Edit tour
Windows
Analysis Report
Doc9078786968795776764567.xla.xlsx
Overview
General Information
| Sample name: | Doc9078786968795776764567.xla.xlsx |
| Analysis ID: | 1632078 |
| MD5: | e5e8f7c4e8638793cfde2342e03480dc |
| SHA1: | 56e2dee858992aa8498a1a1935aad525fb2198fd |
| SHA256: | 5b5ba0157979fe96f31b72f27860e79ef396543e1ebc6e03679d2239830a7226 |
| Tags: | CVE-2017-0199xlaxlsxuser-abuse_ch |
| Infos: |  |
 | |
Detection
| Score: | 60 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Excel sheet contains many unusual embedded objects
Document contains embedded VBA macros
Document embeds suspicious OLE2 link
Document misses a certain OLE stream usually present in this Microsoft Office document type
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Suricata IDS alerts with low severity for network traffic
Unable to load, office file is protected or invalid
Uses a known web browser user agent for HTTP communication
Classification
- System is w10x64
EXCEL.EXE (PID: 7608 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\EXCEL .EXE" /aut omation -E mbedding MD5: 4A871771235598812032C822E6F68F19) 
splwow64.exe (PID: 7240 cmdline: C:\Windows \splwow64. exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)
- EXCEL.EXE (PID: 5112 cmdline:
"C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\EXCEL .EXE" "C:\ Users\user \Desktop\D oc90787869 6879577676 4567.xla.x lsx" MD5: 4A871771235598812032C822E6F68F19)
- cleanup
⊘No configs have been found
⊘No yara matches
System Summary |   |
|---|
| Source: | Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: | ||
| Source: | Author: X__Junior (Nextron Systems): | ||
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-03-07T19:32:25.360866+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49729 | 13.107.246.60 | 443 | TCP |
| 2025-03-07T19:32:34.602522+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49731 | 13.107.246.60 | 443 | TCP |
| 2025-03-07T19:32:34.697993+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49730 | 13.107.246.60 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Avira: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | File opened: | Jump to behavior | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
System Summary | |
|---|
| Source: | OLE: | ||
| Source: | OLE: | ||
| Source: | OLE: | ||
| Source: | OLE indicator, VBA macros: | ||
| Source: | Stream path 'MBD0004E8E2/\x1Ole' : | ||
| Source: | Stream path 'MBD0004E8E2/\x1Ole' : | ||
| Source: | OLE stream indicators for Word, Excel, PowerPoint, and Visio: | ||
| Source: | Window title found: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | OLE indicator, Workbook stream: | ||
| Source: | OLE indicator, Workbook stream: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Static file information: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Stream path 'MBD0004E8E1/Package' entropy: | ||
| Source: | Stream path 'Workbook' entropy: | ||
| Source: | Stream path 'Package' entropy: | ||
| Source: | Stream path 'MBD0004E8E1/Package' entropy: | ||
| Source: | Stream path 'Workbook' entropy: | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Process information queried: | Jump to behavior | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | 1 Scripting | Valid Accounts | 3 Exploitation for Client Execution | 1 Scripting | 1 Process Injection | 2 Masquerading | OS Credential Dumping | 1 Process Discovery | Remote Services | Data from Local System | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | 1 Virtualization/Sandbox Evasion | LSASS Memory | 1 Virtualization/Sandbox Evasion | Remote Desktop Protocol | Data from Removable Media | 1 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 Process Injection | Security Account Manager | 1 Application Window Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 2 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Obfuscated Files or Information | NTDS | 1 File and Directory Discovery | Distributed Component Object Model | Input Capture | 13 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | Software Packing | LSA Secrets | 1 System Information Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 46% | Virustotal | Browse | ||
| 39% | ReversingLabs | Document-Excel.Exploit.CVE-2017-0199 | ||
| 100% | Avira | W97M/AVI.Agent.yntrz |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| link.orai.io | 104.26.0.139 | true | false | high | |
| st3.pro | 5.161.200.29 | true | false | high | |
| s-0005.dual-s-msedge.net | 52.123.128.14 | true | false | high | |
| s-part-0032.t-0009.t-msedge.net | 13.107.246.60 | true | false | high | |
| otelrules.svc.static.microsoft | unknown | unknown | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high | ||
| false |
| unknown | |
| false | high | ||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 104.26.0.139 | link.orai.io | United States | 13335 | CLOUDFLARENETUS | false | |
| 5.161.200.29 | st3.pro | Germany | 24940 | HETZNER-ASDE | false | |
| 13.107.246.60 | s-part-0032.t-0009.t-msedge.net | United States | 8068 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1632078 |
| Start date and time: | 2025-03-07 19:29:56 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 5m 41s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultwindowsofficecookbook.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Run name: | Without Instrumentation |
| Number of analysed new started processes analysed: | 18 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | Doc9078786968795776764567.xla.xlsx |
| Detection: | MAL |
| Classification: | mal60.winXLSX@4/9@3/3 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, audiodg.exe, sppsvc.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 52.109.28.46, 23.199.214.10, 52.109.89.19, 20.42.65.84, 52.109.89.18, 51.104.15.253, 52.123.128.14, 20.190.159.4
- Excluded domains from analysis (whitelisted): weu-azsc-000.roaming.officeapps.live.com, weu-azsc-config.officeapps.live.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live.com.akadns.net, mobile.events.data.microsoft.com, roaming.officeapps.live.com, osiprod-weu-buff-azsc-000.westeurope.cloudapp.azure.com, dual-s-0005-office.config.skype.com, login.live.com, onedscolprdeus02.eastus.cloudapp.azure.com, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, onedscolprduks04.uksouth.cloudapp.azure.com, prod.roaming1.live.com.akadns.net, config.officeapps.live.com, e16604.f.akamaiedge.net, ecs.office.trafficmanager.net, europe.configsvc1.live.com.akadns.net, mobile.events.data.trafficmanager.net, uks-azsc-config.officeapps.live.com
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtCreateKey calls found.
