Edit tour
Windows
Analysis Report
Purchase Inquiry.xla.xlsx
Overview
General Information
| Sample name: | Purchase Inquiry.xla.xlsx |
| Analysis ID: | 1636034 |
| MD5: | cb34fe6cca91b8e75a9696cf1885a88f |
| SHA1: | 2abddcefd9a44d6fe7b002deee04eb8c324bbf1b |
| SHA256: | 5158d0d207d89aec3aa2fb28a107269d9bed3f9b0f7f595c0e3668c92c25eb9e |
| Tags: | xlsxuser-lowmal3 |
| Infos: |  |
 | |
Detection
| Score: | 56 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Document embeds suspicious OLE2 link
Document misses a certain OLE stream usually present in this Microsoft Office document type
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Suricata IDS alerts with low severity for network traffic
Unable to load, office file is protected or invalid
Classification
- System is w10x64
EXCEL.EXE (PID: 7640 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\EXCEL .EXE" /aut omation -E mbedding MD5: 4A871771235598812032C822E6F68F19) 
splwow64.exe (PID: 8044 cmdline: C:\Windows \splwow64. exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)
- EXCEL.EXE (PID: 3340 cmdline:
"C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\EXCEL .EXE" "C:\ Users\user \Desktop\P urchase In quiry.xla. xlsx" MD5: 4A871771235598812032C822E6F68F19)
- cleanup
⊘No configs have been found
⊘No yara matches
| Source: | Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: | ||
| Source: | Author: X__Junior (Nextron Systems): | ||
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-03-12T10:32:33.480879+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49732 | 13.107.246.76 | 443 | TCP |
| 2025-03-12T10:32:41.353502+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49734 | 13.107.246.76 | 443 | TCP |
| 2025-03-12T10:32:41.447679+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49735 | 13.107.246.76 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | File opened: | Jump to behavior | ||
| Source: | HTTPS traffic detected: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Stream path 'MBD00A93362/\x1Ole' : | ||
| Source: | Stream path 'MBD00A93362/\x1Ole' : | ||
| Source: | OLE stream indicators for Word, Excel, PowerPoint, and Visio: | ||
| Source: | Window title found: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | OLE indicator, Workbook stream: | ||
| Source: | OLE indicator, Workbook stream: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Static file information: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Stream path 'MBD00A93361/Package' entropy: | ||
| Source: | Stream path 'Workbook' entropy: | ||
| Source: | Stream path 'Workbook' entropy: | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Process information queried: | Jump to behavior | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 3 Exploitation for Client Execution | Path Interception | 1 Process Injection | 2 Masquerading | OS Credential Dumping | 1 Process Discovery | Remote Services | Data from Local System | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | 1 Virtualization/Sandbox Evasion | LSASS Memory | 1 Virtualization/Sandbox Evasion | Remote Desktop Protocol | Data from Removable Media | 1 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 Process Injection | Security Account Manager | 1 Application Window Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 2 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Obfuscated Files or Information | NTDS | 1 File and Directory Discovery | Distributed Component Object Model | Input Capture | 3 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | Software Packing | LSA Secrets | 1 System Information Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 43% | Virustotal | Browse | ||
| 32% | ReversingLabs | Win32.Exploit.CVE-2017-0199 | ||
| 100% | Avira | EXP/CVE-2017-0199.dmrct |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| bg.microsoft.map.fastly.net | 199.232.214.172 | true | false | high | |
| st3.pro | 5.161.200.29 | true | false | high | |
| s-0005.dual-s-dc-msedge.net | 52.123.130.14 | true | false | high | |
| s-part-0048.t-0009.t-msedge.net | 13.107.246.76 | true | false | high | |
| otelrules.svc.static.microsoft | unknown | unknown | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high | ||
| false | high | ||
| false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 13.107.246.76 | s-part-0048.t-0009.t-msedge.net | United States | 8068 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 5.161.200.29 | st3.pro | Germany | 24940 | HETZNER-ASDE | false |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1636034 |
| Start date and time: | 2025-03-12 10:30:21 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 56s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultwindowsofficecookbook.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 24 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | Purchase Inquiry.xla.xlsx |
| Detection: | MAL |
| Classification: | mal56.winXLSX@4/9@2/2 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, SIHClient.exe, backgroundTaskHost.exe, audiodg.exe, sppsvc.exe, ShellExperienceHost.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 52.109.28.46, 23.60.203.209, 52.109.28.47, 199.232.214.172, 52.168.112.67, 20.50.201.205, 40.79.173.40, 52.123.130.14, 20.190.159.68, 52.149.20.212
- Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, eur.roaming1.live.com.akadns.net, mobile.events.data.microsoft.com, roaming.officeapps.live.com, dual-s-0005-office.config.skype.com, login.live.com, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, c.pki.goog, wu-b-net.trafficmanager.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, onedscolprdaue00.australiaeast.cloudapp.azure.com, ctldl.windowsupdate.com.delivery.microsoft.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, osiprod-uks-buff-azsc-000.uksouth.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com, uks-azsc-000.roaming.officeapps.live.com, config.officeapps.live.com, onedscolprdeus04.eastus.cloudapp.azure.com, onedscolprdweu13.westeurope.cloudapp.azure.com, ecs.office.trafficma
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtCreateKey calls found.
