exe, ProcessId: 1900, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Snort Signatures

ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 - Source IP: 192.168.2.22 - Destination IP: 104.16.166.228

Timestamp:	06/07/24-20:39:03.946772
SID:	2024298
Source Port:	49164
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Kryptos Logic - Source IP: 104.16.167.228 - Destination IP: 192.168.2.22

Timestamp:	06/07/24-20:39:04.567081
SID:	2031515
Source Port:	80
Destination Port:	49163
Protocol:	TCP
Classtype:	Misc activity

ET TROJAN Possible WannaCry DNS Lookup 1 - Source IP: 192.168.2.22 - Destination IP: 8.8.8.8

Timestamp:	06/07/24-20:39:03.922467
SID:	2024291
Source Port:	57893
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 - Source IP: 192.168.2.22 - Destination IP: 104.16.167.228

Timestamp:	06/07/24-20:39:03.925405
SID:	2024298
Source Port:	49163
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 - Source IP: 192.168.2.22 - Destination IP: 104.16.166.228

Timestamp:	06/07/24-20:39:02.682934
SID:	2024298
Source Port:	49162
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Kryptos Logic - Source IP: 104.16.166.228 - Destination IP: 192.168.2.22

Timestamp:	06/07/24-20:39:03.337539
SID:	2031515
Source Port:	80
Destination Port:	49162
Protocol:	TCP
Classtype:	Misc activity

ET TROJAN Known Sinkhole Response Kryptos Logic - Source IP: 104.16.166.228 - Destination IP: 192.168.2.22

Timestamp:	06/07/24-20:39:04.565273
SID:	2031515
Source Port:	80
Destination Port:	49164
Protocol:	TCP
Classtype:	Misc activity

ET TROJAN Possible WannaCry DNS Lookup 1 - Source IP: 192.168.2.22 - Destination IP: 8.8.8.8

Timestamp:	06/07/24-20:39:02.653511
SID:	2024291
Source Port:	52917
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Possible WannaCry DNS Lookup 1 - Source IP: 192.168.2.22 - Destination IP: 8.8.8.8

Timestamp:	06/07/24-20:39:03.899755
SID:	2024291
Source Port:	62751
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: zbRmQrzaHY.dll

Avira: detected

Antivirus detection for URL or domain

Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/	Avira URL Cloud: Label: phishing
Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Windows\mssecsvc.exe	Avira: detection malicious, Label: TR/AD.WannaCry.bqdjz
Source: C:\Windows\tasksche.exe	Avira: detection malicious, Label: TR/AD.WannaCry.sewvt

Multi AV Scanner detection for dropped file

Source: C:\Windows\mssecsvc.exe	ReversingLabs: Detection: 100%
Source: C:\Windows\tasksche.exe	ReversingLabs: Detection: 100%

Multi AV Scanner detection for submitted file

Source: zbRmQrzaHY.dll

ReversingLabs: Detection: 91%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 79.3% probability

Machine Learning detection for dropped file

Source: C:\Windows\mssecsvc.exe	Joe Sandbox ML: detected
Source: C:\Windows\tasksche.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: zbRmQrzaHY.dll

Joe Sandbox ML: detected

Exploits

Connects to many different private IPs (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior

Connects to many different private IPs via SMB (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior

Source: zbRmQrzaHY.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2024291 ET TROJAN Possible WannaCry DNS Lookup 1 192.168.2.22:52917 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024298 ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 192.168.2.22:49162 -> 104.16.166.228:80
Source: Traffic	Snort IDS: 2031515 ET TROJAN Known Sinkhole Response Kryptos Logic 104.16.166.228:80 -> 192.168.2.22:49162
Source: Traffic	Snort IDS: 2024291 ET TROJAN Possible WannaCry DNS Lookup 1 192.168.2.22:62751 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024291 ET TROJAN Possible WannaCry DNS Lookup 1 192.168.2.22:57893 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024298 ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 192.168.2.22:49163 -> 104.16.167.228:80
Source: Traffic	Snort IDS: 2024298 ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 192.168.2.22:49164 -> 104.16.166.228:80
Source: Traffic	Snort IDS: 2031515 ET TROJAN Known Sinkhole Response Kryptos Logic 104.16.166.228:80 -> 192.168.2.22:49164
Source: Traffic	Snort IDS: 2031515 ET TROJAN Known Sinkhole Response Kryptos Logic 104.16.167.228:80 -> 192.168.2.22:49163

Tries to download HTTP data from a sinkholed server

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Jun 2024 18:39:03 GMTContent-Type: text/htmlContent-Length: 607Connection: closeServer: cloudflareCF-RAY: 8902c33d3a63eafa-DFWData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Jun 2024 18:39:04 GMTContent-Type: text/htmlContent-Length: 607Connection: closeServer: cloudflareCF-RAY: 8902c3450e21e70a-DFWData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Jun 2024 18:39:04 GMTContent-Type: text/htmlContent-Length: 607Connection: closeServer: cloudflareCF-RAY: 8902c344ff4de9a4-DFWData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 175.62.123.234
Source: unknown	TCP traffic detected without corresponding DNS query: 175.62.123.234
Source: unknown	TCP traffic detected without corresponding DNS query: 175.62.123.234
Source: unknown	TCP traffic detected without corresponding DNS query: 175.62.123.1
Source: unknown	TCP traffic detected without corresponding DNS query: 175.62.123.1
Source: unknown	TCP traffic detected without corresponding DNS query: 175.62.123.234
Source: unknown	TCP traffic detected without corresponding DNS query: 175.62.123.1
Source: unknown	TCP traffic detected without corresponding DNS query: 175.62.123.1
Source: unknown	TCP traffic detected without corresponding DNS query: 175.62.123.1
Source: unknown	TCP traffic detected without corresponding DNS query: 175.62.123.1
Source: unknown	TCP traffic detected without corresponding DNS query: 175.62.123.1
Source: unknown	TCP traffic detected without corresponding DNS query: 7.168.109.174
Source: unknown	TCP traffic detected without corresponding DNS query: 7.168.109.174
Source: unknown	TCP traffic detected without corresponding DNS query: 7.168.109.174
Source: unknown	TCP traffic detected without corresponding DNS query: 7.168.109.1
Source: unknown	TCP traffic detected without corresponding DNS query: 7.168.109.174
Source: unknown	TCP traffic detected without corresponding DNS query: 7.168.109.1
Source: unknown	TCP traffic detected without corresponding DNS query: 7.168.109.1
Source: unknown	TCP traffic detected without corresponding DNS query: 7.168.109.1
Source: unknown	TCP traffic detected without corresponding DNS query: 7.168.109.1
Source: unknown	TCP traffic detected without corresponding DNS query: 7.168.109.1
Source: unknown	TCP traffic detected without corresponding DNS query: 7.168.109.1
Source: unknown	TCP traffic detected without corresponding DNS query: 170.101.108.120
Source: unknown	TCP traffic detected without corresponding DNS query: 170.101.108.120
Source: unknown	TCP traffic detected without corresponding DNS query: 170.101.108.120
Source: unknown	TCP traffic detected without corresponding DNS query: 170.101.108.1
Source: unknown	TCP traffic detected without corresponding DNS query: 170.101.108.1
Source: unknown	TCP traffic detected without corresponding DNS query: 170.101.108.120
Source: unknown	TCP traffic detected without corresponding DNS query: 170.101.108.1
Source: unknown	TCP traffic detected without corresponding DNS query: 170.101.108.1
Source: unknown	TCP traffic detected without corresponding DNS query: 170.101.108.1
Source: unknown	TCP traffic detected without corresponding DNS query: 170.101.108.1
Source: unknown	TCP traffic detected without corresponding DNS query: 170.101.108.1
Source: unknown	TCP traffic detected without corresponding DNS query: 137.124.231.46
Source: unknown	TCP traffic detected without corresponding DNS query: 137.124.231.46
Source: unknown	TCP traffic detected without corresponding DNS query: 137.124.231.46
Source: unknown	TCP traffic detected without corresponding DNS query: 137.124.231.1
Source: unknown	TCP traffic detected without corresponding DNS query: 137.124.231.1
Source: unknown	TCP traffic detected without corresponding DNS query: 137.124.231.1
Source: unknown	TCP traffic detected without corresponding DNS query: 137.124.231.1
Source: unknown	TCP traffic detected without corresponding DNS query: 137.124.231.46
Source: unknown	TCP traffic detected without corresponding DNS query: 137.124.231.1
Source: unknown	TCP traffic detected without corresponding DNS query: 137.124.231.1
Source: unknown	TCP traffic detected without corresponding DNS query: 137.124.231.1
Source: unknown	TCP traffic detected without corresponding DNS query: 145.5.191.223
Source: unknown	TCP traffic detected without corresponding DNS query: 145.5.191.223
Source: unknown	TCP traffic detected without corresponding DNS query: 145.5.191.223
Source: unknown	TCP traffic detected without corresponding DNS query: 145.5.191.1
Source: unknown	TCP traffic detected without corresponding DNS query: 145.5.191.223
Source: unknown	TCP traffic detected without corresponding DNS query: 145.5.191.1

Source: C:\Windows\mssecsvc.exe

File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat

Jump to behavior

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

Source: mssecsvc.exe.5.dr	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Source: mssecsvc.exe, 0000000A.00000002.499805793.0000000000B64000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 0000000B.00000002.363828816.0000000000B44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
Source: mssecsvc.exe, 0000000A.00000002.499581626.000000000018C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJ
Source: mssecsvc.exe, 0000000A.00000002.499805793.0000000000B88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.kryptoslogic.com

Spam, unwanted Advertisements and Ransom Demands

Yara detected Wannacry ransomware

Source: Yara match	File source: zbRmQrzaHY.dll, type: SAMPLE
Source: Yara match	File source: 00000006.00000000.356244680.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.364040179.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.499667031.000000000042E000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.361281172.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.363619536.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.361347736.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.361343499.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.361392720.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.364067431.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.500102417.000000000293B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.356298598.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.500000036.0000000002423000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.499709795.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.363662706.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 1900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 3016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 2504, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\tasksche.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\mssecsvc.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: zbRmQrzaHY.dll, type: SAMPLE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: zbRmQrzaHY.dll, type: SAMPLE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 0000000C.00000002.363896323.000000000040E000.00000008.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 0000000C.00000000.363626200.000000000040E000.00000008.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 0000000B.00000000.361343499.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 0000000A.00000000.361392720.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000006.00000002.364067431.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 0000000A.00000002.500102417.000000000293B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000006.00000000.356298598.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 0000000A.00000002.500000036.0000000002423000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 0000000A.00000002.499709795.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 0000000B.00000002.363662706.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs

Source: C:\Windows\System32\loaddll32.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\WINDOWS\mssecsvc.exe	Jump to behavior
Source: C:\Windows\mssecsvc.exe	File created: C:\WINDOWS\tasksche.exe	Jump to behavior
Source: C:\Windows\mssecsvc.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Jump to behavior

Source: Joe Sandbox View

Dropped File: C:\Windows\tasksche.exe 2584E1521065E45EC3C17767C065429038FC6291C091097EA8B22C8A502C41DD

Source: mssecsvc.exe.5.dr	Static PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: tasksche.exe.6.dr	Static PE information: Resource name: XIA type: Zip archive data, at least v2.0 to extract, compression method=deflate

Source: zbRmQrzaHY.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: zbRmQrzaHY.dll, type: SAMPLE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: zbRmQrzaHY.dll, type: SAMPLE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 0000000C.00000002.363896323.000000000040E000.00000008.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 0000000C.00000000.363626200.000000000040E000.00000008.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 0000000B.00000000.361343499.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 0000000A.00000000.361392720.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000006.00000002.364067431.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 0000000A.00000002.500102417.000000000293B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000006.00000000.356298598.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 0000000A.00000002.500000036.0000000002423000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 0000000A.00000002.499709795.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 0000000B.00000002.363662706.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware

Source: tasksche.exe, 0000000C.00000002.363896323.000000000040E000.00000008.00000001.01000000.00000006.sdmp, zbRmQrzaHY.dll, mssecsvc.exe.5.dr, tasksche.exe.6.dr

Binary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll

Source: classification engine

Classification label: mal100.rans.expl.evad.winDLL@17/2@3/100

Source: zbRmQrzaHY.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\mssecsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\zbRmQrzaHY.dll,PlayGame

Source: zbRmQrzaHY.dll

ReversingLabs: Detection: 91%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\zbRmQrzaHY.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\zbRmQrzaHY.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\zbRmQrzaHY.dll,PlayGame
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\zbRmQrzaHY.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\zbRmQrzaHY.dll",PlayGame
Source: unknown	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe -m security
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
Source: C:\Windows\mssecsvc.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\zbRmQrzaHY.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\zbRmQrzaHY.dll,PlayGame	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\zbRmQrzaHY.dll",PlayGame	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\zbRmQrzaHY.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: zbRmQrzaHY.dll

Static file information: File size 5267459 > 1048576

Source: zbRmQrzaHY.dll

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x501000

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\rundll32.exe	Executable created and started: C:\WINDOWS\mssecsvc.exe			Jump to behavior
Source: C:\Windows\mssecsvc.exe	Executable created and started: C:\WINDOWS\tasksche.exe			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvc.exe			Jump to dropped file
Source: C:\Windows\mssecsvc.exe	File created: C:\Windows\tasksche.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvc.exe			Jump to dropped file
Source: C:\Windows\mssecsvc.exe	File created: C:\Windows\tasksche.exe			Jump to dropped file

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\mssecsvc.exe

Thread delayed: delay time: 86400000

Jump to behavior

Source: C:\Windows\mssecsvc.exe TID: 1704	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 3084	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 3088	Thread sleep count: 87 > 30	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 3088	Thread sleep time: -174000s >= -30000s	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 3092	Thread sleep count: 118 > 30	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 3092	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 3088	Thread sleep time: -86400000s >= -30000s	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 724	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\mssecsvc.exe	Thread delayed: delay time: 86400000			Jump to behavior

Source: loaddll32.exe, 00000000.00000003.353725598.000000000076B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmcicda.dll
Source: loaddll32.exe, 00000000.00000003.353807802.000000000075B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmcicda.dll80v
Source: loaddll32.exe, 00000000.00000003.360499272.0000000000769000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @}vmcicda.dllmon_

Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\zbRmQrzaHY.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\zbRmQrzaHY.dll,PlayGame	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\zbRmQrzaHY.dll",PlayGame	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\zbRmQrzaHY.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	12 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Rundll32	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	12 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
zbRmQrzaHY.dll	91%	ReversingLabs	Win32.Ransomware.WannaCry
zbRmQrzaHY.dll	100%	Avira	TR/AD.WannaCry.zbqny
zbRmQrzaHY.dll	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\mssecsvc.exe	100%	Avira	TR/AD.WannaCry.bqdjz
C:\Windows\tasksche.exe	100%	Avira	TR/AD.WannaCry.sewvt
C:\Windows\mssecsvc.exe	100%	Joe Sandbox ML
C:\Windows\tasksche.exe	100%	Joe Sandbox ML
C:\Windows\mssecsvc.exe	100%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Windows\tasksche.exe	100%	ReversingLabs	Win32.Ransomware.WannaCry

Source	Detection	Scanner	Label
https://ipinfo.io/	0%	URL Reputation	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/	100%	Avira URL Cloud	phishing
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	100%	Avira URL Cloud	phishing
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJ	0%	Avira URL Cloud	safe
https://www.kryptoslogic.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	104.16.166.228	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/	true	Avira URL Cloud: phishing	unknown
https://ipinfo.io/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	mssecsvc.exe.5.dr	false	Avira URL Cloud: phishing	unknown
https://www.kryptoslogic.com	mssecsvc.exe, 0000000A.00000002.499805793.0000000000B88000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJ	mssecsvc.exe, 0000000A.00000002.499581626.000000000018C000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
39.128.101.2	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
39.128.101.1	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
102.226.231.1	unknown	unknown	36926	CKL1-ASNKE	false
102.226.231.2	unknown	unknown	36926	CKL1-ASNKE	false
145.5.191.223	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
202.29.104.242	unknown	Thailand	133919	RMUTP-AS-APUniversitycampusnetworkRajamangalaUniversit	false
144.146.120.1	unknown	United States	5972	DNIC-ASBLK-05800-06055US	false
144.146.120.2	unknown	United States	5972	DNIC-ASBLK-05800-06055US	false
144.146.120.3	unknown	United States	5972	DNIC-ASBLK-05800-06055US	false
202.195.174.231	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
18.149.154.1	unknown	United States	16509	AMAZON-02US	false
145.5.191.2	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
145.5.191.3	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
45.139.167.1	unknown	Netherlands	62068	SPECTRAIPSpectraIPBVNL	false
45.139.167.2	unknown	Netherlands	62068	SPECTRAIPSpectraIPBVNL	false
23.35.183.3	unknown	United States	16625	AKAMAI-ASUS	false
23.35.183.1	unknown	United States	16625	AKAMAI-ASUS	false
23.35.183.2	unknown	United States	16625	AKAMAI-ASUS	false
145.5.191.1	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
51.252.175.1	unknown	Saudi Arabia	39891	ALJAWWALSTC-ASSA	false
102.226.231.46	unknown	unknown	36926	CKL1-ASNKE	false
153.124.214.173	unknown	Japan	59108	KATCH-NETKATCHNETWORKINCJP	false
90.170.69.2	unknown	Spain	12479	UNI2-ASES	false
90.170.69.1	unknown	Spain	12479	UNI2-ASES	false
103.27.230.1	unknown	Singapore	22363	PHMGMT-AS1US	false
106.6.123.1	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false

Private

IP
192.168.2.148
192.168.2.149
192.168.2.146
192.168.2.147
192.168.2.140
192.168.2.141
192.168.2.144
192.168.2.145
192.168.2.142
192.168.2.143
192.168.2.159
192.168.2.157
192.168.2.158
192.168.2.151
192.168.2.152
192.168.2.150
192.168.2.155
192.168.2.156
192.168.2.153
192.168.2.154
192.168.2.126
192.168.2.247
192.168.2.127
192.168.2.248
192.168.2.124
192.168.2.245
192.168.2.125
192.168.2.246
192.168.2.128
192.168.2.249
192.168.2.129
192.168.2.240
192.168.2.122
192.168.2.243
192.168.2.123
192.168.2.244
192.168.2.120
192.168.2.241
192.168.2.121
192.168.2.242
192.168.2.97
192.168.2.137
192.168.2.96
192.168.2.138
192.168.2.99
192.168.2.135
192.168.2.98
192.168.2.136
192.168.2.139
192.168.2.250
192.168.2.130
192.168.2.251
192.168.2.91
192.168.2.90
192.168.2.93
192.168.2.133
192.168.2.254
192.168.2.92
192.168.2.134
192.168.2.95
192.168.2.131
192.168.2.252
192.168.2.94
192.168.2.132
192.168.2.253
192.168.2.104
192.168.2.225
192.168.2.105
192.168.2.226
192.168.2.102
192.168.2.223
192.168.2.103
192.168.2.224
192.168.2.108

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1453841
Start date and time:	2024-06-07 20:38:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	zbRmQrzaHY.dll renamed because original name is a hash value
Original Sample Name:	c05e2dab77349cd639aa837e7e121710b8a0718d8fc93fb4cc6458ae90e5c597.dll
Detection:	MAL
Classification:	mal100.rans.expl.evad.winDLL@17/2@3/100
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: zbRmQrzaHY.dll

Simulations

Behavior and APIs

Time	Type	Description
14:39:01	API Interceptor	2008x Sleep call for process: mssecsvc.exe modified
14:39:02	API Interceptor	1x Sleep call for process: loaddll32.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	Get hash	malicious	Unknown	Browse	104.16.167.228
	qCc1a4w5YZ.exe	Get hash	malicious	Wannacry	Browse	104.17.244.81
	http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	Get hash	malicious	Unknown	Browse	104.17.244.81
	http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	Get hash	malicious	Unknown	Browse	104.16.173.80
	02353699.exe	Get hash	malicious	Wannacry	Browse	104.16.173.80
	05894899.exe	Get hash	malicious	Wannacry	Browse	104.17.244.81
	dNDbcC4Trx.exe	Get hash	malicious	Wannacry	Browse	104.17.244.81
	tk6uE0LqBo.exe	Get hash	malicious	Wannacry	Browse	104.17.244.81

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CMNET-GDGuangdongMobileCommunicationCoLtdCN	skid.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	111.60.149.203
	skid.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	112.18.30.124
	mpsl.elf	Get hash	malicious	Mirai	Browse	112.49.37.41
	KKveTTgaAAsecNNaaaa.arm.elf	Get hash	malicious	Unknown	Browse	121.255.244.121
	oWWFhzvYZa.elf	Get hash	malicious	Mirai	Browse	39.141.226.159
	R0KZjqu0OA.elf	Get hash	malicious	Mirai	Browse	183.252.130.79
	lMIVD0KqYQ.elf	Get hash	malicious	Mirai	Browse	36.182.120.85
	arm.elf	Get hash	malicious	Mirai	Browse	120.192.206.121
	https://app.appsflyer.com///com.ze6aealotdigital.zdgohero-MyCard?%7D&af_r=//baidu.com///link?url=ol1I_mBk5azo3rw7Up0mVy7Zr04ZQgFIeR8_yMgFtg2goL_gWcalf4aovW0R0Fsb&wd#.ZGVubmlzd0B0eGRwc2N1Lm9yZw==	Get hash	malicious	Unknown	Browse	39.156.66.10
	nxz1JLFrc3.elf	Get hash	malicious	Mirai	Browse	36.184.182.79
CMNET-GDGuangdongMobileCommunicationCoLtdCN	skid.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	111.60.149.203
	skid.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	112.18.30.124
	mpsl.elf	Get hash	malicious	Mirai	Browse	112.49.37.41
	KKveTTgaAAsecNNaaaa.arm.elf	Get hash	malicious	Unknown	Browse	121.255.244.121
	oWWFhzvYZa.elf	Get hash	malicious	Mirai	Browse	39.141.226.159
	R0KZjqu0OA.elf	Get hash	malicious	Mirai	Browse	183.252.130.79
	lMIVD0KqYQ.elf	Get hash	malicious	Mirai	Browse	36.182.120.85
	arm.elf	Get hash	malicious	Mirai	Browse	120.192.206.121
	https://app.appsflyer.com///com.ze6aealotdigital.zdgohero-MyCard?%7D&af_r=//baidu.com///link?url=ol1I_mBk5azo3rw7Up0mVy7Zr04ZQgFIeR8_yMgFtg2goL_gWcalf4aovW0R0Fsb&wd#.ZGVubmlzd0B0eGRwc2N1Lm9yZw==	Get hash	malicious	Unknown	Browse	39.156.66.10
	nxz1JLFrc3.elf	Get hash	malicious	Mirai	Browse	36.184.182.79
CKL1-ASNKE	arm.elf	Get hash	malicious	Mirai	Browse	102.236.206.207
	arm7.elf	Get hash	malicious	Mirai	Browse	102.215.238.74
	skid.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	102.194.153.245
	Q8QeOUbRK0.exe	Get hash	malicious	GuLoader	Browse	102.218.215.30
	1PTLWkB6Xv.img	Get hash	malicious	FormBook	Browse	102.222.124.13
	5dzdxe7bVc.elf	Get hash	malicious	Mirai	Browse	102.222.82.213
	nr 133764ZMA2024.exe	Get hash	malicious	FormBook	Browse	102.222.124.13
	FrsPvfk735.exe	Get hash	malicious	GuLoader	Browse	102.218.215.30
	gI7kdes69D.elf	Get hash	malicious	Mirai	Browse	102.209.241.218
	4xGw66BS5c.elf	Get hash	malicious	Mirai	Browse	102.208.250.57
CKL1-ASNKE	arm.elf	Get hash	malicious	Mirai	Browse	102.236.206.207
	arm7.elf	Get hash	malicious	Mirai	Browse	102.215.238.74
	skid.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	102.194.153.245
	Q8QeOUbRK0.exe	Get hash	malicious	GuLoader	Browse	102.218.215.30
	1PTLWkB6Xv.img	Get hash	malicious	FormBook	Browse	102.222.124.13
	5dzdxe7bVc.elf	Get hash	malicious	Mirai	Browse	102.222.82.213
	nr 133764ZMA2024.exe	Get hash	malicious	FormBook	Browse	102.222.124.13
	FrsPvfk735.exe	Get hash	malicious	GuLoader	Browse	102.218.215.30
	gI7kdes69D.elf	Get hash	malicious	Mirai	Browse	102.209.241.218
	4xGw66BS5c.elf	Get hash	malicious	Mirai	Browse	102.208.250.57

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\tasksche.exe	zyeX8bTkky.dll	Get hash	malicious	Wannacry	Browse
	qCc1a4w5YZ.exe	Get hash	malicious	Wannacry	Browse
	stN592INV6.exe	Get hash	malicious	Wannacry	Browse
	onq54JS79W.exe	Get hash	malicious	Wannacry	Browse
	MSNRf9dZ63.exe	Get hash	malicious	Wannacry	Browse
	7Qu8thR7WW.dll	Get hash	malicious	Wannacry, Virut	Browse
	MSmReFKunQ.dll	Get hash	malicious	Wannacry	Browse

Created / dropped Files

C:\Windows\mssecsvc.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3723264
Entropy (8bit):	7.965905243891064
Encrypted:	false
SSDEEP:	98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HI:yDqPe1Cxcxk3ZAEUadzR8yc4HI
MD5:	0C694193CEAC8BFB016491FFB534EB7C
SHA1:	3AFA73283D1E17DE1BDE6CC14E19417E70FC9554
SHA-256:	DBF3890B782AC04136C3336814EEF97E3C0F4133F9592E882C131C179161B27B
SHA-512:	BFA729E9449C0A438CFB51FC9F4314022B2F18092938FD42702A06246EDC865DB77327399A8D21CC1FA208A99E3436E4A460CB010E428CADDC638C3FA6547AFB
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvc.exe, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (based on rule by US CERT) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvc.exe, Author: us-cert code analysis team Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\mssecsvc.exe, Author: ReversingLabs
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U<S..]=..]=..]=.jA1..]=.A3..]=.~B7..]=.~B6..]=.~B9..]=..R`..]=..]<.J]=.'{6..]=..[;..]=.Rich.]=.........................PE..L.....L.....................08...................@...........................f......................................................1.T.5..........................................................................................................text.............................. ..`.rdata..............................@..@.data....H0......p..................@....rsrc...T.5...1...5.. ..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\tasksche.exe

Download File

Process:	C:\Windows\mssecsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3514368
Entropy (8bit):	7.996072890929898
Encrypted:	true
SSDEEP:	98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hj:QqPe1Cxcxk3ZAEUadzR8yc4Hj
MD5:	7F7CCAA16FB15EB1C7399D422F8363E8
SHA1:	BD44D0AB543BF814D93B719C24E90D8DD7111234
SHA-256:	2584E1521065E45EC3C17767C065429038FC6291C091097EA8B22C8A502C41DD
SHA-512:	83E334B80DE08903CFA9891A3FA349C1ECE7E19F8E62B74A017512FA9A7989A0FD31929BF1FC13847BEE04F2DA3DACF6BC3F5EE58F0E4B9D495F4B9AF12ED2B7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\tasksche.exe, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\tasksche.exe, Author: ReversingLabs
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Joe Sandbox View:	Filename: zyeX8bTkky.dll, Detection: malicious, Browse Filename: qCc1a4w5YZ.exe, Detection: malicious, Browse Filename: stN592INV6.exe, Detection: malicious, Browse Filename: onq54JS79W.exe, Detection: malicious, Browse Filename: MSNRf9dZ63.exe, Detection: malicious, Browse Filename: 7Qu8thR7WW.dll, Detection: malicious, Browse Filename: MSmReFKunQ.dll, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..T...T...T..X...T.._...T.'.Z...T..^...T..P...T.g.....T...U...T..._...T.c.R...T.Rich..T.........................PE..L...A..L.................p... 5......w............@...........................5.................................................d.........4..........................................................................................................text....i.......p.................. ..`.rdata..p_.......`..................@..@.data...X........ ..................@....rsrc.....4.......4.................@..@........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.412630716402947
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	zbRmQrzaHY.dll
File size:	5'267'459 bytes
MD5:	ae12bb54af31227017feffd9598a6f5e
SHA1:	f597a1cc16d42b7f02e077696e067cd3030a06d9
SHA256:	c05e2dab77349cd639aa837e7e121710b8a0718d8fc93fb4cc6458ae90e5c597
SHA512:	a80b1cc70cafff3b8edb2e732fa2360436cc7556ba91977ab1fa505ad7c6e184c465839d1584f827be17ccb751240432348debe69eed4e006321d9af4334621b
SSDEEP:	98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:+DqPe1Cxcxk3ZAEUadzR8yc4H
TLSH:	92363394622CB2FCF0440EB44463896BB7B33C6967BA5E1F8BC086670D43B5BAFD0641
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.r_9...9...9.......=...9...6.....A.:.......8.......8.......:...Rich9...........................PE..L...QW.Y...........!.......

