Windows
Analysis Report
PastePictures 1.xla
Overview
General Information
Detection
Score: | 56 |
Range: | 0 - 100 |
Confidence: | 100% |
Signatures
Classification
- System is w10x64
EXCEL.EXE (PID: 7452 cmdline:
"C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\EXCEL .EXE" /aut omation -E mbedding MD5: 4A871771235598812032C822E6F68F19) splwow64.exe (PID: 8180 cmdline:
C:\Windows \splwow64. exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)
- cleanup
System Summary |
---|
Source: | Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: |
Source: | Author: X__Junior (Nextron Systems): |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2025-03-10T11:19:07.111068+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.6 | 49698 | 13.107.246.60 | 443 | TCP |
2025-03-10T11:19:14.347102+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.6 | 49700 | 13.107.246.60 | 443 | TCP |
2025-03-10T11:19:14.592660+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.6 | 49699 | 13.107.246.60 | 443 | TCP |
Click to jump to signature section
AV Detection |
---|
Source: | Avira: |
Source: | File opened: | Jump to behavior |
Source: | HTTPS traffic detected: |
Source: | Memory has grown: |
Source: | IP Address: |
Source: | JA3 fingerprint: |
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: |
Source: | UDP traffic detected without corresponding DNS query: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | DNS traffic detected: |
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: |
Source: | HTTPS traffic detected: |
System Summary |
---|
Source: | Stream path '_VBA_PROJECT_CUR/VBA/Module1' : | |||
Source: | Stream path '_VBA_PROJECT_CUR/VBA/thisWB' : | |||
Source: | OLE, VBA macro: | Name: HWID | ||
Source: | OLE, VBA macro: | Name: Workbook_Open | ||
Source: | Stream path '_VBA_PROJECT_CUR/VBA/Module1' : | |||
Source: | Stream path '_VBA_PROJECT_CUR/VBA/thisWB' : | |||
Source: | Stream path '_VBA_PROJECT_CUR/VBA/Module1' : | |||
Source: | Stream path '_VBA_PROJECT_CUR/VBA/thisWB' : |
Source: | COM Object queried: | Jump to behavior |
Source: | OLE, VBA macro line: | |||
Source: | OLE, VBA macro: | Name: Workbook_Open | ||
Source: | OLE, VBA macro line: | |||
Source: | OLE, VBA macro line: |
Source: | Classification label: |
Source: | File created: | Jump to behavior |
Source: | File created: | Jump to behavior |
Source: | File read: | Jump to behavior |
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | Jump to behavior |
Source: | Key value queried: | Jump to behavior |
Source: | Window found: | Jump to behavior |
Source: | Window detected: |
Source: | Key opened: | Jump to behavior |
Source: | Static file information: |
Source: | File opened: | Jump to behavior |
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior |
Source: | Window / User API: | Jump to behavior |
Source: | Last function: | ||
Source: | Last function: |
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior |
Source: | Process information queried: | Jump to behavior |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | 11 Scripting | Valid Accounts | Windows Management Instrumentation | 11 Scripting | 1 Process Injection | 1 Masquerading | OS Credential Dumping | 1 Process Discovery | Remote Services | Data from Local System | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 Extra Window Memory Injection | 1 Virtualization/Sandbox Evasion | LSASS Memory | 1 Virtualization/Sandbox Evasion | Remote Desktop Protocol | Data from Removable Media | 1 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 Process Injection | Security Account Manager | 1 Application Window Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 2 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Extra Window Memory Injection | NTDS | 1 File and Directory Discovery | Distributed Component Object Model | Input Capture | 3 Application Layer Protocol | Traffic Duplication | Data Destruction |
Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | Software Packing | LSA Secrets | 1 System Information Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
2% | Virustotal | Browse | ||
3% | ReversingLabs |
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
100% | Avira | HEUR/Macro.Downloader.PYA.Gen |
Name | IP | Active | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|---|
bg.microsoft.map.fastly.net | 199.232.214.172 | true | false | high | |
s-0005.dual-s-dc-msedge.net | 52.123.131.14 | true | false | high | |
s-part-0032.t-0009.t-msedge.net | 13.107.246.60 | true | false | high | |
otelrules.svc.static.microsoft | unknown | unknown | false | high |
Name | Malicious | Antivirus Detection | Reputation |
---|---|---|---|
false | high | ||
false | high | ||
false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
---|---|---|---|---|---|---|
13.107.246.60 | s-part-0032.t-0009.t-msedge.net | United States | 8068 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false |
Joe Sandbox version: | 42.0.0 Malachite |
Analysis ID: | 1633444 |
Start date and time: | 2025-03-10 11:16:52 +01:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 4m 47s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | defaultwindowsofficecookbook.jbs |
Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
Number of analysed new started processes analysed: | 9 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Sample name: | PastePictures 1.xla |
Detection: | MAL |
Classification: | mal56.winXLA@3/9@1/1 |
Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 23.60.203.209, 52.109.32.97, 52.109.28.47, 199.232.214.172, 20.42.73.31, 52.123.131.14, 20.190.160.4, 4.245.163.56
- Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live.com.akadns.net, onedscolprdeus21.eastus.cloudapp.azure.com, roaming.officeapps.live.com, dual-s-0005-office.config.skype.com, login.live.com, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, ukw-azsc-config.officeapps.live.com, c.pki.goog, wu-b-net.trafficmanager.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, osiprod-uks-buff-azsc-000.uksouth.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com, uks-azsc-000.roaming.officeapps.live.com, config.officeapps.live.com, e16604.f.akamaiedge.net, ecs.office.trafficmanager.net, europe.configsvc1.live.com.akadns.net
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing behavior information.