- Report size getting too big, too many NtOpenFile calls found.
- Report size getting too big, too many NtQueryAttributesFile calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Report size getting too big, too many NtReadFile calls found.
- Report size getting too big, too many NtReadVirtualMemory calls found.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
| Time | Type | Description |
|---|---|---|
| 05:32:26 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 13.107.246.76 | Get hash | malicious | HTMLPhisher | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | DBatLoader, PureLog Stealer | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HtmlDropper | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| 5.161.200.29 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| s-0005.dual-s-dc-msedge.net | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | KnowBe4 | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | PureLog Stealer | Browse |
| ||
| s-part-0048.t-0009.t-msedge.net | Get hash | malicious | HTMLPhisher | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | DBatLoader, PureLog Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | HTMLPhisher, Invisible JS | Browse |
| ||
| bg.microsoft.map.fastly.net | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | ScreenConnect Tool | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | GO Backdoor, LummaC Stealer | Browse |
| ||
| Get hash | malicious | HTMLPhisher, Invisible JS, Tycoon2FA | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| st3.pro | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| MICROSOFT-CORP-MSN-AS-BLOCKUS | Get hash | malicious | Mirai | Browse |
| |
| Get hash | malicious | KnowBe4 | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| HETZNER-ASDE | Get hash | malicious | FormBook | Browse |
| |
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Prometei | Browse |
| ||
| Get hash | malicious | Prometei | Browse |
| ||
| Get hash | malicious | Prometei | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Prometei | Browse |
| ||
| Get hash | malicious | Prometei | Browse |
| ||
| Get hash | malicious | Prometei | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| a0e9f5d64349fb13191bc781f81f42e1 | Get hash | malicious | LummaC Stealer | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | GO Backdoor, LummaC Stealer | Browse |
| ||
| Get hash | malicious | KnowBe4 | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
|
⊘No context
C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 118 |
| Entropy (8bit): | 3.5700810731231707 |
| Encrypted: | false |
| SSDEEP: | 3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq |
| MD5: | 573220372DA4ED487441611079B623CD |
| SHA1: | 8F9D967AC6EF34640F1F0845214FBC6994C0CB80 |
| SHA-256: | BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D |
| SHA-512: | F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 836 |
| Entropy (8bit): | 2.7151910322565733 |
| Encrypted: | false |
| SSDEEP: | 24:J3fIxk+vpKAk6ScvoGA8xpiOnAvJ5yoIHWK:h3+RfkpcvoGAYcvJ5LIHD |
| MD5: | 92A7E6E963E0E668F6585E8694F68380 |
| SHA1: | 9CFB8F0EA9A80C54FEBF664E2E8DA3A20C6F5DAE |
| SHA-256: | F09EE04026948847263A11CC3D3276A676246EF074A985681DBEF03D76801482 |
| SHA-512: | F3E94DC16458B4CE76A18D44360256A233CDF918A34FDB0AB3A85AF5FA3ADEB8B0BBB173CE658D8344939FE77AEB467C04D111A887424A65BA2833897DE3F4E2 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 16384 |
| Entropy (8bit): | 0.06007693391688613 |
| Encrypted: | false |
| SSDEEP: | 3:xRy//lvEXKRjgEAJnOb0lvlllrAm8wtYXFqLSLcEX/:wlnAJMellhAm8wtU2WcE |
| MD5: | 1918207FF423F809365029941FF9D32F |
| SHA1: | CE5CEF48FDF1F67CBB30317A93C250C290EFF8C6 |
| SHA-256: | 56D76D4386B6234BCAE9BB895BA87EEDA21103D2468B0E77CE80CA524CE167F8 |
| SHA-512: | 44A1C064A3C1A6029DCC8652B34DD74B783ED3657B4EA209243A02749D96521C192011FBDDE556D8FB4E5E4A0DFC9193D41334632C8FE5D08FB847E6D8D27202 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1536 |
| Entropy (8bit): | 1.2710134452235702 |
| Encrypted: | false |
| SSDEEP: | 6:rl912N0xs+CFfmy2cX+lG8ElCl5XCB9Xh9X:rl3lKFelcXanMClJCb7 |
| MD5: | D95B2E220C5C7FC24091831F20A8D1E4 |
| SHA1: | 4D1020E2D38929FC2D068DF2521CA27094669AEF |
| SHA-256: | 33F1A5C5939CFF2578F10D238E0681C8DD487FF91616C839FF571934AAA1A158 |
| SHA-512: | E196FACADF7F5BC64925BDFED77E86605C448440BCC38BFE444DAD59268BEA6E34D128E3C03A6B9440A1E3986B781F7B3C28C7F5F8ED27F51B062A2F3A2AF998 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 512 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | 3:: |
| MD5: | BF619EAC0CDF3F68D496EA9344137E8B |
| SHA1: | 5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5 |
| SHA-256: | 076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560 |
| SHA-512: | DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 35328 |
| Entropy (8bit): | 7.5784054222174735 |
| Encrypted: | false |
| SSDEEP: | 768:hsTyIO4IrujgEqYErK27Rmi4+3yfcLc2drJr:UyH4uujfqYDwR1/3+2c8r |
| MD5: | EBAFBA6EB8BABC19E5471CF359CA4923 |
| SHA1: | 7E0349EA3A53DF7EA9AC8D9474CE193C4CADA1B6 |
| SHA-256: | A3BB15E0EDA87282F265BE56EC6DA772F3EF9A1F9BF43ED6B1680022CE0900C7 |
| SHA-512: | 8F5080472DE357DE0D16AD13E22A1DB99D28F05F80CBE12C4D7CE0B59284F568340AB3903928ECC610A6910C2BFA992A9010A707AD5669EEBBD6CEEB7E3ECC5F |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | modified |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | 3:ggPYV:rPYV |
| MD5: | 187F488E27DB4AF347237FE461A079AD |
| SHA1: | 6693BA299EC1881249D59262276A0D2CB21F8E64 |
| SHA-256: | 255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309 |
| SHA-512: | 89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 35328 |
| Entropy (8bit): | 7.5784054222174735 |
| Encrypted: | false |
| SSDEEP: | 768:hsTyIO4IrujgEqYErK27Rmi4+3yfcLc2drJr:UyH4uujfqYDwR1/3+2c8r |
| MD5: | EBAFBA6EB8BABC19E5471CF359CA4923 |
| SHA1: | 7E0349EA3A53DF7EA9AC8D9474CE193C4CADA1B6 |
| SHA-256: | A3BB15E0EDA87282F265BE56EC6DA772F3EF9A1F9BF43ED6B1680022CE0900C7 |
| SHA-512: | 8F5080472DE357DE0D16AD13E22A1DB99D28F05F80CBE12C4D7CE0B59284F568340AB3903928ECC610A6910C2BFA992A9010A707AD5669EEBBD6CEEB7E3ECC5F |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 165 |
| Entropy (8bit): | 1.4377382811115937 |
| Encrypted: | false |
| SSDEEP: | 3:KVC+cAmltV:KVC+cR |
| MD5: | 9C7132B2A8CABF27097749F4D8447635 |
| SHA1: | 71D7F78718A7AFC3EAB22ED395321F6CBE2F9899 |
| SHA-256: | 7029AE5479F0CD98D892F570A22B2AE8302747DCFF3465B2DE64D974AE815A83 |
| SHA-512: | 333AC8A4987CC7DF5981AE81238A77D123996DB2C4C97053E8BD2048A64FDCF33E1245DEE6839358161F6B5EEA6BFD8D2358BC4A9188D786295C22F79E2D635E |
| Malicious: | true |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.988066904387626 |
| TrID: |
|
| File name: | Purchase Inquiry.xla.xlsx |
| File size: | 1'268'736 bytes |
| MD5: | cb34fe6cca91b8e75a9696cf1885a88f |
| SHA1: | 2abddcefd9a44d6fe7b002deee04eb8c324bbf1b |
| SHA256: | 5158d0d207d89aec3aa2fb28a107269d9bed3f9b0f7f595c0e3668c92c25eb9e |