File Icon


Icon Hash:	72e697938fb690c7

Static PE Info

General

Entrypoint:	0x100011e9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x59145751 [Thu May 11 12:21:37 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2e5708ae5fed0403e8117c645fb23e5b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ebx
mov ebx, dword ptr [ebp+08h]
push esi
mov esi, dword ptr [ebp+0Ch]
push edi
mov edi, dword ptr [ebp+10h]
test esi, esi
jne 00007F9FC91B01EBh
cmp dword ptr [10003140h], 00000000h
jmp 00007F9FC91B0208h
cmp esi, 01h
je 00007F9FC91B01E7h
cmp esi, 02h
jne 00007F9FC91B0204h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F9FC91B01EBh
push edi
push esi
push ebx
call eax
test eax, eax
je 00007F9FC91B01EEh
push edi
push esi
push ebx
call 00007F9FC91B00FAh
test eax, eax
jne 00007F9FC91B01E6h
xor eax, eax
jmp 00007F9FC91B0230h
push edi
push esi
push ebx
call 00007F9FC91AFFACh
cmp esi, 01h
mov dword ptr [ebp+0Ch], eax
jne 00007F9FC91B01EEh
test eax, eax
jne 00007F9FC91B0219h
push edi
push eax
push ebx
call 00007F9FC91B00D6h
test esi, esi
je 00007F9FC91B01E7h
cmp esi, 03h
jne 00007F9FC91B0208h
push edi
push esi
push ebx
call 00007F9FC91B00C5h
test eax, eax
jne 00007F9FC91B01E5h
and dword ptr [ebp+0Ch], eax
cmp dword ptr [ebp+0Ch], 00000000h
je 00007F9FC91B01F3h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F9FC91B01EAh
push edi
push esi
push ebx
call eax
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
pop esi
pop ebx
pop ebp
retn 000Ch
jmp dword ptr [10002028h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[C++] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2190	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x203c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x500060	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x505000	0x5c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28c	0x1000	8de9a2cb31e4c74bd008b871d14bfafc	False	0.13037109375	data	1.4429971244731552	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x1d8	0x1000	3dd394f95ab218593f2bc8eb65184db4	False	0.072509765625	data	0.7346018133622799	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x154	0x1000	fe5022c5b5d015ad38b2b77fc437a5cb	False	0.016845703125	Matlab v4 mat-file (little endian) C:\%s\%s, numeric, rows 0, columns 0	0.085238686413312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x500060	0x501000	d0fa4e97f2da8d58667c85e5416426e6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x505000	0x2ac	0x1000	620f0b67a91f7f74151bc5be745b7110	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
W	0x4060	0x500000	data	English	United States	0.8770942687988281

Imports

DLL	Import
KERNEL32.dll	CloseHandle, WriteFile, CreateFileA, SizeofResource, LockResource, LoadResource, FindResourceA, CreateProcessA
MSVCRT.dll	free, _initterm, malloc, _adjust_fdiv, sprintf

