Edit tour
Windows
Analysis Report
Purchase Inquiry.xla.xlsx
Overview
General Information
| Sample name: | Purchase Inquiry.xla.xlsx |
| Analysis ID: | 1635383 |
| MD5: | 276274b804683f9b015af1af8d4fcd68 |
| SHA1: | 82c4589b4714ba3682733ca3fc260fdc80ae2465 |
| SHA256: | 700b86b936426ac3bb8ab4d38d84e3019f7840cdd6340b22f4dd3e358e1a122d |
| Tags: | xlsxuser-lowmal3 |
| Infos: |  |
 | |
Detection
| Score: | 60 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Excel sheet contains many unusual embedded objects
Document embeds suspicious OLE2 link
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Suricata IDS alerts with low severity for network traffic
Unable to load, office file is protected or invalid
Uses a known web browser user agent for HTTP communication
Classification
- System is w10x64
EXCEL.EXE (PID: 7148 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\EXCEL .EXE" /aut omation -E mbedding MD5: 4A871771235598812032C822E6F68F19) 
splwow64.exe (PID: 8012 cmdline: C:\Windows \splwow64. exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)
- EXCEL.EXE (PID: 6888 cmdline:
"C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\EXCEL .EXE" "C:\ Users\user \Desktop\P urchase In quiry.xla. xlsx" MD5: 4A871771235598812032C822E6F68F19)
- cleanup
⊘No configs have been found
⊘No yara matches
System Summary |   |
|---|
| Source: | Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: | ||
| Source: | Author: X__Junior (Nextron Systems): | ||
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-03-11T16:20:11.206516+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 49704 | 13.107.246.67 | 443 | TCP |
| 2025-03-11T16:20:19.161423+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 49707 | 13.107.246.67 | 443 | TCP |
| 2025-03-11T16:20:19.193562+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.8 | 49706 | 13.107.246.67 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Avira: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | File opened: | Jump to behavior | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
System Summary | |
|---|
| Source: | OLE: | ||
| Source: | OLE: | ||
| Source: | OLE: | ||
| Source: | OLE: | ||
| Source: | Stream path 'MBD00938692/\x1Ole' : | ||
| Source: | Stream path 'MBD00938692/\x1Ole' : | ||
| Source: | Window title found: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | OLE indicator, Workbook stream: | ||
| Source: | OLE indicator, Workbook stream: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Static file information: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Stream path 'Workbook' entropy: | ||
| Source: | Stream path 'Workbook' entropy: | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Process information queried: | Jump to behavior | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 3 Exploitation for Client Execution | Path Interception | 1 Process Injection | 2 Masquerading | OS Credential Dumping | 1 Process Discovery | Remote Services | Data from Local System | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | 1 Virtualization/Sandbox Evasion | LSASS Memory | 1 Virtualization/Sandbox Evasion | Remote Desktop Protocol | Data from Removable Media | 3 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 Process Injection | Security Account Manager | 1 Application Window Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Obfuscated Files or Information | NTDS | 1 File and Directory Discovery | Distributed Component Object Model | Input Capture | 14 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | Software Packing | LSA Secrets | 1 System Information Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 24% | Virustotal | Browse | ||
| 29% | ReversingLabs | Win32.Exploit.CVE-2017-0199 | ||
| 100% | Avira | EXP/CVE-2017-0199.vvvnm |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| bg.microsoft.map.fastly.net | 199.232.214.172 | true | false | high | |
| st3.pro | 5.161.200.29 | true | false | high | |
| s-0005.dual-s-dc-msedge.net | 52.123.131.14 | true | false | high | |
| s-part-0039.t-0009.t-msedge.net | 13.107.246.67 | true | false | high | |
| service-eks-nlb-public-0b7cb0a32741e125.elb.ap-northeast-2.amazonaws.com | 3.39.153.44 | true | false | high | |
| otelrules.svc.static.microsoft | unknown | unknown | false | high | |
| link.saja.market | unknown | unknown | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high | ||
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown | |
| false | high | ||
| false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 13.107.246.67 | s-part-0039.t-0009.t-msedge.net | United States | 8068 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 3.39.153.44 | service-eks-nlb-public-0b7cb0a32741e125.elb.ap-northeast-2.amazonaws.com | United States | 8987 | AMAZONEXPANSIONGB | false | |
| 5.161.200.29 | st3.pro | Germany | 24940 | HETZNER-ASDE | false |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1635383 |
| Start date and time: | 2025-03-11 16:17:51 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 5m 28s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultwindowsofficecookbook.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 19 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | Purchase Inquiry.xla.xlsx |
| Detection: | MAL |
| Classification: | mal60.winXLSX@4/8@3/3 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 52.109.32.97, 23.60.203.209, 52.109.89.19, 20.189.173.3, 199.232.214.172, 52.109.76.240, 13.89.179.13, 52.123.131.14, 20.109.210.53, 40.126.31.67
- Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, weu-azsc-000.roaming.officeapps.live.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, eur.roaming1.live.com.akadns.net, mobile.events.data.microsoft.com, roaming.officeapps.live.com, osiprod-weu-buff-azsc-000.westeurope.cloudapp.azure.com, dual-s-0005-office.config.skype.com, onedscolprdcus21.centralus.cloudapp.azure.com, login.live.com, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, prod.fs.microsoft.com.akadns.net, c.pki.goog, wu-b-net.trafficmanager.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, onedscolprdwus02.westus.cloudapp.azure.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, fe3cr.delivery.mp.microsoft.com, neu-azsc-config.officeapps.live.com, config.officeapps.live.
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtCreateKey calls found.