| SHA512: | deeb3d19e2fd4d5466278e71d185fc4412c2a61768db5eed36614a672581d6f724c3c7b03d5f94e704893602b77c7b2e0793eff6c6735532a7cffee1ae09e8f2 |
| SSDEEP: | 24576:WJ1EM2sTVgyawU1CGO7oaomhapQs7ANo+9npaJ0/6CYOqgT:WJ95xaP/O7oarhMB7Yz9paJ0/ |
| TLSH: | F2452328AFC41B0BC4DFA97C4C16D661847ACDDABE56E157239C7394383367AA38721C |
| File Content Preview: | ........................>...................................b...........................................................................................f...................................................................................................... |
 | |
| Icon Hash: | 35e58a8c0c8a85b9 |
| Document Type: | OLE |
| Number of OLE Files: | 1 |
| Has Summary Info: | |
| Application Name: | Microsoft Excel |
| Encrypted Document: | True |
| Contains Word Document Stream: | False |
| Contains Workbook/Book Stream: | True |
| Contains PowerPoint Document Stream: | False |
| Contains Visio Document Stream: | False |
| Contains ObjectPool Stream: | False |
| Flash Objects Count: | 0 |
| Contains VBA Macros: | False |
| Code Page: | 1252 |
| Author: | |
| Last Saved By: | |
| Create Time: | 2006-09-16T00:00:00Z |
| Last Saved Time: | 2025-03-11T07:40:12Z |
| Creating Application: | |
| Security: | 0 |
| Document Code Page: | 1252 |
| Thumbnail Scaling Desired: | false |
| Contains Dirty Links: | false |
| Shared Document: | false |
| Changed Hyperlinks: | false |
| Application Version: | 12.0000 |
General | |
| Stream Path: | \x1CompObj |
| CLSID: | |
| File Type: | data |
| Stream Size: | 114 |
| Entropy: | 4.25248375192737 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . . |
| Data Raw: | 01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
| Stream Path: | \x5DocumentSummaryInformation |
| CLSID: | |
| File Type: | data |
| Stream Size: | 244 |
| Entropy: | 2.889430592781307 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00 |
General | |
| Stream Path: | \x5SummaryInformation |
| CLSID: | |
| File Type: | data |
| Stream Size: | 200 |
| Entropy: | 3.3020681057018666 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . | . # . @ . . . . X . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00 |
General | |
| Stream Path: | MBD00A93361/\x1CompObj |
| CLSID: | |
| File Type: | data |
| Stream Size: | 99 |
| Entropy: | 3.631242196770981 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . . |
| Data Raw: | 01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
| Stream Path: | MBD00A93361/Package |
| CLSID: | |
| File Type: | Microsoft Excel 2007+ |
| Stream Size: | 1218763 |
| Entropy: | 7.9961576263815575 |
| Base64 Encoded: | True |
| Data ASCII: | P K . . . . . . . . . . ! . P % ` . . . X . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
| Data Raw: | 50 4b 03 04 14 00 06 00 08 00 00 00 21 00 50 25 9e 60 c9 01 00 00 58 08 00 00 13 00 d1 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 cd 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
| Stream Path: | MBD00A93362/\x1Ole |
| CLSID: | |
| File Type: | data |
| Stream Size: | 914 |
| Entropy: | 5.720955189029818 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . ! x 1 i = X 1 . . . . . . . . . . . . . . . y . . . K . . . . h . t . t . p . s . : . / . / . s . t . 3 . . . p . r . o . / . h . N . j . K . T . U . f . ? . & . c . h . i . t . - . c . h . a . t . = . s . e . l . e . c . t . i . v . e . & . m . i . s . s . i . l . e . = . c . u . r . i . o . u . s . & . p . a . m . p . h . l . e . t . = . v . i . v . a . c . i . o . u . s . & . o . r . d . e . r . . . k ? @ 1 ? o . > _ . c . k J . I q w . . 5 . ^ . : . a 4 . ? 6 . . , . U A ` . b . L p . ' . { O g |
| Data Raw: | 01 00 00 02 21 78 31 69 3d 99 58 31 00 00 00 00 00 00 00 00 00 00 00 00 bc 01 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b b8 01 00 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 73 00 74 00 33 00 2e 00 70 00 72 00 6f 00 2f 00 68 00 4e 00 6a 00 4b 00 54 00 55 00 66 00 3f 00 26 00 63 00 68 00 69 00 74 00 2d 00 63 00 68 00 61 00 74 00 3d 00 73 00 65 00 6c 00 65 00 63 00 |
General | |
| Stream Path: | Workbook |
| CLSID: | |
| File Type: | Applesoft BASIC program data, first line number 16 |
| Stream Size: | 34370 |
| Entropy: | 7.960692231662655 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . . . . . . . . . . / . 6 . . . . . . . M L J C < . . ! . . } e l . . w Q 2 p 2 . 5 y } V . Z . . . . . . . . . . . . p . . . \\ . p . w d C C Q . g % . G . 7 . . . ' , . m n G N . . A . . . " w = O . " ( . & " v . . & ; y = w R , - B . . . b 6 a . . . { . . . = . . . . , l . . . \\ . F . . . . 7 J m . . . . . . . . H x . . . . . . . . | . . . . . . . | = . . . . . > . | H { . g * x @ . . . 9 . . . N " . . . A Y . . . . . . . . . . 1 . . . . . S I 5 . Q A n W l . . m S 1 . . . { Y . P 9 . A . |
| Data Raw: | 09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 e2 d2 cd 4d dc 4c 4a 43 d7 3c 12 04 21 03 16 7d 65 c2 6c 04 89 c7 11 77 8c a7 51 32 70 32 e0 a2 ce d3 96 35 e2 79 88 7d 90 56 b1 2e e0 5a 0e 12 87 00 00 00 e1 00 02 00 b0 04 c1 00 02 00 70 8b e2 00 00 00 5c 00 70 00 dd 77 a8 b4 de c1 f6 cf 64 43 43 51 94 b3 1e f8 ce 67 c3 e1 25 05 47 a4 e5 e7 |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-03-12T10:32:33.480879+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.4 | 49732 | 13.107.246.76 | 443 | TCP |
| 2025-03-12T10:32:41.353502+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.4 | 49734 | 13.107.246.76 | 443 | TCP |
| 2025-03-12T10:32:41.447679+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.4 | 49735 | 13.107.246.76 | 443 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 12, 2025 10:32:15.288404942 CET | 49729 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 12, 2025 10:32:15.288450003 CET | 443 | 49729 | 5.161.200.29 | 192.168.2.4 |
| Mar 12, 2025 10:32:15.288506985 CET | 49729 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 12, 2025 10:32:15.288726091 CET | 49729 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 12, 2025 10:32:15.288738966 CET | 443 | 49729 | 5.161.200.29 | 192.168.2.4 |
| Mar 12, 2025 10:32:18.643650055 CET | 443 | 49729 | 5.161.200.29 | 192.168.2.4 |
| Mar 12, 2025 10:32:18.643719912 CET | 49729 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 12, 2025 10:32:18.646771908 CET | 443 | 49729 | 5.161.200.29 | 192.168.2.4 |
| Mar 12, 2025 10:32:18.646826029 CET | 49729 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 12, 2025 10:32:18.648088932 CET | 49729 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 12, 2025 10:32:18.648117065 CET | 443 | 49729 | 5.161.200.29 | 192.168.2.4 |
| Mar 12, 2025 10:32:18.661550045 CET | 49730 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 12, 2025 10:32:18.661590099 CET | 443 | 49730 | 5.161.200.29 | 192.168.2.4 |
| Mar 12, 2025 10:32:18.661669970 CET | 49730 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 12, 2025 10:32:18.662005901 CET | 49730 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 12, 2025 10:32:18.662022114 CET | 443 | 49730 | 5.161.200.29 | 192.168.2.4 |