Exports

Name	Ordinal	Address
PlayGame	1	0x10001114

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/07/24-20:39:03.946772	TCP	2024298	ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1	49164	80	192.168.2.22	104.16.166.228
06/07/24-20:39:04.567081	TCP	2031515	ET TROJAN Known Sinkhole Response Kryptos Logic	80	49163	104.16.167.228	192.168.2.22
06/07/24-20:39:03.922467	UDP	2024291	ET TROJAN Possible WannaCry DNS Lookup 1	57893	53	192.168.2.22	8.8.8.8
06/07/24-20:39:03.925405	TCP	2024298	ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1	49163	80	192.168.2.22	104.16.167.228
06/07/24-20:39:02.682934	TCP	2024298	ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1	49162	80	192.168.2.22	104.16.166.228
06/07/24-20:39:03.337539	TCP	2031515	ET TROJAN Known Sinkhole Response Kryptos Logic	80	49162	104.16.166.228	192.168.2.22
06/07/24-20:39:04.565273	TCP	2031515	ET TROJAN Known Sinkhole Response Kryptos Logic	80	49164	104.16.166.228	192.168.2.22
06/07/24-20:39:02.653511	UDP	2024291	ET TROJAN Possible WannaCry DNS Lookup 1	52917	53	192.168.2.22	8.8.8.8
06/07/24-20:39:03.899755	UDP	2024291	ET TROJAN Possible WannaCry DNS Lookup 1	62751	53	192.168.2.22	8.8.8.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 7, 2024 20:39:02.677287102 CEST	49162	80	192.168.2.22	104.16.166.228
Jun 7, 2024 20:39:02.682441950 CEST	80	49162	104.16.166.228	192.168.2.22
Jun 7, 2024 20:39:02.682512999 CEST	49162	80	192.168.2.22	104.16.166.228
Jun 7, 2024 20:39:02.682934046 CEST	49162	80	192.168.2.22	104.16.166.228
Jun 7, 2024 20:39:02.687849045 CEST	80	49162	104.16.166.228	192.168.2.22
Jun 7, 2024 20:39:03.337538958 CEST	80	49162	104.16.166.228	192.168.2.22
Jun 7, 2024 20:39:03.337608099 CEST	49162	80	192.168.2.22	104.16.166.228
Jun 7, 2024 20:39:03.339476109 CEST	80	49162	104.16.166.228	192.168.2.22
Jun 7, 2024 20:39:03.339534998 CEST	49162	80	192.168.2.22	104.16.166.228
Jun 7, 2024 20:39:03.401477098 CEST	49162	80	192.168.2.22	104.16.166.228
Jun 7, 2024 20:39:03.406512022 CEST	80	49162	104.16.166.228	192.168.2.22
Jun 7, 2024 20:39:03.920114994 CEST	49163	80	192.168.2.22	104.16.167.228
Jun 7, 2024 20:39:03.925081968 CEST	80	49163	104.16.167.228	192.168.2.22
Jun 7, 2024 20:39:03.925159931 CEST	49163	80	192.168.2.22	104.16.167.228
Jun 7, 2024 20:39:03.925405025 CEST	49163	80	192.168.2.22	104.16.167.228
Jun 7, 2024 20:39:03.930238008 CEST	80	49163	104.16.167.228	192.168.2.22
Jun 7, 2024 20:39:03.941332102 CEST	49164	80	192.168.2.22	104.16.166.228
Jun 7, 2024 20:39:03.946384907 CEST	80	49164	104.16.166.228	192.168.2.22
Jun 7, 2024 20:39:03.946445942 CEST	49164	80	192.168.2.22	104.16.166.228
Jun 7, 2024 20:39:03.946772099 CEST	49164	80	192.168.2.22	104.16.166.228
Jun 7, 2024 20:39:03.951587915 CEST	80	49164	104.16.166.228	192.168.2.22
Jun 7, 2024 20:39:04.565273046 CEST	80	49164	104.16.166.228	192.168.2.22
Jun 7, 2024 20:39:04.566461086 CEST	80	49164	104.16.166.228	192.168.2.22
Jun 7, 2024 20:39:04.566544056 CEST	49164	80	192.168.2.22	104.16.166.228
Jun 7, 2024 20:39:04.566874981 CEST	49164	80	192.168.2.22	104.16.166.228
Jun 7, 2024 20:39:04.567080975 CEST	80	49163	104.16.167.228	192.168.2.22
Jun 7, 2024 20:39:04.567400932 CEST	49163	80	192.168.2.22	104.16.167.228
Jun 7, 2024 20:39:04.568150043 CEST	49163	80	192.168.2.22	104.16.167.228
Jun 7, 2024 20:39:04.570066929 CEST	80	49163	104.16.167.228	192.168.2.22
Jun 7, 2024 20:39:04.570142031 CEST	49163	80	192.168.2.22	104.16.167.228
Jun 7, 2024 20:39:04.571744919 CEST	80	49164	104.16.166.228	192.168.2.22
Jun 7, 2024 20:39:04.573043108 CEST	80	49163	104.16.167.228	192.168.2.22
Jun 7, 2024 20:39:04.617739916 CEST	49165	445	192.168.2.22	175.62.123.234
Jun 7, 2024 20:39:04.622884989 CEST	445	49165	175.62.123.234	192.168.2.22
Jun 7, 2024 20:39:04.622996092 CEST	49165	445	192.168.2.22	175.62.123.234
Jun 7, 2024 20:39:04.622996092 CEST	49165	445	192.168.2.22	175.62.123.234
Jun 7, 2024 20:39:04.623146057 CEST	49166	445	192.168.2.22	175.62.123.1
Jun 7, 2024 20:39:04.628134012 CEST	445	49166	175.62.123.1	192.168.2.22
Jun 7, 2024 20:39:04.628391027 CEST	445	49165	175.62.123.234	192.168.2.22
Jun 7, 2024 20:39:04.628479958 CEST	49166	445	192.168.2.22	175.62.123.1
Jun 7, 2024 20:39:04.628523111 CEST	49165	445	192.168.2.22	175.62.123.234
Jun 7, 2024 20:39:04.632375956 CEST	49166	445	192.168.2.22	175.62.123.1
Jun 7, 2024 20:39:04.636516094 CEST	49169	445	192.168.2.22	175.62.123.1
Jun 7, 2024 20:39:04.637363911 CEST	445	49166	175.62.123.1	192.168.2.22
Jun 7, 2024 20:39:04.638910055 CEST	49166	445	192.168.2.22	175.62.123.1
Jun 7, 2024 20:39:04.641438961 CEST	445	49169	175.62.123.1	192.168.2.22
Jun 7, 2024 20:39:04.641668081 CEST	49169	445	192.168.2.22	175.62.123.1
Jun 7, 2024 20:39:04.641742945 CEST	49169	445	192.168.2.22	175.62.123.1
Jun 7, 2024 20:39:04.646620035 CEST	445	49169	175.62.123.1	192.168.2.22
Jun 7, 2024 20:39:06.612279892 CEST	49190	445	192.168.2.22	7.168.109.174
Jun 7, 2024 20:39:06.617475033 CEST	445	49190	7.168.109.174	192.168.2.22
Jun 7, 2024 20:39:06.617738008 CEST	49190	445	192.168.2.22	7.168.109.174
Jun 7, 2024 20:39:06.617816925 CEST	49190	445	192.168.2.22	7.168.109.174
Jun 7, 2024 20:39:06.618000031 CEST	49191	445	192.168.2.22	7.168.109.1
Jun 7, 2024 20:39:06.623023033 CEST	445	49191	7.168.109.1	192.168.2.22
Jun 7, 2024 20:39:06.623112917 CEST	445	49190	7.168.109.174	192.168.2.22
Jun 7, 2024 20:39:06.623306036 CEST	49190	445	192.168.2.22	7.168.109.174
Jun 7, 2024 20:39:06.623306036 CEST	49191	445	192.168.2.22	7.168.109.1
Jun 7, 2024 20:39:06.623306036 CEST	49191	445	192.168.2.22	7.168.109.1
Jun 7, 2024 20:39:06.625113964 CEST	49192	445	192.168.2.22	7.168.109.1
Jun 7, 2024 20:39:06.628545046 CEST	445	49191	7.168.109.1	192.168.2.22
Jun 7, 2024 20:39:06.629689932 CEST	49191	445	192.168.2.22	7.168.109.1
Jun 7, 2024 20:39:06.630048990 CEST	445	49192	7.168.109.1	192.168.2.22
Jun 7, 2024 20:39:06.633966923 CEST	49192	445	192.168.2.22	7.168.109.1
Jun 7, 2024 20:39:06.634006977 CEST	49192	445	192.168.2.22	7.168.109.1
Jun 7, 2024 20:39:06.638931990 CEST	445	49192	7.168.109.1	192.168.2.22
Jun 7, 2024 20:39:08.624496937 CEST	49215	445	192.168.2.22	170.101.108.120
Jun 7, 2024 20:39:08.630944967 CEST	445	49215	170.101.108.120	192.168.2.22
Jun 7, 2024 20:39:08.631028891 CEST	49215	445	192.168.2.22	170.101.108.120
Jun 7, 2024 20:39:08.631081104 CEST	49215	445	192.168.2.22	170.101.108.120
Jun 7, 2024 20:39:08.631244898 CEST	49216	445	192.168.2.22	170.101.108.1
Jun 7, 2024 20:39:08.639482975 CEST	445	49216	170.101.108.1	192.168.2.22
Jun 7, 2024 20:39:08.639518023 CEST	445	49215	170.101.108.120	192.168.2.22
Jun 7, 2024 20:39:08.639580011 CEST	49216	445	192.168.2.22	170.101.108.1
Jun 7, 2024 20:39:08.639609098 CEST	49215	445	192.168.2.22	170.101.108.120
Jun 7, 2024 20:39:08.639637947 CEST	49216	445	192.168.2.22	170.101.108.1
Jun 7, 2024 20:39:08.641103029 CEST	49217	445	192.168.2.22	170.101.108.1
Jun 7, 2024 20:39:08.648556948 CEST	445	49216	170.101.108.1	192.168.2.22
Jun 7, 2024 20:39:08.649291039 CEST	445	49217	170.101.108.1	192.168.2.22
Jun 7, 2024 20:39:08.649355888 CEST	49217	445	192.168.2.22	170.101.108.1
Jun 7, 2024 20:39:08.649390936 CEST	49217	445	192.168.2.22	170.101.108.1
Jun 7, 2024 20:39:08.657638073 CEST	445	49217	170.101.108.1	192.168.2.22
Jun 7, 2024 20:39:08.658206940 CEST	445	49216	170.101.108.1	192.168.2.22
Jun 7, 2024 20:39:08.658389091 CEST	49216	445	192.168.2.22	170.101.108.1
Jun 7, 2024 20:39:10.637496948 CEST	49238	445	192.168.2.22	137.124.231.46
Jun 7, 2024 20:39:10.644161940 CEST	445	49238	137.124.231.46	192.168.2.22
Jun 7, 2024 20:39:10.644366980 CEST	49238	445	192.168.2.22	137.124.231.46
Jun 7, 2024 20:39:10.644366980 CEST	49238	445	192.168.2.22	137.124.231.46
Jun 7, 2024 20:39:10.644540071 CEST	49240	445	192.168.2.22	137.124.231.1
Jun 7, 2024 20:39:10.650957108 CEST	445	49240	137.124.231.1	192.168.2.22
Jun 7, 2024 20:39:10.651037931 CEST	49240	445	192.168.2.22	137.124.231.1
Jun 7, 2024 20:39:10.651099920 CEST	49240	445	192.168.2.22	137.124.231.1
Jun 7, 2024 20:39:10.652766943 CEST	49241	445	192.168.2.22	137.124.231.1
Jun 7, 2024 20:39:10.655488968 CEST	445	49238	137.124.231.46	192.168.2.22
Jun 7, 2024 20:39:10.655680895 CEST	49238	445	192.168.2.22	137.124.231.46
Jun 7, 2024 20:39:10.656131983 CEST	445	49240	137.124.231.1	192.168.2.22
Jun 7, 2024 20:39:10.656306982 CEST	49240	445	192.168.2.22	137.124.231.1
Jun 7, 2024 20:39:10.657732010 CEST	445	49241	137.124.231.1	192.168.2.22
Jun 7, 2024 20:39:10.657808065 CEST	49241	445	192.168.2.22	137.124.231.1
Jun 7, 2024 20:39:10.657855034 CEST	49241	445	192.168.2.22	137.124.231.1
Jun 7, 2024 20:39:10.662724018 CEST	445	49241	137.124.231.1	192.168.2.22
Jun 7, 2024 20:39:12.648914099 CEST	49261	445	192.168.2.22	145.5.191.223
Jun 7, 2024 20:39:12.654166937 CEST	445	49261	145.5.191.223	192.168.2.22
Jun 7, 2024 20:39:12.654251099 CEST	49261	445	192.168.2.22	145.5.191.223
Jun 7, 2024 20:39:12.654325962 CEST	49261	445	192.168.2.22	145.5.191.223
Jun 7, 2024 20:39:12.654532909 CEST	49262	445	192.168.2.22	145.5.191.1
Jun 7, 2024 20:39:12.659363031 CEST	445	49261	145.5.191.223	192.168.2.22
Jun 7, 2024 20:39:12.659420967 CEST	445	49262	145.5.191.1	192.168.2.22
Jun 7, 2024 20:39:12.659441948 CEST	49261	445	192.168.2.22	145.5.191.223
Jun 7, 2024 20:39:12.659483910 CEST	49262	445	192.168.2.22	145.5.191.1
Jun 7, 2024 20:39:12.659543991 CEST	49262	445	192.168.2.22	145.5.191.1
Jun 7, 2024 20:39:12.660981894 CEST	49263	445	192.168.2.22	145.5.191.1
Jun 7, 2024 20:39:12.664827108 CEST	445	49262	145.5.191.1	192.168.2.22
Jun 7, 2024 20:39:12.664907932 CEST	49262	445	192.168.2.22	145.5.191.1
Jun 7, 2024 20:39:12.665932894 CEST	445	49263	145.5.191.1	192.168.2.22
Jun 7, 2024 20:39:12.666038036 CEST	49263	445	192.168.2.22	145.5.191.1
Jun 7, 2024 20:39:12.666117907 CEST	49263	445	192.168.2.22	145.5.191.1
Jun 7, 2024 20:39:12.670948029 CEST	445	49263	145.5.191.1	192.168.2.22
Jun 7, 2024 20:39:13.137717009 CEST	445	49169	175.62.123.1	192.168.2.22
Jun 7, 2024 20:39:13.137957096 CEST	49169	445	192.168.2.22	175.62.123.1
Jun 7, 2024 20:39:13.138063908 CEST	49169	445	192.168.2.22	175.62.123.1
Jun 7, 2024 20:39:13.138063908 CEST	49169	445	192.168.2.22	175.62.123.1
Jun 7, 2024 20:39:13.143197060 CEST	445	49169	175.62.123.1	192.168.2.22
Jun 7, 2024 20:39:13.143250942 CEST	445	49169	175.62.123.1	192.168.2.22
Jun 7, 2024 20:39:14.689209938 CEST	49284	445	192.168.2.22	159.156.112.97
Jun 7, 2024 20:39:14.694365978 CEST	445	49284	159.156.112.97	192.168.2.22
Jun 7, 2024 20:39:14.694438934 CEST	49284	445	192.168.2.22	159.156.112.97
Jun 7, 2024 20:39:14.694469929 CEST	49284	445	192.168.2.22	159.156.112.97
Jun 7, 2024 20:39:14.694633007 CEST	49286	445	192.168.2.22	159.156.112.1
Jun 7, 2024 20:39:14.699588060 CEST	445	49286	159.156.112.1	192.168.2.22
Jun 7, 2024 20:39:14.699703932 CEST	49286	445	192.168.2.22	159.156.112.1
Jun 7, 2024 20:39:14.699743032 CEST	49286	445	192.168.2.22	159.156.112.1
Jun 7, 2024 20:39:14.700078011 CEST	445	49284	159.156.112.97	192.168.2.22
Jun 7, 2024 20:39:14.700135946 CEST	49284	445	192.168.2.22	159.156.112.97
Jun 7, 2024 20:39:14.700958967 CEST	49287	445	192.168.2.22	159.156.112.1
Jun 7, 2024 20:39:14.704876900 CEST	445	49286	159.156.112.1	192.168.2.22
Jun 7, 2024 20:39:14.704932928 CEST	49286	445	192.168.2.22	159.156.112.1
Jun 7, 2024 20:39:14.705859900 CEST	445	49287	159.156.112.1	192.168.2.22
Jun 7, 2024 20:39:14.705920935 CEST	49287	445	192.168.2.22	159.156.112.1
Jun 7, 2024 20:39:14.705956936 CEST	49287	445	192.168.2.22	159.156.112.1
Jun 7, 2024 20:39:14.710783958 CEST	445	49287	159.156.112.1	192.168.2.22
Jun 7, 2024 20:39:15.137892008 CEST	445	49192	7.168.109.1	192.168.2.22
Jun 7, 2024 20:39:15.138021946 CEST	49192	445	192.168.2.22	7.168.109.1
Jun 7, 2024 20:39:15.138118982 CEST	49192	445	192.168.2.22	7.168.109.1
Jun 7, 2024 20:39:15.138118982 CEST	49192	445	192.168.2.22	7.168.109.1
Jun 7, 2024 20:39:15.143101931 CEST	445	49192	7.168.109.1	192.168.2.22
Jun 7, 2024 20:39:15.143134117 CEST	445	49192	7.168.109.1	192.168.2.22
Jun 7, 2024 20:39:16.141846895 CEST	49302	445	192.168.2.22	175.62.123.1
Jun 7, 2024 20:39:16.146797895 CEST	445	49302	175.62.123.1	192.168.2.22
Jun 7, 2024 20:39:16.147022009 CEST	49302	445	192.168.2.22	175.62.123.1
Jun 7, 2024 20:39:16.147047043 CEST	49302	445	192.168.2.22	175.62.123.1
Jun 7, 2024 20:39:16.151889086 CEST	445	49302	175.62.123.1	192.168.2.22
Jun 7, 2024 20:39:16.688236952 CEST	49310	445	192.168.2.22	8.113.72.50
Jun 7, 2024 20:39:16.693259954 CEST	445	49310	8.113.72.50	192.168.2.22
Jun 7, 2024 20:39:16.693486929 CEST	49310	445	192.168.2.22	8.113.72.50
Jun 7, 2024 20:39:16.693486929 CEST	49310	445	192.168.2.22	8.113.72.50
Jun 7, 2024 20:39:16.693681955 CEST	49311	445	192.168.2.22	8.113.72.1
Jun 7, 2024 20:39:16.698537111 CEST	445	49311	8.113.72.1	192.168.2.22
Jun 7, 2024 20:39:16.698615074 CEST	49311	445	192.168.2.22	8.113.72.1
Jun 7, 2024 20:39:16.698653936 CEST	445	49310	8.113.72.50	192.168.2.22
Jun 7, 2024 20:39:16.698689938 CEST	49311	445	192.168.2.22	8.113.72.1
Jun 7, 2024 20:39:16.698738098 CEST	49310	445	192.168.2.22	8.113.72.50
Jun 7, 2024 20:39:16.699095011 CEST	49312	445	192.168.2.22	8.113.72.1
Jun 7, 2024 20:39:16.703852892 CEST	445	49311	8.113.72.1	192.168.2.22
Jun 7, 2024 20:39:16.703918934 CEST	49311	445	192.168.2.22	8.113.72.1
Jun 7, 2024 20:39:16.703953981 CEST	445	49312	8.113.72.1	192.168.2.22
Jun 7, 2024 20:39:16.704031944 CEST	49312	445	192.168.2.22	8.113.72.1
Jun 7, 2024 20:39:16.704032898 CEST	49312	445	192.168.2.22	8.113.72.1
Jun 7, 2024 20:39:16.709532022 CEST	445	49312	8.113.72.1	192.168.2.22
Jun 7, 2024 20:39:17.143896103 CEST	445	49217	170.101.108.1	192.168.2.22
Jun 7, 2024 20:39:17.143971920 CEST	49217	445	192.168.2.22	170.101.108.1
Jun 7, 2024 20:39:17.144067049 CEST	49217	445	192.168.2.22	170.101.108.1
Jun 7, 2024 20:39:17.144238949 CEST	49217	445	192.168.2.22	170.101.108.1
Jun 7, 2024 20:39:17.148972988 CEST	445	49217	170.101.108.1	192.168.2.22
Jun 7, 2024 20:39:17.149066925 CEST	445	49217	170.101.108.1	192.168.2.22
Jun 7, 2024 20:39:18.138710022 CEST	49327	445	192.168.2.22	7.168.109.1
Jun 7, 2024 20:39:18.143722057 CEST	445	49327	7.168.109.1	192.168.2.22
Jun 7, 2024 20:39:18.143802881 CEST	49327	445	192.168.2.22	7.168.109.1
Jun 7, 2024 20:39:18.143894911 CEST	49327	445	192.168.2.22	7.168.109.1
Jun 7, 2024 20:39:18.148736954 CEST	445	49327	7.168.109.1	192.168.2.22
Jun 7, 2024 20:39:18.700594902 CEST	49334	445	192.168.2.22	196.164.18.73
Jun 7, 2024 20:39:18.705713034 CEST	445	49334	196.164.18.73	192.168.2.22
Jun 7, 2024 20:39:18.705816031 CEST	49334	445	192.168.2.22	196.164.18.73
Jun 7, 2024 20:39:18.705915928 CEST	49334	445	192.168.2.22	196.164.18.73
Jun 7, 2024 20:39:18.706113100 CEST	49335	445	192.168.2.22	196.164.18.1
Jun 7, 2024 20:39:18.711051941 CEST	445	49334	196.164.18.73	192.168.2.22
Jun 7, 2024 20:39:18.711088896 CEST	445	49335	196.164.18.1	192.168.2.22
Jun 7, 2024 20:39:18.711136103 CEST	49334	445	192.168.2.22	196.164.18.73
Jun 7, 2024 20:39:18.711167097 CEST	49335	445	192.168.2.22	196.164.18.1
Jun 7, 2024 20:39:18.711298943 CEST	49335	445	192.168.2.22	196.164.18.1
Jun 7, 2024 20:39:18.711678028 CEST	49336	445	192.168.2.22	196.164.18.1
Jun 7, 2024 20:39:18.716290951 CEST	445	49335	196.164.18.1	192.168.2.22
Jun 7, 2024 20:39:18.716367960 CEST	49335	445	192.168.2.22	196.164.18.1
Jun 7, 2024 20:39:18.716546059 CEST	445	49336	196.164.18.1	192.168.2.22
Jun 7, 2024 20:39:18.716613054 CEST	49336	445	192.168.2.22	196.164.18.1
Jun 7, 2024 20:39:18.716653109 CEST	49336	445	192.168.2.22	196.164.18.1
Jun 7, 2024 20:39:18.721496105 CEST	445	49336	196.164.18.1	192.168.2.22
Jun 7, 2024 20:39:19.145041943 CEST	445	49241	137.124.231.1	192.168.2.22
Jun 7, 2024 20:39:19.145164013 CEST	49241	445	192.168.2.22	137.124.231.1
Jun 7, 2024 20:39:19.151607990 CEST	49241	445	192.168.2.22	137.124.231.1
Jun 7, 2024 20:39:19.151751041 CEST	49241	445	192.168.2.22	137.124.231.1
Jun 7, 2024 20:39:19.156575918 CEST	445	49241	137.124.231.1	192.168.2.22
Jun 7, 2024 20:39:19.156712055 CEST	445	49241	137.124.231.1	192.168.2.22
Jun 7, 2024 20:39:20.156460047 CEST	49351	445	192.168.2.22	170.101.108.1
Jun 7, 2024 20:39:20.161488056 CEST	445	49351	170.101.108.1	192.168.2.22
Jun 7, 2024 20:39:20.161556959 CEST	49351	445	192.168.2.22	170.101.108.1
Jun 7, 2024 20:39:20.166961908 CEST	49351	445	192.168.2.22	170.101.108.1
Jun 7, 2024 20:39:20.172100067 CEST	445	49351	170.101.108.1	192.168.2.22
Jun 7, 2024 20:39:20.712950945 CEST	49358	445	192.168.2.22	202.195.174.231
Jun 7, 2024 20:39:20.717914104 CEST	445	49358	202.195.174.231	192.168.2.22
Jun 7, 2024 20:39:20.718081951 CEST	49358	445	192.168.2.22	202.195.174.231
Jun 7, 2024 20:39:20.718101025 CEST	49358	445	192.168.2.22	202.195.174.231
Jun 7, 2024 20:39:20.718326092 CEST	49359	445	192.168.2.22	202.195.174.1
Jun 7, 2024 20:39:20.723202944 CEST	445	49359	202.195.174.1	192.168.2.22
Jun 7, 2024 20:39:20.723318100 CEST	445	49358	202.195.174.231	192.168.2.22
Jun 7, 2024 20:39:20.723364115 CEST	49359	445	192.168.2.22	202.195.174.1
Jun 7, 2024 20:39:20.723364115 CEST	49359	445	192.168.2.22	202.195.174.1
Jun 7, 2024 20:39:20.723377943 CEST	49358	445	192.168.2.22	202.195.174.231
Jun 7, 2024 20:39:20.723788977 CEST	49360	445	192.168.2.22	202.195.174.1
Jun 7, 2024 20:39:20.728527069 CEST	445	49359	202.195.174.1	192.168.2.22
Jun 7, 2024 20:39:20.728581905 CEST	49359	445	192.168.2.22	202.195.174.1
Jun 7, 2024 20:39:20.728605032 CEST	445	49360	202.195.174.1	192.168.2.22
Jun 7, 2024 20:39:20.728653908 CEST	49360	445	192.168.2.22	202.195.174.1
Jun 7, 2024 20:39:20.728689909 CEST	49360	445	192.168.2.22	202.195.174.1
Jun 7, 2024 20:39:20.733730078 CEST	445	49360	202.195.174.1	192.168.2.22
Jun 7, 2024 20:39:21.156234980 CEST	445	49263	145.5.191.1	192.168.2.22
Jun 7, 2024 20:39:21.156342983 CEST	49263	445	192.168.2.22	145.5.191.1
Jun 7, 2024 20:39:21.156416893 CEST	49263	445	192.168.2.22	145.5.191.1
Jun 7, 2024 20:39:21.156498909 CEST	49263	445	192.168.2.22	145.5.191.1
Jun 7, 2024 20:39:21.161312103 CEST	445	49263	145.5.191.1	192.168.2.22
Jun 7, 2024 20:39:21.161322117 CEST	445	49263	145.5.191.1	192.168.2.22
Jun 7, 2024 20:39:22.147877932 CEST	49377	445	192.168.2.22	137.124.231.1
Jun 7, 2024 20:39:22.152973890 CEST	445	49377	137.124.231.1	192.168.2.22
Jun 7, 2024 20:39:22.153042078 CEST	49377	445	192.168.2.22	137.124.231.1
Jun 7, 2024 20:39:22.153121948 CEST	49377	445	192.168.2.22	137.124.231.1
Jun 7, 2024 20:39:22.158032894 CEST	445	49377	137.124.231.1	192.168.2.22
Jun 7, 2024 20:39:22.725497007 CEST	49383	445	192.168.2.22	144.146.120.168
Jun 7, 2024 20:39:22.733786106 CEST	445	49383	144.146.120.168	192.168.2.22
Jun 7, 2024 20:39:22.733973980 CEST	49383	445	192.168.2.22	144.146.120.168
Jun 7, 2024 20:39:22.734033108 CEST	49383	445	192.168.2.22	144.146.120.168
Jun 7, 2024 20:39:22.734200954 CEST	49384	445	192.168.2.22	144.146.120.1
Jun 7, 2024 20:39:22.742101908 CEST	445	49384	144.146.120.1	192.168.2.22
Jun 7, 2024 20:39:22.742185116 CEST	49384	445	192.168.2.22	144.146.120.1
Jun 7, 2024 20:39:22.742213011 CEST	49384	445	192.168.2.22	144.146.120.1
Jun 7, 2024 20:39:22.742491961 CEST	445	49383	144.146.120.168	192.168.2.22
Jun 7, 2024 20:39:22.742558956 CEST	49383	445	192.168.2.22	144.146.120.168
Jun 7, 2024 20:39:22.742819071 CEST	49385	445	192.168.2.22	144.146.120.1
Jun 7, 2024 20:39:22.751017094 CEST	445	49384	144.146.120.1	192.168.2.22
Jun 7, 2024 20:39:22.751034021 CEST	445	49385	144.146.120.1	192.168.2.22
Jun 7, 2024 20:39:22.751072884 CEST	49384	445	192.168.2.22	144.146.120.1
Jun 7, 2024 20:39:22.751096010 CEST	49385	445	192.168.2.22	144.146.120.1
Jun 7, 2024 20:39:22.751148939 CEST	49385	445	192.168.2.22	144.146.120.1
Jun 7, 2024 20:39:22.757778883 CEST	445	49385	144.146.120.1	192.168.2.22
Jun 7, 2024 20:39:23.197104931 CEST	445	49287	159.156.112.1	192.168.2.22
Jun 7, 2024 20:39:23.197187901 CEST	49287	445	192.168.2.22	159.156.112.1
Jun 7, 2024 20:39:23.197241068 CEST	49287	445	192.168.2.22	159.156.112.1
Jun 7, 2024 20:39:23.197335958 CEST	49287	445	192.168.2.22	159.156.112.1
Jun 7, 2024 20:39:23.202156067 CEST	445	49287	159.156.112.1	192.168.2.22
Jun 7, 2024 20:39:23.202260017 CEST	445	49287	159.156.112.1	192.168.2.22
Jun 7, 2024 20:39:24.160478115 CEST	49399	445	192.168.2.22	145.5.191.1
Jun 7, 2024 20:39:24.347034931 CEST	445	49399	145.5.191.1	192.168.2.22
Jun 7, 2024 20:39:24.347146988 CEST	49399	445	192.168.2.22	145.5.191.1
Jun 7, 2024 20:39:24.347225904 CEST	49399	445	192.168.2.22	145.5.191.1
Jun 7, 2024 20:39:24.352102041 CEST	445	49399	145.5.191.1	192.168.2.22
Jun 7, 2024 20:39:24.637288094 CEST	445	49302	175.62.123.1	192.168.2.22
Jun 7, 2024 20:39:24.637571096 CEST	49302	445	192.168.2.22	175.62.123.1
Jun 7, 2024 20:39:24.681664944 CEST	49302	445	192.168.2.22	175.62.123.1
Jun 7, 2024 20:39:24.681693077 CEST	49302	445	192.168.2.22	175.62.123.1
Jun 7, 2024 20:39:24.686801910 CEST	445	49302	175.62.123.1	192.168.2.22
Jun 7, 2024 20:39:24.686841011 CEST	445	49302	175.62.123.1	192.168.2.22
Jun 7, 2024 20:39:24.737734079 CEST	49408	445	192.168.2.22	175.62.123.2
Jun 7, 2024 20:39:24.738240957 CEST	49409	445	192.168.2.22	21.115.191.236
Jun 7, 2024 20:39:24.742803097 CEST	445	49408	175.62.123.2	192.168.2.22
Jun 7, 2024 20:39:24.742889881 CEST	49408	445	192.168.2.22	175.62.123.2
Jun 7, 2024 20:39:24.742930889 CEST	49408	445	192.168.2.22	175.62.123.2
Jun 7, 2024 20:39:24.743247032 CEST	445	49409	21.115.191.236	192.168.2.22
Jun 7, 2024 20:39:24.743309021 CEST	49410	445	192.168.2.22	175.62.123.2
Jun 7, 2024 20:39:24.743313074 CEST	49409	445	192.168.2.22	21.115.191.236
Jun 7, 2024 20:39:24.743360043 CEST	49409	445	192.168.2.22	21.115.191.236
Jun 7, 2024 20:39:24.743510962 CEST	49411	445	192.168.2.22	21.115.191.1
Jun 7, 2024 20:39:24.748239994 CEST	445	49408	175.62.123.2	192.168.2.22
Jun 7, 2024 20:39:24.748378038 CEST	49408	445	192.168.2.22	175.62.123.2
Jun 7, 2024 20:39:24.748387098 CEST	445	49410	175.62.123.2	192.168.2.22
Jun 7, 2024 20:39:24.748460054 CEST	445	49411	21.115.191.1	192.168.2.22
Jun 7, 2024 20:39:24.748507977 CEST	49410	445	192.168.2.22	175.62.123.2
Jun 7, 2024 20:39:24.748507977 CEST	49410	445	192.168.2.22	175.62.123.2
Jun 7, 2024 20:39:24.748528957 CEST	49411	445	192.168.2.22	21.115.191.1
Jun 7, 2024 20:39:24.748555899 CEST	445	49409	21.115.191.236	192.168.2.22
Jun 7, 2024 20:39:24.748585939 CEST	49411	445	192.168.2.22	21.115.191.1
Jun 7, 2024 20:39:24.748616934 CEST	49409	445	192.168.2.22	21.115.191.236
Jun 7, 2024 20:39:24.748919964 CEST	49412	445	192.168.2.22	21.115.191.1
Jun 7, 2024 20:39:24.753742933 CEST	445	49410	175.62.123.2	192.168.2.22
Jun 7, 2024 20:39:24.753880024 CEST	445	49411	21.115.191.1	192.168.2.22
Jun 7, 2024 20:39:24.753935099 CEST	49411	445	192.168.2.22	21.115.191.1
Jun 7, 2024 20:39:24.754065037 CEST	445	49412	21.115.191.1	192.168.2.22
Jun 7, 2024 20:39:24.754141092 CEST	49412	445	192.168.2.22	21.115.191.1
Jun 7, 2024 20:39:24.754184008 CEST	49412	445	192.168.2.22	21.115.191.1
Jun 7, 2024 20:39:24.759138107 CEST	445	49412	21.115.191.1	192.168.2.22
Jun 7, 2024 20:39:25.209201097 CEST	445	49312	8.113.72.1	192.168.2.22
Jun 7, 2024 20:39:25.209279060 CEST	49312	445	192.168.2.22	8.113.72.1
Jun 7, 2024 20:39:25.209402084 CEST	49312	445	192.168.2.22	8.113.72.1
Jun 7, 2024 20:39:25.209402084 CEST	49312	445	192.168.2.22	8.113.72.1
Jun 7, 2024 20:39:25.214272976 CEST	445	49312	8.113.72.1	192.168.2.22
Jun 7, 2024 20:39:25.214297056 CEST	445	49312	8.113.72.1	192.168.2.22
Jun 7, 2024 20:39:26.203850985 CEST	49426	445	192.168.2.22	159.156.112.1
Jun 7, 2024 20:39:26.208806038 CEST	445	49426	159.156.112.1	192.168.2.22
Jun 7, 2024 20:39:26.208919048 CEST	49426	445	192.168.2.22	159.156.112.1
Jun 7, 2024 20:39:26.208977938 CEST	49426	445	192.168.2.22	159.156.112.1
Jun 7, 2024 20:39:26.213855982 CEST	445	49426	159.156.112.1	192.168.2.22
Jun 7, 2024 20:39:26.634215117 CEST	445	49327	7.168.109.1	192.168.2.22
Jun 7, 2024 20:39:26.634582043 CEST	49327	445	192.168.2.22	7.168.109.1
Jun 7, 2024 20:39:26.634582043 CEST	49327	445	192.168.2.22	7.168.109.1
Jun 7, 2024 20:39:26.634582043 CEST	49327	445	192.168.2.22	7.168.109.1
Jun 7, 2024 20:39:26.639638901 CEST	445	49327	7.168.109.1	192.168.2.22
Jun 7, 2024 20:39:26.639669895 CEST	445	49327	7.168.109.1	192.168.2.22
Jun 7, 2024 20:39:26.687822104 CEST	49434	445	192.168.2.22	7.168.109.2
Jun 7, 2024 20:39:26.692841053 CEST	445	49434	7.168.109.2	192.168.2.22
Jun 7, 2024 20:39:26.692919016 CEST	49434	445	192.168.2.22	7.168.109.2
Jun 7, 2024 20:39:26.699305058 CEST	49434	445	192.168.2.22	7.168.109.2
Jun 7, 2024 20:39:26.699523926 CEST	49436	445	192.168.2.22	7.168.109.2
Jun 7, 2024 20:39:26.704287052 CEST	445	49434	7.168.109.2	192.168.2.22
Jun 7, 2024 20:39:26.704363108 CEST	49434	445	192.168.2.22	7.168.109.2
Jun 7, 2024 20:39:26.704440117 CEST	445	49436	7.168.109.2	192.168.2.22
Jun 7, 2024 20:39:26.704540014 CEST	49436	445	192.168.2.22	7.168.109.2
Jun 7, 2024 20:39:26.704540014 CEST	49436	445	192.168.2.22	7.168.109.2
Jun 7, 2024 20:39:26.709697962 CEST	445	49436	7.168.109.2	192.168.2.22
Jun 7, 2024 20:39:26.750063896 CEST	49437	445	192.168.2.22	15.117.122.74
Jun 7, 2024 20:39:26.755008936 CEST	445	49437	15.117.122.74	192.168.2.22
Jun 7, 2024 20:39:26.755084991 CEST	49437	445	192.168.2.22	15.117.122.74
Jun 7, 2024 20:39:26.755117893 CEST	49437	445	192.168.2.22	15.117.122.74
Jun 7, 2024 20:39:26.755292892 CEST	49439	445	192.168.2.22	15.117.122.1
Jun 7, 2024 20:39:26.760262012 CEST	445	49439	15.117.122.1	192.168.2.22
Jun 7, 2024 20:39:26.760368109 CEST	445	49437	15.117.122.74	192.168.2.22
Jun 7, 2024 20:39:26.760376930 CEST	49439	445	192.168.2.22	15.117.122.1
Jun 7, 2024 20:39:26.760436058 CEST	49437	445	192.168.2.22	15.117.122.74
Jun 7, 2024 20:39:26.760453939 CEST	49439	445	192.168.2.22	15.117.122.1
Jun 7, 2024 20:39:26.760716915 CEST	49440	445	192.168.2.22	15.117.122.1
Jun 7, 2024 20:39:26.765496016 CEST	445	49439	15.117.122.1	192.168.2.22
Jun 7, 2024 20:39:26.765562057 CEST	49439	445	192.168.2.22	15.117.122.1
Jun 7, 2024 20:39:26.765741110 CEST	445	49440	15.117.122.1	192.168.2.22
Jun 7, 2024 20:39:26.765815020 CEST	49440	445	192.168.2.22	15.117.122.1
Jun 7, 2024 20:39:26.765867949 CEST	49440	445	192.168.2.22	15.117.122.1
Jun 7, 2024 20:39:26.770747900 CEST	445	49440	15.117.122.1	192.168.2.22
Jun 7, 2024 20:39:27.213752031 CEST	445	49336	196.164.18.1	192.168.2.22
Jun 7, 2024 20:39:27.213943005 CEST	49336	445	192.168.2.22	196.164.18.1
Jun 7, 2024 20:39:27.213943958 CEST	49336	445	192.168.2.22	196.164.18.1
Jun 7, 2024 20:39:27.213943958 CEST	49336	445	192.168.2.22	196.164.18.1
Jun 7, 2024 20:39:27.219712019 CEST	445	49336	196.164.18.1	192.168.2.22
Jun 7, 2024 20:39:27.220266104 CEST	445	49336	196.164.18.1	192.168.2.22
Jun 7, 2024 20:39:28.216384888 CEST	49453	445	192.168.2.22	8.113.72.1
Jun 7, 2024 20:39:28.221407890 CEST	445	49453	8.113.72.1	192.168.2.22
Jun 7, 2024 20:39:28.221499920 CEST	49453	445	192.168.2.22	8.113.72.1
Jun 7, 2024 20:39:28.221574068 CEST	49453	445	192.168.2.22	8.113.72.1
Jun 7, 2024 20:39:28.226411104 CEST	445	49453	8.113.72.1	192.168.2.22
Jun 7, 2024 20:39:28.653667927 CEST	445	49351	170.101.108.1	192.168.2.22
Jun 7, 2024 20:39:28.653783083 CEST	49351	445	192.168.2.22	170.101.108.1
Jun 7, 2024 20:39:28.653846979 CEST	49351	445	192.168.2.22	170.101.108.1
Jun 7, 2024 20:39:28.653846979 CEST	49351	445	192.168.2.22	170.101.108.1
Jun 7, 2024 20:39:28.658787966 CEST	445	49351	170.101.108.1	192.168.2.22
Jun 7, 2024 20:39:28.658818960 CEST	445	49351	170.101.108.1	192.168.2.22
Jun 7, 2024 20:39:28.715537071 CEST	49459	445	192.168.2.22	170.101.108.2
Jun 7, 2024 20:39:28.720417023 CEST	445	49459	170.101.108.2	192.168.2.22
Jun 7, 2024 20:39:28.720472097 CEST	49459	445	192.168.2.22	170.101.108.2
Jun 7, 2024 20:39:28.720506907 CEST	49459	445	192.168.2.22	170.101.108.2
Jun 7, 2024 20:39:28.720876932 CEST	49460	445	192.168.2.22	170.101.108.2
Jun 7, 2024 20:39:28.725600958 CEST	445	49459	170.101.108.2	192.168.2.22
Jun 7, 2024 20:39:28.725653887 CEST	49459	445	192.168.2.22	170.101.108.2
Jun 7, 2024 20:39:28.725769997 CEST	445	49460	170.101.108.2	192.168.2.22
Jun 7, 2024 20:39:28.725831985 CEST	49460	445	192.168.2.22	170.101.108.2
Jun 7, 2024 20:39:28.725864887 CEST	49460	445	192.168.2.22	170.101.108.2
Jun 7, 2024 20:39:28.730746031 CEST	445	49460	170.101.108.2	192.168.2.22
Jun 7, 2024 20:39:28.762520075 CEST	49462	445	192.168.2.22	90.170.69.144
Jun 7, 2024 20:39:28.767602921 CEST	445	49462	90.170.69.144	192.168.2.22
Jun 7, 2024 20:39:28.767695904 CEST	49462	445	192.168.2.22	90.170.69.144
Jun 7, 2024 20:39:28.767822027 CEST	49462	445	192.168.2.22	90.170.69.144
Jun 7, 2024 20:39:28.767996073 CEST	49463	445	192.168.2.22	90.170.69.1
Jun 7, 2024 20:39:28.773017883 CEST	445	49463	90.170.69.1	192.168.2.22