- Report size getting too big, too many NtCreateKey calls found.
- Report size getting too big, too many NtQueryAttributesFile calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Report size getting too big, too many NtReadVirtualMemory calls found.
- Report size getting too big, too many NtSetInformationFile calls found.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Time | Type | Description |
---|---|---|
06:18:59 | API Interceptor |
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
13.107.246.60 | Get hash | malicious | Unknown | Browse |
| |
Get hash | malicious | Unknown | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
s-part-0032.t-0009.t-msedge.net | Get hash | malicious | Unknown | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | DCRat | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | HTMLPhisher | Browse |
| ||
Get hash | malicious | Remcos | Browse |
| ||
s-0005.dual-s-dc-msedge.net | Get hash | malicious | Unknown | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | unknown | Browse |
| ||
Get hash | malicious | HTMLPhisher | Browse |
| ||
Get hash | malicious | Mimikatz | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
bg.microsoft.map.fastly.net | Get hash | malicious | Unknown | Browse |
| |
Get hash | malicious | Remcos, GuLoader | Browse |
| ||
Get hash | malicious | Remcos, GuLoader | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Remcos, GuLoader | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | CobaltStrike, Metasploit | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | LummaC Stealer | Browse |
| ||
Get hash | malicious | XWorm | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
MICROSOFT-CORP-MSN-AS-BLOCKUS | Get hash | malicious | Mirai, Moobot | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Mirai, Moobot | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
a0e9f5d64349fb13191bc781f81f42e1 | Get hash | malicious | LummaC Stealer | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | LummaC Stealer | Browse |
| ||
Get hash | malicious | LummaC Stealer | Browse |
| ||
Get hash | malicious | LummaC Stealer | Browse |
| ||
Get hash | malicious | LummaC Stealer | Browse |
| ||
Get hash | malicious | LummaC Stealer | Browse |
|
C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml
Download File
Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
File Type: | |
Category: | dropped |
Size (bytes): | 118 |
Entropy (8bit): | 3.5700810731231707 |
Encrypted: | false |
SSDEEP: | 3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq |
MD5: | 573220372DA4ED487441611079B623CD |
SHA1: | 8F9D967AC6EF34640F1F0845214FBC6994C0CB80 |
SHA-256: | BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D |
SHA-512: | F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7 |
Malicious: | false |
Reputation: | high, very likely benign file |
Preview: |
Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
File Type: | |
Category: | dropped |
Size (bytes): | 152056 |
Entropy (8bit): | 4.414520022182999 |
Encrypted: | false |
SSDEEP: | 1536:fmmH/zolWWpFpKKHAeedydju4HTbTuo+o5aQxJudUl9yhQL3ow:ft88WpFpKKHHedydFeo+oQLUlPow |
MD5: | 16357719C39AE4A77E24027CA89C8B75 |
SHA1: | 50DCAFC88649A069FDDEE75E6D37941B98E30C22 |
SHA-256: | BC3957B0616AEA36783F544023F33C5B00DD1215961D2A59A6C6D36C7D2998E3 |
SHA-512: | 23F6012C5EBF04DAEADBA0315AB7C55BA23F2C5659A9A769D31CF54059D830987A4C3707492B970D47B0AB4DE4FC6C3D46DC75BAD5C1DC6FD4024BCD7910813E |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
File Type: | |
Category: | dropped |
Size (bytes): | 139264 |
Entropy (8bit): | 2.2562883760995227 |
Encrypted: | false |
SSDEEP: | 768:KZkh+WxTYZi8hCNj2ang6ScT9ys+WR603DSCjurrmN9w/4ePgps:Gk5TYZiPNTRJ6sDSCSqMbgG |
MD5: | F878375E3F3DF932E600BEC53B4C2E9C |
SHA1: | 73FE25B6504181E740A16BE1903D7B8B84D9207D |
SHA-256: | D9F6BCCE8B58B99F60F3899BA0DB658B00CA6451B4A2CE831D04FB8E48F067B4 |
SHA-512: | 2E9C85F73EF3FA58EE63E22EAF0F876ACD07FE52D3C640A8BCE2D81AA9E42F6307B2A8C711B9D109F98098F3DB9F629AA056A36F4DC5CA40E9FF540ECC2B0BCE |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
File Type: | |
Category: | dropped |
Size (bytes): | 32768 |
Entropy (8bit): | 3.7384383069416565 |
Encrypted: | false |
SSDEEP: | 384:mNpb7dfBUKQnaA5qvZ/uZHrLYEq3G+D6trJ9quVX:8pbxfBU3boZ/uZH62VrTX |
MD5: | F983C65C3B3A40BB75162BE2C5054B8A |
SHA1: | 11E8E6CCD33C95931373D9FEAE32B0A3EE738163 |
SHA-256: | 164F5CCCE83D423D3F21AE64C8646BD9116F3404A049A7334AABB58EEA5C0F01 |
SHA-512: | 5F6D4FCC602D9FE21BB1D1A113D9698A1DA96B4B1ED5921AF035104F35D4E1C5002EA4F57830C0F9D465888354168B59E8FC2D13D3149487A63123B7735F2034 |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
File Type: | |
Category: | dropped |
Size (bytes): | 512 |
Entropy (8bit): | 0.0 |
Encrypted: | false |
SSDEEP: | 3:: |
MD5: | BF619EAC0CDF3F68D496EA9344137E8B |
SHA1: | 5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5 |
SHA-256: | 076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560 |
SHA-512: | DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE |
Malicious: | false |
Reputation: | high, very likely benign file |
Preview: |
Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
File Type: | |
Category: | dropped |
Size (bytes): | 512 |
Entropy (8bit): | 0.0 |
Encrypted: | false |
SSDEEP: | 3:: |
MD5: | BF619EAC0CDF3F68D496EA9344137E8B |
SHA1: | 5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5 |
SHA-256: | 076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560 |
SHA-512: | DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE |
Malicious: | false |
Reputation: | high, very likely benign file |
Preview: |
Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
File Type: | |
Category: | dropped |
Size (bytes): | 3039232 |
Entropy (8bit): | 3.5653222881085527 |
Encrypted: | false |
SSDEEP: | 12288:BrESVFJJqhJ7E1C9eyXQCJ9DeaQNkdNQQRtW+R9ikagBVbwlMbb9gQnqs7e7601y:tDV1axQVsBVMaCWQI/r7 |
MD5: | 1DCD224CD772538902EAA8F17BF5CD40 |
SHA1: | A2A564AD0D00320A75DFBD16690FC46C4B17B500 |
SHA-256: | 856E40B9DA85EF1A8838451C2C5D2EA2E51B440E4049E26C8B23C926AF8537C6 |
SHA-512: | B55310BC2C0BE34FF51A06FE1DF1BB7F406ABC8F6622883F35FD17B06BDC3E066455AE3E1E58371706D224A9AEF93A7C84B8009520D89B96EACF4EF2F3CF7E81 |
Malicious: | true |
Antivirus: |
|
Preview: |
Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
File Type: | |
Category: | dropped |
Size (bytes): | 28672 |
Entropy (8bit): | 2.982588495036166 |
Encrypted: | false |
SSDEEP: | 768:HLcKoSsxz1PDZLDZjlbR868O8KldzH3K7uDphYHceXVhca+fMHLtyeGxcbB8/dgq:HLcKoSsxz1PDZLDZjlbR868O8KlVH3Kq |
MD5: | AE8A9D3787FBE2BE331E651BE9B19A41 |
SHA1: | 261631AA5C5251BA7DC0326A767CBE15EE978852 |
SHA-256: | 55934578BFDCDB1C2B0F77A49DD4BE0BC64E4FC2E8B413FCDBA07857E5A2471B |
SHA-512: | 38E85F371DC955EB832B59D68643ABEC8F7B9659D825E39D35754AA9BC8AC714C1F007F13161605CCF2C15DDA7A70652CA1CDCF0D8858C76D7E3F2BACF2763E7 |
Malicious: | false |
Preview: |
Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
File Type: | |
Category: | dropped |
Size (bytes): | 3039232 |
Entropy (8bit): | 3.5653222881085527 |
Encrypted: | false |
SSDEEP: | 12288:BrESVFJJqhJ7E1C9eyXQCJ9DeaQNkdNQQRtW+R9ikagBVbwlMbb9gQnqs7e7601y:tDV1axQVsBVMaCWQI/r7 |
MD5: | 1DCD224CD772538902EAA8F17BF5CD40 |
SHA1: | A2A564AD0D00320A75DFBD16690FC46C4B17B500 |
SHA-256: | 856E40B9DA85EF1A8838451C2C5D2EA2E51B440E4049E26C8B23C926AF8537C6 |
SHA-512: | B55310BC2C0BE34FF51A06FE1DF1BB7F406ABC8F6622883F35FD17B06BDC3E066455AE3E1E58371706D224A9AEF93A7C84B8009520D89B96EACF4EF2F3CF7E81 |
Malicious: | true |
Preview: |
File type: | |
Entropy (8bit): | 3.5600350377931385 |
TrID: |
|
File name: | PastePictures 1.xla |
File size: | 3'037'696 bytes |
MD5: | c5c860ab09e407ff33e9e171f92feedd |
SHA1: | 7bb228762dccf79efd386efae2d1c37e7501f735 |
SHA256: | 7094f139fc7a3b89cb19b4fdf34e59dd74291e5c828739c5c8eb190dfc4a6e9b |