| Mar 12, 2025 10:32:21.883549929 CET | 443 | 49730 | 5.161.200.29 | 192.168.2.4 |
| Mar 12, 2025 10:32:21.883649111 CET | 49730 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 12, 2025 10:32:21.884036064 CET | 49730 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 12, 2025 10:32:21.884166002 CET | 443 | 49730 | 5.161.200.29 | 192.168.2.4 |
| Mar 12, 2025 10:32:21.884212971 CET | 49730 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 12, 2025 10:32:21.884706020 CET | 49731 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 12, 2025 10:32:21.884752989 CET | 443 | 49731 | 5.161.200.29 | 192.168.2.4 |
| Mar 12, 2025 10:32:21.884829998 CET | 49731 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 12, 2025 10:32:21.884958029 CET | 49731 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 12, 2025 10:32:21.884983063 CET | 443 | 49731 | 5.161.200.29 | 192.168.2.4 |
| Mar 12, 2025 10:32:21.885040998 CET | 49731 | 443 | 192.168.2.4 | 5.161.200.29 |
| Mar 12, 2025 10:32:31.586503983 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:31.586558104 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:31.586674929 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:31.587125063 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:31.587141991 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:33.480811119 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:33.480879068 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:33.484910965 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:33.484925985 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:33.485194921 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:33.492688894 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:33.536335945 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.665081978 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.665111065 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.665127993 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.665199041 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.665229082 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.665245056 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.665271044 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.742908955 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.742939949 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.742995024 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.743040085 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.743063927 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.743081093 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.777189970 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.777215958 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.777267933 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.777302027 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.777324915 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.777340889 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.813823938 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.813862085 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.813921928 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.813962936 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.813982010 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.814009905 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.841701984 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.841730118 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.841819048 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.841847897 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.841891050 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.860821009 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.860846996 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.860928059 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.860958099 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.861134052 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.883482933 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.883516073 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.883563995 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.883600950 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.883621931 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.883641958 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.901654005 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.901681900 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.901762009 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.901791096 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.901978016 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.926928997 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.926956892 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.927040100 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.927063942 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.927125931 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.936487913 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.936518908 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.936572075 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.936590910 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.936644077 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.936671972 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.946763992 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.946793079 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.946842909 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.946863890 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.946902037 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.946921110 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.958272934 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.958304882 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.958339930 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.958359957 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.958372116 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.958405018 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.969093084 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.969122887 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.969163895 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.969191074 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.969208002 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.969268084 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.977446079 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.977471113 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.977533102 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.977566004 