- Report size getting too big, too many NtQueryAttributesFile calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Report size getting too big, too many NtReadVirtualMemory calls found.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
| Time | Type | Description |
|---|---|---|
| 11:20:12 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 13.107.246.67 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | KillMBR | Browse | |||
| Get hash | malicious | KnowBe4 | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| 3.39.153.44 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| 5.161.200.29 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| s-part-0039.t-0009.t-msedge.net | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | KillMBR | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | KnowBe4 | Browse |
| ||
| s-0005.dual-s-dc-msedge.net | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | KnowBe4 | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | PureLog Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| bg.microsoft.map.fastly.net | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | PureCrypter, AsyncRAT | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | DarkVision Rat | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| st3.pro | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| MICROSOFT-CORP-MSN-AS-BLOCKUS | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Invisible JS, Tycoon2FA | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| HETZNER-ASDE | Get hash | malicious | DanaBot | Browse |
| |
| Get hash | malicious | DanaBot | Browse |
| ||
| Get hash | malicious | DanaBot | Browse |
| ||
| Get hash | malicious | Prometei | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Prometei | Browse |
| ||
| Get hash | malicious | Prometei | Browse |
| ||
| Get hash | malicious | Prometei | Browse |
| ||
| Get hash | malicious | Prometei | Browse |
| ||
| AMAZONEXPANSIONGB | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | CAPTCHA Scam ClickFix | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 6271f898ce5be7dd52b0fc260d0662b3 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | DarkVision Rat | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | CAPTCHA Scam ClickFix | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| a0e9f5d64349fb13191bc781f81f42e1 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | PrivateLoader | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | DarkVision Rat | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
|
⊘No context
C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 118 |
| Entropy (8bit): | 3.5700810731231707 |
| Encrypted: | false |
| SSDEEP: | 3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq |
| MD5: | 573220372DA4ED487441611079B623CD |
| SHA1: | 8F9D967AC6EF34640F1F0845214FBC6994C0CB80 |
| SHA-256: | BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D |
| SHA-512: | F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 784 |
| Entropy (8bit): | 2.7137690747287806 |
| Encrypted: | false |
| SSDEEP: | 24:YIrNvpKAzLRwcfHGF8AJp9WtAZRJ5poIHWI:YmbfzLmc88AJtfJ52IHV |
| MD5: | 09F73B3902CD3D88E04312787956B654 |
| SHA1: | A6C275F1A65DB02D8A752C614C27E88326447C41 |
| SHA-256: | 72971990E5DC57AC8F4F27701158F6DC16E235814EA17DECA95E59CF5F60BC26 |
| SHA-512: | 6A68530BA4D4413B587E340CF871162036B6AC60AC0F969C07C70967C3102ADDE3C895BA6F1E2590D9D0C98C253ADFA33CA84E65106C3B56F506FE0E06F0ADA9 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 675840 |
| Entropy (8bit): | 0.658948567426688 |
| Encrypted: | false |
| SSDEEP: | 1536:7CCCh/88zeJPtV8S1Qv8sbckzQoegOya/WW/9BZ7VU:mOyrW/9BZS |
| MD5: | 08B646E1AA3C4D67F4CA43D4502F5027 |
| SHA1: | CAECE924A4145F7F778BD5D496C878E3A9187EB8 |
| SHA-256: | F5980432AD64AB271D3BED9364B91FB695788FA34849DE854E536B5C3CE41095 |
| SHA-512: | 5B14319B55DF59E78B20A8CD2B4DA020CDF92BD0B3D7042FEC9D664C6DC6C7F6DD4C43064B6CBF6C1B84E2E3FCD1148537EB17F00A5A226964EA306C9F65868C |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 512 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | 3:: |
| MD5: | BF619EAC0CDF3F68D496EA9344137E8B |
| SHA1: | 5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5 |
| SHA-256: | 076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560 |
| SHA-512: | DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1272832 |
| Entropy (8bit): | 7.872217778705129 |
| Encrypted: | false |
| SSDEEP: | 24576:jLDfEc/yraCIhIFly2G7qXHFBkb82yjaQIaPYWFDh1RJAV8ySrxI:bjyGdhIFdGcFB682yjaQImLJhNI |
| MD5: | 6C29420999C8912D2981B5305ED6C603 |
| SHA1: | 1BA913D0239B21E1258C0550E97DEE18B24982E7 |
| SHA-256: | 90C69DDCB06EEB40053296176D7F3CA6E121471F61624A79992D576FF480C8A0 |
| SHA-512: | 878875FCFAF84B16460182E5F0821CE13792CD366CB290A980FC11CC87784158EC2CF47761747AC38CC1CA81BF690F2188039DD2675A6A9A7DAB4287C0FA965D |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | 3:ggPYV:rPYV |
| MD5: | 187F488E27DB4AF347237FE461A079AD |
| SHA1: | 6693BA299EC1881249D59262276A0D2CB21F8E64 |
| SHA-256: | 255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309 |
| SHA-512: | 89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1272832 |
| Entropy (8bit): | 7.872217778705129 |
| Encrypted: | false |
| SSDEEP: | 24576:jLDfEc/yraCIhIFly2G7qXHFBkb82yjaQIaPYWFDh1RJAV8ySrxI:bjyGdhIFdGcFB682yjaQImLJhNI |
| MD5: | 6C29420999C8912D2981B5305ED6C603 |
| SHA1: | 1BA913D0239B21E1258C0550E97DEE18B24982E7 |
| SHA-256: | 90C69DDCB06EEB40053296176D7F3CA6E121471F61624A79992D576FF480C8A0 |
| SHA-512: | 878875FCFAF84B16460182E5F0821CE13792CD366CB290A980FC11CC87784158EC2CF47761747AC38CC1CA81BF690F2188039DD2675A6A9A7DAB4287C0FA965D |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 165 |
| Entropy (8bit): | 1.5231029153786204 |
| Encrypted: | false |
| SSDEEP: | 3:WH25nJFV:WH2/ |
| MD5: | FB5ABAA34A0BB284B640327B9745AAAC |
| SHA1: | 7E1063A0F1DE0E83424399F104C1D3752BFAECDE |
| SHA-256: | 12464C713EE2E0CBBDCF98FACF8AC034D34A9F4D221D7BB7A5C7D458AAEC0AF9 |
| SHA-512: | 0FB235A4475D72D9BB6A195F6DFE471152B91F6DE0967D4174298D0A3C228BFF0ED57F0A5F388833A7793BD90F6CA0D5A974D21D795938D8D96C079AB5D99294 |
| Malicious: | true |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.606440722640607 |
| TrID: |
|
| File name: | Purchase Inquiry.xla.xlsx |
| File size: | 1'443'840 bytes |
| MD5: | 276274b804683f9b015af1af8d4fcd68 |
| SHA1: | 82c4589b4714ba3682733ca3fc260fdc80ae2465 |
| SHA256: | 700b86b936426ac3bb8ab4d38d84e3019f7840cdd6340b22f4dd3e358e1a122d |
| SHA512: | 15dde9280e040866476bd0b45549b12b20f1f6cc2e40642b055ba88d04ba3ebc2445c73ef328b16f33fa4d13a68d9025fcbfda688b565c31b56793678947f149 |
| SSDEEP: | 24576:aLDfEc/yraCIhIFly2G7qXHFBkb82yjaQIaPYWFDh1RJAV8L:UjyGdhIFdGcFB682yjaQImLJh |
| TLSH: | 5565E105BF809B17E4A455B049E78EAD0668EC44EF544E1F325CF32D3DB23742E6BA68 |
| File Content Preview: | ........................>.......................................................I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...G...H...I.............................................................................................. |
 | |
| Icon Hash: | 35e58a8c0c8a85b9 |
| Document Type: | OLE |
| Number of OLE Files: | 1 |
| Has Summary Info: | |
| Application Name: | Microsoft Excel |
| Encrypted Document: | True |
| Contains Word Document Stream: | False |
| Contains Workbook/Book Stream: | True |
| Contains PowerPoint Document Stream: | False |
| Contains Visio Document Stream: | False |
| Contains ObjectPool Stream: | False |
| Flash Objects Count: | 0 |
| Contains VBA Macros: | False |
| Code Page: | 1252 |
| Author: | |
| Last Saved By: | |
| Create Time: | 2006-09-16 00:00:00 |