SHA512: | bb351d796e6b440dbcaa2111b77b6d008273a61b19b204c9966d0f15f176480a4f27b155982b9b457b0551e66a7988e93b59b7ce8c3fdfdf2ec162c4878fe886 |
SSDEEP: | 12288:4rESVFJJqhJ7E1C9eyXQCJ9DeaQNkdNQQRtW+R9ikagBVbwlMbb9gQnqs7e76019:wDV1axQVsBVMaCWQI/q |
TLSH: | 2DE5EBA055AB8680F61F95606DA8BB610272F1A3B9CB1F33133F6506DF9CD212EC6D4D |
File Content Preview: | ........................>.................../...................................b.......d.......f.......h.......j.......l.......n.......p.......r.......t.......v.......x.......z.......|.......~...............b.......d.......f.......h.......j.......l...... |
Icon Hash: | cbe126242426202b |
Document Type: | OLE |
Number of OLE Files: | 1 |
Has Summary Info: | |
Application Name: | Microsoft Excel |
Encrypted Document: | False |
Contains Word Document Stream: | False |
Contains Workbook/Book Stream: | True |
Contains PowerPoint Document Stream: | False |
Contains Visio Document Stream: | False |
Contains ObjectPool Stream: | False |
Flash Objects Count: | 0 |
Contains VBA Macros: | True |
Code Page: | 1251 |
Author: | |
Last Saved By: | |
Create Time: | 2023-04-03 16:54:13 |
Last Saved Time: | 2024-07-16 22:41:24 |
Creating Application: | |
Security: | 0 |
Document Code Page: | 1251 |
Thumbnail Scaling Desired: | False |
Contains Dirty Links: | False |
Shared Document: | False |
Changed Hyperlinks: | False |
Application Version: | 917504 |
General | |
Stream Path: | _VBA_PROJECT_CUR/VBA/FP |
VBA File Name: | FP.frm |
Stream Size: | 1171 |
Data ASCII: | . . . . . . . . V . . . . . . L . . . ] . . . . . . . . . . . . . . F J . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . ( . . . . . S < . . . . S < . . . . S < . . . . S < . . . . . . . . . . . 0 . { . D . 7 . A . 3 . E . 9 . B . D . - . |
Data Raw: | 01 16 03 00 00 f0 00 00 00 56 03 00 00 d4 00 00 00 4c 02 00 00 ff ff ff ff 5d 03 00 00 b1 03 00 00 00 00 00 00 01 00 00 00 46 bd 4a 17 00 00 ff ff 01 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
|
General | |
Stream Path: | _VBA_PROJECT_CUR/VBA/Module1 |
VBA File Name: | Module1.bas |
Stream Size: | 4249 |
Data ASCII: | . . . . . . . . B . . . . . . . . . K . . . / . . . . . . . . . . . F . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . . < 8 . . . . . . < J . . . . . . < . . . . . . . < . . . . . . . . . . . . . . . . . . . . . . |
Data Raw: | 01 16 03 00 00 f0 00 00 00 42 04 00 00 d4 00 00 00 b0 01 00 00 ff ff ff ff 4b 04 00 00 2f 0c 00 00 00 00 00 00 01 00 00 00 46 bd a6 9b 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
|
General | |
Stream Path: | _VBA_PROJECT_CUR/VBA/sh |
VBA File Name: | sh.cls |
Stream Size: | 987 |
Data ASCII: | . . . . . . . . . . . . . . . . . . . . . - . . . . . . . . . . . F ( w . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - |
Data Raw: | 01 16 03 00 00 f0 00 00 00 d2 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d9 02 00 00 2d 03 00 00 00 00 00 00 01 00 00 00 46 bd 28 77 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
|
General | |
Stream Path: | _VBA_PROJECT_CUR/VBA/thisWB |
VBA File Name: | thisWB.cls |
Stream Size: | 4749 |
Data ASCII: | . . . . . . . . . . . . . . ( . . . . . . w . . . . . . . . . . . F . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . ( . . . . P . . . . . S L . . . . S . . . . . S . . . . . < 8 . . . . . . < J . . . . . . < 0 . . . . . . < 8 . . . . . . |
Data Raw: | 01 16 03 00 00 f0 00 00 00 f2 04 00 00 d4 00 00 00 28 02 00 00 ff ff ff ff fb 04 00 00 77 0d 00 00 00 00 00 00 01 00 00 00 46 bd c6 c3 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
|
General | |
Stream Path: | \x1CompObj |
CLSID: | |
File Type: | data |
Stream Size: | 102 |
Entropy: | 4.176928665602674 |
Base64 Encoded: | True |
Data ASCII: | . . . . . . . . . . . . . . . . . . . F . . . . M i c r o s o f t E x c e l 2 0 0 3 . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . . |
Data Raw: | 01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 1a 00 00 00 cb e8 f1 f2 20 4d 69 63 72 6f 73 6f 66 74 20 45 78 63 65 6c 20 32 30 30 33 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
Stream Path: | \x5DocumentSummaryInformation |
CLSID: | |
File Type: | data |
Stream Size: | 216 |
Entropy: | 2.626699751943469 |
Base64 Encoded: | False |
Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . s h e e t . . . . . . . . . . . . . . . . . . . . . . . . . . |
Data Raw: | fe ff 00 00 06 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 a8 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 8a 00 00 00 02 00 00 00 e3 04 00 00 |
General | |
Stream Path: | \x5SummaryInformation |
CLSID: | |
File Type: | data |
Stream Size: | 216 |
Entropy: | 3.77063656648511 |
Base64 Encoded: | False |
Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . \\ . . . . . . . p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E x c e l V B A . r u . . . . . . . . . E x c e l V B A . r u . . . . . . . . . M i c r o s o f t E x c e l . @ . . . L f . @ . . . . _ I . . . . . . . . . |
Data Raw: | fe ff 00 00 06 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 a8 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 5c 00 00 00 12 00 00 00 70 00 00 00 0c 00 00 00 88 00 00 00 0d 00 00 00 94 00 00 00 13 00 00 00 a0 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 0c 00 00 00 |
General | |
Stream Path: | Workbook |
CLSID: | |
File Type: | Applesoft BASIC program data, first line number 16 |
Stream Size: | 2989725 |
Entropy: | 3.4726861081736584 |
Base64 Encoded: | True |
Data ASCII: | . . . . . . . . g 2 . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . E x c e l V B A . r u B . . . . a . . . . . . . . = . . . . . . . . . . . . . . t h i s W B . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . i . J 8 " < . . . . . . . X . @ . . . . . . . . . . " . . . . . . . |
Data Raw: | 09 08 10 00 00 06 05 00 67 32 cd 07 c9 80 01 00 06 06 00 00 87 00 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 0b 00 00 45 78 63 65 6c 56 42 41 2e 72 75 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |
General | |
Stream Path: | _VBA_PROJECT_CUR/FP/\x1CompObj |
CLSID: | |
File Type: | data |
Stream Size: | 97 |
Entropy: | 3.6106491830605214 |
Base64 Encoded: | False |
Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t F o r m s 2 . 0 F o r m . . . . . E m b e d d e d O b j e c t . . . . . 9 q . . . . . . . . . . . . |
Data Raw: | 01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 46 6f 72 6d 73 20 32 2e 30 20 46 6f 72 6d 00 10 00 00 00 45 6d 62 65 64 64 65 64 20 4f 62 6a 65 63 74 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
Stream Path: | _VBA_PROJECT_CUR/FP/\x3VBFrame |
CLSID: | |
File Type: | ASCII text, with CRLF line terminators |
Stream Size: | 282 |
Entropy: | 4.560235679208743 |
Base64 Encoded: | True |
Data ASCII: | V E R S I O N 5 . 0 0 . . B e g i n { C 6 2 A 6 9 F 0 - 1 6 D C - 1 1 C E - 9 E 9 8 - 0 0 A A 0 0 5 7 4 A 4 F } F P . . C l i e n t H e i g h t = 6 4 5 . . C l i e n t L e f t = 4 5 . . C l i e n t T o p = 3 7 5 . . C l i e n t W i d t h = 4 2 4 5 . . S h o w M o d a l = 0 ' F a l s e . . S t a r t U p P o s i t i o n = 1 ' C e n t e r O w n e r . . T y |
Data Raw: | 56 45 52 53 49 4f 4e 20 35 2e 30 30 0d 0a 42 65 67 69 6e 20 7b 43 36 32 41 36 39 46 30 2d 31 36 44 43 2d 31 31 43 45 2d 39 45 39 38 2d 30 30 41 41 30 30 35 37 34 41 34 46 7d 20 46 50 20 0d 0a 20 20 20 43 6c 69 65 6e 74 48 65 69 67 68 74 20 20 20 20 3d 20 20 20 36 34 35 0d 0a 20 20 20 43 6c 69 65 6e 74 4c 65 66 74 20 20 20 20 20 20 3d 20 20 20 34 35 0d 0a 20 20 20 43 6c 69 65 6e 74 |
General | |
Stream Path: | _VBA_PROJECT_CUR/FP/f |
CLSID: | |
File Type: | data |
Stream Size: | 191 |
Entropy: | 3.6055730692137606 |
Base64 Encoded: | False |
Data ASCII: | . . ( . H . . . . . . . . @ . . . . . . . . . } . . @ . . . r . . . . . . . . . . . . R . . . . K Q . . . . D B . . . T a h o m a . . . . . . X . . . . . o . . ( . . . . . . . . . . . 2 . . . 0 . . . . . . . P r B a r . . . . . . { . . . . . $ . . . . . . . . . . . 2 . . . 0 . . . . . . . T e x t . . . . . . . . . . . . . . . . . . . . |
