It was explain elsewhere, server not was vulnerable for the first 19 hours. That's why it says hacked in 19 hours not 38 hours.