| Last Saved Time: | 2025-03-11 01:22:06 |
| Creating Application: | |
| Security: | 1 |
| Document Code Page: | 1252 |
| Thumbnail Scaling Desired: | False |
| Contains Dirty Links: | False |
| Shared Document: | False |
| Changed Hyperlinks: | False |
| Application Version: | 786432 |
General | |
| Stream Path: | \x1CompObj |
| CLSID: | |
| File Type: | data |
| Stream Size: | 114 |
| Entropy: | 4.25248375192737 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . . |
| Data Raw: | 01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
| Stream Path: | \x5DocumentSummaryInformation |
| CLSID: | |
| File Type: | data |
| Stream Size: | 244 |
| Entropy: | 2.889430592781307 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00 |
General | |
| Stream Path: | \x5SummaryInformation |
| CLSID: | |
| File Type: | data |
| Stream Size: | 200 |
| Entropy: | 3.2185724163189633 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . | . # . @ . . . . Z . $ . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00 |
General | |
| Stream Path: | MBD00938691/\x1CompObj |
| CLSID: | |
| File Type: | data |
| Stream Size: | 114 |
| Entropy: | 4.25248375192737 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . . |
| Data Raw: | 01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
| Stream Path: | MBD00938691/\x5DocumentSummaryInformation |
| CLSID: | |
| File Type: | data |
| Stream Size: | 560 |
| Entropy: | 3.3879366798911743 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , D . . . . . . . . . . + , . . . H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . % . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 44 00 00 00 05 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 8c 01 00 00 48 01 00 00 10 00 00 00 01 00 00 00 88 00 00 00 03 00 00 00 90 00 00 00 05 00 00 00 9c 00 00 00 06 00 00 00 a4 00 00 00 07 00 00 00 ac 00 00 00 08 00 00 00 b4 00 00 00 09 00 00 00 |
General | |
| Stream Path: | MBD00938691/\x5SummaryInformation |
| CLSID: | |
| File Type: | data |
| Stream Size: | 169088 |
| Entropy: | 3.242943699085938 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . P . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1 9 7 4 . . . . . . . . . . . 1 . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . . . g . @ . . . . . . Q < . . @ . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 50 94 02 00 0e 00 00 00 01 00 00 00 78 00 00 00 04 00 00 00 80 00 00 00 07 00 00 00 94 00 00 00 08 00 00 00 a0 00 00 00 09 00 00 00 b0 00 00 00 12 00 00 00 bc 00 00 00 0b 00 00 00 d4 00 00 00 0c 00 00 00 e0 00 00 00 0d 00 00 00 ec 00 00 00 |
General | |
| Stream Path: | MBD00938691/MBD009374CA/\x1CompObj |
| CLSID: | |
| File Type: | data |
| Stream Size: | 114 |
| Entropy: | 4.219515110876372 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . 0 . . . . . . . . . . . . . F ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . E x c e l . S h e e t . 1 2 . 9 q . . . . . . . . . . . . |
| Data Raw: | 01 00 fe ff 03 0a 00 00 ff ff ff ff 30 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 0f 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 31 32 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00 |
Stream Path: MBD00938691/MBD009374CA/Package, File Type: Microsoft Excel 2007+, Stream Size: 1147991
General | |
| Stream Path: | MBD00938691/MBD009374CA/Package |
| CLSID: | |
| File Type: | Microsoft Excel 2007+ |
| Stream Size: | 1147991 |
| Entropy: | 7.8858098387040725 |
| Base64 Encoded: | True |
| Data ASCII: | P K . . . . . . . . . . ! . b ( ( . . . l . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
| Data Raw: | 50 4b 03 04 14 00 06 00 08 00 00 00 21 00 62 89 28 28 aa 01 00 00 6c 06 00 00 13 00 d5 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 d1 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
| Stream Path: | MBD00938691/MBD00937B55/\x1CompObj |
| CLSID: | |
| File Type: | data |
| Stream Size: | 114 |
| Entropy: | 4.219515110876372 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . 0 . . . . . . . . . . . . . F ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . E x c e l . S h e e t . 1 2 . 9 q . . . . . . . . . . . . |
| Data Raw: | 01 00 fe ff 03 0a 00 00 ff ff ff ff 30 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 0f 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 31 32 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
| Stream Path: | MBD00938691/MBD00937B55/Package |
| CLSID: | |
| File Type: | Microsoft Excel 2007+ |
| Stream Size: | 19563 |
| Entropy: | 7.559019050311009 |
| Base64 Encoded: | True |
| Data ASCII: | P K . . . . . . . . . . ! . . z > . . . 8 . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
| Data Raw: | 50 4b 03 04 14 00 06 00 08 00 00 00 21 00 c1 0c 7a 3e 86 01 00 00 38 05 00 00 13 00 cd 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 c9 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
| Stream Path: | MBD00938691/Workbook |
| CLSID: | |
| File Type: | Applesoft BASIC program data, first line number 16 |
| Stream Size: | 34717 |
| Entropy: | 5.594043806360197 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . 9 1 9 7 4 B . . . . a . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . . Z T 0 8 . . . . . . . X . @ . . . . . . . . . . " . . . . . . . . . . . |
| Data Raw: | 09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 05 00 00 39 31 39 37 34 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |
General | |
| Stream Path: | MBD00938692/\x1Ole |
| CLSID: | |
| File Type: | data |
| Stream Size: | 826 |
| Entropy: | 4.7890076969976 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . p 6 . ! q . . . . . . . . . . . . . . . y . . . K . . . . h . t . t . p . s . : . / . / . s . t . 3 . . . p . r . o . / . h . N . j . K . T . U . f . ? . & . k . a . l . e . = . n . o . x . i . o . u . s . & . s . t . e . p . - . g . r . a . n . d . f . a . t . h . e . r . = . l . a . r . g . e . & . m . o . n . s . o . o . n . . . j . . m T * . c . I . k f D . n . . $ . ) L . ? q . . y . 9 . . g F . ~ C k { 2 . - l z . . . . . . . . . . . . . . . . . . . w . H . n . Q . 7 . r . w . W . k . L . k |
| Data Raw: | 01 00 00 02 03 70 ad 36 dd 92 21 71 00 00 00 00 00 00 00 00 00 00 00 00 e4 00 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b e0 00 00 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 73 00 74 00 33 00 2e 00 70 00 72 00 6f 00 2f 00 68 00 4e 00 6a 00 4b 00 54 00 55 00 66 00 3f 00 26 00 6b 00 61 00 6c 00 65 00 3d 00 6e 00 6f 00 78 00 69 00 6f 00 75 00 73 00 26 00 73 00 74 00 |
General | |
| Stream Path: | Workbook |
| CLSID: | |
| File Type: | Applesoft BASIC program data, first line number 16 |
| Stream Size: | 52823 |
| Entropy: | 7.979585685771197 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . . . . . . . . . . / . 6 . . . . . . . A { t . . \\ & . | . H s 8 [ z ! O ` . + . . . . . . . . . . . . ] . . . \\ . p . + 7 . % 9 ] . . T z a | A . K K \\ . Z 2 U . e 2 . % ' 7 F q . < . d . a o . } . . c { . ~ v m > . } u . . . S + o X . ! E ! . a B . . . . a . . . . . . . . = . . . g . . . . , . o F b 2 E B . . . . + . . . . . . . . . C . . . . / H . . . $ . . . . = . . . ^ . . . u } l b = @ . . . > . . . _ 5 " . . . 8 k . . . . g . . . 4 . . . 1 . . . S Z i . i X . . s . t . . } 1 . . . . |
| Data Raw: | 09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 41 7b 20 b0 92 74 af d3 a9 b4 84 c9 f0 a4 dd a8 c9 5c de 26 a2 da a3 7c 0b 48 73 97 ac 38 5b d4 f5 f3 de 7a 21 f5 d2 4f 82 fa 60 cb 1c 2b f7 d5 87 00 00 00 e1 00 02 00 b0 04 c1 00 02 00 18 5d e2 00 00 00 5c 00 70 00 2b 37 9e 18 95 25 ad b1 39 5d e2 ea e1 a9 83 0a b3 9f 54 7a 61 dc 7c ad 41 0c |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-03-11T16:20:11.206516+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 49704 | 13.107.246.67 | 443 | TCP |