Data Raw: | 00 04 28 00 48 0c 10 0c 03 00 00 00 04 40 00 00 ff ff 00 00 05 00 00 00 00 7d 00 00 40 1d 00 00 72 04 00 00 00 00 00 00 00 00 00 00 03 52 e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b8 51 01 cc 00 00 90 01 44 42 01 00 06 54 61 68 6f 6d 61 00 00 02 00 00 00 58 00 00 00 00 82 01 6f 00 00 28 00 f5 01 00 00 05 00 00 80 01 00 00 00 32 00 00 00 30 00 00 00 00 00 11 00 50 72 42 61 72 00 00 00 d4 |
General | |
Stream Path: | _VBA_PROJECT_CUR/FP/o |
CLSID: | |
File Type: | Intel ia64 COFF object file, not stripped, 16 sections, symbol offset=0xff00, 7056 symbols, optional header size 344, created Thu Jan 1 00:00:34 1970 |
Stream Size: | 96 |
Entropy: | 3.0687296366895245 |
Base64 Encoded: | False |
Data ASCII: | . . . . " . . . . . . . . . X . . . . . . . u . . . . . . . . . . . . T a h o m a . . . . . . $ . . . . . . & . . . . . . . . . . 5 . . . . . . . . . . . . . T a h o m a . . |
Data Raw: | 00 02 10 00 22 00 00 00 00 ff 00 00 90 1b 00 00 58 01 00 00 00 02 18 00 75 00 00 00 06 00 00 80 a5 00 00 00 cc 02 03 00 54 61 68 6f 6d 61 00 00 00 02 10 00 24 00 00 00 13 00 80 00 26 1b 00 00 a7 01 00 00 00 02 18 00 35 00 00 00 06 00 00 80 a5 00 00 00 00 02 00 00 54 61 68 6f 6d 61 00 00 |
General | |
Stream Path: | _VBA_PROJECT_CUR/PROJECT |
CLSID: | |
File Type: | ASCII text, with CRLF line terminators |
Stream Size: | 515 |
Entropy: | 5.297845384204525 |
Base64 Encoded: | True |
Data ASCII: | I D = " { 7 F 5 9 F F 6 B - 0 E C F - 4 9 5 0 - 9 2 9 7 - 7 4 C 7 8 2 4 A 2 F D 7 } " . . D o c u m e n t = t h i s W B / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = s h / & H 0 0 0 0 0 0 0 0 . . B a s e C l a s s = F P . . M o d u l e = M o d u l e 1 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 7 2 7 0 8 F 8 C 7 4 9 0 7 4 9 0 7 4 9 0 7 4 9 0 " . . D P B = " 5 3 5 1 A E A F 8 E B 0 8 E B 0 8 E " . . |
Data Raw: | 49 44 3d 22 7b 37 46 35 39 46 46 36 42 2d 30 45 43 46 2d 34 39 35 30 2d 39 32 39 37 2d 37 34 43 37 38 32 34 41 32 46 44 37 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 74 68 69 73 57 42 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 73 68 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 42 61 73 65 43 6c 61 73 73 3d 46 50 0d 0a 4d 6f 64 75 6c 65 3d 4d 6f 64 75 6c 65 31 0d 0a 4e |
General | |
Stream Path: | _VBA_PROJECT_CUR/PROJECTwm |
CLSID: | |
File Type: | data |
Stream Size: | 65 |
Entropy: | 3.0134434188439445 |
Base64 Encoded: | False |
Data ASCII: | t h i s W B . t . h . i . s . W . B . . . s h . s . h . . . F P . F . P . . . M o d u l e 1 . M . o . d . u . l . e . 1 . . . . . |
Data Raw: | 74 68 69 73 57 42 00 74 00 68 00 69 00 73 00 57 00 42 00 00 00 73 68 00 73 00 68 00 00 00 46 50 00 46 00 50 00 00 00 4d 6f 64 75 6c 65 31 00 4d 00 6f 00 64 00 75 00 6c 00 65 00 31 00 00 00 00 00 |
General | |
Stream Path: | _VBA_PROJECT_CUR/VBA/_VBA_PROJECT |
CLSID: | |
File Type: | data |
Stream Size: | 3977 |
Entropy: | 4.507299088638643 |
Base64 Encoded: | False |
Data ASCII: | a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 1 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 1 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 7 . \\ . V . B . E . 7 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r . |
Data Raw: | cc 61 9a 00 00 03 00 ff 19 04 00 00 09 04 00 00 e3 04 03 00 00 00 00 00 00 00 00 00 01 00 06 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 31 00 23 00 |
General | |
Stream Path: | _VBA_PROJECT_CUR/VBA/dir |
CLSID: | |
File Type: | Apollo m68k COFF executable not stripped - version 18435 |
Stream Size: | 923 |
Entropy: | 6.512383334584636 |
Base64 Encoded: | True |
Data ASCII: | . . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . k . h . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ s y s t e m 3 2 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2 E |
Data Raw: | 01 97 b3 80 01 00 04 00 00 00 03 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e3 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 6b d5 a7 68 07 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47 |
Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
---|---|---|---|---|---|---|---|---|
2025-03-10T11:19:07.111068+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.6 | 49698 | 13.107.246.60 | 443 | TCP |
2025-03-10T11:19:14.347102+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.6 | 49700 | 13.107.246.60 | 443 | TCP |
2025-03-10T11:19:14.592660+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.6 | 49699 | 13.107.246.60 | 443 | TCP |
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Mar 10, 2025 11:19:04.974601030 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:04.974654913 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:04.974735022 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:04.975145102 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:04.975163937 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.110894918 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.111068010 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:07.112643957 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:07.112653971 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.112890959 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.114545107 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:07.160315037 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.796015024 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.796045065 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.796066999 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.796113968 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:07.796133995 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.796168089 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:07.796183109 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:07.873275042 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.873311043 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.873359919 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:07.873377085 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.873406887 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:07.873424053 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:07.905649900 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.905698061 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.905730963 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:07.905740023 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.905775070 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:07.905786037 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:07.949044943 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.949065924 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.949150085 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:07.949166059 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.949203968 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:07.970211029 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.970231056 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.970289946 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:07.970299959 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.970329046 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:07.970351934 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:07.988873959 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.988894939 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.988969088 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:07.988996983 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:07.989067078 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.011436939 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.011456966 