Jun 7, 2024 20:39:28.773088932 CEST	49463	445	192.168.2.22	90.170.69.1
Jun 7, 2024 20:39:28.773124933 CEST	49463	445	192.168.2.22	90.170.69.1
Jun 7, 2024 20:39:28.773164034 CEST	445	49462	90.170.69.144	192.168.2.22
Jun 7, 2024 20:39:28.773224115 CEST	49462	445	192.168.2.22	90.170.69.144
Jun 7, 2024 20:39:28.773437023 CEST	49464	445	192.168.2.22	90.170.69.1
Jun 7, 2024 20:39:28.778350115 CEST	445	49464	90.170.69.1	192.168.2.22
Jun 7, 2024 20:39:28.778474092 CEST	49464	445	192.168.2.22	90.170.69.1
Jun 7, 2024 20:39:28.778474092 CEST	49464	445	192.168.2.22	90.170.69.1
Jun 7, 2024 20:39:28.778563023 CEST	445	49463	90.170.69.1	192.168.2.22
Jun 7, 2024 20:39:28.778629065 CEST	49463	445	192.168.2.22	90.170.69.1
Jun 7, 2024 20:39:28.783504963 CEST	445	49464	90.170.69.1	192.168.2.22
Jun 7, 2024 20:39:29.225824118 CEST	445	49360	202.195.174.1	192.168.2.22
Jun 7, 2024 20:39:29.225883007 CEST	49360	445	192.168.2.22	202.195.174.1
Jun 7, 2024 20:39:29.226049900 CEST	49360	445	192.168.2.22	202.195.174.1
Jun 7, 2024 20:39:29.226049900 CEST	49360	445	192.168.2.22	202.195.174.1
Jun 7, 2024 20:39:29.230916023 CEST	445	49360	202.195.174.1	192.168.2.22
Jun 7, 2024 20:39:29.230942011 CEST	445	49360	202.195.174.1	192.168.2.22
Jun 7, 2024 20:39:30.213123083 CEST	49475	445	192.168.2.22	196.164.18.1
Jun 7, 2024 20:39:30.218200922 CEST	445	49475	196.164.18.1	192.168.2.22
Jun 7, 2024 20:39:30.218264103 CEST	49475	445	192.168.2.22	196.164.18.1
Jun 7, 2024 20:39:30.218286991 CEST	49475	445	192.168.2.22	196.164.18.1
Jun 7, 2024 20:39:30.223082066 CEST	445	49475	196.164.18.1	192.168.2.22
Jun 7, 2024 20:39:30.639672995 CEST	445	49377	137.124.231.1	192.168.2.22
Jun 7, 2024 20:39:30.639879942 CEST	49377	445	192.168.2.22	137.124.231.1
Jun 7, 2024 20:39:30.639935970 CEST	49377	445	192.168.2.22	137.124.231.1
Jun 7, 2024 20:39:30.639998913 CEST	49377	445	192.168.2.22	137.124.231.1
Jun 7, 2024 20:39:30.644790888 CEST	445	49377	137.124.231.1	192.168.2.22
Jun 7, 2024 20:39:30.644820929 CEST	445	49377	137.124.231.1	192.168.2.22
Jun 7, 2024 20:39:30.697010040 CEST	49476	445	192.168.2.22	137.124.231.2
Jun 7, 2024 20:39:30.701893091 CEST	445	49476	137.124.231.2	192.168.2.22
Jun 7, 2024 20:39:30.701950073 CEST	49476	445	192.168.2.22	137.124.231.2
Jun 7, 2024 20:39:30.701966047 CEST	49476	445	192.168.2.22	137.124.231.2
Jun 7, 2024 20:39:30.702351093 CEST	49477	445	192.168.2.22	137.124.231.2
Jun 7, 2024 20:39:30.707123995 CEST	445	49476	137.124.231.2	192.168.2.22
Jun 7, 2024 20:39:30.707165003 CEST	445	49477	137.124.231.2	192.168.2.22
Jun 7, 2024 20:39:30.707182884 CEST	49476	445	192.168.2.22	137.124.231.2
Jun 7, 2024 20:39:30.707214117 CEST	49477	445	192.168.2.22	137.124.231.2
Jun 7, 2024 20:39:30.707258940 CEST	49477	445	192.168.2.22	137.124.231.2
Jun 7, 2024 20:39:30.712188959 CEST	445	49477	137.124.231.2	192.168.2.22
Jun 7, 2024 20:39:30.775816917 CEST	49478	445	192.168.2.22	102.226.231.46
Jun 7, 2024 20:39:30.780934095 CEST	445	49478	102.226.231.46	192.168.2.22
Jun 7, 2024 20:39:30.781032085 CEST	49478	445	192.168.2.22	102.226.231.46
Jun 7, 2024 20:39:30.783514977 CEST	49478	445	192.168.2.22	102.226.231.46
Jun 7, 2024 20:39:30.783664942 CEST	49479	445	192.168.2.22	102.226.231.1
Jun 7, 2024 20:39:30.788544893 CEST	445	49478	102.226.231.46	192.168.2.22
Jun 7, 2024 20:39:30.788625956 CEST	49478	445	192.168.2.22	102.226.231.46
Jun 7, 2024 20:39:30.788633108 CEST	445	49479	102.226.231.1	192.168.2.22
Jun 7, 2024 20:39:30.788691998 CEST	49479	445	192.168.2.22	102.226.231.1
Jun 7, 2024 20:39:30.788736105 CEST	49479	445	192.168.2.22	102.226.231.1
Jun 7, 2024 20:39:30.788927078 CEST	49480	445	192.168.2.22	102.226.231.1
Jun 7, 2024 20:39:30.793926001 CEST	445	49480	102.226.231.1	192.168.2.22
Jun 7, 2024 20:39:30.793997049 CEST	49480	445	192.168.2.22	102.226.231.1
Jun 7, 2024 20:39:30.794238091 CEST	445	49479	102.226.231.1	192.168.2.22
Jun 7, 2024 20:39:30.794306040 CEST	49479	445	192.168.2.22	102.226.231.1
Jun 7, 2024 20:39:30.799679995 CEST	49480	445	192.168.2.22	102.226.231.1
Jun 7, 2024 20:39:30.804691076 CEST	445	49480	102.226.231.1	192.168.2.22
Jun 7, 2024 20:39:31.249494076 CEST	445	49385	144.146.120.1	192.168.2.22
Jun 7, 2024 20:39:31.249607086 CEST	49385	445	192.168.2.22	144.146.120.1
Jun 7, 2024 20:39:31.249649048 CEST	49385	445	192.168.2.22	144.146.120.1
Jun 7, 2024 20:39:31.249680042 CEST	49385	445	192.168.2.22	144.146.120.1
Jun 7, 2024 20:39:31.257172108 CEST	445	49385	144.146.120.1	192.168.2.22
Jun 7, 2024 20:39:31.257236958 CEST	445	49385	144.146.120.1	192.168.2.22
Jun 7, 2024 20:39:32.225720882 CEST	49481	445	192.168.2.22	202.195.174.1
Jun 7, 2024 20:39:32.230978012 CEST	445	49481	202.195.174.1	192.168.2.22
Jun 7, 2024 20:39:32.231069088 CEST	49481	445	192.168.2.22	202.195.174.1
Jun 7, 2024 20:39:32.231116056 CEST	49481	445	192.168.2.22	202.195.174.1
Jun 7, 2024 20:39:32.236293077 CEST	445	49481	202.195.174.1	192.168.2.22
Jun 7, 2024 20:39:32.787559032 CEST	49482	445	192.168.2.22	23.35.183.3
Jun 7, 2024 20:39:32.792757988 CEST	445	49482	23.35.183.3	192.168.2.22
Jun 7, 2024 20:39:32.792861938 CEST	49482	445	192.168.2.22	23.35.183.3
Jun 7, 2024 20:39:32.792932987 CEST	49482	445	192.168.2.22	23.35.183.3
Jun 7, 2024 20:39:32.792932987 CEST	49483	445	192.168.2.22	23.35.183.1
Jun 7, 2024 20:39:32.797840118 CEST	445	49483	23.35.183.1	192.168.2.22
Jun 7, 2024 20:39:32.797919989 CEST	49483	445	192.168.2.22	23.35.183.1
Jun 7, 2024 20:39:32.797919989 CEST	49483	445	192.168.2.22	23.35.183.1
Jun 7, 2024 20:39:32.798085928 CEST	445	49482	23.35.183.3	192.168.2.22
Jun 7, 2024 20:39:32.798146009 CEST	49482	445	192.168.2.22	23.35.183.3
Jun 7, 2024 20:39:32.798217058 CEST	49484	445	192.168.2.22	23.35.183.1
Jun 7, 2024 20:39:32.803178072 CEST	445	49483	23.35.183.1	192.168.2.22
Jun 7, 2024 20:39:32.803196907 CEST	445	49484	23.35.183.1	192.168.2.22
Jun 7, 2024 20:39:32.803242922 CEST	49483	445	192.168.2.22	23.35.183.1
Jun 7, 2024 20:39:32.803268909 CEST	49484	445	192.168.2.22	23.35.183.1
Jun 7, 2024 20:39:32.803284883 CEST	49484	445	192.168.2.22	23.35.183.1
Jun 7, 2024 20:39:32.810215950 CEST	445	49484	23.35.183.1	192.168.2.22
Jun 7, 2024 20:39:32.837932110 CEST	445	49399	145.5.191.1	192.168.2.22
Jun 7, 2024 20:39:32.838006973 CEST	49399	445	192.168.2.22	145.5.191.1
Jun 7, 2024 20:39:32.838047981 CEST	49399	445	192.168.2.22	145.5.191.1
Jun 7, 2024 20:39:32.838088989 CEST	49399	445	192.168.2.22	145.5.191.1
Jun 7, 2024 20:39:32.844537020 CEST	445	49399	145.5.191.1	192.168.2.22
Jun 7, 2024 20:39:32.844647884 CEST	445	49399	145.5.191.1	192.168.2.22
Jun 7, 2024 20:39:32.896568060 CEST	49485	445	192.168.2.22	145.5.191.2
Jun 7, 2024 20:39:32.903316021 CEST	445	49485	145.5.191.2	192.168.2.22
Jun 7, 2024 20:39:32.903409958 CEST	49485	445	192.168.2.22	145.5.191.2
Jun 7, 2024 20:39:32.903428078 CEST	49485	445	192.168.2.22	145.5.191.2
Jun 7, 2024 20:39:32.903819084 CEST	49486	445	192.168.2.22	145.5.191.2
Jun 7, 2024 20:39:32.910454035 CEST	445	49485	145.5.191.2	192.168.2.22
Jun 7, 2024 20:39:32.910484076 CEST	445	49486	145.5.191.2	192.168.2.22
Jun 7, 2024 20:39:32.910522938 CEST	49485	445	192.168.2.22	145.5.191.2
Jun 7, 2024 20:39:32.910577059 CEST	49486	445	192.168.2.22	145.5.191.2
Jun 7, 2024 20:39:32.910586119 CEST	49486	445	192.168.2.22	145.5.191.2
Jun 7, 2024 20:39:32.917324066 CEST	445	49486	145.5.191.2	192.168.2.22
Jun 7, 2024 20:39:33.238368988 CEST	445	49410	175.62.123.2	192.168.2.22
Jun 7, 2024 20:39:33.238569975 CEST	49410	445	192.168.2.22	175.62.123.2
Jun 7, 2024 20:39:33.238610029 CEST	49410	445	192.168.2.22	175.62.123.2
Jun 7, 2024 20:39:33.238676071 CEST	49410	445	192.168.2.22	175.62.123.2
Jun 7, 2024 20:39:33.243488073 CEST	445	49410	175.62.123.2	192.168.2.22
Jun 7, 2024 20:39:33.243515015 CEST	445	49410	175.62.123.2	192.168.2.22
Jun 7, 2024 20:39:33.245333910 CEST	445	49412	21.115.191.1	192.168.2.22
Jun 7, 2024 20:39:33.245398045 CEST	49412	445	192.168.2.22	21.115.191.1
Jun 7, 2024 20:39:33.245434046 CEST	49412	445	192.168.2.22	21.115.191.1
Jun 7, 2024 20:39:33.245459080 CEST	49412	445	192.168.2.22	21.115.191.1
Jun 7, 2024 20:39:33.250308990 CEST	445	49412	21.115.191.1	192.168.2.22
Jun 7, 2024 20:39:33.250348091 CEST	445	49412	21.115.191.1	192.168.2.22
Jun 7, 2024 20:39:34.253526926 CEST	49487	445	192.168.2.22	144.146.120.1
Jun 7, 2024 20:39:34.258613110 CEST	445	49487	144.146.120.1	192.168.2.22
Jun 7, 2024 20:39:34.258713007 CEST	49487	445	192.168.2.22	144.146.120.1
Jun 7, 2024 20:39:34.258752108 CEST	49487	445	192.168.2.22	144.146.120.1
Jun 7, 2024 20:39:34.263710022 CEST	445	49487	144.146.120.1	192.168.2.22
Jun 7, 2024 20:39:34.701870918 CEST	445	49426	159.156.112.1	192.168.2.22
Jun 7, 2024 20:39:34.702008009 CEST	49426	445	192.168.2.22	159.156.112.1
Jun 7, 2024 20:39:34.702096939 CEST	49426	445	192.168.2.22	159.156.112.1
Jun 7, 2024 20:39:34.702096939 CEST	49426	445	192.168.2.22	159.156.112.1
Jun 7, 2024 20:39:34.707025051 CEST	445	49426	159.156.112.1	192.168.2.22
Jun 7, 2024 20:39:34.707068920 CEST	445	49426	159.156.112.1	192.168.2.22
Jun 7, 2024 20:39:34.752736092 CEST	49488	445	192.168.2.22	159.156.112.2
Jun 7, 2024 20:39:34.757602930 CEST	445	49488	159.156.112.2	192.168.2.22
Jun 7, 2024 20:39:34.757658005 CEST	49488	445	192.168.2.22	159.156.112.2
Jun 7, 2024 20:39:34.757725954 CEST	49488	445	192.168.2.22	159.156.112.2
Jun 7, 2024 20:39:34.758068085 CEST	49489	445	192.168.2.22	159.156.112.2
Jun 7, 2024 20:39:34.762840986 CEST	445	49488	159.156.112.2	192.168.2.22
Jun 7, 2024 20:39:34.762888908 CEST	445	49489	159.156.112.2	192.168.2.22
Jun 7, 2024 20:39:34.762984991 CEST	49488	445	192.168.2.22	159.156.112.2
Jun 7, 2024 20:39:34.762999058 CEST	49489	445	192.168.2.22	159.156.112.2
Jun 7, 2024 20:39:34.763042927 CEST	49489	445	192.168.2.22	159.156.112.2
Jun 7, 2024 20:39:34.767847061 CEST	445	49489	159.156.112.2	192.168.2.22
Jun 7, 2024 20:39:34.799567938 CEST	49490	445	192.168.2.22	83.48.154.62
Jun 7, 2024 20:39:34.804516077 CEST	445	49490	83.48.154.62	192.168.2.22
Jun 7, 2024 20:39:34.804573059 CEST	49490	445	192.168.2.22	83.48.154.62
Jun 7, 2024 20:39:34.804725885 CEST	49490	445	192.168.2.22	83.48.154.62
Jun 7, 2024 20:39:34.804846048 CEST	49491	445	192.168.2.22	83.48.154.1
Jun 7, 2024 20:39:34.809689999 CEST	445	49490	83.48.154.62	192.168.2.22
Jun 7, 2024 20:39:34.809729099 CEST	445	49491	83.48.154.1	192.168.2.22
Jun 7, 2024 20:39:34.809731007 CEST	49490	445	192.168.2.22	83.48.154.62
Jun 7, 2024 20:39:34.809786081 CEST	49491	445	192.168.2.22	83.48.154.1
Jun 7, 2024 20:39:34.809822083 CEST	49491	445	192.168.2.22	83.48.154.1
Jun 7, 2024 20:39:34.810012102 CEST	49492	445	192.168.2.22	83.48.154.1
Jun 7, 2024 20:39:34.814764023 CEST	445	49491	83.48.154.1	192.168.2.22
Jun 7, 2024 20:39:34.814832926 CEST	445	49492	83.48.154.1	192.168.2.22
Jun 7, 2024 20:39:34.814831972 CEST	49491	445	192.168.2.22	83.48.154.1
Jun 7, 2024 20:39:34.814896107 CEST	49492	445	192.168.2.22	83.48.154.1
Jun 7, 2024 20:39:34.815033913 CEST	49492	445	192.168.2.22	83.48.154.1
Jun 7, 2024 20:39:34.819804907 CEST	445	49492	83.48.154.1	192.168.2.22
Jun 7, 2024 20:39:35.203104973 CEST	445	49436	7.168.109.2	192.168.2.22
Jun 7, 2024 20:39:35.203195095 CEST	49436	445	192.168.2.22	7.168.109.2
Jun 7, 2024 20:39:35.203243017 CEST	49436	445	192.168.2.22	7.168.109.2
Jun 7, 2024 20:39:35.203243017 CEST	49436	445	192.168.2.22	7.168.109.2
Jun 7, 2024 20:39:35.208174944 CEST	445	49436	7.168.109.2	192.168.2.22
Jun 7, 2024 20:39:35.208226919 CEST	445	49436	7.168.109.2	192.168.2.22
Jun 7, 2024 20:39:35.267981052 CEST	445	49440	15.117.122.1	192.168.2.22
Jun 7, 2024 20:39:35.268085003 CEST	49440	445	192.168.2.22	15.117.122.1
Jun 7, 2024 20:39:35.275191069 CEST	49440	445	192.168.2.22	15.117.122.1
Jun 7, 2024 20:39:35.275219917 CEST	49440	445	192.168.2.22	15.117.122.1
Jun 7, 2024 20:39:35.280113935 CEST	445	49440	15.117.122.1	192.168.2.22
Jun 7, 2024 20:39:35.280184984 CEST	445	49440	15.117.122.1	192.168.2.22
Jun 7, 2024 20:39:36.234739065 CEST	49493	445	192.168.2.22	175.62.123.2
Jun 7, 2024 20:39:36.239948034 CEST	445	49493	175.62.123.2	192.168.2.22
Jun 7, 2024 20:39:36.240051985 CEST	49493	445	192.168.2.22	175.62.123.2
Jun 7, 2024 20:39:36.240097046 CEST	49493	445	192.168.2.22	175.62.123.2
Jun 7, 2024 20:39:36.245080948 CEST	445	49493	175.62.123.2	192.168.2.22
Jun 7, 2024 20:39:36.250348091 CEST	49494	445	192.168.2.22	21.115.191.1
Jun 7, 2024 20:39:36.255486965 CEST	445	49494	21.115.191.1	192.168.2.22
Jun 7, 2024 20:39:36.255616903 CEST	49494	445	192.168.2.22	21.115.191.1
Jun 7, 2024 20:39:36.255616903 CEST	49494	445	192.168.2.22	21.115.191.1
Jun 7, 2024 20:39:36.260749102 CEST	445	49494	21.115.191.1	192.168.2.22
Jun 7, 2024 20:39:36.721712112 CEST	445	49453	8.113.72.1	192.168.2.22
Jun 7, 2024 20:39:36.721798897 CEST	49453	445	192.168.2.22	8.113.72.1
Jun 7, 2024 20:39:36.721836090 CEST	49453	445	192.168.2.22	8.113.72.1
Jun 7, 2024 20:39:36.721872091 CEST	49453	445	192.168.2.22	8.113.72.1
Jun 7, 2024 20:39:36.727236986 CEST	445	49453	8.113.72.1	192.168.2.22
Jun 7, 2024 20:39:36.727286100 CEST	445	49453	8.113.72.1	192.168.2.22
Jun 7, 2024 20:39:36.780724049 CEST	49495	445	192.168.2.22	8.113.72.2
Jun 7, 2024 20:39:36.785644054 CEST	445	49495	8.113.72.2	192.168.2.22
Jun 7, 2024 20:39:36.785732031 CEST	49495	445	192.168.2.22	8.113.72.2
Jun 7, 2024 20:39:36.785753965 CEST	49495	445	192.168.2.22	8.113.72.2
Jun 7, 2024 20:39:36.786031961 CEST	49496	445	192.168.2.22	8.113.72.2
Jun 7, 2024 20:39:36.790839911 CEST	445	49495	8.113.72.2	192.168.2.22
Jun 7, 2024 20:39:36.790854931 CEST	445	49496	8.113.72.2	192.168.2.22
Jun 7, 2024 20:39:36.790887117 CEST	49495	445	192.168.2.22	8.113.72.2
Jun 7, 2024 20:39:36.790903091 CEST	49496	445	192.168.2.22	8.113.72.2
Jun 7, 2024 20:39:36.790923119 CEST	49496	445	192.168.2.22	8.113.72.2
Jun 7, 2024 20:39:36.795749903 CEST	445	49496	8.113.72.2	192.168.2.22
Jun 7, 2024 20:39:36.812200069 CEST	49497	445	192.168.2.22	149.41.53.155
Jun 7, 2024 20:39:36.817065954 CEST	445	49497	149.41.53.155	192.168.2.22
Jun 7, 2024 20:39:36.817110062 CEST	49497	445	192.168.2.22	149.41.53.155
Jun 7, 2024 20:39:36.817127943 CEST	49497	445	192.168.2.22	149.41.53.155
Jun 7, 2024 20:39:36.817193031 CEST	49498	445	192.168.2.22	149.41.53.1
Jun 7, 2024 20:39:36.822083950 CEST	445	49498	149.41.53.1	192.168.2.22
Jun 7, 2024 20:39:36.822132111 CEST	49498	445	192.168.2.22	149.41.53.1
Jun 7, 2024 20:39:36.822149038 CEST	49498	445	192.168.2.22	149.41.53.1
Jun 7, 2024 20:39:36.822417974 CEST	49499	445	192.168.2.22	149.41.53.1
Jun 7, 2024 20:39:36.822551012 CEST	445	49497	149.41.53.155	192.168.2.22
Jun 7, 2024 20:39:36.822597980 CEST	49497	445	192.168.2.22	149.41.53.155
Jun 7, 2024 20:39:36.827163935 CEST	445	49498	149.41.53.1	192.168.2.22
Jun 7, 2024 20:39:36.827209949 CEST	49498	445	192.168.2.22	149.41.53.1
Jun 7, 2024 20:39:36.827272892 CEST	445	49499	149.41.53.1	192.168.2.22
Jun 7, 2024 20:39:36.827316046 CEST	49499	445	192.168.2.22	149.41.53.1
Jun 7, 2024 20:39:36.827332973 CEST	49499	445	192.168.2.22	149.41.53.1
Jun 7, 2024 20:39:36.832160950 CEST	445	49499	149.41.53.1	192.168.2.22
Jun 7, 2024 20:39:37.217855930 CEST	445	49460	170.101.108.2	192.168.2.22
Jun 7, 2024 20:39:37.217931986 CEST	49460	445	192.168.2.22	170.101.108.2
Jun 7, 2024 20:39:37.217972040 CEST	49460	445	192.168.2.22	170.101.108.2
Jun 7, 2024 20:39:37.217998981 CEST	49460	445	192.168.2.22	170.101.108.2
Jun 7, 2024 20:39:37.223023891 CEST	445	49460	170.101.108.2	192.168.2.22
Jun 7, 2024 20:39:37.223094940 CEST	445	49460	170.101.108.2	192.168.2.22
Jun 7, 2024 20:39:37.263140917 CEST	445	49464	90.170.69.1	192.168.2.22
Jun 7, 2024 20:39:37.263307095 CEST	49464	445	192.168.2.22	90.170.69.1
Jun 7, 2024 20:39:37.263437986 CEST	49464	445	192.168.2.22	90.170.69.1
Jun 7, 2024 20:39:37.263437986 CEST	49464	445	192.168.2.22	90.170.69.1
Jun 7, 2024 20:39:37.268286943 CEST	445	49464	90.170.69.1	192.168.2.22
Jun 7, 2024 20:39:37.268311977 CEST	445	49464	90.170.69.1	192.168.2.22
Jun 7, 2024 20:39:38.200475931 CEST	49500	445	192.168.2.22	7.168.109.2
Jun 7, 2024 20:39:38.205670118 CEST	445	49500	7.168.109.2	192.168.2.22
Jun 7, 2024 20:39:38.205763102 CEST	49500	445	192.168.2.22	7.168.109.2
Jun 7, 2024 20:39:38.205806017 CEST	49500	445	192.168.2.22	7.168.109.2
Jun 7, 2024 20:39:38.210808992 CEST	445	49500	7.168.109.2	192.168.2.22
Jun 7, 2024 20:39:38.278306007 CEST	49501	445	192.168.2.22	15.117.122.1
Jun 7, 2024 20:39:38.283540010 CEST	445	49501	15.117.122.1	192.168.2.22
Jun 7, 2024 20:39:38.283615112 CEST	49501	445	192.168.2.22	15.117.122.1
Jun 7, 2024 20:39:38.283628941 CEST	49501	445	192.168.2.22	15.117.122.1
Jun 7, 2024 20:39:38.288650036 CEST	445	49501	15.117.122.1	192.168.2.22
Jun 7, 2024 20:39:38.717364073 CEST	445	49475	196.164.18.1	192.168.2.22
Jun 7, 2024 20:39:38.717459917 CEST	49475	445	192.168.2.22	196.164.18.1
Jun 7, 2024 20:39:38.717519999 CEST	49475	445	192.168.2.22	196.164.18.1
Jun 7, 2024 20:39:38.717550039 CEST	49475	445	192.168.2.22	196.164.18.1
Jun 7, 2024 20:39:38.722497940 CEST	445	49475	196.164.18.1	192.168.2.22
Jun 7, 2024 20:39:38.722527981 CEST	445	49475	196.164.18.1	192.168.2.22
Jun 7, 2024 20:39:38.777673960 CEST	49502	445	192.168.2.22	196.164.18.2
Jun 7, 2024 20:39:38.782743931 CEST	445	49502	196.164.18.2	192.168.2.22
Jun 7, 2024 20:39:38.782829046 CEST	49502	445	192.168.2.22	196.164.18.2
Jun 7, 2024 20:39:38.782913923 CEST	49502	445	192.168.2.22	196.164.18.2
Jun 7, 2024 20:39:38.783341885 CEST	49503	445	192.168.2.22	196.164.18.2
Jun 7, 2024 20:39:38.788187027 CEST	445	49502	196.164.18.2	192.168.2.22
Jun 7, 2024 20:39:38.788254023 CEST	49502	445	192.168.2.22	196.164.18.2
Jun 7, 2024 20:39:38.788260937 CEST	445	49503	196.164.18.2	192.168.2.22
Jun 7, 2024 20:39:38.788326979 CEST	49503	445	192.168.2.22	196.164.18.2
Jun 7, 2024 20:39:38.788371086 CEST	49503	445	192.168.2.22	196.164.18.2
Jun 7, 2024 20:39:38.793199062 CEST	445	49503	196.164.18.2	192.168.2.22
Jun 7, 2024 20:39:38.824510098 CEST	49504	445	192.168.2.22	148.204.151.192
Jun 7, 2024 20:39:38.829507113 CEST	445	49504	148.204.151.192	192.168.2.22
Jun 7, 2024 20:39:38.829588890 CEST	49504	445	192.168.2.22	148.204.151.192
Jun 7, 2024 20:39:38.829662085 CEST	49504	445	192.168.2.22	148.204.151.192
Jun 7, 2024 20:39:38.829678059 CEST	49505	445	192.168.2.22	148.204.151.1
Jun 7, 2024 20:39:38.834568024 CEST	445	49505	148.204.151.1	192.168.2.22
Jun 7, 2024 20:39:38.834645987 CEST	49505	445	192.168.2.22	148.204.151.1
Jun 7, 2024 20:39:38.834717989 CEST	445	49504	148.204.151.192	192.168.2.22
Jun 7, 2024 20:39:38.834763050 CEST	49505	445	192.168.2.22	148.204.151.1
Jun 7, 2024 20:39:38.834769011 CEST	49504	445	192.168.2.22	148.204.151.192
Jun 7, 2024 20:39:38.834955931 CEST	49506	445	192.168.2.22	148.204.151.1
Jun 7, 2024 20:39:38.839756966 CEST	445	49505	148.204.151.1	192.168.2.22
Jun 7, 2024 20:39:38.839809895 CEST	445	49506	148.204.151.1	192.168.2.22
Jun 7, 2024 20:39:38.839818954 CEST	49505	445	192.168.2.22	148.204.151.1
Jun 7, 2024 20:39:38.839871883 CEST	49506	445	192.168.2.22	148.204.151.1
Jun 7, 2024 20:39:38.839896917 CEST	49506	445	192.168.2.22	148.204.151.1
Jun 7, 2024 20:39:38.844763994 CEST	445	49506	148.204.151.1	192.168.2.22
Jun 7, 2024 20:39:39.198100090 CEST	445	49477	137.124.231.2	192.168.2.22
Jun 7, 2024 20:39:39.198267937 CEST	49477	445	192.168.2.22	137.124.231.2
Jun 7, 2024 20:39:39.198267937 CEST	49477	445	192.168.2.22	137.124.231.2
Jun 7, 2024 20:39:39.198267937 CEST	49477	445	192.168.2.22	137.124.231.2
Jun 7, 2024 20:39:39.203211069 CEST	445	49477	137.124.231.2	192.168.2.22
Jun 7, 2024 20:39:39.203237057 CEST	445	49477	137.124.231.2	192.168.2.22
Jun 7, 2024 20:39:39.291858912 CEST	445	49480	102.226.231.1	192.168.2.22
Jun 7, 2024 20:39:39.291929960 CEST	49480	445	192.168.2.22	102.226.231.1
Jun 7, 2024 20:39:39.292090893 CEST	49480	445	192.168.2.22	102.226.231.1
Jun 7, 2024 20:39:39.292090893 CEST	49480	445	192.168.2.22	102.226.231.1
Jun 7, 2024 20:39:39.296962023 CEST	445	49480	102.226.231.1	192.168.2.22
Jun 7, 2024 20:39:39.297017097 CEST	445	49480	102.226.231.1	192.168.2.22
Jun 7, 2024 20:39:40.228446960 CEST	49507	445	192.168.2.22	170.101.108.2
Jun 7, 2024 20:39:40.233750105 CEST	445	49507	170.101.108.2	192.168.2.22
Jun 7, 2024 20:39:40.233819962 CEST	49507	445	192.168.2.22	170.101.108.2
Jun 7, 2024 20:39:40.233861923 CEST	49507	445	192.168.2.22	170.101.108.2
Jun 7, 2024 20:39:40.238765001 CEST	445	49507	170.101.108.2	192.168.2.22
Jun 7, 2024 20:39:40.259690046 CEST	49508	445	192.168.2.22	90.170.69.1
Jun 7, 2024 20:39:40.264828920 CEST	445	49508	90.170.69.1	192.168.2.22
Jun 7, 2024 20:39:40.264933109 CEST	49508	445	192.168.2.22	90.170.69.1
Jun 7, 2024 20:39:40.264933109 CEST	49508	445	192.168.2.22	90.170.69.1
Jun 7, 2024 20:39:40.269929886 CEST	445	49508	90.170.69.1	192.168.2.22
Jun 7, 2024 20:39:40.696487904 CEST	49509	445	192.168.2.22	54.92.197.157
Jun 7, 2024 20:39:40.701596022 CEST	445	49509	54.92.197.157	192.168.2.22
Jun 7, 2024 20:39:40.701833010 CEST	49509	445	192.168.2.22	54.92.197.157
Jun 7, 2024 20:39:40.701869011 CEST	49509	445	192.168.2.22	54.92.197.157
Jun 7, 2024 20:39:40.701973915 CEST	49510	445	192.168.2.22	54.92.197.1
Jun 7, 2024 20:39:40.706895113 CEST	445	49510	54.92.197.1	192.168.2.22
Jun 7, 2024 20:39:40.706954002 CEST	49510	445	192.168.2.22	54.92.197.1
Jun 7, 2024 20:39:40.706986904 CEST	49510	445	192.168.2.22	54.92.197.1
Jun 7, 2024 20:39:40.707150936 CEST	445	49509	54.92.197.157	192.168.2.22
Jun 7, 2024 20:39:40.707214117 CEST	49509	445	192.168.2.22	54.92.197.157
Jun 7, 2024 20:39:40.707226038 CEST	49511	445	192.168.2.22	54.92.197.1
Jun 7, 2024 20:39:40.712214947 CEST	445	49510	54.92.197.1	192.168.2.22
Jun 7, 2024 20:39:40.712245941 CEST	445	49511	54.92.197.1	192.168.2.22
Jun 7, 2024 20:39:40.712270975 CEST	49510	445	192.168.2.22	54.92.197.1
Jun 7, 2024 20:39:40.712301970 CEST	49511	445	192.168.2.22	54.92.197.1
Jun 7, 2024 20:39:40.712331057 CEST	49511	445	192.168.2.22	54.92.197.1
Jun 7, 2024 20:39:40.717232943 CEST	445	49511	54.92.197.1	192.168.2.22
Jun 7, 2024 20:39:40.722131968 CEST	445	49481	202.195.174.1	192.168.2.22
Jun 7, 2024 20:39:40.722254992 CEST	49481	445	192.168.2.22	202.195.174.1
Jun 7, 2024 20:39:40.722403049 CEST	49481	445	192.168.2.22	202.195.174.1
Jun 7, 2024 20:39:40.722403049 CEST	49481	445	192.168.2.22	202.195.174.1
Jun 7, 2024 20:39:40.727319002 CEST	445	49481	202.195.174.1	192.168.2.22
Jun 7, 2024 20:39:40.727372885 CEST	445	49481	202.195.174.1	192.168.2.22
Jun 7, 2024 20:39:40.774322987 CEST	49512	445	192.168.2.22	202.195.174.2
Jun 7, 2024 20:39:40.779373884 CEST	445	49512	202.195.174.2	192.168.2.22
Jun 7, 2024 20:39:40.779452085 CEST	49512	445	192.168.2.22	202.195.174.2
Jun 7, 2024 20:39:40.779524088 CEST	49512	445	192.168.2.22	202.195.174.2
Jun 7, 2024 20:39:40.779823065 CEST	49513	445	192.168.2.22	202.195.174.2
Jun 7, 2024 20:39:40.784795046 CEST	445	49513	202.195.174.2	192.168.2.22
Jun 7, 2024 20:39:40.784873009 CEST	49513	445	192.168.2.22	202.195.174.2
Jun 7, 2024 20:39:40.784873009 CEST	49513	445	192.168.2.22	202.195.174.2
Jun 7, 2024 20:39:40.785008907 CEST	445	49512	202.195.174.2	192.168.2.22
Jun 7, 2024 20:39:40.785062075 CEST	49512	445	192.168.2.22	202.195.174.2
Jun 7, 2024 20:39:40.789889097 CEST	445	49513	202.195.174.2	192.168.2.22
Jun 7, 2024 20:39:41.297934055 CEST	445	49484	23.35.183.1	192.168.2.22
Jun 7, 2024 20:39:41.298038006 CEST	49484	445	192.168.2.22	23.35.183.1
Jun 7, 2024 20:39:41.298122883 CEST	49484	445	192.168.2.22	23.35.183.1
Jun 7, 2024 20:39:41.298122883 CEST	49484	445	192.168.2.22	23.35.183.1
Jun 7, 2024 20:39:41.303046942 CEST	445	49484	23.35.183.1	192.168.2.22
Jun 7, 2024 20:39:41.303080082 CEST	445	49484	23.35.183.1	192.168.2.22
Jun 7, 2024 20:39:41.402719975 CEST	445	49486	145.5.191.2	192.168.2.22
Jun 7, 2024 20:39:41.402951956 CEST	49486	445	192.168.2.22	145.5.191.2
Jun 7, 2024 20:39:41.408566952 CEST	49486	445	192.168.2.22	145.5.191.2
Jun 7, 2024 20:39:41.408615112 CEST	49486	445	192.168.2.22	145.5.191.2
Jun 7, 2024 20:39:41.413566113 CEST	445	49486	145.5.191.2	192.168.2.22
Jun 7, 2024 20:39:41.413594007 CEST	445	49486	145.5.191.2	192.168.2.22
Jun 7, 2024 20:39:42.193900108 CEST	49514	445	192.168.2.22	137.124.231.2
Jun 7, 2024 20:39:42.198913097 CEST	445	49514	137.124.231.2	192.168.2.22
Jun 7, 2024 20:39:42.198967934 CEST	49514	445	192.168.2.22	137.124.231.2
Jun 7, 2024 20:39:42.198995113 CEST	49514	445	192.168.2.22	137.124.231.2
Jun 7, 2024 20:39:42.203793049 CEST	445	49514	137.124.231.2	192.168.2.22
Jun 7, 2024 20:39:42.288045883 CEST	49515	445	192.168.2.22	102.226.231.1
Jun 7, 2024 20:39:42.293210983 CEST	445	49515	102.226.231.1	192.168.2.22
Jun 7, 2024 20:39:42.293411970 CEST	49515	445	192.168.2.22	102.226.231.1
Jun 7, 2024 20:39:42.293411970 CEST	49515	445	192.168.2.22	102.226.231.1
Jun 7, 2024 20:39:42.298465967 CEST	445	49515	102.226.231.1	192.168.2.22
Jun 7, 2024 20:39:42.443917990 CEST	49516	445	192.168.2.22	39.128.101.12
Jun 7, 2024 20:39:42.449085951 CEST	445	49516	39.128.101.12	192.168.2.22
Jun 7, 2024 20:39:42.449223995 CEST	49516	445	192.168.2.22	39.128.101.12
Jun 7, 2024 20:39:42.449302912 CEST	49516	445	192.168.2.22	39.128.101.12
Jun 7, 2024 20:39:42.449558973 CEST	49517	445	192.168.2.22	39.128.101.1
Jun 7, 2024 20:39:42.454575062 CEST	445	49516	39.128.101.12	192.168.2.22
Jun 7, 2024 20:39:42.454607964 CEST	445	49517	39.128.101.1	192.168.2.22
Jun 7, 2024 20:39:42.454636097 CEST	49516	445	192.168.2.22	39.128.101.12
Jun 7, 2024 20:39:42.454670906 CEST	49517	445	192.168.2.22	39.128.101.1
Jun 7, 2024 20:39:42.454730988 CEST	49517	445	192.168.2.22	39.128.101.1
Jun 7, 2024 20:39:42.454938889 CEST	49518	445	192.168.2.22	39.128.101.1
Jun 7, 2024 20:39:42.459856987 CEST	445	49518	39.128.101.1	192.168.2.22
Jun 7, 2024 20:39:42.459944010 CEST	49518	445	192.168.2.22	39.128.101.1
Jun 7, 2024 20:39:42.459944010 CEST	49518	445	192.168.2.22	39.128.101.1
Jun 7, 2024 20:39:42.460021019 CEST	445	49517	39.128.101.1	192.168.2.22
Jun 7, 2024 20:39:42.460134983 CEST	49517	445	192.168.2.22	39.128.101.1
Jun 7, 2024 20:39:42.465085030 CEST	445	49518	39.128.101.1	192.168.2.22
Jun 7, 2024 20:39:42.755812883 CEST	445	49487	144.146.120.1	192.168.2.22
Jun 7, 2024 20:39:42.755920887 CEST	49487	445	192.168.2.22	144.146.120.1
Jun 7, 2024 20:39:42.756068945 CEST	49487	445	192.168.2.22	144.146.120.1
Jun 7, 2024 20:39:42.756068945 CEST	49487	445	192.168.2.22	144.146.120.1
Jun 7, 2024 20:39:42.761085033 CEST	445	49487	144.146.120.1	192.168.2.22
Jun 7, 2024 20:39:42.761157990 CEST	445	49487	144.146.120.1	192.168.2.22
Jun 7, 2024 20:39:42.818061113 CEST	49519	445	192.168.2.22	144.146.120.2
Jun 7, 2024 20:39:42.823057890 CEST	445	49519	144.146.120.2	192.168.2.22
Jun 7, 2024 20:39:42.823124886 CEST	49519	445	192.168.2.22	144.146.120.2
Jun 7, 2024 20:39:42.823144913 CEST	49519	445	192.168.2.22	144.146.120.2
Jun 7, 2024 20:39:42.823582888 CEST	49520	445	192.168.2.22	144.146.120.2
Jun 7, 2024 20:39:42.828263998 CEST	445	49519	144.146.120.2	192.168.2.22
Jun 7, 2024 20:39:42.828330040 CEST	49519	445	192.168.2.22	144.146.120.2
Jun 7, 2024 20:39:42.828573942 CEST	445	49520	144.146.120.2	192.168.2.22
Jun 7, 2024 20:39:42.828663111 CEST	49520	445	192.168.2.22	144.146.120.2
Jun 7, 2024 20:39:42.828663111 CEST	49520	445	192.168.2.22	144.146.120.2
Jun 7, 2024 20:39:42.833631039 CEST	445	49520	144.146.120.2	192.168.2.22
Jun 7, 2024 20:39:43.262135983 CEST	445	49489	159.156.112.2	192.168.2.22
Jun 7, 2024 20:39:43.262537956 CEST	49489	445	192.168.2.22	159.156.112.2
Jun 7, 2024 20:39:43.262684107 CEST	49489	445	192.168.2.22	159.156.112.2
Jun 7, 2024 20:39:43.262684107 CEST	49489	445	192.168.2.22	159.156.112.2
Jun 7, 2024 20:39:43.267656088 CEST	445	49489	159.156.112.2	192.168.2.22
Jun 7, 2024 20:39:43.267685890 CEST	445	49489	159.156.112.2	192.168.2.22
Jun 7, 2024 20:39:43.316293955 CEST	445	49520	144.146.120.2	192.168.2.22
Jun 7, 2024 20:39:43.316550970 CEST	49520	445	192.168.2.22	144.146.120.2
Jun 7, 2024 20:39:43.316550970 CEST	49520	445	192.168.2.22	144.146.120.2
Jun 7, 2024 20:39:43.316627979 CEST	49520	445	192.168.2.22	144.146.120.2
Jun 7, 2024 20:39:43.316793919 CEST	445	49492	83.48.154.1	192.168.2.22
Jun 7, 2024 20:39:43.316890955 CEST	49492	445	192.168.2.22	83.48.154.1
Jun 7, 2024 20:39:43.316982031 CEST	49492	445	192.168.2.22	83.48.154.1
Jun 7, 2024 20:39:43.317086935 CEST	49492	445	192.168.2.22	83.48.154.1
Jun 7, 2024 20:39:43.322988987 CEST	445	49520	144.146.120.2	192.168.2.22
Jun 7, 2024 20:39:43.323004007 CEST	445	49520	144.146.120.2	192.168.2.22
Jun 7, 2024 20:39:43.323016882 CEST	445	49492	83.48.154.1	192.168.2.22
Jun 7, 2024 20:39:43.323029995 CEST	445	49492	83.48.154.1	192.168.2.22
Jun 7, 2024 20:39:44.087924004 CEST	49521	445	192.168.2.22	153.124.214.173
Jun 7, 2024 20:39:44.093116999 CEST	445	49521	153.124.214.173	192.168.2.22