- Report size getting too big, too many NtOpenFile calls found.
- Report size getting too big, too many NtQueryAttributesFile calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Report size getting too big, too many NtReadFile calls found.
- Report size getting too big, too many NtReadVirtualMemory calls found.
- Report size getting too big, too many NtSetInformationFile calls found.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
| Time | Type | Description |
|---|---|---|
| 13:32:18 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 104.26.0.139 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| 5.161.200.29 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| 13.107.246.60 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| s-part-0032.t-0009.t-msedge.net | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| s-0005.dual-s-msedge.net | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| link.orai.io | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| st3.pro | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| HETZNER-ASDE | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| CLOUDFLARENETUS | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| MICROSOFT-CORP-MSN-AS-BLOCKUS | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 6271f898ce5be7dd52b0fc260d0662b3 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| a0e9f5d64349fb13191bc781f81f42e1 | Get hash | malicious | LummaC Stealer | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer, PureLog Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
|
⊘No context
C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 118 |
| Entropy (8bit): | 3.5700810731231707 |
| Encrypted: | false |
| SSDEEP: | 3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq |
| MD5: | 573220372DA4ED487441611079B623CD |
| SHA1: | 8F9D967AC6EF34640F1F0845214FBC6994C0CB80 |
| SHA-256: | BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D |
| SHA-512: | F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 836 |
| Entropy (8bit): | 2.7151910322565733 |
| Encrypted: | false |
| SSDEEP: | 24:J3fIxk+vpKAk6ScvoGA8xpiOnAvJ5yoIHWK:h3+RfkpcvoGAYcvJ5LIHD |
| MD5: | 92A7E6E963E0E668F6585E8694F68380 |
| SHA1: | 9CFB8F0EA9A80C54FEBF664E2E8DA3A20C6F5DAE |
| SHA-256: | F09EE04026948847263A11CC3D3276A676246EF074A985681DBEF03D76801482 |
| SHA-512: | F3E94DC16458B4CE76A18D44360256A233CDF918A34FDB0AB3A85AF5FA3ADEB8B0BBB173CE658D8344939FE77AEB467C04D111A887424A65BA2833897DE3F4E2 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 512 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | 3:: |
| MD5: | BF619EAC0CDF3F68D496EA9344137E8B |
| SHA1: | 5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5 |
| SHA-256: | 076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560 |
| SHA-512: | DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1181696 |
| Entropy (8bit): | 7.944718032779258 |
| Encrypted: | false |
| SSDEEP: | 24576:VdvGt1l7z4cIcNEulvdzHjdfAxbXSud/QyqamuJIwg:PI1pz3DvdTWpiulPqaVzg |
| MD5: | 4126A43D52645B8D0AFECCE7F7FA773C |
| SHA1: | D475A62C050D3EDC450FDC7C8A777052706863AF |
| SHA-256: | 56CE32B6A84BD552BB751339333C2D6DCAAAD600789ACF54904F17C6293B4484 |
| SHA-512: | 142CDD897742894D6C5E3045BF44277D9991A2F7EB8F7B69627B83114343C8CE4F891347FED8252D4593972DB1AE347C46157BE4874E8F398BAFB812548ECF6B |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1163264 |
| Entropy (8bit): | 7.9630940769189635 |
| Encrypted: | false |
| SSDEEP: | 24576:DdvGt1l7z4cIcNEulvdzHjdfAxbXSud/QyqamuJIwg:lI1pz3DvdTWpiulPqaVzg |
| MD5: | 9F6214A77E2078F32299CA4E49E4369B |
| SHA1: | A506025AB87A2C9415B49B59C37CE9F5E046F584 |
| SHA-256: | AE41BA7F3104B89EDE68E043DA1C714F576F2D4C1F4D7CA1FBCCC430B9FB1CC7 |
| SHA-512: | 9B92BB8192418F3F79A9F1CE02C93855A5A6F8D7A0E3642AAFCD10949DAED8174755DAEA13D295C73A96876C62A355BCD6ABC950B7CACEDC4723CA926A3A61BC |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1435136 |
| Entropy (8bit): | 7.988539809116455 |
| Encrypted: | false |
| SSDEEP: | 24576:PdvGt1l7z4cIcNEulvdzHjdfAxbXSud/QyqamuJIwgbsr2gyOb7Jmm:hI1pz3DvdTWpiulPqaVzgArt |
| MD5: | BDAB006705DD2FBC961D23D405A8A1EF |
| SHA1: | DE5643A2240BC54C0023F06DC40EE013239D4EB3 |
| SHA-256: | D50354EEB31365335132AF042273DC5E90288B98052D1504670B0B46840745BE |
| SHA-512: | B605C597087F3ABC85A14EAF44F8F42F3276048AD94E6075B28576C3A20FE6CFB2BC80DCF9B0FC5E0305A133054967140F4B4ACFFAA1F16D3C73A136CF5D16C7 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | modified |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | 3:ggPYV:rPYV |
| MD5: | 187F488E27DB4AF347237FE461A079AD |
| SHA1: | 6693BA299EC1881249D59262276A0D2CB21F8E64 |
| SHA-256: | 255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309 |
| SHA-512: | 89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1435136 |
| Entropy (8bit): | 7.988539809116455 |
| Encrypted: | false |
| SSDEEP: | 24576:PdvGt1l7z4cIcNEulvdzHjdfAxbXSud/QyqamuJIwgbsr2gyOb7Jmm:hI1pz3DvdTWpiulPqaVzgArt |
| MD5: | BDAB006705DD2FBC961D23D405A8A1EF |
| SHA1: | DE5643A2240BC54C0023F06DC40EE013239D4EB3 |
| SHA-256: | D50354EEB31365335132AF042273DC5E90288B98052D1504670B0B46840745BE |
| SHA-512: | B605C597087F3ABC85A14EAF44F8F42F3276048AD94E6075B28576C3A20FE6CFB2BC80DCF9B0FC5E0305A133054967140F4B4ACFFAA1F16D3C73A136CF5D16C7 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 165 |
| Entropy (8bit): | 1.4377382811115937 |
| Encrypted: | false |
| SSDEEP: | 3:KVC+cAmltV:KVC+cR |
| MD5: | 9C7132B2A8CABF27097749F4D8447635 |
| SHA1: | 71D7F78718A7AFC3EAB22ED395321F6CBE2F9899 |
| SHA-256: | 7029AE5479F0CD98D892F570A22B2AE8302747DCFF3465B2DE64D974AE815A83 |
| SHA-512: | 333AC8A4987CC7DF5981AE81238A77D123996DB2C4C97053E8BD2048A64FDCF33E1245DEE6839358161F6B5EEA6BFD8D2358BC4A9188D786295C22F79E2D635E |
| Malicious: | true |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.9806836434250945 |
| TrID: |
|
| File name: | Doc9078786968795776764567.xla.xlsx |
| File size: | 1'236'480 bytes |
| MD5: | e5e8f7c4e8638793cfde2342e03480dc |
| SHA1: | 56e2dee858992aa8498a1a1935aad525fb2198fd |
| SHA256: | 5b5ba0157979fe96f31b72f27860e79ef396543e1ebc6e03679d2239830a7226 |
| SHA512: | 51c1f73d314f2888f71dd847533b3d4496a5c027ea5471766bcd45ab050b99b2838d172fab1e6aea50a4578da3da5babf502bd03c8ce94269a8cfaa80786d41b |
| SSDEEP: | 24576:IJIwgbtTgdAnIOXR8YhbBWvdp8tLUWBMDcaPhU3Vjz6r9FnqDe4Kx8:IzgZTcM8YkpwLUwhauzOFqtKx |
| TLSH: | F74522D4EDD4BE02CF43457A0F96C46D940ABE4EB259D40B3234B71A1A3BA3D46F281A |
| File Content Preview: | ........................>...............................................................................................................x.......z.............................................................................................................. |
 | |
| Icon Hash: | 35e58a8c0c8a85b9 |
| Document Type: | OLE |
| Number of OLE Files: | 1 |
| Has Summary Info: | |
| Application Name: | Microsoft Excel |
| Encrypted Document: | True |
| Contains Word Document Stream: | False |
| Contains Workbook/Book Stream: | True |
| Contains PowerPoint Document Stream: | False |
| Contains Visio Document Stream: | False |
| Contains ObjectPool Stream: | False |
| Flash Objects Count: | 0 |
| Contains VBA Macros: | True |
| Code Page: | 1252 |
| Author: | |
| Last Saved By: | |
| Create Time: | 2006-09-16 00:00:00 |
| Last Saved Time: | 2025-03-05 17:04:45 |
| Creating Application: | |
| Security: | 1 |
| Document Code Page: | 1252 |
| Thumbnail Scaling Desired: | False |
| Contains Dirty Links: | False |
| Shared Document: | False |
