Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
NB NT19901102W.xls

Overview

General Information

Sample name:NB NT19901102W.xls
Analysis ID:1636402
MD5:50f4662d25acba4c65aeb4249bb92048
SHA1:7583fdc28466d08710fb86017b477e58128f884b
SHA256:90883aca6d0f0119112cf6cdba8323643f8385428af33e88e6d9050daa8899bd
Tags:xlsuser-abuse_ch
Infos:

Detection

Score:56
Range:0 - 100
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Document contains embedded VBA macros
Document embeds suspicious OLE2 link
Document misses a certain OLE stream usually present in this Microsoft Office document type
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • EXCEL.EXE (PID: 8540 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)
    • splwow64.exe (PID: 6152 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)
  • EXCEL.EXE (PID: 8248 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\NB NT19901102W.xls" MD5: 4A871771235598812032C822E6F68F19)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Excel Network Connections
Source: Network ConnectionAuthor: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 5.161.200.29, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 8540, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49720
Sigma detected: Suspicious Office Outbound Connections
Source: Network ConnectionAuthor: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.5, DestinationIsIpv6: false, DestinationPort: 49720, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 8540, Protocol: tcp, SourceIp: 5.161.200.29, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2025-03-12T18:35:34.014108+010020283713Unknown Traffic192.168.2.54972213.107.253.72443TCP
2025-03-12T18:35:43.441340+010020283713Unknown Traffic192.168.2.54972313.107.253.72443TCP
2025-03-12T18:35:43.442526+010020283713Unknown Traffic192.168.2.54972413.107.253.72443TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: NB NT19901102W.xlsAvira: detected
Multi AV Scanner detection for submitted file
Source: NB NT19901102W.xlsVirustotal: Detection: 43%Perma Link
Source: NB NT19901102W.xlsReversingLabs: Detection: 36%
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEFile opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dllJump to behavior
Source: unknownHTTPS traffic detected: 5.161.200.29:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknownHTTPS traffic detected: 5.161.200.29:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: global trafficDNS query: name: st3.pro
Source: global trafficDNS query: name: otelrules.svc.static.microsoft
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49723 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49724 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49723 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49723 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49723 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49724 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49724 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49724 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49723 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49723 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49724 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49724 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49723 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49723 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49723 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49723 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49724 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49724 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49724 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 5.161.200.29:443 -> 192.168.2.5:49720
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 5.161.200.29:443 -> 192.168.2.5:49720
Source: global trafficTCP traffic: 5.161.200.29:443 -> 192.168.2.5:49720
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 5.161.200.29:443 -> 192.168.2.5:49720
Source: global trafficTCP traffic: 5.161.200.29:443 -> 192.168.2.5:49720
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 5.161.200.29:443 -> 192.168.2.5:49720
Source: global trafficTCP traffic: 5.161.200.29:443 -> 192.168.2.5:49720
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 5.161.200.29:443 -> 192.168.2.5:49720
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 5.161.200.29:443 -> 192.168.2.5:49720
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 5.161.200.29:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 5.161.200.29:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 5.161.200.29:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 5.161.200.29:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 5.161.200.29:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 5.161.200.29:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 5.161.200.29:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 5.161.200.29:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 5.161.200.29:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 5.161.200.29:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49722 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49722
Source: global trafficTCP traffic: 192.168.2.5:49723 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49723
Source: global trafficTCP traffic: 192.168.2.5:49723 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49723 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49723
Source: global trafficTCP traffic: 192.168.2.5:49724 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49724
Source: global trafficTCP traffic: 192.168.2.5:49724 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49724 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49724
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49723
Source: global trafficTCP traffic: 192.168.2.5:49723 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49723
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49724
Source: global trafficTCP traffic: 192.168.2.5:49723 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49723