Jun 7, 2024 20:39:44.093282938 CEST	49521	445	192.168.2.22	153.124.214.173
Jun 7, 2024 20:39:44.095211029 CEST	49521	445	192.168.2.22	153.124.214.173
Jun 7, 2024 20:39:44.095324993 CEST	49522	445	192.168.2.22	153.124.214.1
Jun 7, 2024 20:39:44.100198030 CEST	445	49521	153.124.214.173	192.168.2.22
Jun 7, 2024 20:39:44.100241899 CEST	445	49522	153.124.214.1	192.168.2.22
Jun 7, 2024 20:39:44.100300074 CEST	49521	445	192.168.2.22	153.124.214.173
Jun 7, 2024 20:39:44.100341082 CEST	49522	445	192.168.2.22	153.124.214.1
Jun 7, 2024 20:39:44.107938051 CEST	49522	445	192.168.2.22	153.124.214.1
Jun 7, 2024 20:39:44.108270884 CEST	49523	445	192.168.2.22	153.124.214.1
Jun 7, 2024 20:39:44.112971067 CEST	445	49522	153.124.214.1	192.168.2.22
Jun 7, 2024 20:39:44.113045931 CEST	49522	445	192.168.2.22	153.124.214.1
Jun 7, 2024 20:39:44.113147974 CEST	445	49523	153.124.214.1	192.168.2.22
Jun 7, 2024 20:39:44.113596916 CEST	49523	445	192.168.2.22	153.124.214.1
Jun 7, 2024 20:39:44.116858006 CEST	49523	445	192.168.2.22	153.124.214.1
Jun 7, 2024 20:39:44.121720076 CEST	445	49523	153.124.214.1	192.168.2.22
Jun 7, 2024 20:39:44.299984932 CEST	49524	445	192.168.2.22	23.35.183.1
Jun 7, 2024 20:39:44.304986000 CEST	445	49524	23.35.183.1	192.168.2.22
Jun 7, 2024 20:39:44.305147886 CEST	49524	445	192.168.2.22	23.35.183.1
Jun 7, 2024 20:39:44.305252075 CEST	49524	445	192.168.2.22	23.35.183.1
Jun 7, 2024 20:39:44.310195923 CEST	445	49524	23.35.183.1	192.168.2.22
Jun 7, 2024 20:39:44.409313917 CEST	49525	445	192.168.2.22	145.5.191.2
Jun 7, 2024 20:39:44.414417028 CEST	445	49525	145.5.191.2	192.168.2.22
Jun 7, 2024 20:39:44.414537907 CEST	49525	445	192.168.2.22	145.5.191.2
Jun 7, 2024 20:39:44.414582014 CEST	49525	445	192.168.2.22	145.5.191.2
Jun 7, 2024 20:39:44.419469118 CEST	445	49525	145.5.191.2	192.168.2.22
Jun 7, 2024 20:39:44.738317013 CEST	445	49493	175.62.123.2	192.168.2.22
Jun 7, 2024 20:39:44.738461971 CEST	49493	445	192.168.2.22	175.62.123.2
Jun 7, 2024 20:39:44.739444017 CEST	49493	445	192.168.2.22	175.62.123.2
Jun 7, 2024 20:39:44.739444017 CEST	49493	445	192.168.2.22	175.62.123.2
Jun 7, 2024 20:39:44.744319916 CEST	445	49493	175.62.123.2	192.168.2.22
Jun 7, 2024 20:39:44.744371891 CEST	445	49493	175.62.123.2	192.168.2.22
Jun 7, 2024 20:39:44.753779888 CEST	445	49494	21.115.191.1	192.168.2.22
Jun 7, 2024 20:39:44.753865957 CEST	49494	445	192.168.2.22	21.115.191.1
Jun 7, 2024 20:39:44.753931046 CEST	49494	445	192.168.2.22	21.115.191.1
Jun 7, 2024 20:39:44.753983974 CEST	49494	445	192.168.2.22	21.115.191.1
Jun 7, 2024 20:39:44.758984089 CEST	445	49494	21.115.191.1	192.168.2.22
Jun 7, 2024 20:39:44.759015083 CEST	445	49494	21.115.191.1	192.168.2.22
Jun 7, 2024 20:39:44.799587011 CEST	49526	445	192.168.2.22	175.62.123.3
Jun 7, 2024 20:39:44.804811001 CEST	445	49526	175.62.123.3	192.168.2.22
Jun 7, 2024 20:39:44.804883957 CEST	49526	445	192.168.2.22	175.62.123.3
Jun 7, 2024 20:39:44.804924965 CEST	49526	445	192.168.2.22	175.62.123.3
Jun 7, 2024 20:39:44.805391073 CEST	49527	445	192.168.2.22	175.62.123.3
Jun 7, 2024 20:39:44.810209990 CEST	445	49526	175.62.123.3	192.168.2.22
Jun 7, 2024 20:39:44.810262918 CEST	445	49527	175.62.123.3	192.168.2.22
Jun 7, 2024 20:39:44.810280085 CEST	49526	445	192.168.2.22	175.62.123.3
Jun 7, 2024 20:39:44.810317993 CEST	49527	445	192.168.2.22	175.62.123.3
Jun 7, 2024 20:39:44.810374022 CEST	49527	445	192.168.2.22	175.62.123.3
Jun 7, 2024 20:39:44.814981937 CEST	49528	445	192.168.2.22	21.115.191.2
Jun 7, 2024 20:39:44.815229893 CEST	445	49527	175.62.123.3	192.168.2.22
Jun 7, 2024 20:39:44.820066929 CEST	445	49528	21.115.191.2	192.168.2.22
Jun 7, 2024 20:39:44.820138931 CEST	49528	445	192.168.2.22	21.115.191.2
Jun 7, 2024 20:39:44.820174932 CEST	49528	445	192.168.2.22	21.115.191.2
Jun 7, 2024 20:39:44.820508003 CEST	49529	445	192.168.2.22	21.115.191.2
Jun 7, 2024 20:39:44.825144053 CEST	445	49528	21.115.191.2	192.168.2.22
Jun 7, 2024 20:39:44.825270891 CEST	445	49528	21.115.191.2	192.168.2.22
Jun 7, 2024 20:39:44.825344086 CEST	49528	445	192.168.2.22	21.115.191.2
Jun 7, 2024 20:39:44.825421095 CEST	445	49529	21.115.191.2	192.168.2.22
Jun 7, 2024 20:39:44.825486898 CEST	49529	445	192.168.2.22	21.115.191.2
Jun 7, 2024 20:39:44.825534105 CEST	49529	445	192.168.2.22	21.115.191.2
Jun 7, 2024 20:39:44.830436945 CEST	445	49529	21.115.191.2	192.168.2.22
Jun 7, 2024 20:39:45.288124084 CEST	445	49496	8.113.72.2	192.168.2.22
Jun 7, 2024 20:39:45.288335085 CEST	49496	445	192.168.2.22	8.113.72.2
Jun 7, 2024 20:39:45.288513899 CEST	49496	445	192.168.2.22	8.113.72.2
Jun 7, 2024 20:39:45.288513899 CEST	49496	445	192.168.2.22	8.113.72.2
Jun 7, 2024 20:39:45.293466091 CEST	445	49496	8.113.72.2	192.168.2.22
Jun 7, 2024 20:39:45.293497086 CEST	445	49496	8.113.72.2	192.168.2.22
Jun 7, 2024 20:39:45.323209047 CEST	445	49499	149.41.53.1	192.168.2.22
Jun 7, 2024 20:39:45.323363066 CEST	49499	445	192.168.2.22	149.41.53.1
Jun 7, 2024 20:39:45.323410988 CEST	49499	445	192.168.2.22	149.41.53.1
Jun 7, 2024 20:39:45.323455095 CEST	49499	445	192.168.2.22	149.41.53.1
Jun 7, 2024 20:39:45.328363895 CEST	445	49499	149.41.53.1	192.168.2.22
Jun 7, 2024 20:39:45.328417063 CEST	445	49499	149.41.53.1	192.168.2.22
Jun 7, 2024 20:39:45.610836029 CEST	49530	445	192.168.2.22	45.139.167.241
Jun 7, 2024 20:39:45.615931988 CEST	445	49530	45.139.167.241	192.168.2.22
Jun 7, 2024 20:39:45.616050005 CEST	49530	445	192.168.2.22	45.139.167.241
Jun 7, 2024 20:39:45.616050005 CEST	49530	445	192.168.2.22	45.139.167.241
Jun 7, 2024 20:39:45.616100073 CEST	49531	445	192.168.2.22	45.139.167.1
Jun 7, 2024 20:39:45.621150017 CEST	445	49531	45.139.167.1	192.168.2.22
Jun 7, 2024 20:39:45.621264935 CEST	49531	445	192.168.2.22	45.139.167.1
Jun 7, 2024 20:39:45.621264935 CEST	49531	445	192.168.2.22	45.139.167.1
Jun 7, 2024 20:39:45.621629000 CEST	49532	445	192.168.2.22	45.139.167.1
Jun 7, 2024 20:39:45.621941090 CEST	445	49530	45.139.167.241	192.168.2.22
Jun 7, 2024 20:39:45.622019053 CEST	49530	445	192.168.2.22	45.139.167.241
Jun 7, 2024 20:39:45.626528978 CEST	445	49531	45.139.167.1	192.168.2.22
Jun 7, 2024 20:39:45.626635075 CEST	445	49532	45.139.167.1	192.168.2.22
Jun 7, 2024 20:39:45.626652956 CEST	49531	445	192.168.2.22	45.139.167.1
Jun 7, 2024 20:39:45.626703978 CEST	49532	445	192.168.2.22	45.139.167.1
Jun 7, 2024 20:39:45.626727104 CEST	49532	445	192.168.2.22	45.139.167.1
Jun 7, 2024 20:39:45.631573915 CEST	445	49532	45.139.167.1	192.168.2.22
Jun 7, 2024 20:39:46.282522917 CEST	49533	445	192.168.2.22	159.156.112.2
Jun 7, 2024 20:39:46.287729979 CEST	445	49533	159.156.112.2	192.168.2.22
Jun 7, 2024 20:39:46.287830114 CEST	49533	445	192.168.2.22	159.156.112.2
Jun 7, 2024 20:39:46.287889004 CEST	49533	445	192.168.2.22	159.156.112.2
Jun 7, 2024 20:39:46.292767048 CEST	445	49533	159.156.112.2	192.168.2.22
Jun 7, 2024 20:39:46.312410116 CEST	49534	445	192.168.2.22	144.146.120.2
Jun 7, 2024 20:39:46.317655087 CEST	445	49534	144.146.120.2	192.168.2.22
Jun 7, 2024 20:39:46.317758083 CEST	49534	445	192.168.2.22	144.146.120.2
Jun 7, 2024 20:39:46.317817926 CEST	49534	445	192.168.2.22	144.146.120.2
Jun 7, 2024 20:39:46.322843075 CEST	445	49534	144.146.120.2	192.168.2.22
Jun 7, 2024 20:39:46.328147888 CEST	49535	445	192.168.2.22	83.48.154.1
Jun 7, 2024 20:39:46.333065033 CEST	445	49535	83.48.154.1	192.168.2.22
Jun 7, 2024 20:39:46.333204031 CEST	49535	445	192.168.2.22	83.48.154.1
Jun 7, 2024 20:39:46.333265066 CEST	49535	445	192.168.2.22	83.48.154.1
Jun 7, 2024 20:39:46.338135004 CEST	445	49535	83.48.154.1	192.168.2.22
Jun 7, 2024 20:39:46.697103024 CEST	445	49500	7.168.109.2	192.168.2.22
Jun 7, 2024 20:39:46.697200060 CEST	49500	445	192.168.2.22	7.168.109.2
Jun 7, 2024 20:39:46.697231054 CEST	49500	445	192.168.2.22	7.168.109.2
Jun 7, 2024 20:39:46.697249889 CEST	49500	445	192.168.2.22	7.168.109.2
Jun 7, 2024 20:39:46.702245951 CEST	445	49500	7.168.109.2	192.168.2.22
Jun 7, 2024 20:39:46.702344894 CEST	445	49500	7.168.109.2	192.168.2.22
Jun 7, 2024 20:39:46.749340057 CEST	49536	445	192.168.2.22	7.168.109.3
Jun 7, 2024 20:39:46.754429102 CEST	445	49536	7.168.109.3	192.168.2.22
Jun 7, 2024 20:39:46.754540920 CEST	49536	445	192.168.2.22	7.168.109.3
Jun 7, 2024 20:39:46.754657030 CEST	49536	445	192.168.2.22	7.168.109.3
Jun 7, 2024 20:39:46.754977942 CEST	49537	445	192.168.2.22	7.168.109.3
Jun 7, 2024 20:39:46.760015965 CEST	445	49537	7.168.109.3	192.168.2.22
Jun 7, 2024 20:39:46.760101080 CEST	445	49536	7.168.109.3	192.168.2.22
Jun 7, 2024 20:39:46.760107040 CEST	49537	445	192.168.2.22	7.168.109.3
Jun 7, 2024 20:39:46.760145903 CEST	49537	445	192.168.2.22	7.168.109.3
Jun 7, 2024 20:39:46.760165930 CEST	49536	445	192.168.2.22	7.168.109.3
Jun 7, 2024 20:39:46.765132904 CEST	445	49537	7.168.109.3	192.168.2.22
Jun 7, 2024 20:39:46.783996105 CEST	445	49501	15.117.122.1	192.168.2.22
Jun 7, 2024 20:39:46.784077883 CEST	49501	445	192.168.2.22	15.117.122.1
Jun 7, 2024 20:39:46.784154892 CEST	49501	445	192.168.2.22	15.117.122.1
Jun 7, 2024 20:39:46.784204006 CEST	49501	445	192.168.2.22	15.117.122.1
Jun 7, 2024 20:39:46.789426088 CEST	445	49501	15.117.122.1	192.168.2.22
Jun 7, 2024 20:39:46.789463043 CEST	445	49501	15.117.122.1	192.168.2.22
Jun 7, 2024 20:39:46.842721939 CEST	49538	445	192.168.2.22	15.117.122.2
Jun 7, 2024 20:39:46.847946882 CEST	445	49538	15.117.122.2	192.168.2.22
Jun 7, 2024 20:39:46.848031044 CEST	49538	445	192.168.2.22	15.117.122.2
Jun 7, 2024 20:39:46.848083019 CEST	49538	445	192.168.2.22	15.117.122.2
Jun 7, 2024 20:39:46.848400116 CEST	49539	445	192.168.2.22	15.117.122.2
Jun 7, 2024 20:39:46.853177071 CEST	445	49538	15.117.122.2	192.168.2.22
Jun 7, 2024 20:39:46.853207111 CEST	445	49538	15.117.122.2	192.168.2.22
Jun 7, 2024 20:39:46.853265047 CEST	49538	445	192.168.2.22	15.117.122.2
Jun 7, 2024 20:39:46.853322983 CEST	445	49539	15.117.122.2	192.168.2.22
Jun 7, 2024 20:39:46.853446007 CEST	49539	445	192.168.2.22	15.117.122.2
Jun 7, 2024 20:39:46.853483915 CEST	49539	445	192.168.2.22	15.117.122.2
Jun 7, 2024 20:39:46.858388901 CEST	445	49539	15.117.122.2	192.168.2.22
Jun 7, 2024 20:39:47.030383110 CEST	49540	445	192.168.2.22	20.33.198.100
Jun 7, 2024 20:39:47.035942078 CEST	445	49540	20.33.198.100	192.168.2.22
Jun 7, 2024 20:39:47.036055088 CEST	49540	445	192.168.2.22	20.33.198.100
Jun 7, 2024 20:39:47.036151886 CEST	49540	445	192.168.2.22	20.33.198.100
Jun 7, 2024 20:39:47.036216021 CEST	49541	445	192.168.2.22	20.33.198.1
Jun 7, 2024 20:39:47.041344881 CEST	445	49541	20.33.198.1	192.168.2.22
Jun 7, 2024 20:39:47.041362047 CEST	445	49540	20.33.198.100	192.168.2.22
Jun 7, 2024 20:39:47.041408062 CEST	49541	445	192.168.2.22	20.33.198.1
Jun 7, 2024 20:39:47.041465044 CEST	49541	445	192.168.2.22	20.33.198.1
Jun 7, 2024 20:39:47.041469097 CEST	445	49540	20.33.198.100	192.168.2.22
Jun 7, 2024 20:39:47.041532040 CEST	49540	445	192.168.2.22	20.33.198.100
Jun 7, 2024 20:39:47.041766882 CEST	49542	445	192.168.2.22	20.33.198.1
Jun 7, 2024 20:39:47.046767950 CEST	445	49541	20.33.198.1	192.168.2.22
Jun 7, 2024 20:39:47.046819925 CEST	49541	445	192.168.2.22	20.33.198.1
Jun 7, 2024 20:39:47.046931028 CEST	445	49542	20.33.198.1	192.168.2.22
Jun 7, 2024 20:39:47.046988010 CEST	49542	445	192.168.2.22	20.33.198.1
Jun 7, 2024 20:39:47.047091961 CEST	49542	445	192.168.2.22	20.33.198.1
Jun 7, 2024 20:39:47.052022934 CEST	445	49542	20.33.198.1	192.168.2.22
Jun 7, 2024 20:39:47.273421049 CEST	445	49503	196.164.18.2	192.168.2.22
Jun 7, 2024 20:39:47.273684978 CEST	49503	445	192.168.2.22	196.164.18.2
Jun 7, 2024 20:39:47.273684978 CEST	49503	445	192.168.2.22	196.164.18.2
Jun 7, 2024 20:39:47.273684978 CEST	49503	445	192.168.2.22	196.164.18.2
Jun 7, 2024 20:39:47.278944016 CEST	445	49503	196.164.18.2	192.168.2.22
Jun 7, 2024 20:39:47.278958082 CEST	445	49503	196.164.18.2	192.168.2.22
Jun 7, 2024 20:39:47.334345102 CEST	445	49506	148.204.151.1	192.168.2.22
Jun 7, 2024 20:39:47.334485054 CEST	49506	445	192.168.2.22	148.204.151.1
Jun 7, 2024 20:39:47.334573030 CEST	49506	445	192.168.2.22	148.204.151.1
Jun 7, 2024 20:39:47.334680080 CEST	49506	445	192.168.2.22	148.204.151.1
Jun 7, 2024 20:39:47.339435101 CEST	445	49506	148.204.151.1	192.168.2.22
Jun 7, 2024 20:39:47.339493036 CEST	445	49506	148.204.151.1	192.168.2.22
Jun 7, 2024 20:39:48.294001102 CEST	49543	445	192.168.2.22	8.113.72.2
Jun 7, 2024 20:39:48.299081087 CEST	445	49543	8.113.72.2	192.168.2.22
Jun 7, 2024 20:39:48.299300909 CEST	49543	445	192.168.2.22	8.113.72.2
Jun 7, 2024 20:39:48.299387932 CEST	49543	445	192.168.2.22	8.113.72.2
Jun 7, 2024 20:39:48.304326057 CEST	445	49543	8.113.72.2	192.168.2.22
Jun 7, 2024 20:39:48.324702024 CEST	49544	445	192.168.2.22	149.41.53.1
Jun 7, 2024 20:39:48.329616070 CEST	445	49544	149.41.53.1	192.168.2.22
Jun 7, 2024 20:39:48.329689980 CEST	49544	445	192.168.2.22	149.41.53.1
Jun 7, 2024 20:39:48.329879045 CEST	49544	445	192.168.2.22	149.41.53.1
Jun 7, 2024 20:39:48.334727049 CEST	445	49544	149.41.53.1	192.168.2.22
Jun 7, 2024 20:39:48.356475115 CEST	49545	445	192.168.2.22	18.149.154.106
Jun 7, 2024 20:39:48.361454010 CEST	445	49545	18.149.154.106	192.168.2.22
Jun 7, 2024 20:39:48.361577988 CEST	49545	445	192.168.2.22	18.149.154.106
Jun 7, 2024 20:39:48.361666918 CEST	49545	445	192.168.2.22	18.149.154.106
Jun 7, 2024 20:39:48.361886024 CEST	49546	445	192.168.2.22	18.149.154.1
Jun 7, 2024 20:39:48.366729021 CEST	445	49545	18.149.154.106	192.168.2.22
Jun 7, 2024 20:39:48.366755009 CEST	445	49546	18.149.154.1	192.168.2.22
Jun 7, 2024 20:39:48.366797924 CEST	49545	445	192.168.2.22	18.149.154.106
Jun 7, 2024 20:39:48.366827011 CEST	49546	445	192.168.2.22	18.149.154.1
Jun 7, 2024 20:39:48.366990089 CEST	49546	445	192.168.2.22	18.149.154.1
Jun 7, 2024 20:39:48.367413044 CEST	49547	445	192.168.2.22	18.149.154.1
Jun 7, 2024 20:39:48.372248888 CEST	445	49546	18.149.154.1	192.168.2.22
Jun 7, 2024 20:39:48.372314930 CEST	49546	445	192.168.2.22	18.149.154.1
Jun 7, 2024 20:39:48.372353077 CEST	445	49547	18.149.154.1	192.168.2.22
Jun 7, 2024 20:39:48.372446060 CEST	49547	445	192.168.2.22	18.149.154.1
Jun 7, 2024 20:39:48.372446060 CEST	49547	445	192.168.2.22	18.149.154.1
Jun 7, 2024 20:39:48.377408981 CEST	445	49547	18.149.154.1	192.168.2.22
Jun 7, 2024 20:39:48.728146076 CEST	445	49507	170.101.108.2	192.168.2.22
Jun 7, 2024 20:39:48.728235006 CEST	49507	445	192.168.2.22	170.101.108.2
Jun 7, 2024 20:39:48.728318930 CEST	49507	445	192.168.2.22	170.101.108.2
Jun 7, 2024 20:39:48.728347063 CEST	49507	445	192.168.2.22	170.101.108.2
Jun 7, 2024 20:39:48.733222961 CEST	445	49507	170.101.108.2	192.168.2.22
Jun 7, 2024 20:39:48.733252048 CEST	445	49507	170.101.108.2	192.168.2.22
Jun 7, 2024 20:39:48.755451918 CEST	445	49508	90.170.69.1	192.168.2.22
Jun 7, 2024 20:39:48.755563021 CEST	49508	445	192.168.2.22	90.170.69.1
Jun 7, 2024 20:39:48.755649090 CEST	49508	445	192.168.2.22	90.170.69.1
Jun 7, 2024 20:39:48.755649090 CEST	49508	445	192.168.2.22	90.170.69.1
Jun 7, 2024 20:39:48.760818005 CEST	445	49508	90.170.69.1	192.168.2.22
Jun 7, 2024 20:39:48.760848999 CEST	445	49508	90.170.69.1	192.168.2.22
Jun 7, 2024 20:39:48.777200937 CEST	49548	445	192.168.2.22	170.101.108.3
Jun 7, 2024 20:39:48.783042908 CEST	445	49548	170.101.108.3	192.168.2.22
Jun 7, 2024 20:39:48.783107996 CEST	49548	445	192.168.2.22	170.101.108.3
Jun 7, 2024 20:39:48.783149004 CEST	49548	445	192.168.2.22	170.101.108.3
Jun 7, 2024 20:39:48.783477068 CEST	49549	445	192.168.2.22	170.101.108.3
Jun 7, 2024 20:39:48.789166927 CEST	445	49548	170.101.108.3	192.168.2.22
Jun 7, 2024 20:39:48.789305925 CEST	445	49548	170.101.108.3	192.168.2.22
Jun 7, 2024 20:39:48.789340973 CEST	445	49549	170.101.108.3	192.168.2.22
Jun 7, 2024 20:39:48.789356947 CEST	49548	445	192.168.2.22	170.101.108.3
Jun 7, 2024 20:39:48.789411068 CEST	49549	445	192.168.2.22	170.101.108.3
Jun 7, 2024 20:39:48.789450884 CEST	49549	445	192.168.2.22	170.101.108.3
Jun 7, 2024 20:39:48.794514894 CEST	445	49549	170.101.108.3	192.168.2.22
Jun 7, 2024 20:39:48.808290005 CEST	49550	445	192.168.2.22	90.170.69.2
Jun 7, 2024 20:39:48.813299894 CEST	445	49550	90.170.69.2	192.168.2.22
Jun 7, 2024 20:39:48.813414097 CEST	49550	445	192.168.2.22	90.170.69.2
Jun 7, 2024 20:39:48.813415051 CEST	49550	445	192.168.2.22	90.170.69.2
Jun 7, 2024 20:39:48.813606024 CEST	49551	445	192.168.2.22	90.170.69.2
Jun 7, 2024 20:39:48.818525076 CEST	445	49551	90.170.69.2	192.168.2.22
Jun 7, 2024 20:39:48.818600893 CEST	49551	445	192.168.2.22	90.170.69.2
Jun 7, 2024 20:39:48.818636894 CEST	49551	445	192.168.2.22	90.170.69.2
Jun 7, 2024 20:39:48.818727016 CEST	445	49550	90.170.69.2	192.168.2.22
Jun 7, 2024 20:39:48.818793058 CEST	49550	445	192.168.2.22	90.170.69.2
Jun 7, 2024 20:39:48.823574066 CEST	445	49551	90.170.69.2	192.168.2.22
Jun 7, 2024 20:39:49.207811117 CEST	445	49511	54.92.197.1	192.168.2.22
Jun 7, 2024 20:39:49.207988977 CEST	49511	445	192.168.2.22	54.92.197.1
Jun 7, 2024 20:39:49.207988977 CEST	49511	445	192.168.2.22	54.92.197.1
Jun 7, 2024 20:39:49.207988977 CEST	49511	445	192.168.2.22	54.92.197.1
Jun 7, 2024 20:39:49.212935925 CEST	445	49511	54.92.197.1	192.168.2.22
Jun 7, 2024 20:39:49.212961912 CEST	445	49511	54.92.197.1	192.168.2.22
Jun 7, 2024 20:39:49.277848005 CEST	445	49513	202.195.174.2	192.168.2.22
Jun 7, 2024 20:39:49.277951956 CEST	49513	445	192.168.2.22	202.195.174.2
Jun 7, 2024 20:39:49.278033972 CEST	49513	445	192.168.2.22	202.195.174.2
Jun 7, 2024 20:39:49.278105974 CEST	49513	445	192.168.2.22	202.195.174.2
Jun 7, 2024 20:39:49.283947945 CEST	445	49513	202.195.174.2	192.168.2.22
Jun 7, 2024 20:39:49.283962011 CEST	445	49513	202.195.174.2	192.168.2.22
Jun 7, 2024 20:39:49.604304075 CEST	49552	445	192.168.2.22	175.20.89.160
Jun 7, 2024 20:39:49.616873980 CEST	445	49552	175.20.89.160	192.168.2.22
Jun 7, 2024 20:39:49.617063046 CEST	49552	445	192.168.2.22	175.20.89.160
Jun 7, 2024 20:39:49.617105961 CEST	49552	445	192.168.2.22	175.20.89.160
Jun 7, 2024 20:39:49.617285967 CEST	49553	445	192.168.2.22	175.20.89.1
Jun 7, 2024 20:39:49.622299910 CEST	445	49553	175.20.89.1	192.168.2.22
Jun 7, 2024 20:39:49.622333050 CEST	445	49552	175.20.89.160	192.168.2.22
Jun 7, 2024 20:39:49.622370958 CEST	49553	445	192.168.2.22	175.20.89.1
Jun 7, 2024 20:39:49.622415066 CEST	49553	445	192.168.2.22	175.20.89.1
Jun 7, 2024 20:39:49.622448921 CEST	49552	445	192.168.2.22	175.20.89.160
Jun 7, 2024 20:39:49.622862101 CEST	49554	445	192.168.2.22	175.20.89.1
Jun 7, 2024 20:39:49.627474070 CEST	445	49553	175.20.89.1	192.168.2.22
Jun 7, 2024 20:39:49.627542019 CEST	49553	445	192.168.2.22	175.20.89.1
Jun 7, 2024 20:39:49.627784014 CEST	445	49554	175.20.89.1	192.168.2.22
Jun 7, 2024 20:39:49.628056049 CEST	49554	445	192.168.2.22	175.20.89.1
Jun 7, 2024 20:39:49.628056049 CEST	49554	445	192.168.2.22	175.20.89.1
Jun 7, 2024 20:39:49.633095980 CEST	445	49554	175.20.89.1	192.168.2.22
Jun 7, 2024 20:39:50.274970055 CEST	49555	445	192.168.2.22	196.164.18.2
Jun 7, 2024 20:39:50.280572891 CEST	445	49555	196.164.18.2	192.168.2.22
Jun 7, 2024 20:39:50.280838966 CEST	49555	445	192.168.2.22	196.164.18.2
Jun 7, 2024 20:39:50.280838966 CEST	49555	445	192.168.2.22	196.164.18.2
Jun 7, 2024 20:39:50.285762072 CEST	445	49555	196.164.18.2	192.168.2.22
Jun 7, 2024 20:39:50.337157965 CEST	49556	445	192.168.2.22	148.204.151.1
Jun 7, 2024 20:39:50.342264891 CEST	445	49556	148.204.151.1	192.168.2.22
Jun 7, 2024 20:39:50.342652082 CEST	49556	445	192.168.2.22	148.204.151.1
Jun 7, 2024 20:39:50.342652082 CEST	49556	445	192.168.2.22	148.204.151.1
Jun 7, 2024 20:39:50.347616911 CEST	445	49556	148.204.151.1	192.168.2.22
Jun 7, 2024 20:39:50.695106983 CEST	445	49514	137.124.231.2	192.168.2.22
Jun 7, 2024 20:39:50.695553064 CEST	49514	445	192.168.2.22	137.124.231.2
Jun 7, 2024 20:39:50.695554018 CEST	49514	445	192.168.2.22	137.124.231.2
Jun 7, 2024 20:39:50.695554018 CEST	49514	445	192.168.2.22	137.124.231.2
Jun 7, 2024 20:39:50.703250885 CEST	445	49514	137.124.231.2	192.168.2.22
Jun 7, 2024 20:39:50.703282118 CEST	445	49514	137.124.231.2	192.168.2.22
Jun 7, 2024 20:39:50.742793083 CEST	49557	445	192.168.2.22	137.124.231.3
Jun 7, 2024 20:39:50.749231100 CEST	445	49557	137.124.231.3	192.168.2.22
Jun 7, 2024 20:39:50.749293089 CEST	49557	445	192.168.2.22	137.124.231.3
Jun 7, 2024 20:39:50.749353886 CEST	49557	445	192.168.2.22	137.124.231.3
Jun 7, 2024 20:39:50.749769926 CEST	49558	445	192.168.2.22	137.124.231.3
Jun 7, 2024 20:39:50.756072998 CEST	445	49558	137.124.231.3	192.168.2.22
Jun 7, 2024 20:39:50.756087065 CEST	445	49557	137.124.231.3	192.168.2.22
Jun 7, 2024 20:39:50.756138086 CEST	49558	445	192.168.2.22	137.124.231.3
Jun 7, 2024 20:39:50.756138086 CEST	49558	445	192.168.2.22	137.124.231.3
Jun 7, 2024 20:39:50.757668972 CEST	49557	445	192.168.2.22	137.124.231.3
Jun 7, 2024 20:39:50.758400917 CEST	49559	445	192.168.2.22	202.29.104.242
Jun 7, 2024 20:39:50.762423992 CEST	445	49558	137.124.231.3	192.168.2.22
Jun 7, 2024 20:39:50.764712095 CEST	445	49559	202.29.104.242	192.168.2.22
Jun 7, 2024 20:39:50.764761925 CEST	49559	445	192.168.2.22	202.29.104.242
Jun 7, 2024 20:39:50.764844894 CEST	49559	445	192.168.2.22	202.29.104.242
Jun 7, 2024 20:39:50.764990091 CEST	49560	445	192.168.2.22	202.29.104.1
Jun 7, 2024 20:39:50.771296978 CEST	445	49560	202.29.104.1	192.168.2.22
Jun 7, 2024 20:39:50.771353006 CEST	49560	445	192.168.2.22	202.29.104.1
Jun 7, 2024 20:39:50.771404982 CEST	49560	445	192.168.2.22	202.29.104.1
Jun 7, 2024 20:39:50.771593094 CEST	49561	445	192.168.2.22	202.29.104.1
Jun 7, 2024 20:39:50.771773100 CEST	445	49559	202.29.104.242	192.168.2.22
Jun 7, 2024 20:39:50.771909952 CEST	49559	445	192.168.2.22	202.29.104.242
Jun 7, 2024 20:39:50.777959108 CEST	445	49561	202.29.104.1	192.168.2.22
Jun 7, 2024 20:39:50.778023958 CEST	49561	445	192.168.2.22	202.29.104.1
Jun 7, 2024 20:39:50.778069019 CEST	49561	445	192.168.2.22	202.29.104.1
Jun 7, 2024 20:39:50.778260946 CEST	445	49560	202.29.104.1	192.168.2.22
Jun 7, 2024 20:39:50.778352022 CEST	49560	445	192.168.2.22	202.29.104.1
Jun 7, 2024 20:39:50.784502029 CEST	445	49561	202.29.104.1	192.168.2.22
Jun 7, 2024 20:39:50.790241957 CEST	445	49515	102.226.231.1	192.168.2.22
Jun 7, 2024 20:39:50.790467024 CEST	49515	445	192.168.2.22	102.226.231.1
Jun 7, 2024 20:39:50.790467978 CEST	49515	445	192.168.2.22	102.226.231.1
Jun 7, 2024 20:39:50.790560007 CEST	49515	445	192.168.2.22	102.226.231.1
Jun 7, 2024 20:39:50.797147036 CEST	445	49515	102.226.231.1	192.168.2.22
Jun 7, 2024 20:39:50.797177076 CEST	445	49515	102.226.231.1	192.168.2.22
Jun 7, 2024 20:39:50.851955891 CEST	49562	445	192.168.2.22	102.226.231.2
Jun 7, 2024 20:39:50.858720064 CEST	445	49562	102.226.231.2	192.168.2.22
Jun 7, 2024 20:39:50.858856916 CEST	49562	445	192.168.2.22	102.226.231.2
Jun 7, 2024 20:39:50.858942986 CEST	49562	445	192.168.2.22	102.226.231.2
Jun 7, 2024 20:39:50.859314919 CEST	49563	445	192.168.2.22	102.226.231.2
Jun 7, 2024 20:39:50.865885019 CEST	445	49562	102.226.231.2	192.168.2.22
Jun 7, 2024 20:39:50.865899086 CEST	445	49563	102.226.231.2	192.168.2.22
Jun 7, 2024 20:39:50.865994930 CEST	49562	445	192.168.2.22	102.226.231.2
Jun 7, 2024 20:39:50.866040945 CEST	49563	445	192.168.2.22	102.226.231.2
Jun 7, 2024 20:39:50.866136074 CEST	49563	445	192.168.2.22	102.226.231.2
Jun 7, 2024 20:39:50.872698069 CEST	445	49563	102.226.231.2	192.168.2.22
Jun 7, 2024 20:39:50.950093031 CEST	445	49518	39.128.101.1	192.168.2.22
Jun 7, 2024 20:39:50.950469971 CEST	49518	445	192.168.2.22	39.128.101.1
Jun 7, 2024 20:39:50.950726032 CEST	49518	445	192.168.2.22	39.128.101.1
Jun 7, 2024 20:39:50.950726032 CEST	49518	445	192.168.2.22	39.128.101.1
Jun 7, 2024 20:39:50.957814932 CEST	445	49518	39.128.101.1	192.168.2.22
Jun 7, 2024 20:39:50.958118916 CEST	445	49518	39.128.101.1	192.168.2.22
Jun 7, 2024 20:39:51.835825920 CEST	49564	445	192.168.2.22	20.138.183.84
Jun 7, 2024 20:39:51.841453075 CEST	445	49564	20.138.183.84	192.168.2.22
Jun 7, 2024 20:39:51.841593027 CEST	49564	445	192.168.2.22	20.138.183.84
Jun 7, 2024 20:39:51.841721058 CEST	49564	445	192.168.2.22	20.138.183.84
Jun 7, 2024 20:39:51.841912985 CEST	49565	445	192.168.2.22	20.138.183.1
Jun 7, 2024 20:39:51.846800089 CEST	445	49565	20.138.183.1	192.168.2.22
Jun 7, 2024 20:39:51.846863985 CEST	445	49564	20.138.183.84	192.168.2.22
Jun 7, 2024 20:39:51.846939087 CEST	49565	445	192.168.2.22	20.138.183.1
Jun 7, 2024 20:39:51.846966028 CEST	49564	445	192.168.2.22	20.138.183.84
Jun 7, 2024 20:39:51.847002983 CEST	49565	445	192.168.2.22	20.138.183.1
Jun 7, 2024 20:39:51.847513914 CEST	49566	445	192.168.2.22	20.138.183.1
Jun 7, 2024 20:39:51.852169037 CEST	445	49565	20.138.183.1	192.168.2.22
Jun 7, 2024 20:39:51.852238894 CEST	49565	445	192.168.2.22	20.138.183.1
Jun 7, 2024 20:39:51.852411032 CEST	445	49566	20.138.183.1	192.168.2.22
Jun 7, 2024 20:39:51.852545977 CEST	49566	445	192.168.2.22	20.138.183.1
Jun 7, 2024 20:39:51.852598906 CEST	49566	445	192.168.2.22	20.138.183.1
Jun 7, 2024 20:39:51.857475042 CEST	445	49566	20.138.183.1	192.168.2.22
Jun 7, 2024 20:39:52.209445000 CEST	49567	445	192.168.2.22	54.92.197.1
Jun 7, 2024 20:39:52.214591026 CEST	445	49567	54.92.197.1	192.168.2.22
Jun 7, 2024 20:39:52.214792013 CEST	49567	445	192.168.2.22	54.92.197.1
Jun 7, 2024 20:39:52.214863062 CEST	49567	445	192.168.2.22	54.92.197.1
Jun 7, 2024 20:39:52.219801903 CEST	445	49567	54.92.197.1	192.168.2.22
Jun 7, 2024 20:39:52.287167072 CEST	49568	445	192.168.2.22	202.195.174.2
Jun 7, 2024 20:39:52.292224884 CEST	445	49568	202.195.174.2	192.168.2.22
Jun 7, 2024 20:39:52.292370081 CEST	49568	445	192.168.2.22	202.195.174.2
Jun 7, 2024 20:39:52.292370081 CEST	49568	445	192.168.2.22	202.195.174.2
Jun 7, 2024 20:39:52.297445059 CEST	445	49568	202.195.174.2	192.168.2.22
Jun 7, 2024 20:39:52.605499029 CEST	445	49523	153.124.214.1	192.168.2.22
Jun 7, 2024 20:39:52.605905056 CEST	49523	445	192.168.2.22	153.124.214.1
Jun 7, 2024 20:39:52.605905056 CEST	49523	445	192.168.2.22	153.124.214.1
Jun 7, 2024 20:39:52.605905056 CEST	49523	445	192.168.2.22	153.124.214.1
Jun 7, 2024 20:39:52.610846043 CEST	445	49523	153.124.214.1	192.168.2.22
Jun 7, 2024 20:39:52.610886097 CEST	445	49523	153.124.214.1	192.168.2.22
Jun 7, 2024 20:39:52.802678108 CEST	445	49524	23.35.183.1	192.168.2.22
Jun 7, 2024 20:39:52.802815914 CEST	49524	445	192.168.2.22	23.35.183.1
Jun 7, 2024 20:39:52.810501099 CEST	49524	445	192.168.2.22	23.35.183.1
Jun 7, 2024 20:39:52.810501099 CEST	49524	445	192.168.2.22	23.35.183.1
Jun 7, 2024 20:39:52.815711021 CEST	445	49524	23.35.183.1	192.168.2.22
Jun 7, 2024 20:39:52.815768957 CEST	445	49524	23.35.183.1	192.168.2.22
Jun 7, 2024 20:39:52.849378109 CEST	49569	445	192.168.2.22	8.137.78.78
Jun 7, 2024 20:39:52.854315042 CEST	445	49569	8.137.78.78	192.168.2.22
Jun 7, 2024 20:39:52.854409933 CEST	49569	445	192.168.2.22	8.137.78.78
Jun 7, 2024 20:39:52.854506969 CEST	49569	445	192.168.2.22	8.137.78.78
Jun 7, 2024 20:39:52.854716063 CEST	49570	445	192.168.2.22	8.137.78.1
Jun 7, 2024 20:39:52.859680891 CEST	445	49570	8.137.78.1	192.168.2.22
Jun 7, 2024 20:39:52.859791994 CEST	49570	445	192.168.2.22	8.137.78.1
Jun 7, 2024 20:39:52.859791994 CEST	49570	445	192.168.2.22	8.137.78.1
Jun 7, 2024 20:39:52.859890938 CEST	445	49569	8.137.78.78	192.168.2.22
Jun 7, 2024 20:39:52.859956980 CEST	49569	445	192.168.2.22	8.137.78.78
Jun 7, 2024 20:39:52.860327005 CEST	49571	445	192.168.2.22	8.137.78.1
Jun 7, 2024 20:39:52.864382029 CEST	49572	445	192.168.2.22	23.35.183.2
Jun 7, 2024 20:39:52.864944935 CEST	445	49570	8.137.78.1	192.168.2.22
Jun 7, 2024 20:39:52.865011930 CEST	49570	445	192.168.2.22	8.137.78.1
Jun 7, 2024 20:39:52.865277052 CEST	445	49571	8.137.78.1	192.168.2.22
Jun 7, 2024 20:39:52.865339994 CEST	49571	445	192.168.2.22	8.137.78.1
Jun 7, 2024 20:39:52.865381956 CEST	49571	445	192.168.2.22	8.137.78.1
Jun 7, 2024 20:39:52.869329929 CEST	445	49572	23.35.183.2	192.168.2.22
Jun 7, 2024 20:39:52.869406939 CEST	49572	445	192.168.2.22	23.35.183.2
Jun 7, 2024 20:39:52.869487047 CEST	49572	445	192.168.2.22	23.35.183.2
Jun 7, 2024 20:39:52.869868994 CEST	49573	445	192.168.2.22	23.35.183.2
Jun 7, 2024 20:39:52.870273113 CEST	445	49571	8.137.78.1	192.168.2.22
Jun 7, 2024 20:39:52.874667883 CEST	445	49572	23.35.183.2	192.168.2.22
Jun 7, 2024 20:39:52.874769926 CEST	49572	445	192.168.2.22	23.35.183.2
Jun 7, 2024 20:39:52.874818087 CEST	445	49573	23.35.183.2	192.168.2.22
Jun 7, 2024 20:39:52.874888897 CEST	49573	445	192.168.2.22	23.35.183.2
Jun 7, 2024 20:39:52.874952078 CEST	49573	445	192.168.2.22	23.35.183.2
Jun 7, 2024 20:39:52.881011963 CEST	445	49573	23.35.183.2	192.168.2.22
Jun 7, 2024 20:39:52.904524088 CEST	445	49525	145.5.191.2	192.168.2.22
Jun 7, 2024 20:39:52.904867887 CEST	49525	445	192.168.2.22	145.5.191.2