| Changed Hyperlinks: | False |
| Application Version: | 786432 |
General | |
| Stream Path: | _VBA_PROJECT_CUR/VBA/Sheet1 |
| VBA File Name: | Sheet1.cls |
| Stream Size: | 977 |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + h . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - |
| Data Raw: | 01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 a4 2b 68 03 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
|
General | |
| Stream Path: | _VBA_PROJECT_CUR/VBA/Sheet2 |
| VBA File Name: | Sheet2.cls |
| Stream Size: | 977 |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + c . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . |
| Data Raw: | 01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 a4 2b c3 63 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
|
General | |
| Stream Path: | _VBA_PROJECT_CUR/VBA/Sheet3 |
| VBA File Name: | Sheet3.cls |
| Stream Size: | 977 |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + H . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . |
| Data Raw: | 01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 a4 2b 48 98 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
|
General | |
| Stream Path: | _VBA_PROJECT_CUR/VBA/ThisWorkbook |
| VBA File Name: | ThisWorkbook.cls |
| Stream Size: | 985 |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . - . |
| Data Raw: | 01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 a4 2b ce 08 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
|
General | |
| Stream Path: | \x1CompObj |
| CLSID: | |
| File Type: | data |
| Stream Size: | 114 |
| Entropy: | 4.25248375192737 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . . |
| Data Raw: | 01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
| Stream Path: | \x5DocumentSummaryInformation |
| CLSID: | |
| File Type: | data |
| Stream Size: | 244 |
| Entropy: | 2.889430592781307 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00 |
General | |
| Stream Path: | \x5SummaryInformation |
| CLSID: | |
| File Type: | data |
| Stream Size: | 200 |
| Entropy: | 3.3020681057018666 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . | . # . @ . . . . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00 |
General | |
| Stream Path: | MBD0004E8E1/\x1CompObj |
| CLSID: | |
| File Type: | data |
| Stream Size: | 99 |
| Entropy: | 3.631242196770981 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . . |
| Data Raw: | 01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
| Stream Path: | MBD0004E8E1/Package |
| CLSID: | |
| File Type: | Microsoft Excel 2007+ |
| Stream Size: | 919249 |
| Entropy: | 7.9927407165072255 |
| Base64 Encoded: | True |
| Data ASCII: | P K . . . . . . . . . . ! . h . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
| Data Raw: | 50 4b 03 04 14 00 06 00 08 00 00 00 21 00 d5 68 cd d7 f9 01 00 00 da 08 00 00 13 00 c4 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 c0 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
| Stream Path: | MBD0004E8E2/\x1Ole |
| CLSID: | |
| File Type: | data |
| Stream Size: | 806 |
| Entropy: | 4.842271720864075 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . w > y V . . . . . . . . . . . . . . . . y . . . K . . . . h . t . t . p . s . : . / . / . l . i . n . k . . . o . r . a . i . . . i . o . / . H . u . K . 0 . L . 2 . ? . & . b . e . l . f . r . y . = . b . a . w . d . y . & . l . a . n . g . u . a . g . e . = . r . i . g . h . t . e . o . u . s . & . g . a . l . e . . . . L . D . 8 . h I ; E 5 . h J R % 2 ` . D . 8 . x h o p ( . I ' . * / a B w w ` & # u ) . E . o . . . . . . . . . . . . . . . . . . . P . e . Q . 3 . v . a . F . 1 . w . I . z . Y . |
| Data Raw: | 01 00 00 02 77 c3 3e 79 93 cf 56 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b e4 00 00 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 6c 00 69 00 6e 00 6b 00 2e 00 6f 00 72 00 61 00 69 00 2e 00 69 00 6f 00 2f 00 48 00 75 00 4b 00 30 00 4c 00 32 00 3f 00 26 00 62 00 65 00 6c 00 66 00 72 00 79 00 3d 00 62 00 61 00 77 00 64 00 |
General | |
| Stream Path: | Workbook |
| CLSID: | |
| File Type: | Applesoft BASIC program data, first line number 16 |
| Stream Size: | 293108 |
| Entropy: | 7.998482533182839 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . . . . . . . . . . / . 6 . . . . . . . Q r + . . r . r n g . 5 v . + # Q i E . . 4 . ) . . h K . . . . . . . . . . 1 . . . \\ . p . . b ' Y . . . Q . . : 5 % i p v R J I > . . ) . W s { 1 k " 3 . . . , . Z . . < J $ c ? O T 0 1 ] . . H A . V * ] T . ' r B . . . ! a . . . . . . = . . . q F F C . . . D B . C . { 2 . . . . . . . . . o . . . . . . . . . . . . l . . . . = . . . ~ . - O P z . . 8 n w @ . . . . . . . . " . . . . . . . _ . . . . k . . . 2 . 1 . . . c | $ . . . > . m ; 3 . F ] 5 : |
| Data Raw: | 09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 bf f4 e5 51 a2 72 2b 1a d8 86 8f 72 0e c8 e5 72 6e 67 08 35 e5 bf 76 15 ff 2b 23 ed 88 51 69 45 d4 e6 03 9e a7 0b 34 e6 0f 29 c3 0a 1c 68 e7 4b 87 00 00 00 e1 00 02 00 b0 04 c1 00 02 00 99 31 e2 00 00 00 5c 00 70 00 ca 8d 62 27 59 ef cd 15 ad fd 0f 1f 51 1a c6 b6 3a b5 99 99 fb 35 25 69 70 76 |
General | |
| Stream Path: | _VBA_PROJECT_CUR/PROJECT |
| CLSID: | |
| File Type: | ASCII text, with CRLF line terminators |
| Stream Size: | 525 |
| Entropy: | 5.172412904274722 |
| Base64 Encoded: | True |
| Data ASCII: | I D = " { 8 D 4 4 B B 5 F - C 9 5 D - 4 7 0 0 - A 9 4 B - 3 B 9 4 C B 5 D C 8 D C } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 5 F 5 D 7 E 3 C 8 2 3 C C 0 4 0 C |
| Data Raw: | 49 44 3d 22 7b 38 44 34 34 42 42 35 46 2d 43 39 35 44 2d 34 37 30 30 2d 41 39 34 42 2d 33 42 39 34 43 42 35 44 43 38 44 43 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30 |
General | |
| Stream Path: | _VBA_PROJECT_CUR/PROJECTwm |
| CLSID: | |
| File Type: | data |
| Stream Size: | 104 |
| Entropy: | 3.0488640812019017 |
| Base64 Encoded: | False |
| Data ASCII: | T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . . |
| Data Raw: | 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00 |
General | |
| Stream Path: | _VBA_PROJECT_CUR/VBA/_VBA_PROJECT |
| CLSID: | |
| File Type: | data |
| Stream Size: | 2644 |
| Entropy: | 3.9830170565388197 |
| Base64 Encoded: | False |
| Data ASCII: | a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r . |
| Data Raw: | cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00 |
General | |
| Stream Path: | _VBA_PROJECT_CUR/VBA/dir |
| CLSID: | |
| File Type: | data |
| Stream Size: | 553 |
| Entropy: | 6.34327716220257 |
| Base64 Encoded: | True |
| Data ASCII: | . % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . 6 . i . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2 |
| Data Raw: | 01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 36 12 e0 69 08 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47 |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-03-07T19:32:25.360866+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.4 | 49729 | 13.107.246.60 | 443 | TCP |
| 2025-03-07T19:32:34.602522+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.4 | 49731 | 13.107.246.60 | 443 | TCP |
| 2025-03-07T19:32:34.697993+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.4 | 49730 | 13.107.246.60 | 443 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 7, 2025 19:32:07.290807962 CET | 49727 | 443 | 192.168.2.4 | 104.26.0.139 |
| Mar 7, 2025 19:32:07.290863037 CET | 443 | 49727 | 104.26.0.139 | 192.168.2.4 |
| Mar 7, 2025 19:32:07.290956974 CET | 49727 | 443 | 192.168.2.4 | 104.26.0.139 |