| 2025-03-11T16:20:19.161423+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 49707 | 13.107.246.67 | 443 | TCP |
| 2025-03-11T16:20:19.193562+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.8 | 49706 | 13.107.246.67 | 443 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 11, 2025 16:20:01.785345078 CET | 49701 | 443 | 192.168.2.8 | 5.161.200.29 |
| Mar 11, 2025 16:20:01.785397053 CET | 443 | 49701 | 5.161.200.29 | 192.168.2.8 |
| Mar 11, 2025 16:20:01.785468102 CET | 49701 | 443 | 192.168.2.8 | 5.161.200.29 |
| Mar 11, 2025 16:20:01.785753012 CET | 49701 | 443 | 192.168.2.8 | 5.161.200.29 |
| Mar 11, 2025 16:20:01.785764933 CET | 443 | 49701 | 5.161.200.29 | 192.168.2.8 |
| Mar 11, 2025 16:20:03.597927094 CET | 443 | 49701 | 5.161.200.29 | 192.168.2.8 |
| Mar 11, 2025 16:20:03.598059893 CET | 49701 | 443 | 192.168.2.8 | 5.161.200.29 |
| Mar 11, 2025 16:20:03.615900040 CET | 49701 | 443 | 192.168.2.8 | 5.161.200.29 |
| Mar 11, 2025 16:20:03.615920067 CET | 443 | 49701 | 5.161.200.29 | 192.168.2.8 |
| Mar 11, 2025 16:20:03.616240978 CET | 443 | 49701 | 5.161.200.29 | 192.168.2.8 |
| Mar 11, 2025 16:20:03.616296053 CET | 49701 | 443 | 192.168.2.8 | 5.161.200.29 |
| Mar 11, 2025 16:20:03.617120981 CET | 49701 | 443 | 192.168.2.8 | 5.161.200.29 |
| Mar 11, 2025 16:20:03.664329052 CET | 443 | 49701 | 5.161.200.29 | 192.168.2.8 |
| Mar 11, 2025 16:20:04.137221098 CET | 443 | 49701 | 5.161.200.29 | 192.168.2.8 |
| Mar 11, 2025 16:20:04.137281895 CET | 49701 | 443 | 192.168.2.8 | 5.161.200.29 |
| Mar 11, 2025 16:20:04.137291908 CET | 443 | 49701 | 5.161.200.29 | 192.168.2.8 |
| Mar 11, 2025 16:20:04.137303114 CET | 443 | 49701 | 5.161.200.29 | 192.168.2.8 |
| Mar 11, 2025 16:20:04.137331963 CET | 49701 | 443 | 192.168.2.8 | 5.161.200.29 |
| Mar 11, 2025 16:20:04.137357950 CET | 49701 | 443 | 192.168.2.8 | 5.161.200.29 |
| Mar 11, 2025 16:20:04.148514032 CET | 49701 | 443 | 192.168.2.8 | 5.161.200.29 |
| Mar 11, 2025 16:20:04.148528099 CET | 443 | 49701 | 5.161.200.29 | 192.168.2.8 |
| Mar 11, 2025 16:20:04.203588963 CET | 49702 | 443 | 192.168.2.8 | 3.39.153.44 |
| Mar 11, 2025 16:20:04.203624964 CET | 443 | 49702 | 3.39.153.44 | 192.168.2.8 |
| Mar 11, 2025 16:20:04.204365969 CET | 49702 | 443 | 192.168.2.8 | 3.39.153.44 |
| Mar 11, 2025 16:20:04.204365969 CET | 49702 | 443 | 192.168.2.8 | 3.39.153.44 |
| Mar 11, 2025 16:20:04.204396009 CET | 443 | 49702 | 3.39.153.44 | 192.168.2.8 |
| Mar 11, 2025 16:20:07.032169104 CET | 443 | 49702 | 3.39.153.44 | 192.168.2.8 |
| Mar 11, 2025 16:20:07.032351971 CET | 49702 | 443 | 192.168.2.8 | 3.39.153.44 |
| Mar 11, 2025 16:20:07.036195040 CET | 49702 | 443 | 192.168.2.8 | 3.39.153.44 |
| Mar 11, 2025 16:20:07.036205053 CET | 443 | 49702 | 3.39.153.44 | 192.168.2.8 |
| Mar 11, 2025 16:20:07.036492109 CET | 443 | 49702 | 3.39.153.44 | 192.168.2.8 |
| Mar 11, 2025 16:20:07.037393093 CET | 49702 | 443 | 192.168.2.8 | 3.39.153.44 |
| Mar 11, 2025 16:20:07.037394047 CET | 49702 | 443 | 192.168.2.8 | 3.39.153.44 |
| Mar 11, 2025 16:20:07.080318928 CET | 443 | 49702 | 3.39.153.44 | 192.168.2.8 |
| Mar 11, 2025 16:20:07.711117029 CET | 443 | 49702 | 3.39.153.44 | 192.168.2.8 |
| Mar 11, 2025 16:20:07.711220026 CET | 443 | 49702 | 3.39.153.44 | 192.168.2.8 |
| Mar 11, 2025 16:20:07.711312056 CET | 49702 | 443 | 192.168.2.8 | 3.39.153.44 |
| Mar 11, 2025 16:20:07.711415052 CET | 49702 | 443 | 192.168.2.8 | 3.39.153.44 |
| Mar 11, 2025 16:20:07.720429897 CET | 49702 | 443 | 192.168.2.8 | 3.39.153.44 |
| Mar 11, 2025 16:20:07.720448971 CET | 443 | 49702 | 3.39.153.44 | 192.168.2.8 |
| Mar 11, 2025 16:20:07.721329927 CET | 49703 | 443 | 192.168.2.8 | 3.39.153.44 |
| Mar 11, 2025 16:20:07.721364021 CET | 443 | 49703 | 3.39.153.44 | 192.168.2.8 |
| Mar 11, 2025 16:20:07.721438885 CET | 49703 | 443 | 192.168.2.8 | 3.39.153.44 |
| Mar 11, 2025 16:20:07.721647978 CET | 49703 | 443 | 192.168.2.8 | 3.39.153.44 |
| Mar 11, 2025 16:20:07.721661091 CET | 443 | 49703 | 3.39.153.44 | 192.168.2.8 |
| Mar 11, 2025 16:20:09.099214077 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:09.099276066 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:09.099350929 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:09.099647999 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:09.099663019 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:10.047039032 CET | 443 | 49703 | 3.39.153.44 | 192.168.2.8 |
| Mar 11, 2025 16:20:10.047179937 CET | 49703 | 443 | 192.168.2.8 | 3.39.153.44 |
| Mar 11, 2025 16:20:10.047689915 CET | 49703 | 443 | 192.168.2.8 | 3.39.153.44 |
| Mar 11, 2025 16:20:10.047705889 CET | 443 | 49703 | 3.39.153.44 | 192.168.2.8 |
| Mar 11, 2025 16:20:10.047898054 CET | 49703 | 443 | 192.168.2.8 | 3.39.153.44 |
| Mar 11, 2025 16:20:10.047904015 CET | 443 | 49703 | 3.39.153.44 | 192.168.2.8 |
| Mar 11, 2025 16:20:10.936959982 CET | 443 | 49703 | 3.39.153.44 | 192.168.2.8 |
| Mar 11, 2025 16:20:10.936990976 CET | 443 | 49703 | 3.39.153.44 | 192.168.2.8 |
| Mar 11, 2025 16:20:10.937072039 CET | 443 | 49703 | 3.39.153.44 | 192.168.2.8 |
| Mar 11, 2025 16:20:10.937124968 CET | 49703 | 443 | 192.168.2.8 | 3.39.153.44 |
| Mar 11, 2025 16:20:10.937153101 CET | 49703 | 443 | 192.168.2.8 | 3.39.153.44 |
| Mar 11, 2025 16:20:10.937963009 CET | 49703 | 443 | 192.168.2.8 | 3.39.153.44 |
| Mar 11, 2025 16:20:10.937982082 CET | 443 | 49703 | 3.39.153.44 | 192.168.2.8 |
| Mar 11, 2025 16:20:10.937995911 CET | 49703 | 443 | 192.168.2.8 | 3.39.153.44 |
| Mar 11, 2025 16:20:10.938029051 CET | 49703 | 443 | 192.168.2.8 | 3.39.153.44 |
| Mar 11, 2025 16:20:11.206384897 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:11.206516027 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:11.208154917 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:11.208173037 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:11.208483934 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:11.209608078 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:11.252324104 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:11.762430906 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:11.762471914 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:11.762487888 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:11.762535095 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:11.762557983 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:11.762568951 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:11.762600899 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:11.848843098 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:11.848867893 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:11.848923922 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:11.848946095 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:11.848978043 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:11.848998070 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:11.905101061 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:11.905124903 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:11.905190945 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:11.905208111 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:11.905235052 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:11.905253887 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:11.930418968 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:11.930438995 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:11.930511951 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:11.930526018 