Jun 7, 2024 20:39:52.904869080 CEST	49525	445	192.168.2.22	145.5.191.2
Jun 7, 2024 20:39:52.904869080 CEST	49525	445	192.168.2.22	145.5.191.2
Jun 7, 2024 20:39:52.910116911 CEST	445	49525	145.5.191.2	192.168.2.22
Jun 7, 2024 20:39:52.910134077 CEST	445	49525	145.5.191.2	192.168.2.22
Jun 7, 2024 20:39:52.958146095 CEST	49574	445	192.168.2.22	145.5.191.3
Jun 7, 2024 20:39:52.963072062 CEST	445	49574	145.5.191.3	192.168.2.22
Jun 7, 2024 20:39:52.963233948 CEST	49574	445	192.168.2.22	145.5.191.3
Jun 7, 2024 20:39:52.963233948 CEST	49574	445	192.168.2.22	145.5.191.3
Jun 7, 2024 20:39:52.963485956 CEST	49575	445	192.168.2.22	145.5.191.3
Jun 7, 2024 20:39:52.968375921 CEST	445	49574	145.5.191.3	192.168.2.22
Jun 7, 2024 20:39:52.968390942 CEST	445	49575	145.5.191.3	192.168.2.22
Jun 7, 2024 20:39:52.968446016 CEST	49574	445	192.168.2.22	145.5.191.3
Jun 7, 2024 20:39:52.968477011 CEST	49575	445	192.168.2.22	145.5.191.3
Jun 7, 2024 20:39:52.968539953 CEST	49575	445	192.168.2.22	145.5.191.3
Jun 7, 2024 20:39:52.973325968 CEST	445	49575	145.5.191.3	192.168.2.22
Jun 7, 2024 20:39:53.305754900 CEST	445	49527	175.62.123.3	192.168.2.22
Jun 7, 2024 20:39:53.305819035 CEST	49527	445	192.168.2.22	175.62.123.3
Jun 7, 2024 20:39:53.305919886 CEST	49527	445	192.168.2.22	175.62.123.3
Jun 7, 2024 20:39:53.306147099 CEST	49527	445	192.168.2.22	175.62.123.3
Jun 7, 2024 20:39:53.310889959 CEST	445	49527	175.62.123.3	192.168.2.22
Jun 7, 2024 20:39:53.311041117 CEST	445	49527	175.62.123.3	192.168.2.22
Jun 7, 2024 20:39:53.315946102 CEST	445	49529	21.115.191.2	192.168.2.22
Jun 7, 2024 20:39:53.316174984 CEST	49529	445	192.168.2.22	21.115.191.2
Jun 7, 2024 20:39:53.316174984 CEST	49529	445	192.168.2.22	21.115.191.2
Jun 7, 2024 20:39:53.316277981 CEST	49529	445	192.168.2.22	21.115.191.2
Jun 7, 2024 20:39:53.321307898 CEST	445	49529	21.115.191.2	192.168.2.22
Jun 7, 2024 20:39:53.321346045 CEST	445	49529	21.115.191.2	192.168.2.22
Jun 7, 2024 20:39:53.785805941 CEST	49576	445	192.168.2.22	181.39.243.242
Jun 7, 2024 20:39:53.790916920 CEST	445	49576	181.39.243.242	192.168.2.22
Jun 7, 2024 20:39:53.791007996 CEST	49576	445	192.168.2.22	181.39.243.242
Jun 7, 2024 20:39:53.791048050 CEST	49576	445	192.168.2.22	181.39.243.242
Jun 7, 2024 20:39:53.791131020 CEST	49577	445	192.168.2.22	181.39.243.1
Jun 7, 2024 20:39:53.796120882 CEST	445	49577	181.39.243.1	192.168.2.22
Jun 7, 2024 20:39:53.796252012 CEST	49577	445	192.168.2.22	181.39.243.1
Jun 7, 2024 20:39:53.796252012 CEST	49577	445	192.168.2.22	181.39.243.1
Jun 7, 2024 20:39:53.796277046 CEST	445	49576	181.39.243.242	192.168.2.22
Jun 7, 2024 20:39:53.796392918 CEST	49576	445	192.168.2.22	181.39.243.242
Jun 7, 2024 20:39:53.796897888 CEST	49578	445	192.168.2.22	181.39.243.1
Jun 7, 2024 20:39:53.801517963 CEST	445	49577	181.39.243.1	192.168.2.22
Jun 7, 2024 20:39:53.801640034 CEST	49577	445	192.168.2.22	181.39.243.1
Jun 7, 2024 20:39:53.801803112 CEST	445	49578	181.39.243.1	192.168.2.22
Jun 7, 2024 20:39:53.801913977 CEST	49578	445	192.168.2.22	181.39.243.1
Jun 7, 2024 20:39:53.801986933 CEST	49578	445	192.168.2.22	181.39.243.1
Jun 7, 2024 20:39:53.806945086 CEST	445	49578	181.39.243.1	192.168.2.22
Jun 7, 2024 20:39:53.956533909 CEST	49579	445	192.168.2.22	39.128.101.1
Jun 7, 2024 20:39:53.961716890 CEST	445	49579	39.128.101.1	192.168.2.22
Jun 7, 2024 20:39:53.961886883 CEST	49579	445	192.168.2.22	39.128.101.1
Jun 7, 2024 20:39:53.961935997 CEST	49579	445	192.168.2.22	39.128.101.1
Jun 7, 2024 20:39:53.966866970 CEST	445	49579	39.128.101.1	192.168.2.22
Jun 7, 2024 20:39:54.123248100 CEST	445	49532	45.139.167.1	192.168.2.22
Jun 7, 2024 20:39:54.123428106 CEST	49532	445	192.168.2.22	45.139.167.1
Jun 7, 2024 20:39:54.123428106 CEST	49532	445	192.168.2.22	45.139.167.1
Jun 7, 2024 20:39:54.123495102 CEST	49532	445	192.168.2.22	45.139.167.1
Jun 7, 2024 20:39:54.129565954 CEST	445	49532	45.139.167.1	192.168.2.22
Jun 7, 2024 20:39:54.129580021 CEST	445	49532	45.139.167.1	192.168.2.22
Jun 7, 2024 20:39:54.378763914 CEST	445	49578	181.39.243.1	192.168.2.22
Jun 7, 2024 20:39:54.378982067 CEST	49578	445	192.168.2.22	181.39.243.1
Jun 7, 2024 20:39:54.378983021 CEST	49578	445	192.168.2.22	181.39.243.1
Jun 7, 2024 20:39:54.379085064 CEST	49578	445	192.168.2.22	181.39.243.1
Jun 7, 2024 20:39:54.384433985 CEST	445	49578	181.39.243.1	192.168.2.22
Jun 7, 2024 20:39:54.384444952 CEST	445	49578	181.39.243.1	192.168.2.22
Jun 7, 2024 20:39:54.674602032 CEST	49580	445	192.168.2.22	103.27.230.241
Jun 7, 2024 20:39:54.679682016 CEST	445	49580	103.27.230.241	192.168.2.22
Jun 7, 2024 20:39:54.679867029 CEST	49580	445	192.168.2.22	103.27.230.241
Jun 7, 2024 20:39:54.679941893 CEST	49580	445	192.168.2.22	103.27.230.241
Jun 7, 2024 20:39:54.680105925 CEST	49581	445	192.168.2.22	103.27.230.1
Jun 7, 2024 20:39:54.684945107 CEST	445	49581	103.27.230.1	192.168.2.22
Jun 7, 2024 20:39:54.684986115 CEST	445	49580	103.27.230.241	192.168.2.22
Jun 7, 2024 20:39:54.685100079 CEST	49580	445	192.168.2.22	103.27.230.241
Jun 7, 2024 20:39:54.685122013 CEST	49581	445	192.168.2.22	103.27.230.1
Jun 7, 2024 20:39:54.685882092 CEST	49582	445	192.168.2.22	103.27.230.1
Jun 7, 2024 20:39:54.690359116 CEST	445	49581	103.27.230.1	192.168.2.22
Jun 7, 2024 20:39:54.690438986 CEST	49581	445	192.168.2.22	103.27.230.1
Jun 7, 2024 20:39:54.690691948 CEST	445	49582	103.27.230.1	192.168.2.22
Jun 7, 2024 20:39:54.690776110 CEST	49582	445	192.168.2.22	103.27.230.1
Jun 7, 2024 20:39:54.690831900 CEST	49582	445	192.168.2.22	103.27.230.1
Jun 7, 2024 20:39:54.695638895 CEST	445	49582	103.27.230.1	192.168.2.22
Jun 7, 2024 20:39:54.785789013 CEST	445	49533	159.156.112.2	192.168.2.22
Jun 7, 2024 20:39:54.785985947 CEST	49533	445	192.168.2.22	159.156.112.2
Jun 7, 2024 20:39:54.785985947 CEST	49533	445	192.168.2.22	159.156.112.2
Jun 7, 2024 20:39:54.786174059 CEST	49533	445	192.168.2.22	159.156.112.2
Jun 7, 2024 20:39:54.791449070 CEST	445	49533	159.156.112.2	192.168.2.22
Jun 7, 2024 20:39:54.791578054 CEST	445	49533	159.156.112.2	192.168.2.22
Jun 7, 2024 20:39:54.809623957 CEST	445	49534	144.146.120.2	192.168.2.22
Jun 7, 2024 20:39:54.809818029 CEST	49534	445	192.168.2.22	144.146.120.2
Jun 7, 2024 20:39:54.809818029 CEST	49534	445	192.168.2.22	144.146.120.2
Jun 7, 2024 20:39:54.809818029 CEST	49534	445	192.168.2.22	144.146.120.2
Jun 7, 2024 20:39:54.815469980 CEST	445	49534	144.146.120.2	192.168.2.22
Jun 7, 2024 20:39:54.815480947 CEST	445	49534	144.146.120.2	192.168.2.22
Jun 7, 2024 20:39:54.834991932 CEST	445	49535	83.48.154.1	192.168.2.22
Jun 7, 2024 20:39:54.835069895 CEST	49535	445	192.168.2.22	83.48.154.1
Jun 7, 2024 20:39:54.835233927 CEST	49535	445	192.168.2.22	83.48.154.1
Jun 7, 2024 20:39:54.835233927 CEST	49535	445	192.168.2.22	83.48.154.1
Jun 7, 2024 20:39:54.840303898 CEST	445	49535	83.48.154.1	192.168.2.22
Jun 7, 2024 20:39:54.840323925 CEST	445	49535	83.48.154.1	192.168.2.22
Jun 7, 2024 20:39:54.846021891 CEST	49583	445	192.168.2.22	159.156.112.3
Jun 7, 2024 20:39:54.851490974 CEST	445	49583	159.156.112.3	192.168.2.22
Jun 7, 2024 20:39:54.851700068 CEST	49583	445	192.168.2.22	159.156.112.3
Jun 7, 2024 20:39:54.851748943 CEST	49583	445	192.168.2.22	159.156.112.3
Jun 7, 2024 20:39:54.852132082 CEST	49584	445	192.168.2.22	159.156.112.3
Jun 7, 2024 20:39:54.856904030 CEST	445	49583	159.156.112.3	192.168.2.22
Jun 7, 2024 20:39:54.856965065 CEST	445	49584	159.156.112.3	192.168.2.22
Jun 7, 2024 20:39:54.857002020 CEST	49583	445	192.168.2.22	159.156.112.3
Jun 7, 2024 20:39:54.857095957 CEST	49584	445	192.168.2.22	159.156.112.3
Jun 7, 2024 20:39:54.857131958 CEST	49584	445	192.168.2.22	159.156.112.3
Jun 7, 2024 20:39:54.862096071 CEST	445	49584	159.156.112.3	192.168.2.22
Jun 7, 2024 20:39:54.871264935 CEST	49585	445	192.168.2.22	144.146.120.3
Jun 7, 2024 20:39:54.876233101 CEST	445	49585	144.146.120.3	192.168.2.22
Jun 7, 2024 20:39:54.876307964 CEST	49585	445	192.168.2.22	144.146.120.3
Jun 7, 2024 20:39:54.876374960 CEST	49585	445	192.168.2.22	144.146.120.3
Jun 7, 2024 20:39:54.876764059 CEST	49586	445	192.168.2.22	144.146.120.3
Jun 7, 2024 20:39:54.881433010 CEST	445	49585	144.146.120.3	192.168.2.22
Jun 7, 2024 20:39:54.881491899 CEST	49585	445	192.168.2.22	144.146.120.3
Jun 7, 2024 20:39:54.881659031 CEST	445	49586	144.146.120.3	192.168.2.22
Jun 7, 2024 20:39:54.881742001 CEST	49586	445	192.168.2.22	144.146.120.3
Jun 7, 2024 20:39:54.881779909 CEST	49586	445	192.168.2.22	144.146.120.3
Jun 7, 2024 20:39:54.886580944 CEST	445	49586	144.146.120.3	192.168.2.22
Jun 7, 2024 20:39:54.892323971 CEST	49587	445	192.168.2.22	83.48.154.2
Jun 7, 2024 20:39:54.897432089 CEST	445	49587	83.48.154.2	192.168.2.22
Jun 7, 2024 20:39:54.897532940 CEST	49587	445	192.168.2.22	83.48.154.2
Jun 7, 2024 20:39:54.897672892 CEST	49587	445	192.168.2.22	83.48.154.2
Jun 7, 2024 20:39:54.898188114 CEST	49588	445	192.168.2.22	83.48.154.2
Jun 7, 2024 20:39:54.902617931 CEST	445	49587	83.48.154.2	192.168.2.22
Jun 7, 2024 20:39:54.902695894 CEST	49587	445	192.168.2.22	83.48.154.2
Jun 7, 2024 20:39:54.903048992 CEST	445	49588	83.48.154.2	192.168.2.22
Jun 7, 2024 20:39:54.903137922 CEST	49588	445	192.168.2.22	83.48.154.2
Jun 7, 2024 20:39:54.903347015 CEST	49588	445	192.168.2.22	83.48.154.2
Jun 7, 2024 20:39:54.908189058 CEST	445	49588	83.48.154.2	192.168.2.22
Jun 7, 2024 20:39:55.258058071 CEST	445	49537	7.168.109.3	192.168.2.22
Jun 7, 2024 20:39:55.258440971 CEST	49537	445	192.168.2.22	7.168.109.3
Jun 7, 2024 20:39:55.258440971 CEST	49537	445	192.168.2.22	7.168.109.3
Jun 7, 2024 20:39:55.258440971 CEST	49537	445	192.168.2.22	7.168.109.3
Jun 7, 2024 20:39:55.263458014 CEST	445	49537	7.168.109.3	192.168.2.22
Jun 7, 2024 20:39:55.263514042 CEST	445	49537	7.168.109.3	192.168.2.22
Jun 7, 2024 20:39:55.352452040 CEST	445	49539	15.117.122.2	192.168.2.22
Jun 7, 2024 20:39:55.352561951 CEST	49539	445	192.168.2.22	15.117.122.2
Jun 7, 2024 20:39:55.352724075 CEST	49539	445	192.168.2.22	15.117.122.2
Jun 7, 2024 20:39:55.352725029 CEST	49539	445	192.168.2.22	15.117.122.2
Jun 7, 2024 20:39:55.357587099 CEST	445	49539	15.117.122.2	192.168.2.22
Jun 7, 2024 20:39:55.357677937 CEST	445	49539	15.117.122.2	192.168.2.22
Jun 7, 2024 20:39:55.501682997 CEST	49589	445	192.168.2.22	106.6.123.52
Jun 7, 2024 20:39:55.506844997 CEST	445	49589	106.6.123.52	192.168.2.22
Jun 7, 2024 20:39:55.506957054 CEST	49589	445	192.168.2.22	106.6.123.52
Jun 7, 2024 20:39:55.507019997 CEST	49589	445	192.168.2.22	106.6.123.52
Jun 7, 2024 20:39:55.507210970 CEST	49590	445	192.168.2.22	106.6.123.1
Jun 7, 2024 20:39:55.512155056 CEST	445	49590	106.6.123.1	192.168.2.22
Jun 7, 2024 20:39:55.512223005 CEST	49590	445	192.168.2.22	106.6.123.1
Jun 7, 2024 20:39:55.512257099 CEST	49590	445	192.168.2.22	106.6.123.1
Jun 7, 2024 20:39:55.512542963 CEST	445	49589	106.6.123.52	192.168.2.22
Jun 7, 2024 20:39:55.512613058 CEST	49589	445	192.168.2.22	106.6.123.52
Jun 7, 2024 20:39:55.512804985 CEST	49591	445	192.168.2.22	106.6.123.1
Jun 7, 2024 20:39:55.517391920 CEST	445	49590	106.6.123.1	192.168.2.22
Jun 7, 2024 20:39:55.517452955 CEST	49590	445	192.168.2.22	106.6.123.1
Jun 7, 2024 20:39:55.517700911 CEST	445	49591	106.6.123.1	192.168.2.22
Jun 7, 2024 20:39:55.517788887 CEST	49591	445	192.168.2.22	106.6.123.1
Jun 7, 2024 20:39:55.517829895 CEST	49591	445	192.168.2.22	106.6.123.1
Jun 7, 2024 20:39:55.522989035 CEST	445	49591	106.6.123.1	192.168.2.22
Jun 7, 2024 20:39:55.534538984 CEST	445	49542	20.33.198.1	192.168.2.22
Jun 7, 2024 20:39:55.534620047 CEST	49542	445	192.168.2.22	20.33.198.1
Jun 7, 2024 20:39:55.535437107 CEST	49542	445	192.168.2.22	20.33.198.1
Jun 7, 2024 20:39:55.535438061 CEST	49542	445	192.168.2.22	20.33.198.1
Jun 7, 2024 20:39:55.540323019 CEST	445	49542	20.33.198.1	192.168.2.22
Jun 7, 2024 20:39:55.540433884 CEST	445	49542	20.33.198.1	192.168.2.22
Jun 7, 2024 20:39:55.610167980 CEST	49592	445	192.168.2.22	153.124.214.1
Jun 7, 2024 20:39:55.615202904 CEST	445	49592	153.124.214.1	192.168.2.22
Jun 7, 2024 20:39:55.615444899 CEST	49592	445	192.168.2.22	153.124.214.1
Jun 7, 2024 20:39:55.615444899 CEST	49592	445	192.168.2.22	153.124.214.1
Jun 7, 2024 20:39:55.620398045 CEST	445	49592	153.124.214.1	192.168.2.22
Jun 7, 2024 20:39:55.963224888 CEST	445	49588	83.48.154.2	192.168.2.22
Jun 7, 2024 20:39:55.963299990 CEST	49588	445	192.168.2.22	83.48.154.2
Jun 7, 2024 20:39:55.963362932 CEST	49588	445	192.168.2.22	83.48.154.2
Jun 7, 2024 20:39:55.963402987 CEST	49588	445	192.168.2.22	83.48.154.2
Jun 7, 2024 20:39:55.968380928 CEST	445	49588	83.48.154.2	192.168.2.22
Jun 7, 2024 20:39:55.968395948 CEST	445	49588	83.48.154.2	192.168.2.22
Jun 7, 2024 20:39:56.265527964 CEST	49593	445	192.168.2.22	51.252.175.227
Jun 7, 2024 20:39:56.270550013 CEST	445	49593	51.252.175.227	192.168.2.22
Jun 7, 2024 20:39:56.270735025 CEST	49593	445	192.168.2.22	51.252.175.227
Jun 7, 2024 20:39:56.270777941 CEST	49593	445	192.168.2.22	51.252.175.227
Jun 7, 2024 20:39:56.270881891 CEST	49594	445	192.168.2.22	51.252.175.1
Jun 7, 2024 20:39:56.275738955 CEST	445	49594	51.252.175.1	192.168.2.22
Jun 7, 2024 20:39:56.275789022 CEST	49594	445	192.168.2.22	51.252.175.1
Jun 7, 2024 20:39:56.275886059 CEST	49594	445	192.168.2.22	51.252.175.1
Jun 7, 2024 20:39:56.275907993 CEST	445	49593	51.252.175.227	192.168.2.22
Jun 7, 2024 20:39:56.275964022 CEST	49593	445	192.168.2.22	51.252.175.227
Jun 7, 2024 20:39:56.276230097 CEST	49595	445	192.168.2.22	51.252.175.1
Jun 7, 2024 20:39:56.280985117 CEST	445	49594	51.252.175.1	192.168.2.22
Jun 7, 2024 20:39:56.281126976 CEST	49594	445	192.168.2.22	51.252.175.1
Jun 7, 2024 20:39:56.281168938 CEST	445	49595	51.252.175.1	192.168.2.22
Jun 7, 2024 20:39:56.281259060 CEST	49595	445	192.168.2.22	51.252.175.1
Jun 7, 2024 20:39:56.281326056 CEST	49595	445	192.168.2.22	51.252.175.1
Jun 7, 2024 20:39:56.286108017 CEST	445	49595	51.252.175.1	192.168.2.22
Jun 7, 2024 20:39:56.311995029 CEST	49596	445	192.168.2.22	175.62.123.3
Jun 7, 2024 20:39:56.312077999 CEST	49597	445	192.168.2.22	21.115.191.2
Jun 7, 2024 20:39:56.316871881 CEST	445	49596	175.62.123.3	192.168.2.22
Jun 7, 2024 20:39:56.316936016 CEST	445	49597	21.115.191.2	192.168.2.22
Jun 7, 2024 20:39:56.316963911 CEST	49596	445	192.168.2.22	175.62.123.3
Jun 7, 2024 20:39:56.317029953 CEST	49597	445	192.168.2.22	21.115.191.2
Jun 7, 2024 20:39:56.317085981 CEST	49596	445	192.168.2.22	175.62.123.3
Jun 7, 2024 20:39:56.317169905 CEST	49597	445	192.168.2.22	21.115.191.2
Jun 7, 2024 20:39:56.321896076 CEST	445	49596	175.62.123.3	192.168.2.22
Jun 7, 2024 20:39:56.322040081 CEST	445	49597	21.115.191.2	192.168.2.22
Jun 7, 2024 20:39:56.787944078 CEST	445	49543	8.113.72.2	192.168.2.22
Jun 7, 2024 20:39:56.788182974 CEST	49543	445	192.168.2.22	8.113.72.2
Jun 7, 2024 20:39:56.788281918 CEST	49543	445	192.168.2.22	8.113.72.2
Jun 7, 2024 20:39:56.788283110 CEST	49543	445	192.168.2.22	8.113.72.2
Jun 7, 2024 20:39:56.793212891 CEST	445	49543	8.113.72.2	192.168.2.22
Jun 7, 2024 20:39:56.793224096 CEST	445	49543	8.113.72.2	192.168.2.22
Jun 7, 2024 20:39:56.821808100 CEST	445	49544	149.41.53.1	192.168.2.22
Jun 7, 2024 20:39:56.821971893 CEST	49544	445	192.168.2.22	149.41.53.1
Jun 7, 2024 20:39:56.822046041 CEST	49544	445	192.168.2.22	149.41.53.1
Jun 7, 2024 20:39:56.822099924 CEST	49544	445	192.168.2.22	149.41.53.1
Jun 7, 2024 20:39:56.826929092 CEST	445	49544	149.41.53.1	192.168.2.22
Jun 7, 2024 20:39:56.826950073 CEST	445	49544	149.41.53.1	192.168.2.22
Jun 7, 2024 20:39:56.842770100 CEST	49598	445	192.168.2.22	8.113.72.3
Jun 7, 2024 20:39:56.847631931 CEST	445	49598	8.113.72.3	192.168.2.22
Jun 7, 2024 20:39:56.847733974 CEST	49598	445	192.168.2.22	8.113.72.3
Jun 7, 2024 20:39:56.847789049 CEST	49598	445	192.168.2.22	8.113.72.3
Jun 7, 2024 20:39:56.848428011 CEST	49599	445	192.168.2.22	8.113.72.3
Jun 7, 2024 20:39:56.853074074 CEST	445	49598	8.113.72.3	192.168.2.22
Jun 7, 2024 20:39:56.853164911 CEST	49598	445	192.168.2.22	8.113.72.3
Jun 7, 2024 20:39:56.853324890 CEST	445	49599	8.113.72.3	192.168.2.22
Jun 7, 2024 20:39:56.853404045 CEST	49599	445	192.168.2.22	8.113.72.3
Jun 7, 2024 20:39:56.853467941 CEST	49599	445	192.168.2.22	8.113.72.3
Jun 7, 2024 20:39:56.858514071 CEST	445	49599	8.113.72.3	192.168.2.22
Jun 7, 2024 20:39:56.864183903 CEST	445	49547	18.149.154.1	192.168.2.22
Jun 7, 2024 20:39:56.864285946 CEST	49547	445	192.168.2.22	18.149.154.1
Jun 7, 2024 20:39:56.864367008 CEST	49547	445	192.168.2.22	18.149.154.1
Jun 7, 2024 20:39:56.864453077 CEST	49547	445	192.168.2.22	18.149.154.1
Jun 7, 2024 20:39:56.869259119 CEST	445	49547	18.149.154.1	192.168.2.22
Jun 7, 2024 20:39:56.869280100 CEST	445	49547	18.149.154.1	192.168.2.22
Jun 7, 2024 20:39:56.873604059 CEST	49600	445	192.168.2.22	149.41.53.2
Jun 7, 2024 20:39:56.878479004 CEST	445	49600	149.41.53.2	192.168.2.22
Jun 7, 2024 20:39:56.878556967 CEST	49600	445	192.168.2.22	149.41.53.2
Jun 7, 2024 20:39:56.878638029 CEST	49600	445	192.168.2.22	149.41.53.2
Jun 7, 2024 20:39:56.879508018 CEST	49601	445	192.168.2.22	149.41.53.2
Jun 7, 2024 20:39:56.884032011 CEST	445	49600	149.41.53.2	192.168.2.22
Jun 7, 2024 20:39:56.884121895 CEST	49600	445	192.168.2.22	149.41.53.2
Jun 7, 2024 20:39:56.884442091 CEST	445	49601	149.41.53.2	192.168.2.22
Jun 7, 2024 20:39:56.884536028 CEST	49601	445	192.168.2.22	149.41.53.2
Jun 7, 2024 20:39:56.884579897 CEST	49601	445	192.168.2.22	149.41.53.2
Jun 7, 2024 20:39:56.889446974 CEST	445	49601	149.41.53.2	192.168.2.22
Jun 7, 2024 20:39:57.123150110 CEST	49603	445	192.168.2.22	45.139.167.1
Jun 7, 2024 20:39:57.128153086 CEST	445	49603	45.139.167.1	192.168.2.22
Jun 7, 2024 20:39:57.128216028 CEST	49603	445	192.168.2.22	45.139.167.1
Jun 7, 2024 20:39:57.128298998 CEST	49603	445	192.168.2.22	45.139.167.1
Jun 7, 2024 20:39:57.133744001 CEST	445	49603	45.139.167.1	192.168.2.22
Jun 7, 2024 20:39:57.284921885 CEST	445	49549	170.101.108.3	192.168.2.22
Jun 7, 2024 20:39:57.285032988 CEST	49549	445	192.168.2.22	170.101.108.3
Jun 7, 2024 20:39:57.285033941 CEST	49549	445	192.168.2.22	170.101.108.3
Jun 7, 2024 20:39:57.285151005 CEST	49549	445	192.168.2.22	170.101.108.3
Jun 7, 2024 20:39:57.290433884 CEST	445	49549	170.101.108.3	192.168.2.22
Jun 7, 2024 20:39:57.290445089 CEST	445	49549	170.101.108.3	192.168.2.22
Jun 7, 2024 20:39:57.311511040 CEST	445	49551	90.170.69.2	192.168.2.22
Jun 7, 2024 20:39:57.311597109 CEST	49551	445	192.168.2.22	90.170.69.2
Jun 7, 2024 20:39:57.311644077 CEST	49551	445	192.168.2.22	90.170.69.2
Jun 7, 2024 20:39:57.311697960 CEST	49551	445	192.168.2.22	90.170.69.2
Jun 7, 2024 20:39:57.316817045 CEST	445	49551	90.170.69.2	192.168.2.22
Jun 7, 2024 20:39:57.316852093 CEST	445	49551	90.170.69.2	192.168.2.22
Jun 7, 2024 20:39:57.388549089 CEST	49604	445	192.168.2.22	181.39.243.1
Jun 7, 2024 20:39:57.393503904 CEST	445	49604	181.39.243.1	192.168.2.22
Jun 7, 2024 20:39:57.393606901 CEST	49604	445	192.168.2.22	181.39.243.1
Jun 7, 2024 20:39:57.393672943 CEST	49604	445	192.168.2.22	181.39.243.1
Jun 7, 2024 20:39:57.398624897 CEST	445	49604	181.39.243.1	192.168.2.22
Jun 7, 2024 20:39:57.967991114 CEST	445	49604	181.39.243.1	192.168.2.22
Jun 7, 2024 20:39:57.968115091 CEST	49604	445	192.168.2.22	181.39.243.1
Jun 7, 2024 20:39:57.968115091 CEST	49604	445	192.168.2.22	181.39.243.1
Jun 7, 2024 20:39:57.968218088 CEST	49604	445	192.168.2.22	181.39.243.1
Jun 7, 2024 20:39:57.973121881 CEST	445	49604	181.39.243.1	192.168.2.22
Jun 7, 2024 20:39:57.973135948 CEST	445	49604	181.39.243.1	192.168.2.22
Jun 7, 2024 20:39:58.027972937 CEST	49606	445	192.168.2.22	181.39.243.2
Jun 7, 2024 20:39:58.032903910 CEST	445	49606	181.39.243.2	192.168.2.22
Jun 7, 2024 20:39:58.033103943 CEST	49606	445	192.168.2.22	181.39.243.2
Jun 7, 2024 20:39:58.033202887 CEST	49606	445	192.168.2.22	181.39.243.2
Jun 7, 2024 20:39:58.033731937 CEST	49607	445	192.168.2.22	181.39.243.2
Jun 7, 2024 20:39:58.038618088 CEST	445	49607	181.39.243.2	192.168.2.22
Jun 7, 2024 20:39:58.038876057 CEST	445	49606	181.39.243.2	192.168.2.22
Jun 7, 2024 20:39:58.038942099 CEST	49607	445	192.168.2.22	181.39.243.2
Jun 7, 2024 20:39:58.038995028 CEST	49606	445	192.168.2.22	181.39.243.2
Jun 7, 2024 20:39:58.039072990 CEST	49607	445	192.168.2.22	181.39.243.2
Jun 7, 2024 20:39:58.043862104 CEST	445	49607	181.39.243.2	192.168.2.22
Jun 7, 2024 20:39:58.111174107 CEST	445	49554	175.20.89.1	192.168.2.22
Jun 7, 2024 20:39:58.111538887 CEST	49554	445	192.168.2.22	175.20.89.1
Jun 7, 2024 20:39:58.111634016 CEST	49554	445	192.168.2.22	175.20.89.1
Jun 7, 2024 20:39:58.111673117 CEST	49554	445	192.168.2.22	175.20.89.1
Jun 7, 2024 20:39:58.116460085 CEST	445	49554	175.20.89.1	192.168.2.22
Jun 7, 2024 20:39:58.116520882 CEST	445	49554	175.20.89.1	192.168.2.22
Jun 7, 2024 20:39:58.262291908 CEST	49609	445	192.168.2.22	7.168.109.3
Jun 7, 2024 20:39:58.267287970 CEST	445	49609	7.168.109.3	192.168.2.22
Jun 7, 2024 20:39:58.267416954 CEST	49609	445	192.168.2.22	7.168.109.3
Jun 7, 2024 20:39:58.267479897 CEST	49609	445	192.168.2.22	7.168.109.3
Jun 7, 2024 20:39:58.272316933 CEST	445	49609	7.168.109.3	192.168.2.22
Jun 7, 2024 20:39:58.356261969 CEST	49611	445	192.168.2.22	15.117.122.2
Jun 7, 2024 20:39:58.361187935 CEST	445	49611	15.117.122.2	192.168.2.22
Jun 7, 2024 20:39:58.361293077 CEST	49611	445	192.168.2.22	15.117.122.2
Jun 7, 2024 20:39:58.361355066 CEST	49611	445	192.168.2.22	15.117.122.2
Jun 7, 2024 20:39:58.366255045 CEST	445	49611	15.117.122.2	192.168.2.22
Jun 7, 2024 20:39:58.542999029 CEST	49612	445	192.168.2.22	20.33.198.1
Jun 7, 2024 20:39:58.547979116 CEST	445	49612	20.33.198.1	192.168.2.22
Jun 7, 2024 20:39:58.548120975 CEST	49612	445	192.168.2.22	20.33.198.1
Jun 7, 2024 20:39:58.548185110 CEST	49612	445	192.168.2.22	20.33.198.1
Jun 7, 2024 20:39:58.552966118 CEST	445	49612	20.33.198.1	192.168.2.22
Jun 7, 2024 20:39:58.784904957 CEST	445	49555	196.164.18.2	192.168.2.22
Jun 7, 2024 20:39:58.785104990 CEST	49555	445	192.168.2.22	196.164.18.2
Jun 7, 2024 20:39:58.785193920 CEST	49555	445	192.168.2.22	196.164.18.2
Jun 7, 2024 20:39:58.785306931 CEST	49555	445	192.168.2.22	196.164.18.2
Jun 7, 2024 20:39:58.790052891 CEST	445	49555	196.164.18.2	192.168.2.22
Jun 7, 2024 20:39:58.790081978 CEST	445	49555	196.164.18.2	192.168.2.22
Jun 7, 2024 20:39:58.837481022 CEST	445	49556	148.204.151.1	192.168.2.22
Jun 7, 2024 20:39:58.837758064 CEST	49556	445	192.168.2.22	148.204.151.1
Jun 7, 2024 20:39:58.837848902 CEST	49556	445	192.168.2.22	148.204.151.1
Jun 7, 2024 20:39:58.837970018 CEST	49556	445	192.168.2.22	148.204.151.1
Jun 7, 2024 20:39:58.839401960 CEST	49614	445	192.168.2.22	196.164.18.3
Jun 7, 2024 20:39:58.842643976 CEST	445	49556	148.204.151.1	192.168.2.22
Jun 7, 2024 20:39:58.842750072 CEST	445	49556	148.204.151.1	192.168.2.22
Jun 7, 2024 20:39:58.844265938 CEST	445	49614	196.164.18.3	192.168.2.22
Jun 7, 2024 20:39:58.844376087 CEST	49614	445	192.168.2.22	196.164.18.3
Jun 7, 2024 20:39:58.844417095 CEST	49614	445	192.168.2.22	196.164.18.3
Jun 7, 2024 20:39:58.845153093 CEST	49615	445	192.168.2.22	196.164.18.3
Jun 7, 2024 20:39:58.849468946 CEST	445	49614	196.164.18.3	192.168.2.22
Jun 7, 2024 20:39:58.849529028 CEST	49614	445	192.168.2.22	196.164.18.3
Jun 7, 2024 20:39:58.849989891 CEST	445	49615	196.164.18.3	192.168.2.22
Jun 7, 2024 20:39:58.850037098 CEST	49615	445	192.168.2.22	196.164.18.3
Jun 7, 2024 20:39:58.850070000 CEST	49615	445	192.168.2.22	196.164.18.3
Jun 7, 2024 20:39:58.854908943 CEST	445	49615	196.164.18.3	192.168.2.22
Jun 7, 2024 20:39:58.886065960 CEST	49617	445	192.168.2.22	148.204.151.2
Jun 7, 2024 20:39:58.890930891 CEST	445	49617	148.204.151.2	192.168.2.22
Jun 7, 2024 20:39:58.890997887 CEST	49617	445	192.168.2.22	148.204.151.2
Jun 7, 2024 20:39:58.891103029 CEST	49617	445	192.168.2.22	148.204.151.2
Jun 7, 2024 20:39:58.891541004 CEST	49618	445	192.168.2.22	148.204.151.2
Jun 7, 2024 20:39:58.896312952 CEST	445	49617	148.204.151.2	192.168.2.22
Jun 7, 2024 20:39:58.896378040 CEST	445	49618	148.204.151.2	192.168.2.22
Jun 7, 2024 20:39:58.896378040 CEST	49617	445	192.168.2.22	148.204.151.2
Jun 7, 2024 20:39:58.896431923 CEST	49618	445	192.168.2.22	148.204.151.2
Jun 7, 2024 20:39:58.896473885 CEST	49618	445	192.168.2.22	148.204.151.2
Jun 7, 2024 20:39:58.901343107 CEST	445	49618	148.204.151.2	192.168.2.22
Jun 7, 2024 20:39:58.964250088 CEST	49619	445	192.168.2.22	83.48.154.2
Jun 7, 2024 20:39:58.969315052 CEST	445	49619	83.48.154.2	192.168.2.22
Jun 7, 2024 20:39:58.969383001 CEST	49619	445	192.168.2.22	83.48.154.2
Jun 7, 2024 20:39:58.969841003 CEST	49619	445	192.168.2.22	83.48.154.2
Jun 7, 2024 20:39:58.974680901 CEST	445	49619	83.48.154.2	192.168.2.22
Jun 7, 2024 20:39:59.247807026 CEST	445	49558	137.124.231.3	192.168.2.22
Jun 7, 2024 20:39:59.247912884 CEST	49558	445	192.168.2.22	137.124.231.3
Jun 7, 2024 20:39:59.248007059 CEST	49558	445	192.168.2.22	137.124.231.3
Jun 7, 2024 20:39:59.248029947 CEST	49558	445	192.168.2.22	137.124.231.3
Jun 7, 2024 20:39:59.252935886 CEST	445	49558	137.124.231.3	192.168.2.22
Jun 7, 2024 20:39:59.252949953 CEST	445	49558	137.124.231.3	192.168.2.22
Jun 7, 2024 20:39:59.261574030 CEST	445	49561	202.29.104.1	192.168.2.22
Jun 7, 2024 20:39:59.261637926 CEST	49561	445	192.168.2.22	202.29.104.1
Jun 7, 2024 20:39:59.261748075 CEST	49561	445	192.168.2.22	202.29.104.1
Jun 7, 2024 20:39:59.261748075 CEST	49561	445	192.168.2.22	202.29.104.1
Jun 7, 2024 20:39:59.266594887 CEST	445	49561	202.29.104.1	192.168.2.22
Jun 7, 2024 20:39:59.266608000 CEST	445	49561	202.29.104.1	192.168.2.22
Jun 7, 2024 20:39:59.351008892 CEST	445	49563	102.226.231.2	192.168.2.22
Jun 7, 2024 20:39:59.351078987 CEST	49563	445	192.168.2.22	102.226.231.2
Jun 7, 2024 20:39:59.351145983 CEST	49563	445	192.168.2.22	102.226.231.2
Jun 7, 2024 20:39:59.351250887 CEST	49563	445	192.168.2.22	102.226.231.2
Jun 7, 2024 20:39:59.356057882 CEST	445	49563	102.226.231.2	192.168.2.22
Jun 7, 2024 20:39:59.356084108 CEST	445	49563	102.226.231.2	192.168.2.22
Jun 7, 2024 20:39:59.619308949 CEST	445	49619	83.48.154.2	192.168.2.22
Jun 7, 2024 20:39:59.619446993 CEST	49619	445	192.168.2.22	83.48.154.2
Jun 7, 2024 20:39:59.619447947 CEST	49619	445	192.168.2.22	83.48.154.2
Jun 7, 2024 20:39:59.619539022 CEST	49619	445	192.168.2.22	83.48.154.2
Jun 7, 2024 20:39:59.624443054 CEST	445	49619	83.48.154.2	192.168.2.22
Jun 7, 2024 20:39:59.624500990 CEST	445	49619	83.48.154.2	192.168.2.22
Jun 7, 2024 20:39:59.681694984 CEST	49623	445	192.168.2.22	83.48.154.3
Jun 7, 2024 20:39:59.686705112 CEST	445	49623	83.48.154.3	192.168.2.22
Jun 7, 2024 20:39:59.686790943 CEST	49623	445	192.168.2.22	83.48.154.3
Jun 7, 2024 20:39:59.686863899 CEST	49623	445	192.168.2.22	83.48.154.3
Jun 7, 2024 20:39:59.687175035 CEST	49624	445	192.168.2.22	83.48.154.3
Jun 7, 2024 20:39:59.692033052 CEST	445	49624	83.48.154.3	192.168.2.22
Jun 7, 2024 20:39:59.692127943 CEST	49624	445	192.168.2.22	83.48.154.3
Jun 7, 2024 20:39:59.692162037 CEST	49624	445	192.168.2.22	83.48.154.3
Jun 7, 2024 20:39:59.692261934 CEST	445	49623	83.48.154.3	192.168.2.22
Jun 7, 2024 20:39:59.692441940 CEST	49623	445	192.168.2.22	83.48.154.3
Jun 7, 2024 20:39:59.696958065 CEST	445	49624	83.48.154.3	192.168.2.22
Jun 7, 2024 20:39:59.868925095 CEST	49625	445	192.168.2.22	18.149.154.1
Jun 7, 2024 20:39:59.874023914 CEST	445	49625	18.149.154.1	192.168.2.22
Jun 7, 2024 20:39:59.874226093 CEST	49625	445	192.168.2.22	18.149.154.1
Jun 7, 2024 20:39:59.874273062 CEST	49625	445	192.168.2.22	18.149.154.1
Jun 7, 2024 20:39:59.879170895 CEST	445	49625	18.149.154.1	192.168.2.22
Jun 7, 2024 20:40:00.290010929 CEST	49629	445	192.168.2.22	170.101.108.3
Jun 7, 2024 20:40:00.310868025 CEST	445	49629	170.101.108.3	192.168.2.22
Jun 7, 2024 20:40:00.310981035 CEST	49629	445	192.168.2.22	170.101.108.3
Jun 7, 2024 20:40:00.311063051 CEST	49629	445	192.168.2.22	170.101.108.3
Jun 7, 2024 20:40:00.315907955 CEST	445	49629	170.101.108.3	192.168.2.22
Jun 7, 2024 20:40:00.321229935 CEST	49630	445	192.168.2.22	90.170.69.2
Jun 7, 2024 20:40:00.326172113 CEST	445	49630	90.170.69.2	192.168.2.22
Jun 7, 2024 20:40:00.326231956 CEST	49630	445	192.168.2.22	90.170.69.2
Jun 7, 2024 20:40:00.326266050 CEST	49630	445	192.168.2.22	90.170.69.2
Jun 7, 2024 20:40:00.331127882 CEST	445	49630	90.170.69.2	192.168.2.22
Jun 7, 2024 20:40:00.347121954 CEST	445	49566	20.138.183.1	192.168.2.22
Jun 7, 2024 20:40:00.347225904 CEST	49566	445	192.168.2.22	20.138.183.1
Jun 7, 2024 20:40:00.347584009 CEST	49566	445	192.168.2.22	20.138.183.1
Jun 7, 2024 20:40:00.347628117 CEST	49566	445	192.168.2.22	20.138.183.1
Jun 7, 2024 20:40:00.352478981 CEST	445	49566	20.138.183.1	192.168.2.22
Jun 7, 2024 20:40:00.352523088 CEST	445	49566	20.138.183.1	192.168.2.22
Jun 7, 2024 20:40:00.707959890 CEST	445	49567	54.92.197.1	192.168.2.22