| Mar 7, 2025 19:32:07.291192055 CET | 49727 | 443 | 192.168.2.4 | 104.26.0.139 |
| Mar 7, 2025 19:32:07.291207075 CET | 443 | 49727 | 104.26.0.139 | 192.168.2.4 |
| Mar 7, 2025 19:32:09.316725969 CET | 443 | 49727 | 104.26.0.139 | 192.168.2.4 |
| Mar 7, 2025 19:32:09.316926956 CET | 49727 | 443 | 192.168.2.4 | 104.26.0.139 |
| Mar 7, 2025 19:32:09.328016043 CET | 49727 | 443 | 192.168.2.4 | 104.26.0.139 |
| Mar 7, 2025 19:32:09.328048944 CET | 443 | 49727 | 104.26.0.139 | 192.168.2.4 |
| Mar 7, 2025 19:32:09.328388929 CET | 443 | 49727 | 104.26.0.139 | 192.168.2.4 |
| Mar 7, 2025 19:32:09.328458071 CET | 49727 | 443 | 192.168.2.4 | 104.26.0.139 |
| Mar 7, 2025 19:32:09.329003096 CET | 49727 | 443 | 192.168.2.4 | 104.26.0.139 |
| Mar 7, 2025 19:32:09.372322083 CET | 443 | 49727 | 104.26.0.139 | 192.168.2.4 |
| Mar 7, 2025 19:32:10.149842024 CET | 443 | 49727 | 104.26.0.139 | 192.168.2.4 |
| Mar 7, 2025 19:32:10.149914026 CET | 443 | 49727 | 104.26.0.139 | 192.168.2.4 |
| Mar 7, 2025 19:32:10.150125980 CET | 49727 | 443 | 192.168.2.4 | 104.26.0.139 |
| Mar 7, 2025 19:32:10.150125980 CET | 49727 | 443 | 192.168.2.4 | 104.26.0.139 |
| Mar 7, 2025 19:32:10.154710054 CET | 49727 | 443 | 192.168.2.4 | 104.26.0.139 |
| Mar 7, 2025 19:32:10.154761076 CET | 443 | 49727 | 104.26.0.139 | 192.168.2.4 |
| Mar 7, 2025 19:32:10.171017885 CET | 49728 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 7, 2025 19:32:10.171051025 CET | 443 | 49728 | 5.161.200.29 | 192.168.2.4 |
| Mar 7, 2025 19:32:10.171164989 CET | 49728 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 7, 2025 19:32:10.171510935 CET | 49728 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 7, 2025 19:32:10.171525002 CET | 443 | 49728 | 5.161.200.29 | 192.168.2.4 |
| Mar 7, 2025 19:32:16.399915934 CET | 443 | 49728 | 5.161.200.29 | 192.168.2.4 |
| Mar 7, 2025 19:32:16.400067091 CET | 49728 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 7, 2025 19:32:16.427984953 CET | 49728 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 7, 2025 19:32:16.428003073 CET | 443 | 49728 | 5.161.200.29 | 192.168.2.4 |
| Mar 7, 2025 19:32:17.066289902 CET | 443 | 49728 | 5.161.200.29 | 192.168.2.4 |
| Mar 7, 2025 19:32:17.066389084 CET | 49728 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 7, 2025 19:32:17.067430973 CET | 49728 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 7, 2025 19:32:17.067444086 CET | 443 | 49728 | 5.161.200.29 | 192.168.2.4 |
| Mar 7, 2025 19:32:17.067460060 CET | 49728 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 7, 2025 19:32:17.067465067 CET | 443 | 49728 | 5.161.200.29 | 192.168.2.4 |
| Mar 7, 2025 19:32:17.067490101 CET | 49728 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 7, 2025 19:32:17.067493916 CET | 443 | 49728 | 5.161.200.29 | 192.168.2.4 |
| Mar 7, 2025 19:32:17.741951942 CET | 443 | 49728 | 5.161.200.29 | 192.168.2.4 |
| Mar 7, 2025 19:32:17.742132902 CET | 49728 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 7, 2025 19:32:17.992836952 CET | 443 | 49728 | 5.161.200.29 | 192.168.2.4 |
| Mar 7, 2025 19:32:17.992961884 CET | 49728 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 7, 2025 19:32:18.083024979 CET | 443 | 49728 | 5.161.200.29 | 192.168.2.4 |
| Mar 7, 2025 19:32:18.083302975 CET | 49728 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 7, 2025 19:32:18.092963934 CET | 49728 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 7, 2025 19:32:18.092978001 CET | 443 | 49728 | 5.161.200.29 | 192.168.2.4 |
| Mar 7, 2025 19:32:18.662422895 CET | 443 | 49728 | 5.161.200.29 | 192.168.2.4 |
| Mar 7, 2025 19:32:18.662611961 CET | 49728 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 7, 2025 19:32:18.664227962 CET | 49728 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 7, 2025 19:32:18.664237022 CET | 443 | 49728 | 5.161.200.29 | 192.168.2.4 |
| Mar 7, 2025 19:32:18.826453924 CET | 443 | 49728 | 5.161.200.29 | 192.168.2.4 |
| Mar 7, 2025 19:32:18.826569080 CET | 49728 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 7, 2025 19:32:18.998334885 CET | 443 | 49709 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:18.998522043 CET | 49709 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:18.998756886 CET | 443 | 49709 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:18.998809099 CET | 49709 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:22.617923975 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:22.617983103 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:22.618103027 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:22.618383884 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:22.618403912 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:25.360790014 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:25.360866070 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:25.368717909 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:25.368763924 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:25.369039059 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:25.386395931 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:25.432342052 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.005434990 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.005462885 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.005480051 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.005530119 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.005583048 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.005604029 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.005778074 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.139561892 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.139586926 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.139668941 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.139708996 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.140747070 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.156243086 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.156263113 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.156315088 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.156327009 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.156361103 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.156387091 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.218211889 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.218231916 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.218338966 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.218358994 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.219327927 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.254323006 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.254340887 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.254399061 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.254415035 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.254456043 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.283297062 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.283314943 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.283394098 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.283411026 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.283463955 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.313488007 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.313543081 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.313589096 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.313612938 