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.011514902 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.011521101 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.011615038 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.040381908 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.040400982 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.040465117 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.040488005 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.040600061 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.051134109 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.051156044 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.051207066 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.051213026 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.051315069 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.065202951 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.065222979 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.065268040 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.065274000 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.065308094 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.065315962 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.074354887 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.074372053 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.074425936 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.074434042 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.074557066 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.088201046 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.088275909 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.088289022 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.088310003 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.088324070 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.088402033 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.097543955 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.097593069 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.097615957 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.097624063 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.097651958 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.097660065 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.105042934 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.105088949 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.105107069 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.105114937 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.105150938 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.105150938 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.115545988 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.115567923 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.115609884 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.115617037 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.115644932 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.115658998 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.132711887 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.132735968 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.132776976 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.132786036 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.132807016 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.132818937 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.136096954 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.136118889 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.136154890 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.136162043 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.136183977 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.136200905 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.151791096 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.151810884 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.151873112 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.151884079 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.151912928 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.151921988 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.164232969 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.164258003 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.164303064 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.164315939 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.164334059 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.164352894 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.175249100 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.175282001 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.175313950 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.175322056 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.175347090 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.175362110 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.184325933 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.184349060 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.184391975 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.184406042 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.184431076 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.184446096 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.194550037 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.194576025 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.194613934 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.194622993 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.194647074 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.194660902 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.202847004 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.202867031 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.202907085 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.202914953 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.202941895 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.202950001 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.225363016 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.225397110 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.225450993 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.225460052 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.225617886 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.225966930 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.225990057 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.226033926 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.226042032 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.226058960 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.226082087 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.243423939 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.243446112 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.243496895 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.243505001 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.243539095 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.243546963 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.256499052 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.256520033 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.256570101 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.256577015 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.256609917 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.256623030 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.267712116 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.267733097 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.267797947 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.267812967 