Jun 7, 2024 20:40:00.708049059 CEST	49567	445	192.168.2.22	54.92.197.1
Jun 7, 2024 20:40:00.708146095 CEST	49567	445	192.168.2.22	54.92.197.1
Jun 7, 2024 20:40:00.708147049 CEST	49567	445	192.168.2.22	54.92.197.1
Jun 7, 2024 20:40:00.713107109 CEST	445	49567	54.92.197.1	192.168.2.22
Jun 7, 2024 20:40:00.713149071 CEST	445	49567	54.92.197.1	192.168.2.22
Jun 7, 2024 20:40:00.758202076 CEST	49635	445	192.168.2.22	54.92.197.2
Jun 7, 2024 20:40:00.763138056 CEST	445	49635	54.92.197.2	192.168.2.22
Jun 7, 2024 20:40:00.763230085 CEST	49635	445	192.168.2.22	54.92.197.2
Jun 7, 2024 20:40:00.763641119 CEST	49635	445	192.168.2.22	54.92.197.2
Jun 7, 2024 20:40:00.764019012 CEST	49636	445	192.168.2.22	54.92.197.2
Jun 7, 2024 20:40:00.768619061 CEST	445	49635	54.92.197.2	192.168.2.22
Jun 7, 2024 20:40:00.768727064 CEST	49635	445	192.168.2.22	54.92.197.2
Jun 7, 2024 20:40:00.768861055 CEST	445	49636	54.92.197.2	192.168.2.22
Jun 7, 2024 20:40:00.768948078 CEST	49636	445	192.168.2.22	54.92.197.2
Jun 7, 2024 20:40:00.769068956 CEST	49636	445	192.168.2.22	54.92.197.2
Jun 7, 2024 20:40:00.773861885 CEST	445	49636	54.92.197.2	192.168.2.22
Jun 7, 2024 20:40:00.789895058 CEST	445	49568	202.195.174.2	192.168.2.22
Jun 7, 2024 20:40:00.790038109 CEST	49568	445	192.168.2.22	202.195.174.2
Jun 7, 2024 20:40:00.790186882 CEST	49568	445	192.168.2.22	202.195.174.2
Jun 7, 2024 20:40:00.790273905 CEST	49568	445	192.168.2.22	202.195.174.2
Jun 7, 2024 20:40:00.795023918 CEST	445	49568	202.195.174.2	192.168.2.22
Jun 7, 2024 20:40:00.795150042 CEST	445	49568	202.195.174.2	192.168.2.22
Jun 7, 2024 20:40:00.851870060 CEST	49637	445	192.168.2.22	202.195.174.3
Jun 7, 2024 20:40:00.856785059 CEST	445	49637	202.195.174.3	192.168.2.22
Jun 7, 2024 20:40:00.856885910 CEST	49637	445	192.168.2.22	202.195.174.3
Jun 7, 2024 20:40:00.856981993 CEST	49637	445	192.168.2.22	202.195.174.3
Jun 7, 2024 20:40:00.857434988 CEST	49639	445	192.168.2.22	202.195.174.3
Jun 7, 2024 20:40:00.862174988 CEST	445	49637	202.195.174.3	192.168.2.22
Jun 7, 2024 20:40:00.862267017 CEST	49637	445	192.168.2.22	202.195.174.3
Jun 7, 2024 20:40:00.862320900 CEST	445	49639	202.195.174.3	192.168.2.22
Jun 7, 2024 20:40:00.862401962 CEST	49639	445	192.168.2.22	202.195.174.3
Jun 7, 2024 20:40:00.862454891 CEST	49639	445	192.168.2.22	202.195.174.3
Jun 7, 2024 20:40:00.867280006 CEST	445	49639	202.195.174.3	192.168.2.22
Jun 7, 2024 20:40:01.116835117 CEST	49642	445	192.168.2.22	175.20.89.1
Jun 7, 2024 20:40:01.121917009 CEST	445	49642	175.20.89.1	192.168.2.22
Jun 7, 2024 20:40:01.122023106 CEST	49642	445	192.168.2.22	175.20.89.1
Jun 7, 2024 20:40:01.122060061 CEST	49642	445	192.168.2.22	175.20.89.1
Jun 7, 2024 20:40:01.126921892 CEST	445	49642	175.20.89.1	192.168.2.22
Jun 7, 2024 20:40:01.370543003 CEST	445	49571	8.137.78.1	192.168.2.22
Jun 7, 2024 20:40:01.370712042 CEST	49571	445	192.168.2.22	8.137.78.1
Jun 7, 2024 20:40:01.370848894 CEST	49571	445	192.168.2.22	8.137.78.1
Jun 7, 2024 20:40:01.370923042 CEST	49571	445	192.168.2.22	8.137.78.1
Jun 7, 2024 20:40:01.374982119 CEST	445	49573	23.35.183.2	192.168.2.22
Jun 7, 2024 20:40:01.375082970 CEST	49573	445	192.168.2.22	23.35.183.2
Jun 7, 2024 20:40:01.375626087 CEST	445	49571	8.137.78.1	192.168.2.22
Jun 7, 2024 20:40:01.375745058 CEST	445	49571	8.137.78.1	192.168.2.22
Jun 7, 2024 20:40:01.386064053 CEST	49573	445	192.168.2.22	23.35.183.2
Jun 7, 2024 20:40:01.386107922 CEST	49573	445	192.168.2.22	23.35.183.2
Jun 7, 2024 20:40:01.390938044 CEST	445	49573	23.35.183.2	192.168.2.22
Jun 7, 2024 20:40:01.390989065 CEST	445	49573	23.35.183.2	192.168.2.22
Jun 7, 2024 20:40:01.456058025 CEST	445	49575	145.5.191.3	192.168.2.22
Jun 7, 2024 20:40:01.456152916 CEST	49575	445	192.168.2.22	145.5.191.3
Jun 7, 2024 20:40:01.456217051 CEST	49575	445	192.168.2.22	145.5.191.3
Jun 7, 2024 20:40:01.456271887 CEST	49575	445	192.168.2.22	145.5.191.3
Jun 7, 2024 20:40:01.461159945 CEST	445	49575	145.5.191.3	192.168.2.22
Jun 7, 2024 20:40:01.461209059 CEST	445	49575	145.5.191.3	192.168.2.22
Jun 7, 2024 20:40:02.255592108 CEST	49655	445	192.168.2.22	137.124.231.3
Jun 7, 2024 20:40:02.260611057 CEST	445	49655	137.124.231.3	192.168.2.22
Jun 7, 2024 20:40:02.260710955 CEST	49655	445	192.168.2.22	137.124.231.3
Jun 7, 2024 20:40:02.260752916 CEST	49655	445	192.168.2.22	137.124.231.3
Jun 7, 2024 20:40:02.265594959 CEST	445	49655	137.124.231.3	192.168.2.22
Jun 7, 2024 20:40:02.271306992 CEST	49656	445	192.168.2.22	202.29.104.1
Jun 7, 2024 20:40:02.276350975 CEST	445	49656	202.29.104.1	192.168.2.22
Jun 7, 2024 20:40:02.276446104 CEST	49656	445	192.168.2.22	202.29.104.1
Jun 7, 2024 20:40:02.276495934 CEST	49656	445	192.168.2.22	202.29.104.1
Jun 7, 2024 20:40:02.281389952 CEST	445	49656	202.29.104.1	192.168.2.22
Jun 7, 2024 20:40:02.349170923 CEST	49657	445	192.168.2.22	102.226.231.2
Jun 7, 2024 20:40:02.354192972 CEST	445	49657	102.226.231.2	192.168.2.22
Jun 7, 2024 20:40:02.354299068 CEST	49657	445	192.168.2.22	102.226.231.2
Jun 7, 2024 20:40:02.354374886 CEST	49657	445	192.168.2.22	102.226.231.2
Jun 7, 2024 20:40:02.359193087 CEST	445	49657	102.226.231.2	192.168.2.22
Jun 7, 2024 20:40:02.465837955 CEST	445	49579	39.128.101.1	192.168.2.22
Jun 7, 2024 20:40:02.465962887 CEST	49579	445	192.168.2.22	39.128.101.1
Jun 7, 2024 20:40:02.466068983 CEST	49579	445	192.168.2.22	39.128.101.1
Jun 7, 2024 20:40:02.466068983 CEST	49579	445	192.168.2.22	39.128.101.1
Jun 7, 2024 20:40:02.470932961 CEST	445	49579	39.128.101.1	192.168.2.22
Jun 7, 2024 20:40:02.470954895 CEST	445	49579	39.128.101.1	192.168.2.22
Jun 7, 2024 20:40:02.520837069 CEST	49660	445	192.168.2.22	39.128.101.2
Jun 7, 2024 20:40:02.525767088 CEST	445	49660	39.128.101.2	192.168.2.22
Jun 7, 2024 20:40:02.525841951 CEST	49660	445	192.168.2.22	39.128.101.2
Jun 7, 2024 20:40:02.525888920 CEST	49660	445	192.168.2.22	39.128.101.2
Jun 7, 2024 20:40:02.526189089 CEST	49661	445	192.168.2.22	39.128.101.2
Jun 7, 2024 20:40:02.531079054 CEST	445	49661	39.128.101.2	192.168.2.22
Jun 7, 2024 20:40:02.531141043 CEST	49661	445	192.168.2.22	39.128.101.2
Jun 7, 2024 20:40:02.531172037 CEST	49661	445	192.168.2.22	39.128.101.2
Jun 7, 2024 20:40:02.531409979 CEST	445	49660	39.128.101.2	192.168.2.22
Jun 7, 2024 20:40:02.531467915 CEST	49660	445	192.168.2.22	39.128.101.2
Jun 7, 2024 20:40:02.536034107 CEST	445	49661	39.128.101.2	192.168.2.22
Jun 7, 2024 20:40:03.188045979 CEST	445	49582	103.27.230.1	192.168.2.22
Jun 7, 2024 20:40:03.188160896 CEST	49582	445	192.168.2.22	103.27.230.1
Jun 7, 2024 20:40:03.220793962 CEST	49582	445	192.168.2.22	103.27.230.1
Jun 7, 2024 20:40:03.220827103 CEST	49582	445	192.168.2.22	103.27.230.1
Jun 7, 2024 20:40:03.225723028 CEST	445	49582	103.27.230.1	192.168.2.22
Jun 7, 2024 20:40:03.225750923 CEST	445	49582	103.27.230.1	192.168.2.22
Jun 7, 2024 20:40:03.347484112 CEST	49673	445	192.168.2.22	20.138.183.1
Jun 7, 2024 20:40:03.349752903 CEST	445	49584	159.156.112.3	192.168.2.22
Jun 7, 2024 20:40:03.349843979 CEST	49584	445	192.168.2.22	159.156.112.3
Jun 7, 2024 20:40:03.349936008 CEST	49584	445	192.168.2.22	159.156.112.3
Jun 7, 2024 20:40:03.349936008 CEST	49584	445	192.168.2.22	159.156.112.3
Jun 7, 2024 20:40:03.352422953 CEST	445	49673	20.138.183.1	192.168.2.22
Jun 7, 2024 20:40:03.352494955 CEST	49673	445	192.168.2.22	20.138.183.1
Jun 7, 2024 20:40:03.354804039 CEST	445	49584	159.156.112.3	192.168.2.22
Jun 7, 2024 20:40:03.354839087 CEST	445	49584	159.156.112.3	192.168.2.22
Jun 7, 2024 20:40:03.359756947 CEST	49673	445	192.168.2.22	20.138.183.1
Jun 7, 2024 20:40:03.364670992 CEST	445	49673	20.138.183.1	192.168.2.22
Jun 7, 2024 20:40:03.377008915 CEST	445	49586	144.146.120.3	192.168.2.22
Jun 7, 2024 20:40:03.377089024 CEST	49586	445	192.168.2.22	144.146.120.3
Jun 7, 2024 20:40:03.377198935 CEST	49586	445	192.168.2.22	144.146.120.3
Jun 7, 2024 20:40:03.377237082 CEST	49586	445	192.168.2.22	144.146.120.3
Jun 7, 2024 20:40:03.382138968 CEST	445	49586	144.146.120.3	192.168.2.22
Jun 7, 2024 20:40:03.382153034 CEST	445	49586	144.146.120.3	192.168.2.22
Jun 7, 2024 20:40:04.026912928 CEST	445	49591	106.6.123.1	192.168.2.22
Jun 7, 2024 20:40:04.027051926 CEST	49591	445	192.168.2.22	106.6.123.1
Jun 7, 2024 20:40:04.027139902 CEST	49591	445	192.168.2.22	106.6.123.1
Jun 7, 2024 20:40:04.027173996 CEST	49591	445	192.168.2.22	106.6.123.1
Jun 7, 2024 20:40:04.031979084 CEST	445	49591	106.6.123.1	192.168.2.22
Jun 7, 2024 20:40:04.032025099 CEST	445	49591	106.6.123.1	192.168.2.22
Jun 7, 2024 20:40:04.103111029 CEST	445	49592	153.124.214.1	192.168.2.22
Jun 7, 2024 20:40:04.103219032 CEST	49592	445	192.168.2.22	153.124.214.1
Jun 7, 2024 20:40:04.103313923 CEST	49592	445	192.168.2.22	153.124.214.1
Jun 7, 2024 20:40:04.103315115 CEST	49592	445	192.168.2.22	153.124.214.1
Jun 7, 2024 20:40:04.108237982 CEST	445	49592	153.124.214.1	192.168.2.22
Jun 7, 2024 20:40:04.108263969 CEST	445	49592	153.124.214.1	192.168.2.22
Jun 7, 2024 20:40:04.158886909 CEST	49686	445	192.168.2.22	153.124.214.2
Jun 7, 2024 20:40:04.163924932 CEST	445	49686	153.124.214.2	192.168.2.22
Jun 7, 2024 20:40:04.164000988 CEST	49686	445	192.168.2.22	153.124.214.2
Jun 7, 2024 20:40:04.164160013 CEST	49686	445	192.168.2.22	153.124.214.2
Jun 7, 2024 20:40:04.164633036 CEST	49687	445	192.168.2.22	153.124.214.2
Jun 7, 2024 20:40:04.169114113 CEST	445	49686	153.124.214.2	192.168.2.22
Jun 7, 2024 20:40:04.169176102 CEST	49686	445	192.168.2.22	153.124.214.2
Jun 7, 2024 20:40:04.169477940 CEST	445	49687	153.124.214.2	192.168.2.22
Jun 7, 2024 20:40:04.169531107 CEST	49687	445	192.168.2.22	153.124.214.2
Jun 7, 2024 20:40:04.169548035 CEST	49687	445	192.168.2.22	153.124.214.2
Jun 7, 2024 20:40:04.174865961 CEST	445	49687	153.124.214.2	192.168.2.22
Jun 7, 2024 20:40:04.377202034 CEST	49690	445	192.168.2.22	8.137.78.1
Jun 7, 2024 20:40:04.385294914 CEST	445	49690	8.137.78.1	192.168.2.22
Jun 7, 2024 20:40:04.385384083 CEST	49690	445	192.168.2.22	8.137.78.1
Jun 7, 2024 20:40:04.385401964 CEST	49690	445	192.168.2.22	8.137.78.1
Jun 7, 2024 20:40:04.390352011 CEST	445	49690	8.137.78.1	192.168.2.22
Jun 7, 2024 20:40:04.392699003 CEST	49692	445	192.168.2.22	23.35.183.2
Jun 7, 2024 20:40:04.397603989 CEST	445	49692	23.35.183.2	192.168.2.22
Jun 7, 2024 20:40:04.397660971 CEST	49692	445	192.168.2.22	23.35.183.2
Jun 7, 2024 20:40:04.397690058 CEST	49692	445	192.168.2.22	23.35.183.2
Jun 7, 2024 20:40:04.402590990 CEST	445	49692	23.35.183.2	192.168.2.22
Jun 7, 2024 20:40:04.455132961 CEST	49696	445	192.168.2.22	145.5.191.3
Jun 7, 2024 20:40:04.460119009 CEST	445	49696	145.5.191.3	192.168.2.22
Jun 7, 2024 20:40:04.460191965 CEST	49696	445	192.168.2.22	145.5.191.3
Jun 7, 2024 20:40:04.460670948 CEST	49696	445	192.168.2.22	145.5.191.3
Jun 7, 2024 20:40:04.465522051 CEST	445	49696	145.5.191.3	192.168.2.22
Jun 7, 2024 20:40:04.781783104 CEST	445	49595	51.252.175.1	192.168.2.22
Jun 7, 2024 20:40:04.781994104 CEST	49595	445	192.168.2.22	51.252.175.1
Jun 7, 2024 20:40:04.781994104 CEST	49595	445	192.168.2.22	51.252.175.1
Jun 7, 2024 20:40:04.781994104 CEST	49595	445	192.168.2.22	51.252.175.1
Jun 7, 2024 20:40:04.787204027 CEST	445	49595	51.252.175.1	192.168.2.22
Jun 7, 2024 20:40:04.787237883 CEST	445	49595	51.252.175.1	192.168.2.22
Jun 7, 2024 20:40:04.801635027 CEST	445	49597	21.115.191.2	192.168.2.22
Jun 7, 2024 20:40:04.801846981 CEST	49597	445	192.168.2.22	21.115.191.2
Jun 7, 2024 20:40:04.801920891 CEST	49597	445	192.168.2.22	21.115.191.2
Jun 7, 2024 20:40:04.801920891 CEST	49597	445	192.168.2.22	21.115.191.2
Jun 7, 2024 20:40:04.806787014 CEST	445	49597	21.115.191.2	192.168.2.22
Jun 7, 2024 20:40:04.806849957 CEST	445	49597	21.115.191.2	192.168.2.22
Jun 7, 2024 20:40:04.815572023 CEST	445	49596	175.62.123.3	192.168.2.22
Jun 7, 2024 20:40:04.815654993 CEST	49596	445	192.168.2.22	175.62.123.3
Jun 7, 2024 20:40:04.815654993 CEST	49596	445	192.168.2.22	175.62.123.3
Jun 7, 2024 20:40:04.815694094 CEST	49596	445	192.168.2.22	175.62.123.3
Jun 7, 2024 20:40:04.820661068 CEST	445	49596	175.62.123.3	192.168.2.22
Jun 7, 2024 20:40:04.820698977 CEST	445	49596	175.62.123.3	192.168.2.22
Jun 7, 2024 20:40:04.861002922 CEST	49704	445	192.168.2.22	21.115.191.3
Jun 7, 2024 20:40:04.866313934 CEST	445	49704	21.115.191.3	192.168.2.22
Jun 7, 2024 20:40:04.866405964 CEST	49704	445	192.168.2.22	21.115.191.3
Jun 7, 2024 20:40:04.866406918 CEST	49704	445	192.168.2.22	21.115.191.3
Jun 7, 2024 20:40:04.866731882 CEST	49706	445	192.168.2.22	21.115.191.3
Jun 7, 2024 20:40:04.871762991 CEST	445	49704	21.115.191.3	192.168.2.22
Jun 7, 2024 20:40:04.871778011 CEST	445	49706	21.115.191.3	192.168.2.22
Jun 7, 2024 20:40:04.871828079 CEST	49704	445	192.168.2.22	21.115.191.3
Jun 7, 2024 20:40:04.871846914 CEST	49706	445	192.168.2.22	21.115.191.3
Jun 7, 2024 20:40:04.871926069 CEST	49706	445	192.168.2.22	21.115.191.3
Jun 7, 2024 20:40:04.876307011 CEST	49707	445	192.168.2.22	175.62.123.4
Jun 7, 2024 20:40:04.876836061 CEST	445	49706	21.115.191.3	192.168.2.22
Jun 7, 2024 20:40:04.881231070 CEST	445	49707	175.62.123.4	192.168.2.22
Jun 7, 2024 20:40:04.881287098 CEST	49707	445	192.168.2.22	175.62.123.4
Jun 7, 2024 20:40:04.881330967 CEST	49707	445	192.168.2.22	175.62.123.4
Jun 7, 2024 20:40:04.881601095 CEST	49708	445	192.168.2.22	175.62.123.4
Jun 7, 2024 20:40:04.886420965 CEST	445	49707	175.62.123.4	192.168.2.22
Jun 7, 2024 20:40:04.886459112 CEST	445	49708	175.62.123.4	192.168.2.22
Jun 7, 2024 20:40:04.886476994 CEST	49707	445	192.168.2.22	175.62.123.4
Jun 7, 2024 20:40:04.886653900 CEST	49708	445	192.168.2.22	175.62.123.4
Jun 7, 2024 20:40:04.886653900 CEST	49708	445	192.168.2.22	175.62.123.4
Jun 7, 2024 20:40:04.892013073 CEST	445	49708	175.62.123.4	192.168.2.22
Jun 7, 2024 20:40:05.353713989 CEST	445	49599	8.113.72.3	192.168.2.22
Jun 7, 2024 20:40:05.353801012 CEST	49599	445	192.168.2.22	8.113.72.3
Jun 7, 2024 20:40:05.353847980 CEST	49599	445	192.168.2.22	8.113.72.3
Jun 7, 2024 20:40:05.353847980 CEST	49599	445	192.168.2.22	8.113.72.3
Jun 7, 2024 20:40:05.358747959 CEST	445	49599	8.113.72.3	192.168.2.22
Jun 7, 2024 20:40:05.358799934 CEST	445	49599	8.113.72.3	192.168.2.22
Jun 7, 2024 20:40:05.375056982 CEST	445	49601	149.41.53.2	192.168.2.22
Jun 7, 2024 20:40:05.375150919 CEST	49601	445	192.168.2.22	149.41.53.2
Jun 7, 2024 20:40:05.375152111 CEST	49601	445	192.168.2.22	149.41.53.2
Jun 7, 2024 20:40:05.375271082 CEST	49601	445	192.168.2.22	149.41.53.2
Jun 7, 2024 20:40:05.380125999 CEST	445	49601	149.41.53.2	192.168.2.22
Jun 7, 2024 20:40:05.380148888 CEST	445	49601	149.41.53.2	192.168.2.22
Jun 7, 2024 20:40:05.620183945 CEST	445	49603	45.139.167.1	192.168.2.22
Jun 7, 2024 20:40:05.620589018 CEST	49603	445	192.168.2.22	45.139.167.1
Jun 7, 2024 20:40:05.620589018 CEST	49603	445	192.168.2.22	45.139.167.1
Jun 7, 2024 20:40:05.620589018 CEST	49603	445	192.168.2.22	45.139.167.1
Jun 7, 2024 20:40:05.625509024 CEST	445	49603	45.139.167.1	192.168.2.22
Jun 7, 2024 20:40:05.625667095 CEST	445	49603	45.139.167.1	192.168.2.22
Jun 7, 2024 20:40:05.672048092 CEST	49729	445	192.168.2.22	45.139.167.2
Jun 7, 2024 20:40:05.676992893 CEST	445	49729	45.139.167.2	192.168.2.22
Jun 7, 2024 20:40:05.677078962 CEST	49729	445	192.168.2.22	45.139.167.2
Jun 7, 2024 20:40:05.677239895 CEST	49729	445	192.168.2.22	45.139.167.2
Jun 7, 2024 20:40:05.677524090 CEST	49730	445	192.168.2.22	45.139.167.2
Jun 7, 2024 20:40:05.682379961 CEST	445	49730	45.139.167.2	192.168.2.22
Jun 7, 2024 20:40:05.682410002 CEST	445	49729	45.139.167.2	192.168.2.22
Jun 7, 2024 20:40:05.682549953 CEST	49729	445	192.168.2.22	45.139.167.2
Jun 7, 2024 20:40:05.682595968 CEST	49730	445	192.168.2.22	45.139.167.2
Jun 7, 2024 20:40:05.682595968 CEST	49730	445	192.168.2.22	45.139.167.2
Jun 7, 2024 20:40:05.687541008 CEST	445	49730	45.139.167.2	192.168.2.22
Jun 7, 2024 20:40:06.218188047 CEST	49749	445	192.168.2.22	103.27.230.1
Jun 7, 2024 20:40:06.223134041 CEST	445	49749	103.27.230.1	192.168.2.22
Jun 7, 2024 20:40:06.223215103 CEST	49749	445	192.168.2.22	103.27.230.1
Jun 7, 2024 20:40:06.223262072 CEST	49749	445	192.168.2.22	103.27.230.1
Jun 7, 2024 20:40:06.228101015 CEST	445	49749	103.27.230.1	192.168.2.22
Jun 7, 2024 20:40:06.358664989 CEST	49753	445	192.168.2.22	159.156.112.3
Jun 7, 2024 20:40:06.363748074 CEST	445	49753	159.156.112.3	192.168.2.22
Jun 7, 2024 20:40:06.363818884 CEST	49753	445	192.168.2.22	159.156.112.3
Jun 7, 2024 20:40:06.363862991 CEST	49753	445	192.168.2.22	159.156.112.3
Jun 7, 2024 20:40:06.368694067 CEST	445	49753	159.156.112.3	192.168.2.22
Jun 7, 2024 20:40:06.373966932 CEST	49755	445	192.168.2.22	144.146.120.3
Jun 7, 2024 20:40:06.379231930 CEST	445	49755	144.146.120.3	192.168.2.22
Jun 7, 2024 20:40:06.379295111 CEST	49755	445	192.168.2.22	144.146.120.3
Jun 7, 2024 20:40:06.379343987 CEST	49755	445	192.168.2.22	144.146.120.3
Jun 7, 2024 20:40:06.384217024 CEST	445	49755	144.146.120.3	192.168.2.22
Jun 7, 2024 20:40:06.538177967 CEST	445	49607	181.39.243.2	192.168.2.22
Jun 7, 2024 20:40:06.538259983 CEST	49607	445	192.168.2.22	181.39.243.2
Jun 7, 2024 20:40:06.538355112 CEST	49607	445	192.168.2.22	181.39.243.2
Jun 7, 2024 20:40:06.538355112 CEST	49607	445	192.168.2.22	181.39.243.2
Jun 7, 2024 20:40:06.543246031 CEST	445	49607	181.39.243.2	192.168.2.22
Jun 7, 2024 20:40:06.543272972 CEST	445	49607	181.39.243.2	192.168.2.22
Jun 7, 2024 20:40:06.761455059 CEST	445	49609	7.168.109.3	192.168.2.22
Jun 7, 2024 20:40:06.761693954 CEST	49609	445	192.168.2.22	7.168.109.3
Jun 7, 2024 20:40:06.761694908 CEST	49609	445	192.168.2.22	7.168.109.3
Jun 7, 2024 20:40:06.761694908 CEST	49609	445	192.168.2.22	7.168.109.3
Jun 7, 2024 20:40:06.768903017 CEST	445	49609	7.168.109.3	192.168.2.22
Jun 7, 2024 20:40:06.769037008 CEST	445	49609	7.168.109.3	192.168.2.22
Jun 7, 2024 20:40:06.810868025 CEST	49773	445	192.168.2.22	7.168.109.4
Jun 7, 2024 20:40:06.815797091 CEST	445	49773	7.168.109.4	192.168.2.22
Jun 7, 2024 20:40:06.815865993 CEST	49773	445	192.168.2.22	7.168.109.4
Jun 7, 2024 20:40:06.815882921 CEST	49773	445	192.168.2.22	7.168.109.4
Jun 7, 2024 20:40:06.816207886 CEST	49774	445	192.168.2.22	7.168.109.4
Jun 7, 2024 20:40:06.821044922 CEST	445	49773	7.168.109.4	192.168.2.22
Jun 7, 2024 20:40:06.821065903 CEST	445	49774	7.168.109.4	192.168.2.22
Jun 7, 2024 20:40:06.821094036 CEST	49773	445	192.168.2.22	7.168.109.4
Jun 7, 2024 20:40:06.821113110 CEST	49774	445	192.168.2.22	7.168.109.4
Jun 7, 2024 20:40:06.821145058 CEST	49774	445	192.168.2.22	7.168.109.4
Jun 7, 2024 20:40:06.826106071 CEST	445	49774	7.168.109.4	192.168.2.22
Jun 7, 2024 20:40:06.853024006 CEST	445	49611	15.117.122.2	192.168.2.22
Jun 7, 2024 20:40:06.853121042 CEST	49611	445	192.168.2.22	15.117.122.2
Jun 7, 2024 20:40:06.856201887 CEST	49611	445	192.168.2.22	15.117.122.2
Jun 7, 2024 20:40:06.856235027 CEST	49611	445	192.168.2.22	15.117.122.2
Jun 7, 2024 20:40:06.861145973 CEST	445	49611	15.117.122.2	192.168.2.22
Jun 7, 2024 20:40:06.861171961 CEST	445	49611	15.117.122.2	192.168.2.22
Jun 7, 2024 20:40:06.904314041 CEST	49781	445	192.168.2.22	15.117.122.3
Jun 7, 2024 20:40:06.909729004 CEST	445	49781	15.117.122.3	192.168.2.22
Jun 7, 2024 20:40:06.909789085 CEST	49781	445	192.168.2.22	15.117.122.3
Jun 7, 2024 20:40:06.909811974 CEST	49781	445	192.168.2.22	15.117.122.3
Jun 7, 2024 20:40:06.910134077 CEST	49782	445	192.168.2.22	15.117.122.3
Jun 7, 2024 20:40:06.915290117 CEST	445	49782	15.117.122.3	192.168.2.22
Jun 7, 2024 20:40:06.915363073 CEST	49782	445	192.168.2.22	15.117.122.3
Jun 7, 2024 20:40:06.915374041 CEST	49782	445	192.168.2.22	15.117.122.3
Jun 7, 2024 20:40:06.915380955 CEST	445	49781	15.117.122.3	192.168.2.22
Jun 7, 2024 20:40:06.915429115 CEST	49781	445	192.168.2.22	15.117.122.3
Jun 7, 2024 20:40:06.920289993 CEST	445	49782	15.117.122.3	192.168.2.22
Jun 7, 2024 20:40:07.029606104 CEST	49787	445	192.168.2.22	106.6.123.1
Jun 7, 2024 20:40:07.034607887 CEST	445	49787	106.6.123.1	192.168.2.22
Jun 7, 2024 20:40:07.035003901 CEST	49787	445	192.168.2.22	106.6.123.1
Jun 7, 2024 20:40:07.035005093 CEST	49787	445	192.168.2.22	106.6.123.1
Jun 7, 2024 20:40:07.038070917 CEST	445	49612	20.33.198.1	192.168.2.22
Jun 7, 2024 20:40:07.038278103 CEST	49612	445	192.168.2.22	20.33.198.1
Jun 7, 2024 20:40:07.038279057 CEST	49612	445	192.168.2.22	20.33.198.1
Jun 7, 2024 20:40:07.038279057 CEST	49612	445	192.168.2.22	20.33.198.1
Jun 7, 2024 20:40:07.039958000 CEST	445	49787	106.6.123.1	192.168.2.22
Jun 7, 2024 20:40:07.043306112 CEST	445	49612	20.33.198.1	192.168.2.22
Jun 7, 2024 20:40:07.043344021 CEST	445	49612	20.33.198.1	192.168.2.22
Jun 7, 2024 20:40:07.091999054 CEST	49791	445	192.168.2.22	20.33.198.2
Jun 7, 2024 20:40:07.097157955 CEST	445	49791	20.33.198.2	192.168.2.22
Jun 7, 2024 20:40:07.097229958 CEST	49791	445	192.168.2.22	20.33.198.2
Jun 7, 2024 20:40:07.097271919 CEST	49791	445	192.168.2.22	20.33.198.2
Jun 7, 2024 20:40:07.097682953 CEST	49792	445	192.168.2.22	20.33.198.2
Jun 7, 2024 20:40:07.102582932 CEST	445	49792	20.33.198.2	192.168.2.22
Jun 7, 2024 20:40:07.102633953 CEST	49792	445	192.168.2.22	20.33.198.2
Jun 7, 2024 20:40:07.102677107 CEST	49792	445	192.168.2.22	20.33.198.2
Jun 7, 2024 20:40:07.104958057 CEST	445	49791	20.33.198.2	192.168.2.22
Jun 7, 2024 20:40:07.105015993 CEST	49791	445	192.168.2.22	20.33.198.2
Jun 7, 2024 20:40:07.107496977 CEST	445	49792	20.33.198.2	192.168.2.22
Jun 7, 2024 20:40:07.356165886 CEST	445	49615	196.164.18.3	192.168.2.22
Jun 7, 2024 20:40:07.356410027 CEST	49615	445	192.168.2.22	196.164.18.3
Jun 7, 2024 20:40:07.356575966 CEST	49615	445	192.168.2.22	196.164.18.3
Jun 7, 2024 20:40:07.356576920 CEST	49615	445	192.168.2.22	196.164.18.3
Jun 7, 2024 20:40:07.361458063 CEST	445	49615	196.164.18.3	192.168.2.22
Jun 7, 2024 20:40:07.361465931 CEST	445	49615	196.164.18.3	192.168.2.22
Jun 7, 2024 20:40:07.398747921 CEST	445	49618	148.204.151.2	192.168.2.22
Jun 7, 2024 20:40:07.398876905 CEST	49618	445	192.168.2.22	148.204.151.2
Jun 7, 2024 20:40:07.399015903 CEST	49618	445	192.168.2.22	148.204.151.2
Jun 7, 2024 20:40:07.399015903 CEST	49618	445	192.168.2.22	148.204.151.2
Jun 7, 2024 20:40:07.403882027 CEST	445	49618	148.204.151.2	192.168.2.22
Jun 7, 2024 20:40:07.403901100 CEST	445	49618	148.204.151.2	192.168.2.22
Jun 7, 2024 20:40:07.778506041 CEST	49850	445	192.168.2.22	51.252.175.1
Jun 7, 2024 20:40:07.783526897 CEST	445	49850	51.252.175.1	192.168.2.22
Jun 7, 2024 20:40:07.783790112 CEST	49850	445	192.168.2.22	51.252.175.1
Jun 7, 2024 20:40:07.783791065 CEST	49850	445	192.168.2.22	51.252.175.1
Jun 7, 2024 20:40:07.788769960 CEST	445	49850	51.252.175.1	192.168.2.22
Jun 7, 2024 20:40:07.888045073 CEST	445	49629	170.101.108.3	192.168.2.22
Jun 7, 2024 20:40:07.888281107 CEST	49629	445	192.168.2.22	170.101.108.3
Jun 7, 2024 20:40:07.890942097 CEST	49629	445	192.168.2.22	170.101.108.3
Jun 7, 2024 20:40:07.890943050 CEST	49629	445	192.168.2.22	170.101.108.3
Jun 7, 2024 20:40:07.895874977 CEST	445	49629	170.101.108.3	192.168.2.22
Jun 7, 2024 20:40:07.895920038 CEST	445	49629	170.101.108.3	192.168.2.22
Jun 7, 2024 20:40:07.949907064 CEST	49869	445	192.168.2.22	170.101.108.4
Jun 7, 2024 20:40:07.955216885 CEST	445	49869	170.101.108.4	192.168.2.22
Jun 7, 2024 20:40:07.955573082 CEST	49869	445	192.168.2.22	170.101.108.4
Jun 7, 2024 20:40:07.955574036 CEST	49869	445	192.168.2.22	170.101.108.4
Jun 7, 2024 20:40:07.955718040 CEST	49870	445	192.168.2.22	170.101.108.4
Jun 7, 2024 20:40:07.960814953 CEST	445	49870	170.101.108.4	192.168.2.22
Jun 7, 2024 20:40:07.961016893 CEST	49870	445	192.168.2.22	170.101.108.4
Jun 7, 2024 20:40:07.961108923 CEST	49870	445	192.168.2.22	170.101.108.4
Jun 7, 2024 20:40:07.961162090 CEST	445	49869	170.101.108.4	192.168.2.22
Jun 7, 2024 20:40:07.961236000 CEST	49869	445	192.168.2.22	170.101.108.4
Jun 7, 2024 20:40:07.966065884 CEST	445	49870	170.101.108.4	192.168.2.22
Jun 7, 2024 20:40:08.083707094 CEST	445	49792	20.33.198.2	192.168.2.22
Jun 7, 2024 20:40:08.084033966 CEST	49792	445	192.168.2.22	20.33.198.2
Jun 7, 2024 20:40:08.086699009 CEST	49792	445	192.168.2.22	20.33.198.2
Jun 7, 2024 20:40:08.086945057 CEST	49792	445	192.168.2.22	20.33.198.2
Jun 7, 2024 20:40:08.093684912 CEST	445	49792	20.33.198.2	192.168.2.22
Jun 7, 2024 20:40:08.093936920 CEST	445	49792	20.33.198.2	192.168.2.22
Jun 7, 2024 20:40:08.182527065 CEST	445	49624	83.48.154.3	192.168.2.22
Jun 7, 2024 20:40:08.182635069 CEST	49624	445	192.168.2.22	83.48.154.3
Jun 7, 2024 20:40:08.182785034 CEST	49624	445	192.168.2.22	83.48.154.3
Jun 7, 2024 20:40:08.182785034 CEST	49624	445	192.168.2.22	83.48.154.3
Jun 7, 2024 20:40:08.188515902 CEST	445	49624	83.48.154.3	192.168.2.22
Jun 7, 2024 20:40:08.188529968 CEST	445	49624	83.48.154.3	192.168.2.22
Jun 7, 2024 20:40:08.366193056 CEST	445	49625	18.149.154.1	192.168.2.22
Jun 7, 2024 20:40:08.366272926 CEST	49625	445	192.168.2.22	18.149.154.1
Jun 7, 2024 20:40:08.818911076 CEST	445	49630	90.170.69.2	192.168.2.22
Jun 7, 2024 20:40:08.819036961 CEST	49630	445	192.168.2.22	90.170.69.2
Jun 7, 2024 20:40:09.225073099 CEST	49625	445	192.168.2.22	18.149.154.1
Jun 7, 2024 20:40:09.225188017 CEST	49706	445	192.168.2.22	21.115.191.3
Jun 7, 2024 20:40:09.225277901 CEST	49687	445	192.168.2.22	153.124.214.2
Jun 7, 2024 20:40:09.225363970 CEST	49661	445	192.168.2.22	39.128.101.2
Jun 7, 2024 20:40:09.225363970 CEST	49636	445	192.168.2.22	54.92.197.2
Jun 7, 2024 20:40:09.225364923 CEST	49708	445	192.168.2.22	175.62.123.4
Jun 7, 2024 20:40:09.225390911 CEST	49730	445	192.168.2.22	45.139.167.2
Jun 7, 2024 20:40:09.225455046 CEST	49642	445	192.168.2.22	175.20.89.1
Jun 7, 2024 20:40:09.225471973 CEST	49656	445	192.168.2.22	202.29.104.1
Jun 7, 2024 20:40:09.225512028 CEST	49630	445	192.168.2.22	90.170.69.2
Jun 7, 2024 20:40:09.225526094 CEST	49639	445	192.168.2.22	202.195.174.3
Jun 7, 2024 20:40:09.225553989 CEST	49657	445	192.168.2.22	102.226.231.2
Jun 7, 2024 20:40:09.225574017 CEST	49655	445	192.168.2.22	137.124.231.3
Jun 7, 2024 20:40:09.225579977 CEST	49692	445	192.168.2.22	23.35.183.2
Jun 7, 2024 20:40:09.225629091 CEST	49690	445	192.168.2.22	8.137.78.1
Jun 7, 2024 20:40:09.225663900 CEST	49673	445	192.168.2.22	20.138.183.1
Jun 7, 2024 20:40:09.225666046 CEST	49696	445	192.168.2.22	145.5.191.3
Jun 7, 2024 20:40:09.225701094 CEST	49749	445	192.168.2.22	103.27.230.1
Jun 7, 2024 20:40:09.225744009 CEST	49774	445	192.168.2.22	7.168.109.4
Jun 7, 2024 20:40:09.225788116 CEST	49753	445	192.168.2.22	159.156.112.3
Jun 7, 2024 20:40:09.225817919 CEST	49755	445	192.168.2.22	144.146.120.3
Jun 7, 2024 20:40:09.225861073 CEST	49782	445	192.168.2.22	15.117.122.3
Jun 7, 2024 20:40:09.225893974 CEST	49787	445	192.168.2.22	106.6.123.1
Jun 7, 2024 20:40:09.226402998 CEST	49850	445	192.168.2.22	51.252.175.1
Jun 7, 2024 20:40:09.226562023 CEST	49870	445	192.168.2.22	170.101.108.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 7, 2024 20:39:02.653511047 CEST	52917	53	192.168.2.22	8.8.8.8
Jun 7, 2024 20:39:02.663800001 CEST	53	52917	8.8.8.8	192.168.2.22
Jun 7, 2024 20:39:03.899755001 CEST	62751	53	192.168.2.22	8.8.8.8
Jun 7, 2024 20:39:03.912990093 CEST	53	62751	8.8.8.8	192.168.2.22
Jun 7, 2024 20:39:03.922466993 CEST	57893	53	192.168.2.22	8.8.8.8
Jun 7, 2024 20:39:03.933042049 CEST	53	57893	8.8.8.8	192.168.2.22
Jun 7, 2024 20:40:52.414278984 CEST	138	138	192.168.2.22	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 7, 2024 20:39:02.653511047 CEST	192.168.2.22	8.8.8.8	0x7da1	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	A (IP address)	IN (0x0001)	false
Jun 7, 2024 20:39:03.899755001 CEST	192.168.2.22	8.8.8.8	0x3855	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	A (IP address)	IN (0x0001)	false
Jun 7, 2024 20:39:03.922466993 CEST	192.168.2.22	8.8.8.8	0xe709	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jun 7, 2024 20:39:02.663800001 CEST	8.8.8.8	192.168.2.22	0x7da1	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	104.16.166.228	A (IP address)	IN (0x0001)	false
Jun 7, 2024 20:39:02.663800001 CEST	8.8.8.8	192.168.2.22	0x7da1	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	104.16.167.228	A (IP address)	IN (0x0001)	false
Jun 7, 2024 20:39:03.912990093 CEST	8.8.8.8	192.168.2.22	0x3855	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	104.16.167.228	A (IP address)	IN (0x0001)	false
Jun 7, 2024 20:39:03.912990093 CEST	8.8.8.8	192.168.2.22	0x3855	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	104.16.166.228	A (IP address)	IN (0x0001)	false
Jun 7, 2024 20:39:03.933042049 CEST	8.8.8.8	192.168.2.22	0xe709	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	104.16.166.228	A (IP address)	IN (0x0001)	false
Jun 7, 2024 20:39:03.933042049 CEST	8.8.8.8	192.168.2.22	0xe709	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	104.16.167.228	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ipinfo.io