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:11.930563927 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:11.981513023 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:11.981533051 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:11.981600046 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:11.981631041 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:11.981667995 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.010477066 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.010509014 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.010548115 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.010607004 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.010615110 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.010649920 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.046003103 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.046030998 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.046084881 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.046114922 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.046138048 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.046159029 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.064707994 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.064730883 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.064806938 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.064834118 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.064903021 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.068882942 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.068900108 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.068960905 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.068970919 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.069009066 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.079586029 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.079605103 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.079651117 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.079658985 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.079699993 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.096344948 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.096406937 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.096425056 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.096431971 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.096472979 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.111726046 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.111807108 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.113121986 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.113178968 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.122657061 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.122720003 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.122739077 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.122745991 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.122790098 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.137350082 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.137413979 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.137430906 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.137439966 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.137466908 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.137485981 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.151613951 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.151654005 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.151693106 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.151700974 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.151741028 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.151760101 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.163418055 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.163439035 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.163481951 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.163490057 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.163525105 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.185837984 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.185862064 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.185906887 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.185913086 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.185952902 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.186753988 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.186770916 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.186820030 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.186825991 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.186857939 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.191529036 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.191548109 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.191591024 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.191596985 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.191637993 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.206814051 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.206831932 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.206899881 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.206907988 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.206943035 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.224176884 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.224196911 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.224337101 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.224344969 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.224394083 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.231180906 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.231199980 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.231272936 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.231281042 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.231446981 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.236124992 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.236140966 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.236215115 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.236222982 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.236258984 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.248097897 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.248116016 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.248197079 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.248204947 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.248234987 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.259134054 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.259152889 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.259207964 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.259218931 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.259259939 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.268959045 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.268995047 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.269082069 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.269095898 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.269140005 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.277693033 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.277715921 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.277786970 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.277798891 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.277847052 