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.977689028 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.986957073 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.986983061 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.987061024 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.987088919 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.987133026 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.994826078 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.994851112 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.994914055 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.994945049 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:34.994976044 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:34.994999886 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.009102106 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.009130955 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.009186983 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.009216070 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.009231091 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.009255886 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.022705078 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.022728920 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.022784948 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.022814035 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.022830963 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.022856951 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.033102036 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.033128023 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.033169985 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.033193111 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.033207893 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.033236027 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.045058012 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.045088053 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.045131922 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.045160055 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.045176029 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.045203924 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.053745985 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.053775072 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.053822994 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.053841114 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.053853989 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.053874969 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.064016104 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.064038992 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.064100981 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.064115047 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.064151049 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.073857069 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.073887110 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.073926926 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.073950052 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.073997021 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.074222088 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.081520081 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.081545115 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.081583023 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.081593990 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.081626892 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.081643105 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.091114998 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.091137886 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.091197014 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.091208935 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.091245890 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.111000061 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.111022949 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.111068964 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.111089945 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.111109018 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.111129999 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.121201992 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.121227026 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.121296883 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.121324062 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.121615887 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.133052111 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.133075953 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.133183002 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.133212090 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.133255959 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.142158985 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.142188072 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.142260075 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.142291069 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.142307997 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.142349958 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.152270079 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.152296066 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.152343988 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.152374029 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.152389050 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.152407885 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.162130117 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.162154913 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.162220955 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.162252903 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.162271023 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.162288904 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.169686079 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.169697046 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.169756889 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.169785976 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.169825077 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.179305077 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.179338932 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.179389000 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.179406881 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.179430962 