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.267838955 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.267852068 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.279052019 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.279074907 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.279126883 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.279135942 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.279165030 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.279184103 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.287619114 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.287640095 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.287708998 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.287717104 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.287797928 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.295999050 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.296020031 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.296066046 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.296073914 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.296106100 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.296125889 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.317270041 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.317298889 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.317342997 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.317353964 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.317389011 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.317409039 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.318836927 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.318857908 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.318897009 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.318906069 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.318933010 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.318947077 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.348483086 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.348507881 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.348556995 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.348572969 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.348603010 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.348613024 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.350649118 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.350671053 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.350718975 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.350728035 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.350775957 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.359261990 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.359287024 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.359317064 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.359324932 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.359355927 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.359369040 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.369740963 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.369761944 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.369810104 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.369818926 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.369841099 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.369859934 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.379339933 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.379360914 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.379405975 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.379414082 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.379451990 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.379462004 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.386426926 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.386456013 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.386507988 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.386518002 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.386547089 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.386568069 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.408277988 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.408298969 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.408338070 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.408345938 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.408380032 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.408392906 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.410128117 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.410149097 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.410193920 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.410201073 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.410229921 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.410244942 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.427059889 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.427082062 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.427134991 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.427144051 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.427190065 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.438836098 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.438858032 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.438899040 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.438905954 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.438951015 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.438966036 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.450519085 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.450541973 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.450587034 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.450602055 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.450615883 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.450643063 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.461807966 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.461827993 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.461863995 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.461875916 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.461911917 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.461925983 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.470494986 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.470515966 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.470594883 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.470594883 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.470602989 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.470671892 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.479688883 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.479711056 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.479779959 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.479788065 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.479983091 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.500119925 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.500139952 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.500220060 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.500220060 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.500226974 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.500304937 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.502635002 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.502662897 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.502820969 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.502834082 