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.313635111 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.313657999 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.333802938 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.333821058 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.333884001 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.333899021 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.333964109 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.357628107 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.357656956 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.357705116 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.357717037 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.357758045 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.357781887 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.381274939 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.381300926 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.381407976 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.381438971 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.381484032 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.399503946 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.399524927 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.399566889 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.399580002 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.399610043 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.399632931 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.415069103 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.415088892 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.415137053 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.415163040 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.415182114 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.415215969 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.424491882 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.424510956 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.424599886 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.424617052 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.424678087 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.435559034 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.435580969 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.435641050 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.435652018 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.435710907 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.445369959 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.445391893 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.445456028 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.445468903 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.445523024 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.453548908 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.453564882 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.453622103 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.453632116 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.453701973 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.463546991 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.463563919 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.463619947 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.463629961 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.463761091 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.473206997 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.473222017 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.473284960 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.473294020 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.473339081 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.484277964 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.484299898 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.484383106 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.484392881 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.484467030 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.501311064 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.501327038 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.501416922 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.501432896 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.501482964 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.520338058 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.520354986 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.520441055 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.520463943 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.520720005 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.536526918 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.536549091 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.536628962 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.536664963 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.536832094 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.540702105 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.540716887 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.540782928 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.540792942 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.540882111 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.550096035 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.550112963 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.550189018 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.550201893 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.550251007 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.559679031 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.559696913 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.559762955 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.559773922 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.559865952 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.575663090 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.575684071 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.575747967 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.575761080 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.575834990 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.607533932 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.607557058 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.607646942 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.607673883 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.607829094 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.646219969 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.646243095 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.646338940 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.646364927 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.646497965 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.683825016 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.683846951 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.683923006 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.683944941 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.683993101 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.710390091 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.710414886 