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.179449081 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.199008942 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.199034929 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.199081898 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.199110031 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.199124098 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.199141979 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.209490061 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.209518909 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.209556103 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.209574938 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.209608078 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.209624052 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.221160889 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.221187115 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.221219063 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.221235037 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.221247911 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.221263885 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.231345892 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.231369019 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.231405020 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.231417894 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.231447935 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.231458902 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.240443945 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.240467072 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.240504026 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.240525007 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.240544081 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.240564108 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.250308990 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.250332117 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.250365019 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.250386000 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.250411987 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.250437021 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.257870913 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.257900953 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.257931948 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.257946014 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.257966042 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.257983923 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.267406940 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.267427921 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.267486095 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.267498016 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.267513990 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.267558098 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.287381887 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.287405968 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.287453890 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.287472010 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.287487030 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.287503958 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.297729969 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.297751904 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.297817945 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.297831059 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.297903061 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.309741974 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.309771061 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.309811115 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.309827089 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.309890985 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.319535017 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.319561958 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.319598913 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.319608927 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.319628954 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.319648027 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.328866959 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.328891993 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.328942060 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.328960896 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.329062939 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.338710070 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.338735104 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.338793039 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.338808060 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.338920116 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.346081972 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.346106052 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.346153021 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.346179008 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.346199989 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.346215010 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.355796099 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.355818987 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.355899096 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.355921984 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.355983973 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.375602961 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.375633001 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.375677109 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.375698090 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.375730991 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.375751019 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.386039019 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.386063099 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.386132956 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.386161089 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.386248112 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.397650957 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.397672892 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.397742987 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.397764921 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.397867918 