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.288075924 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.288100958 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.288183928 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.288191080 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.288233042 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.311646938 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.311677933 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.311784983 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.311800957 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.311846018 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.318788052 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.318818092 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.318888903 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.318906069 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.318948030 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.324915886 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.324934959 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.325000048 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.325014114 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.325052023 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.343204021 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.343221903 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.343296051 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.343308926 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.343350887 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.357738972 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.357757092 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.357814074 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.357820988 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.357857943 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.370821953 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.370846987 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.370939016 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.370950937 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.371088982 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.387428045 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.387456894 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.387491941 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.387499094 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.387537003 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.396826029 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.396855116 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.396891117 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.396903038 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.396918058 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.396936893 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.401873112 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.401895046 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.401937008 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.401947975 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.401976109 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.401995897 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.405649900 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.405668974 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.405745029 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.405750990 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.405786991 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.411921024 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.411948919 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.412019014 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.412024021 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.412060976 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.430362940 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.430383921 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.430464029 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.430469990 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.430510998 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.444238901 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.444269896 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.444370031 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.444389105 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.444432974 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.457158089 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.457186937 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.457273960 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.457283020 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.457323074 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.474402905 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.474427938 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.474513054 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.474538088 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.474585056 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.483690977 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.483715057 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.483798981 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.483808041 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.483854055 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.488802910 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.488835096 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.488887072 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.488895893 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.488945007 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.489105940 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.492589951 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.492610931 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.492677927 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.492690086 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.492731094 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.503381014 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.503407955 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.503499031 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.503506899 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.503550053 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.547542095 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.547574043 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.547698021 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.547724009 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.547770977 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.565438986 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.565465927 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.565668106 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.565701008 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.565752029 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.587038994 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.587071896 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.587261915 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.587279081 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.587348938 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.610901117 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.610929966 