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.710493088 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.710525036 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.710712910 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.716636896 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.716661930 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.716696978 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.716738939 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.716749907 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.716826916 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.731125116 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.731146097 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.731213093 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.731235981 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.731282949 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.743479967 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.743500948 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.743570089 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.743590117 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.743813038 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.763344049 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.763361931 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.763453960 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.763480902 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.765625000 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.826365948 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.826395035 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.826491117 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.826517105 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.826571941 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.826610088 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.861629009 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.861653090 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.861958027 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.861987114 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.862098932 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.923945904 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.923970938 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.924060106 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.924086094 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.924127102 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.924145937 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.971494913 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.971520901 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.971601009 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.971628904 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.971807957 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.980580091 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.980597973 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.980675936 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.980684042 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.980726004 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.993335962 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.993350983 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.993422031 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:26.993431091 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:26.993485928 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.016287088 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.016311884 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.016366959 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.016375065 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.016433954 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.026609898 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.026631117 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.026705980 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.026711941 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.026752949 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.077562094 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.077583075 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.077641010 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.077663898 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.077699900 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.077699900 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.110718012 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.110738039 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.110809088 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.110819101 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.110872030 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.172287941 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.172327995 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.172365904 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.172374010 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.172410011 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.172432899 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.231219053 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.231242895 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.231298923 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.231304884 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.231337070 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.231368065 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.240055084 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.240077972 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.240122080 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.240128040 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.240164995 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.240189075 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.252800941 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.252821922 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.252866030 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.252871990 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.252906084 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.252928019 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.278985023 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.279002905 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.279093981 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.279115915 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.279174089 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.288794041 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.288808107 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.288889885 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.288918972 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.288979053 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.339138985 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.339159012 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.339225054 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.339251041 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.339399099 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.363954067 