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.407730103 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.407746077 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.407840014 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.407859087 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.409131050 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.417234898 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.417252064 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.417315006 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.417330027 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.417371988 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.427160978 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.427179098 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.427236080 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.427254915 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.427306890 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.434465885 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.434490919 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.434540033 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.434551001 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.434581995 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.434602022 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.444036007 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.444053888 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.444104910 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.444133043 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.444148064 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.444176912 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.463865995 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.463890076 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.463946104 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.463974953 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.463993073 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.464019060 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.474231005 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.474252939 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.474313021 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.474339008 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.474394083 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.485943079 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.485965967 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.486021996 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.486042023 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.486067057 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.486089945 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.496243000 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.496268034 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.496347904 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.496372938 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.496819019 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.505337954 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.505361080 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.505409956 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.505428076 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.505454063 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.505471945 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.515396118 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.515418053 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.515463114 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.515480995 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.515505075 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.515532017 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.522609949 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.522627115 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.522670031 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.522682905 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.522715092 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.522735119 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.532196999 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.532216072 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.532300949 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.532320976 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.532426119 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.552370071 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.552387953 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.552443981 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.552454948 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.552488089 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.562539101 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.562557936 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.562601089 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.562608957 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.562822104 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.574266911 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.574284077 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.574337006 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.574364901 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.574377060 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.574400902 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.574400902 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.574439049 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.574692011 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.574707985 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:35.574713945 CET | 49732 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:35.574718952 CET | 443 | 49732 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:39.460933924 CET | 49734 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:39.460974932 CET | 443 | 49734 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:39.461057901 CET | 49734 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:39.461252928 CET | 49734 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:39.461265087 CET | 443 | 49734 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:39.462596893 CET | 49735 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:39.462649107 CET | 443 | 49735 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:39.462884903 CET | 49735 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:39.463052988 CET | 49735 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:39.463068962 CET | 443 | 49735 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:41.352965117 CET | 443 | 49734 