www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49162	104.16.166.228	80	1900	C:\Windows\mssecsvc.exe

Timestamp	Bytes transferred	Direction	Data
Jun 7, 2024 20:39:02.682934046 CEST	100	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com Cache-Control: no-cache
Jun 7, 2024 20:39:03.337538958 CEST	778	IN	HTTP/1.1 200 OK Date: Fri, 07 Jun 2024 18:39:03 GMT Content-Type: text/html Content-Length: 607 Connection: close Server: cloudflare CF-RAY: 8902c33d3a63eafa-DFW Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49163	104.16.167.228	80	2504	C:\Windows\mssecsvc.exe

Timestamp	Bytes transferred	Direction	Data
Jun 7, 2024 20:39:03.925405025 CEST	100	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com Cache-Control: no-cache
Jun 7, 2024 20:39:04.567080975 CEST	778	IN	HTTP/1.1 200 OK Date: Fri, 07 Jun 2024 18:39:04 GMT Content-Type: text/html Content-Length: 607 Connection: close Server: cloudflare CF-RAY: 8902c344ff4de9a4-DFW Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49164	104.16.166.228	80	3016	C:\Windows\mssecsvc.exe

Timestamp	Bytes transferred	Direction	Data
Jun 7, 2024 20:39:03.946772099 CEST	100	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com Cache-Control: no-cache
Jun 7, 2024 20:39:04.565273046 CEST	778	IN	HTTP/1.1 200 OK Date: Fri, 07 Jun 2024 18:39:04 GMT Content-Type: text/html Content-Length: 607 Connection: close Server: cloudflare CF-RAY: 8902c3450e21e70a-DFW Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.22	49160	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-06-07 18:38:53 UTC	59	OUT	GET / HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
2024-06-07 18:38:54 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 07 Jun 2024 18:38:54 GMT content-type: application/json; charset=utf-8 Content-Length: 314 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-07 18:38:54 UTC	314	IN	Data Raw: 7b 0a 20 20 22 69 70 22 3a 20 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 31 22 2c 0a 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 31 2e 73 74 61 74 69 63 2e 71 75 61 64 72 61 6e 65 74 2e 63 6f 6d 22 2c 0a 20 20 22 63 69 74 79 22 3a 20 22 44 61 6c 6c 61 73 22 2c 0a 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 54 65 78 61 73 22 2c 0a 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 22 6c 6f 63 22 3a 20 22 33 32 2e 38 31 35 32 2c 2d 39 36 2e 38 37 30 33 22 2c 0a 20 20 22 6f 72 67 22 3a 20 22 41 53 38 31 30 30 20 51 75 61 64 72 61 4e 65 74 20 45 6e 74 65 72 70 72 69 73 65 73 20 4c 4c 43 22 2c 0a 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 37 35 32 34 37 22 2c 0a 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 Data Ascii: { "ip": "173.254.250.91", "hostname": "173.254.250.91.static.quadranet.com", "city": "Dallas", "region": "Texas", "country": "US", "loc": "32.8152,-96.8703", "org": "AS8100 QuadraNet Enterprises LLC", "postal": "75247", "timezone": "Amer

Target ID:	0
Start time:	14:38:59
Start date:	07/06/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\zbRmQrzaHY.dll"
Imagebase:	0xbb0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:38:59
Start date:	07/06/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\zbRmQrzaHY.dll",#1
Imagebase:	0x4aba0000
File size:	302'592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:38:59
Start date:	07/06/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\zbRmQrzaHY.dll,PlayGame
Imagebase:	0xd00000
File size:	44'544 bytes
MD5 hash:	51138BEEA3E2C21EC44D0932C71762A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:38:59
Start date:	07/06/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\zbRmQrzaHY.dll",#1
Imagebase:	0xd00000
File size:	44'544 bytes
MD5 hash:	51138BEEA3E2C21EC44D0932C71762A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:39:00
Start date:	07/06/2024
Path:	C:\Windows\mssecsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvc.exe
Imagebase:	0x400000
File size:	3'723'264 bytes
MD5 hash:	0C694193CEAC8BFB016491FFB534EB7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.356244680.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000002.364040179.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000002.364067431.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000002.364067431.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.356298598.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000000.356298598.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvc.exe, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (based on rule by US CERT) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvc.exe, Author: us-cert code analysis team Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\mssecsvc.exe, Author: ReversingLabs
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:39:02
Start date:	07/06/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\zbRmQrzaHY.dll",PlayGame
Imagebase:	0x710000
File size:	44'544 bytes
MD5 hash:	51138BEEA3E2C21EC44D0932C71762A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:39:02
Start date:	07/06/2024
Path:	C:\Windows\mssecsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvc.exe -m security
Imagebase:	0x400000
File size:	3'723'264 bytes
MD5 hash:	0C694193CEAC8BFB016491FFB534EB7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000A.00000002.499667031.000000000042E000.00000004.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000A.00000000.361347736.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000A.00000000.361392720.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000A.00000000.361392720.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000A.00000002.500102417.000000000293B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000A.00000002.500102417.000000000293B000.00000004.00000020.00020000.00000000.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000A.00000002.500000036.0000000002423000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000A.00000002.500000036.0000000002423000.00000004.00000020.00020000.00000000.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000A.00000002.499709795.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000A.00000002.499709795.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:39:02
Start date:	07/06/2024
Path:	C:\Windows\mssecsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvc.exe
Imagebase:	0x400000
File size:	3'723'264 bytes
MD5 hash:	0C694193CEAC8BFB016491FFB534EB7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000B.00000000.361281172.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000B.00000002.363619536.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000B.00000000.361343499.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000B.00000000.361343499.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000B.00000002.363662706.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000B.00000002.363662706.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:39:04
Start date:	07/06/2024
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	false
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x400000
File size:	3'514'368 bytes
MD5 hash:	7F7CCAA16FB15EB1C7399D422F8363E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000C.00000002.363896323.000000000040E000.00000008.00000001.01000000.00000006.sdmp, Author: us-cert code analysis team Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000C.00000000.363626200.000000000040E000.00000008.00000001.01000000.00000006.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\tasksche.exe, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\tasksche.exe, Author: ReversingLabs
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report zbRmQrzaHY.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\mssecsvc.exe

C:\Windows\tasksche.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
zbRmQrzaHY.dll