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.611016989 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.611032009 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.611078978 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.623014927 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.623047113 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.623114109 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.623126030 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.623155117 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.623173952 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.624315977 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.624344110 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.624383926 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.624392986 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.624419928 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.624439955 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.625051975 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.625081062 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.625123978 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.625133038 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.625164032 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.625176907 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.628649950 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.628668070 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.628724098 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.628735065 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.628777981 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.645530939 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.645550966 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.645627975 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.645638943 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.645678997 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.652472973 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.652491093 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.652548075 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.652558088 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.652599096 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.673865080 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.673892975 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.673969984 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.673979044 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.674021006 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.697777987 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.697797060 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.697879076 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.697890043 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.697938919 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.709781885 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.709806919 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.709880114 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.709914923 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.710180044 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.711543083 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.711574078 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.711662054 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.711675882 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.711795092 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.712371111 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.712393999 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.712455034 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.712466955 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.712519884 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.715501070 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.715518951 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.715616941 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.715624094 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.715670109 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.732604980 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.732625961 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.732774973 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.732805014 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.732882023 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.739377022 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.739394903 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.739466906 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.739483118 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.739582062 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.761269093 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.761287928 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.761428118 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.761446953 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.761531115 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.787440062 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.787471056 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.787622929 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.787642002 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.787765026 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.802526951 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.802546024 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.802587032 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.802654982 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.802772045 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.803019047 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.803036928 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:12.803055048 CET | 49704 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:12.803060055 CET | 443 | 49704 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:17.006465912 CET | 49706 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:17.006546974 CET | 443 | 49706 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:17.006700993 CET | 49706 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:17.006920099 CET | 49706 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:17.006936073 CET | 443 | 49706 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:17.007436037 CET | 49707 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:17.007472992 CET | 443 | 49707 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:17.007785082 CET | 49707 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:17.007946968 CET | 49707 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:17.007958889 CET | 443 | 49707 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:19.160927057 CET | 443 | 49707 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:19.161422968 CET | 49707 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:19.161439896 CET | 443 | 49707 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:19.162405968 CET | 49707 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:19.162410975 CET | 443 | 49707 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:19.192965984 CET | 443 | 49706 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:19.193562031 CET | 49706 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:19.193587065 CET | 443 | 49706 