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:41.353502035 CET | 49734 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:41.353537083 CET | 443 | 49734 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:41.354552984 CET | 49734 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:41.354557991 CET | 443 | 49734 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:41.441229105 CET | 443 | 49735 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:41.447679043 CET | 49735 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:41.447696924 CET | 443 | 49735 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:41.452075005 CET | 49735 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:41.452085018 CET | 443 | 49735 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:41.823944092 CET | 443 | 49734 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:41.827066898 CET | 443 | 49734 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:41.827132940 CET | 49734 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:41.829087973 CET | 49734 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:41.829111099 CET | 443 | 49734 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:41.829123020 CET | 49734 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:41.829128981 CET | 443 | 49734 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:41.898284912 CET | 443 | 49735 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:41.898313999 CET | 443 | 49735 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:41.898478985 CET | 49735 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:41.898494005 CET | 443 | 49735 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:41.898823023 CET | 49735 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:41.898832083 CET | 443 | 49735 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:41.898845911 CET | 49735 | 443 | 192.168.2.4 | 13.107.246.76 |
| Mar 12, 2025 10:32:41.899039984 CET | 443 | 49735 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:41.899071932 CET | 443 | 49735 | 13.107.246.76 | 192.168.2.4 |
| Mar 12, 2025 10:32:41.899108887 CET | 49735 | 443 | 192.168.2.4 | 13.107.246.76 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 12, 2025 10:32:15.275855064 CET | 55808 | 53 | 192.168.2.4 | 1.1.1.1 |
| Mar 12, 2025 10:32:15.287772894 CET | 53 | 55808 | 1.1.1.1 | 192.168.2.4 |
| Mar 12, 2025 10:32:31.545222998 CET | 62370 | 53 | 192.168.2.4 | 1.1.1.1 |
| Mar 12, 2025 10:32:31.585313082 CET | 53 | 62370 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Mar 12, 2025 10:32:15.275855064 CET | 192.168.2.4 | 1.1.1.1 | 0x4c58 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Mar 12, 2025 10:32:31.545222998 CET | 192.168.2.4 | 1.1.1.1 | 0xbe8b | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Mar 12, 2025 10:31:28.833961964 CET | 1.1.1.1 | 192.168.2.4 | 0xdda4 | No error (0) | shed.s-0005.dual-s-dc-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 12, 2025 10:31:28.833961964 CET | 1.1.1.1 | 192.168.2.4 | 0xdda4 | No error (0) | s-0005.dual-s-dc-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 12, 2025 10:31:28.833961964 CET | 1.1.1.1 | 192.168.2.4 | 0xdda4 | No error (0) | 52.123.130.14 | A (IP address) | IN (0x0001) | false | ||
| Mar 12, 2025 10:31:28.833961964 CET | 1.1.1.1 | 192.168.2.4 | 0xdda4 | No error (0) | 52.123.131.14 | A (IP address) | IN (0x0001) | false | ||
| Mar 12, 2025 10:31:30.955585003 CET | 1.1.1.1 | 192.168.2.4 | 0x3fef | No error (0) | 199.232.214.172 | A (IP address) | IN (0x0001) | false | ||
| Mar 12, 2025 10:31:30.955585003 CET | 1.1.1.1 | 192.168.2.4 | 0x3fef | No error (0) | 199.232.210.172 | A (IP address) | IN (0x0001) | false | ||
| Mar 12, 2025 10:32:15.287772894 CET | 1.1.1.1 | 192.168.2.4 | 0x4c58 | No error (0) | 5.161.200.29 | A (IP address) | IN (0x0001) | false | ||
| Mar 12, 2025 10:32:31.585313082 CET | 1.1.1.1 | 192.168.2.4 | 0xbe8b | No error (0) | otelrules-bzhndjfje8dvh5fd.z01.azurefd.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 12, 2025 10:32:31.585313082 CET | 1.1.1.1 | 192.168.2.4 | 0xbe8b | No error (0) | star-azurefd-prod.trafficmanager.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 12, 2025 10:32:31.585313082 CET | 1.1.1.1 | 192.168.2.4 | 0xbe8b | No error (0) | shed.dual-low.s-part-0048.t-0009.t-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 12, 2025 10:32:31.585313082 CET | 1.1.1.1 | 192.168.2.4 | 0xbe8b | No error (0) | s-part-0048.t-0009.t-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 12, 2025 10:32:31.585313082 CET | 1.1.1.1 | 192.168.2.4 | 0xbe8b | No error (0) | 13.107.246.76 | A (IP address) | IN (0x0001) | false | ||
| Mar 12, 2025 10:32:32.728583097 CET | 1.1.1.1 | 192.168.2.4 | 0xec57 | No error (0) | 199.232.210.172 | A (IP address) | IN (0x0001) | false | ||
| Mar 12, 2025 10:32:32.728583097 CET | 1.1.1.1 | 192.168.2.4 | 0xec57 | No error (0) | 199.232.214.172 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49732 | 13.107.246.76 | 443 | 7640 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-12 09:32:33 UTC | 226 | OUT | |
| 2025-03-12 09:32:34 UTC | 473 | IN | |
| 2025-03-12 09:32:34 UTC | 15911 | IN | |
| 2025-03-12 09:32:34 UTC | 16384 | IN | |
| 2025-03-12 09:32:34 UTC | 16384 | IN | |
| 2025-03-12 09:32:34 UTC | 16384 | IN | |
| 2025-03-12 09:32:34 UTC | 16384 | IN | |
| 2025-03-12 09:32:34 UTC | 16384 | IN | |
| 2025-03-12 09:32:34 UTC | 16384 | IN | |
| 2025-03-12 09:32:34 UTC | 16384 | IN | |
| 2025-03-12 09:32:34 UTC | 16384 | IN | |
| 2025-03-12 09:32:34 UTC | 16384 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49734 | 13.107.246.76 | 443 | 7640 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-12 09:32:41 UTC | 214 | OUT | |
| 2025-03-12 09:32:41 UTC | 471 | IN | |
| 2025-03-12 09:32:41 UTC | 204 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.4 | 49735 | 13.107.246.76 | 443 | 7640 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-12 09:32:41 UTC | 214 | OUT | |
| 2025-03-12 09:32:41 UTC | 495 | IN | |
| 2025-03-12 09:32:41 UTC | 2128 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 05:31:22 |
| Start date: | 12/03/2025 |
| Path: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xe70000 |
| File size: | 53'161'064 bytes |
| MD5 hash: | 4A871771235598812032C822E6F68F19 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 16 |
| Start time: | 05:32:26 |
| Start date: | 12/03/2025 |
| Path: | C:\Windows\splwow64.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff62ba00000 |
| File size: | 163'840 bytes |
| MD5 hash: | 77DE7761B037061C7C112FD3C5B91E73 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 21 |
| Start time: | 05:32:43 |
| Start date: | 12/03/2025 |
| Path: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xe70000 |
| File size: | 53'161'064 bytes |
| MD5 hash: | 4A871771235598812032C822E6F68F19 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
⊘No disassembly