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.502952099 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.520976067 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.520997047 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.521246910 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.521264076 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.521406889 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.532759905 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.532780886 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.532872915 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.532874107 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.532886028 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.533029079 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.544409037 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.544431925 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.544514894 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.544514894 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.544528008 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.544658899 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.556009054 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.556030035 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.556061983 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.556209087 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.556216955 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.556365967 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.564201117 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.564229012 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.564321995 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.564321995 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.564333916 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.564467907 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.570848942 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.570873022 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.570955992 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.570955992 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.570966005 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.571074009 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.592530966 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.592554092 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.592628002 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.592628002 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.592641115 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.592761040 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.594075918 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.594099998 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.594135046 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.594142914 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.594187975 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.594187975 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.610444069 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.610466957 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.610598087 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.610598087 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.610611916 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.610698938 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.622951984 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.622989893 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.623027086 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.623035908 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.623069048 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.623142958 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.634651899 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.634675026 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.634756088 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.634756088 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.634763956 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.634896040 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.645535946 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.645560026 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.645639896 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.645639896 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.645648956 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.645829916 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.654608965 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.654632092 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.654743910 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.654755116 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.654804945 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.662585020 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.662607908 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.662702084 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.662702084 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.662710905 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.662833929 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.684346914 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.684374094 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.684442043 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.684442043 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.684453964 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.685038090 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.686245918 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.686275005 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.686314106 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.686321020 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.686351061 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.686445951 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.702610970 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.702632904 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.702707052 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.702708006 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.702723026 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.702960968 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.715051889 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.715082884 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.715122938 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.715137005 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.715163946 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.715296030 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.726845980 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.726875067 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.726943970 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.726954937 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.726967096 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.727035046 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.729876995 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.729963064 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.730053902 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.730129957 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.730139971 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:08.730163097 CET | 49698 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:08.730169058 CET | 443 | 49698 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:12.254590988 CET | 49699 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:12.254632950 CET | 443 | 49699 