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:19.194400072 CET | 49706 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:19.194406986 CET | 443 | 49706 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:19.761567116 CET | 443 | 49706 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:19.761598110 CET | 443 | 49706 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:19.761678934 CET | 443 | 49706 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:19.761679888 CET | 49706 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:19.761739016 CET | 49706 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:19.761982918 CET | 49706 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:19.762001038 CET | 443 | 49706 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:19.762016058 CET | 49706 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:19.762025118 CET | 443 | 49706 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:19.807084084 CET | 443 | 49707 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:19.807168961 CET | 443 | 49707 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:19.807220936 CET | 49707 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:19.807441950 CET | 49707 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:19.807456017 CET | 443 | 49707 | 13.107.246.67 | 192.168.2.8 |
| Mar 11, 2025 16:20:19.807529926 CET | 49707 | 443 | 192.168.2.8 | 13.107.246.67 |
| Mar 11, 2025 16:20:19.807535887 CET | 443 | 49707 | 13.107.246.67 | 192.168.2.8 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 11, 2025 16:20:01.765172958 CET | 56069 | 53 | 192.168.2.8 | 1.1.1.1 |
| Mar 11, 2025 16:20:01.784583092 CET | 53 | 56069 | 1.1.1.1 | 192.168.2.8 |
| Mar 11, 2025 16:20:04.154896021 CET | 63000 | 53 | 192.168.2.8 | 1.1.1.1 |
| Mar 11, 2025 16:20:04.202733994 CET | 53 | 63000 | 1.1.1.1 | 192.168.2.8 |
| Mar 11, 2025 16:20:09.090856075 CET | 63788 | 53 | 192.168.2.8 | 1.1.1.1 |
| Mar 11, 2025 16:20:09.098372936 CET | 53 | 63788 | 1.1.1.1 | 192.168.2.8 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Mar 11, 2025 16:20:01.765172958 CET | 192.168.2.8 | 1.1.1.1 | 0xd3ff | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Mar 11, 2025 16:20:04.154896021 CET | 192.168.2.8 | 1.1.1.1 | 0xd55d | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Mar 11, 2025 16:20:09.090856075 CET | 192.168.2.8 | 1.1.1.1 | 0x4b8d | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Mar 11, 2025 16:19:07.289474964 CET | 1.1.1.1 | 192.168.2.8 | 0x4f4c | No error (0) | shed.s-0005.dual-s-dc-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 11, 2025 16:19:07.289474964 CET | 1.1.1.1 | 192.168.2.8 | 0x4f4c | No error (0) | s-0005.dual-s-dc-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 11, 2025 16:19:07.289474964 CET | 1.1.1.1 | 192.168.2.8 | 0x4f4c | No error (0) | 52.123.131.14 | A (IP address) | IN (0x0001) | false | ||
| Mar 11, 2025 16:19:07.289474964 CET | 1.1.1.1 | 192.168.2.8 | 0x4f4c | No error (0) | 52.123.130.14 | A (IP address) | IN (0x0001) | false | ||
| Mar 11, 2025 16:19:14.899504900 CET | 1.1.1.1 | 192.168.2.8 | 0x4257 | No error (0) | 199.232.214.172 | A (IP address) | IN (0x0001) | false | ||
| Mar 11, 2025 16:19:14.899504900 CET | 1.1.1.1 | 192.168.2.8 | 0x4257 | No error (0) | 199.232.210.172 | A (IP address) | IN (0x0001) | false | ||
| Mar 11, 2025 16:20:01.784583092 CET | 1.1.1.1 | 192.168.2.8 | 0xd3ff | No error (0) | 5.161.200.29 | A (IP address) | IN (0x0001) | false | ||
| Mar 11, 2025 16:20:04.202733994 CET | 1.1.1.1 | 192.168.2.8 | 0xd55d | No error (0) | istio.saja.market | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 11, 2025 16:20:04.202733994 CET | 1.1.1.1 | 192.168.2.8 | 0xd55d | No error (0) | service-eks-nlb-public-0b7cb0a32741e125.elb.ap-northeast-2.amazonaws.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 11, 2025 16:20:04.202733994 CET | 1.1.1.1 | 192.168.2.8 | 0xd55d | No error (0) | 3.39.153.44 | A (IP address) | IN (0x0001) | false | ||
| Mar 11, 2025 16:20:04.202733994 CET | 1.1.1.1 | 192.168.2.8 | 0xd55d | No error (0) | 3.39.89.152 | A (IP address) | IN (0x0001) | false | ||
| Mar 11, 2025 16:20:09.098372936 CET | 1.1.1.1 | 192.168.2.8 | 0x4b8d | No error (0) | otelrules-bzhndjfje8dvh5fd.z01.azurefd.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 11, 2025 16:20:09.098372936 CET | 1.1.1.1 | 192.168.2.8 | 0x4b8d | No error (0) | star-azurefd-prod.trafficmanager.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 11, 2025 16:20:09.098372936 CET | 1.1.1.1 | 192.168.2.8 | 0x4b8d | No error (0) | shed.dual-low.s-part-0039.t-0009.t-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 11, 2025 16:20:09.098372936 CET | 1.1.1.1 | 192.168.2.8 | 0x4b8d | No error (0) | s-part-0039.t-0009.t-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 11, 2025 16:20:09.098372936 CET | 1.1.1.1 | 192.168.2.8 | 0x4b8d | No error (0) | 13.107.246.67 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.8 | 49701 | 5.161.200.29 | 443 | 7148 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-11 15:20:03 UTC | 237 | OUT | |
| 2025-03-11 15:20:04 UTC | 471 | IN | |
| 2025-03-11 15:20:04 UTC | 111 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.8 | 49702 | 3.39.153.44 | 443 | 7148 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-11 15:20:07 UTC | 258 | OUT | |
| 2025-03-11 15:20:07 UTC | 452 | IN | |
| 2025-03-11 15:20:07 UTC | 38 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.8 | 49703 | 3.39.153.44 | 443 | 7148 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-11 15:20:10 UTC | 197 | OUT | |
| 2025-03-11 15:20:10 UTC | 504 | IN | |
| 2025-03-11 15:20:10 UTC | 4645 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.8 | 49704 | 13.107.246.67 | 443 | 7148 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-11 15:20:11 UTC | 226 | OUT | |
| 2025-03-11 15:20:11 UTC | 493 | IN | |
| 2025-03-11 15:20:11 UTC | 15891 | IN | |
| 2025-03-11 15:20:11 UTC | 16384 | IN | |
| 2025-03-11 15:20:11 UTC | 16384 | IN | |
| 2025-03-11 15:20:11 UTC | 16384 | IN | |
| 2025-03-11 15:20:11 UTC | 16384 | IN | |
| 2025-03-11 15:20:12 UTC | 16384 | IN | |
| 2025-03-11 15:20:12 UTC | 16384 | IN | |
| 2025-03-11 15:20:12 UTC | 16384 | IN | |
| 2025-03-11 15:20:12 UTC | 16384 | IN | |
| 2025-03-11 15:20:12 UTC | 16384 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.8 | 49707 | 13.107.246.67 | 443 | 7148 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-11 15:20:19 UTC | 214 | OUT | |
| 2025-03-11 15:20:19 UTC | 498 | IN | |
| 2025-03-11 15:20:19 UTC | 204 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.8 | 49706 | 13.107.246.67 | 443 | 7148 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-11 15:20:19 UTC | 214 | OUT | |
| 2025-03-11 15:20:19 UTC | 522 | IN | |
| 2025-03-11 15:20:19 UTC | 2128 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 11:19:00 |
| Start date: | 11/03/2025 |
| Path: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x730000 |
| File size: | 53'161'064 bytes |
| MD5 hash: | 4A871771235598812032C822E6F68F19 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 12 |
| Start time: | 11:20:12 |
| Start date: | 11/03/2025 |
| Path: | C:\Windows\splwow64.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff764580000 |
| File size: | 163'840 bytes |
| MD5 hash: | 77DE7761B037061C7C112FD3C5B91E73 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 17 |
| Start time: | 11:20:33 |
| Start date: | 11/03/2025 |
| Path: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x730000 |
| File size: | 53'161'064 bytes |
| MD5 hash: | 4A871771235598812032C822E6F68F19 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
⊘No disassembly