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.363979101 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.364064932 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.364089966 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.364141941 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.416214943 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.416238070 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.416507959 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.416534901 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.416764021 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.480654001 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.480704069 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.480751991 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.480767965 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.480812073 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.480830908 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.496373892 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.496436119 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.496471882 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.496488094 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.496551037 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.496558905 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.515300035 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.515367985 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.515410900 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.515425920 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.515450001 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.515467882 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.540880919 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.540899992 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.540967941 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.540982962 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.541028976 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.585164070 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.585185051 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.585272074 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.585289955 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.585304976 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.585370064 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.586460114 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.586477041 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.586539984 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.586558104 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.586643934 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.603646040 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.603693962 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.603725910 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.603740931 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.603780985 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.603801966 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.678761959 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.678776979 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.678859949 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.678879976 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.678941011 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.757463932 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.757486105 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.757615089 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.757615089 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.757632017 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.757886887 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.758523941 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.758538961 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.758651972 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.758658886 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.758764982 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.776341915 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.776420116 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.776458979 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.776469946 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.776532888 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.776534081 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.798738956 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.798787117 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.798976898 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.798976898 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.798986912 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.799400091 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.825634956 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.825656891 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.825762033 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.825778961 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.825845957 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.847871065 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.847888947 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.847980976 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.847996950 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.848136902 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.849327087 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.849343061 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.849453926 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.849463940 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.849575043 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.912384033 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.912456989 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.912592888 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.912592888 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.912625074 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:27.912636995 CET | 49729 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:27.912643909 CET | 443 | 49729 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:32.042716026 CET | 49731 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:32.042757988 CET | 443 | 49731 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:32.042793036 CET | 49730 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:32.042829037 CET | 49731 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:32.042844057 CET | 443 | 49730 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:32.043018103 CET | 49731 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:32.043030977 CET | 443 | 49731 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:32.043050051 CET | 49730 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:32.043204069 CET | 49730 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:32.043215036 CET | 443 | 49730 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:34.601738930 CET | 443 | 49731 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:34.602521896 CET | 49731 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:34.602547884 CET | 443 | 49731 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:34.603543997 CET | 49731 