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:12.254745007 CET | 49699 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:12.254940987 CET | 49699 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:12.254951954 CET | 443 | 49699 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:12.255935907 CET | 49700 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:12.256028891 CET | 443 | 49700 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:12.256112099 CET | 49700 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:12.256349087 CET | 49700 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:12.256383896 CET | 443 | 49700 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:14.346307039 CET | 443 | 49700 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:14.347101927 CET | 49700 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:14.347157955 CET | 443 | 49700 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:14.348006964 CET | 49700 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:14.348018885 CET | 443 | 49700 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:14.591782093 CET | 443 | 49699 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:14.592659950 CET | 49699 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:14.592695951 CET | 443 | 49699 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:14.593913078 CET | 49699 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:14.593919992 CET | 443 | 49699 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:14.878257036 CET | 443 | 49700 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:14.878325939 CET | 443 | 49700 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:14.878509045 CET | 49700 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:14.878823996 CET | 49700 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:14.878865957 CET | 443 | 49700 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:14.878895044 CET | 49700 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:14.878911972 CET | 443 | 49700 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:15.400130987 CET | 443 | 49699 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:15.400187016 CET | 443 | 49699 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:15.400352955 CET | 443 | 49699 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:15.400358915 CET | 49699 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:15.400409937 CET | 49699 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:15.400867939 CET | 49699 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:15.400887012 CET | 443 | 49699 | 13.107.246.60 | 192.168.2.6 |
Mar 10, 2025 11:19:15.400896072 CET | 49699 | 443 | 192.168.2.6 | 13.107.246.60 |
Mar 10, 2025 11:19:15.400901079 CET | 443 | 49699 | 13.107.246.60 | 192.168.2.6 |
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Mar 10, 2025 11:19:04.963735104 CET | 59251 | 53 | 192.168.2.6 | 1.1.1.1 |
Mar 10, 2025 11:19:04.973263025 CET | 53 | 59251 | 1.1.1.1 | 192.168.2.6 |
Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|
Mar 10, 2025 11:19:04.963735104 CET | 192.168.2.6 | 1.1.1.1 | 0x2978 | Standard query (0) | A (IP address) | IN (0x0001) | false |
Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|---|---|
Mar 10, 2025 11:18:02.768551111 CET | 1.1.1.1 | 192.168.2.6 | 0xa724 | No error (0) | shed.s-0005.dual-s-dc-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Mar 10, 2025 11:18:02.768551111 CET | 1.1.1.1 | 192.168.2.6 | 0xa724 | No error (0) | s-0005.dual-s-dc-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Mar 10, 2025 11:18:02.768551111 CET | 1.1.1.1 | 192.168.2.6 | 0xa724 | No error (0) | 52.123.131.14 | A (IP address) | IN (0x0001) | false | ||
Mar 10, 2025 11:18:02.768551111 CET | 1.1.1.1 | 192.168.2.6 | 0xa724 | No error (0) | 52.123.130.14 | A (IP address) | IN (0x0001) | false | ||
Mar 10, 2025 11:18:05.527842045 CET | 1.1.1.1 | 192.168.2.6 | 0x2d1e | No error (0) | 199.232.214.172 | A (IP address) | IN (0x0001) | false | ||
Mar 10, 2025 11:18:05.527842045 CET | 1.1.1.1 | 192.168.2.6 | 0x2d1e | No error (0) | 199.232.210.172 | A (IP address) | IN (0x0001) | false | ||
Mar 10, 2025 11:19:04.973263025 CET | 1.1.1.1 | 192.168.2.6 | 0x2978 | No error (0) | otelrules-bzhndjfje8dvh5fd.z01.azurefd.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Mar 10, 2025 11:19:04.973263025 CET | 1.1.1.1 | 192.168.2.6 | 0x2978 | No error (0) | star-azurefd-prod.trafficmanager.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Mar 10, 2025 11:19:04.973263025 CET | 1.1.1.1 | 192.168.2.6 | 0x2978 | No error (0) | shed.dual-low.s-part-0032.t-0009.t-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Mar 10, 2025 11:19:04.973263025 CET | 1.1.1.1 | 192.168.2.6 | 0x2978 | No error (0) | s-part-0032.t-0009.t-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
Mar 10, 2025 11:19:04.973263025 CET | 1.1.1.1 | 192.168.2.6 | 0x2978 | No error (0) | 13.107.246.60 | A (IP address) | IN (0x0001) | false |
|
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
0 | 192.168.2.6 | 49698 | 13.107.246.60 | 443 | 7452 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2025-03-10 10:19:07 UTC | 226 | OUT | |
2025-03-10 10:19:07 UTC | 500 | IN | |
2025-03-10 10:19:07 UTC | 15884 | IN | |
2025-03-10 10:19:07 UTC | 16384 | IN | |
2025-03-10 10:19:07 UTC | 16384 | IN | |
2025-03-10 10:19:07 UTC | 16384 | IN | |
2025-03-10 10:19:07 UTC | 16384 | IN | |
2025-03-10 10:19:07 UTC | 16384 | IN | |
2025-03-10 10:19:08 UTC | 16384 | IN | |
2025-03-10 10:19:08 UTC | 16384 | IN | |
2025-03-10 10:19:08 UTC | 16384 | IN | |
2025-03-10 10:19:08 UTC | 16384 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
1 | 192.168.2.6 | 49700 | 13.107.246.60 | 443 | 7452 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2025-03-10 10:19:14 UTC | 214 | OUT | |
2025-03-10 10:19:14 UTC | 498 | IN | |
2025-03-10 10:19:14 UTC | 204 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
2 | 192.168.2.6 | 49699 | 13.107.246.60 | 443 | 7452 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2025-03-10 10:19:14 UTC | 214 | OUT | |
2025-03-10 10:19:15 UTC | 495 | IN | |
2025-03-10 10:19:15 UTC | 2128 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
Target ID: | 0 |
Start time: | 06:17:55 |
Start date: | 10/03/2025 |
Path: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x270000 |
File size: | 53'161'064 bytes |
MD5 hash: | 4A871771235598812032C822E6F68F19 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | false |
Target ID: | 6 |
Start time: | 06:18:59 |
Start date: | 10/03/2025 |
Path: | C:\Windows\splwow64.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff7a3c60000 |
File size: | 163'840 bytes |
MD5 hash: | 77DE7761B037061C7C112FD3C5B91E73 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | false |
Call Graph
Graph
- Entrypoint
- Decryption Function
- Executed
- Not Executed
- Show Help
Module: FP
Declaration
Line | Content |
---|---|
1 | Attribute VB_Name = "FP" |
2 | Attribute VB_Base = "0{D7A3E9BD-4315-4980-8EEA-60C05984219D}{F2CC75FE-BBD7-42FB-B9BD-4AC6B65E7C71}" |
3 | Attribute VB_GlobalNameSpace = False |
4 | Attribute VB_Creatable = False |
5 | Attribute VB_PredeclaredId = True |
6 | Attribute VB_Exposed = False |
7 | Attribute VB_TemplateDerived = False |
8 | Attribute VB_Customizable = False |
Module: Module1
Declaration
Line | Content |
---|---|
1 | Attribute VB_Name = "Module1" |
APIs | Meta Information |
---|---|
FileSystemObject | |
FullName | |
Range | |
Range | |
Range | |
End | |
xlUp | |
Rows | |
MsgBox | |
vbCritical | |
Value | |
Fix | |
UBound | |
DisplayAlerts | |
Saved | |
ChangeFileAccess | |
SetAttr | |
vbNormal | |
GetFile | |
Saved | |
Show | |
Caption | |
PrBar | |
Repaint | |
Text | |
LBound | |
UBound | |
Format | |
UBound | |
Text | |
Percent$ | |
PrBar | |
Val | |
Repaint | |
Len | Len( |