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:34.603552103 CET | 443 | 49731 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:34.697137117 CET | 443 | 49730 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:34.697993040 CET | 49730 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:34.698014975 CET | 443 | 49730 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:34.698932886 CET | 49730 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:34.698947906 CET | 443 | 49730 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:35.439301014 CET | 443 | 49730 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:35.439363003 CET | 443 | 49730 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:35.439502001 CET | 443 | 49730 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:35.439779043 CET | 49730 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:35.440272093 CET | 49730 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:35.440272093 CET | 49730 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:35.440320015 CET | 49730 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:35.440335989 CET | 443 | 49730 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:35.509888887 CET | 443 | 49731 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:35.509973049 CET | 443 | 49731 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:35.510221004 CET | 49731 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:35.510469913 CET | 49731 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:35.510498047 CET | 443 | 49731 | 13.107.246.60 | 192.168.2.4 |
| Mar 7, 2025 19:32:35.510510921 CET | 49731 | 443 | 192.168.2.4 | 13.107.246.60 |
| Mar 7, 2025 19:32:35.510518074 CET | 443 | 49731 | 13.107.246.60 | 192.168.2.4 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 7, 2025 19:32:07.278244972 CET | 49859 | 53 | 192.168.2.4 | 1.1.1.1 |
| Mar 7, 2025 19:32:07.288652897 CET | 53 | 49859 | 1.1.1.1 | 192.168.2.4 |
| Mar 7, 2025 19:32:10.157248974 CET | 64537 | 53 | 192.168.2.4 | 1.1.1.1 |
| Mar 7, 2025 19:32:10.170098066 CET | 53 | 64537 | 1.1.1.1 | 192.168.2.4 |
| Mar 7, 2025 19:32:22.539778948 CET | 53817 | 53 | 192.168.2.4 | 1.1.1.1 |
| Mar 7, 2025 19:32:22.617120028 CET | 53 | 53817 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Mar 7, 2025 19:32:07.278244972 CET | 192.168.2.4 | 1.1.1.1 | 0xd2b | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Mar 7, 2025 19:32:10.157248974 CET | 192.168.2.4 | 1.1.1.1 | 0xaa3c | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Mar 7, 2025 19:32:22.539778948 CET | 192.168.2.4 | 1.1.1.1 | 0xdae4 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Mar 7, 2025 19:31:20.945939064 CET | 1.1.1.1 | 192.168.2.4 | 0x55b1 | No error (0) | s-0005.dual-s-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 7, 2025 19:31:20.945939064 CET | 1.1.1.1 | 192.168.2.4 | 0x55b1 | No error (0) | 52.123.128.14 | A (IP address) | IN (0x0001) | false | ||
| Mar 7, 2025 19:31:20.945939064 CET | 1.1.1.1 | 192.168.2.4 | 0x55b1 | No error (0) | 52.123.129.14 | A (IP address) | IN (0x0001) | false | ||
| Mar 7, 2025 19:32:07.288652897 CET | 1.1.1.1 | 192.168.2.4 | 0xd2b | No error (0) | 104.26.0.139 | A (IP address) | IN (0x0001) | false | ||
| Mar 7, 2025 19:32:07.288652897 CET | 1.1.1.1 | 192.168.2.4 | 0xd2b | No error (0) | 104.26.1.139 | A (IP address) | IN (0x0001) | false | ||
| Mar 7, 2025 19:32:07.288652897 CET | 1.1.1.1 | 192.168.2.4 | 0xd2b | No error (0) | 172.67.68.60 | A (IP address) | IN (0x0001) | false | ||
| Mar 7, 2025 19:32:10.170098066 CET | 1.1.1.1 | 192.168.2.4 | 0xaa3c | No error (0) | 5.161.200.29 | A (IP address) | IN (0x0001) | false | ||
| Mar 7, 2025 19:32:22.617120028 CET | 1.1.1.1 | 192.168.2.4 | 0xdae4 | No error (0) | otelrules-bzhndjfje8dvh5fd.z01.azurefd.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 7, 2025 19:32:22.617120028 CET | 1.1.1.1 | 192.168.2.4 | 0xdae4 | No error (0) | star-azurefd-prod.trafficmanager.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 7, 2025 19:32:22.617120028 CET | 1.1.1.1 | 192.168.2.4 | 0xdae4 | No error (0) | shed.dual-low.s-part-0032.t-0009.t-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 7, 2025 19:32:22.617120028 CET | 1.1.1.1 | 192.168.2.4 | 0xdae4 | No error (0) | s-part-0032.t-0009.t-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 7, 2025 19:32:22.617120028 CET | 1.1.1.1 | 192.168.2.4 | 0xdae4 | No error (0) | 13.107.246.60 | A (IP address) | IN (0x0001) | false |
|
| Timestamp | Source IP | Source Port | Dest IP | Dest Port | Subject | Issuer | Not Before | Not After | JA3 SSL Client Fingerprint | JA3 SSL Client Digest |
|---|---|---|---|---|---|---|---|---|---|---|
| Mar 7, 2025 19:32:16.399915934 CET | 5.161.200.29 | 443 | 192.168.2.4 | 49728 | CN=st3.pro CN=R11, O=Let's Encrypt, C=US | CN=R11, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US | Mon Jan 13 16:48:51 CET 2025 Wed Mar 13 01:00:00 CET 2024 | Sun Apr 13 17:48:50 CEST 2025 Sat Mar 13 00:59:59 CET 2027 | 771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-65281,29-23-24,0 | 6271f898ce5be7dd52b0fc260d0662b3 |
| CN=R11, O=Let's Encrypt, C=US | CN=ISRG Root X1, O=Internet Security Research Group, C=US | Wed Mar 13 01:00:00 CET 2024 | Sat Mar 13 00:59:59 CET 2027 |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49727 | 104.26.0.139 | 443 | 7608 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 18:32:09 UTC | 234 | OUT | |
| 2025-03-07 18:32:10 UTC | 1044 | IN | |
| 2025-03-07 18:32:10 UTC | 45 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49729 | 13.107.246.60 | 443 | 7608 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 18:32:25 UTC | 226 | OUT | |
| 2025-03-07 18:32:26 UTC | 493 | IN | |
| 2025-03-07 18:32:26 UTC | 15891 | IN | |
| 2025-03-07 18:32:26 UTC | 16384 | IN | |
| 2025-03-07 18:32:26 UTC | 16384 | IN | |
| 2025-03-07 18:32:26 UTC | 16384 | IN | |
| 2025-03-07 18:32:26 UTC | 16384 | IN | |
| 2025-03-07 18:32:26 UTC | 16384 | IN | |
| 2025-03-07 18:32:26 UTC | 16384 | IN | |
| 2025-03-07 18:32:26 UTC | 16384 | IN | |
| 2025-03-07 18:32:26 UTC | 16384 | IN | |
| 2025-03-07 18:32:26 UTC | 16384 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.4 | 49731 | 13.107.246.60 | 443 | 7608 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 18:32:34 UTC | 214 | OUT | |
| 2025-03-07 18:32:35 UTC | 491 | IN | |
| 2025-03-07 18:32:35 UTC | 204 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.4 | 49730 | 13.107.246.60 | 443 | 7608 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 18:32:34 UTC | 214 | OUT | |
| 2025-03-07 18:32:35 UTC | 515 | IN | |
| 2025-03-07 18:32:35 UTC | 2128 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 13:31:12 |
| Start date: | 07/03/2025 |
| Path: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x40000 |
| File size: | 53'161'064 bytes |
| MD5 hash: | 4A871771235598812032C822E6F68F19 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 12 |
| Start time: | 13:32:18 |
| Start date: | 07/03/2025 |
| Path: | C:\Windows\splwow64.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7e3730000 |
| File size: | 163'840 bytes |
| MD5 hash: | 77DE7761B037061C7C112FD3C5B91E73 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 15 |
| Start time: | 13:32:44 |
| Start date: | 07/03/2025 |
| Path: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x40000 |
| File size: | 53'161'064 bytes |
| MD5 hash: | 4A871771235598812032C822E6F68F19 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
⊘No disassembly