Source: global trafficTCP traffic: 192.168.2.5:49724 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49724
Source: global trafficTCP traffic: 192.168.2.5:49724 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49724
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49723
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49723
Source: global trafficTCP traffic: 192.168.2.5:49723 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49723
Source: global trafficTCP traffic: 192.168.2.5:49723 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49723 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49723
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49723
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49723
Source: global trafficTCP traffic: 192.168.2.5:49723 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49724
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49724
Source: global trafficTCP traffic: 192.168.2.5:49724 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49724 -> 13.107.253.72:443
Source: global trafficTCP traffic: 192.168.2.5:49724 -> 13.107.253.72:443
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49724
Source: global trafficTCP traffic: 13.107.253.72:443 -> 192.168.2.5:49724
Source: Joe Sandbox ViewIP Address: 13.107.253.72 13.107.253.72
Source: Joe Sandbox ViewIP Address: 5.161.200.29 5.161.200.29
Source: Joe Sandbox ViewJA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox ViewJA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49722 -> 13.107.253.72:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49724 -> 13.107.253.72:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49723 -> 13.107.253.72:443
Source: global trafficHTTP traffic detected: GET /7PhNlfi?&coke=absorbing&quiet=heady&weakness=habitual&miscommunication HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: st3.proConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /404 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: st3.proConnection: Keep-Alive
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /7PhNlfi?&coke=absorbing&quiet=heady&weakness=habitual&miscommunication HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: st3.proConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /404 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: st3.proConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /rules/excel.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global trafficHTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global trafficHTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global trafficDNS traffic detected: DNS query: st3.pro
Source: global trafficDNS traffic detected: DNS query: otelrules.svc.static.microsoft
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Date: Wed, 12 Mar 2025 17:35:21 GMTEtag: "1225-4lR+8o8+z0M1Iq6OMuNgxAtPjT8"Strict-Transport-Security: max-age=15552000; includeSubDomainsVary: Accept-EncodingX-Content-Type-Options: nosniffX-Dns-Prefetch-Control: offX-Download-Options: noopenX-Frame-Options: SAMEORIGINX-Powered-By: Next.jsX-Xss-Protection: 1; mode=blockConnection: closeTransfer-Encoding: chunked
Source: NB NT19901102W.xls, A0530000.0.drString found in binary or memory: https://st3.pro/7PhNlfi?&coke=absorbing&quiet=heady&weakness=habitual&miscommunicationY
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownHTTPS traffic detected: 5.161.200.29:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknownHTTPS traffic detected: 5.161.200.29:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: NB NT19901102W.xlsOLE indicator, VBA macros: true
Source: NB NT19901102W.xlsStream path 'MBD00B2C91F/\x1Ole' : https://st3.pro/7PhNlfi?&coke=absorbing&quiet=heady&weakness=habitual&miscommunicationYc-X#J6jSTOrEL}jSRpwTnms2ANwtsU2Cp0NcXYbJLuDnoaN0NtYnDfVnUtBXp9tmFOkZN9vFL8obZgrytr9zMmrj1uvIRYjcIfBE4OyWOAjGci931oT1d1hAuDuavBgQ<}U&
Source: A0530000.0.drStream path 'MBD00B2C91F/\x1Ole' : https://st3.pro/7PhNlfi?&coke=absorbing&quiet=heady&weakness=habitual&miscommunicationYc-X#J6jSTOrEL}jSRpwTnms2ANwtsU2Cp0NcXYbJLuDnoaN0NtYnDfVnUtBXp9tmFOkZN9vFL8obZgrytr9zMmrj1uvIRYjcIfBE4OyWOAjGci931oT1d1hAuDuavBgQ<}U&
Source: ~DF3184C88A79FB43FF.TMP.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: classification engineClassification label: mal56.winXLS@4/9@2/2
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xmlJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEFile created: C:\Users\user\Desktop\A0530000Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{EA7E9A76-8E4C-4DD3-9BC9-8DEC0AAC941D} - OProcSessId.datJump to behavior
Source: NB NT19901102W.xlsOLE indicator, Workbook stream: true
Source: A0530000.0.drOLE indicator, Workbook stream: true
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
Source: NB NT19901102W.xlsVirustotal: Detection: 43%
Source: NB NT19901102W.xlsReversingLabs: Detection: 36%
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\NB NT19901102W.xls"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEAutomated click: OK
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEAutomated click: OK
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\CommonJump to behavior
Source: NB NT19901102W.xlsStatic file information: File size 1294336 > 1048576
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEFile opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dllJump to behavior
Source: ~DF3184C88A79FB43FF.TMP.0.drInitial sample: OLE indicators vbamacros = False
Source: NB NT19901102W.xlsInitial sample: OLE indicators encrypted = True
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: NB NT19901102W.xlsStream path 'MBD00B2C91E/Package' entropy: 7.99483476295 (max. 8.0)
Source: NB NT19901102W.xlsStream path 'Workbook' entropy: 7.98583897101 (max. 8.0)
Source: A0530000.0.drStream path 'Workbook' entropy: 7.98381997905 (max. 8.0)
Source: C:\Windows\splwow64.exeWindow / User API: threadDelayed 723Jump to behavior
Source: C:\Windows\splwow64.exeLast function: Thread delayed
Source: C:\Windows\splwow64.exeLast function: Thread delayed
Source: C:\Windows\splwow64.exeThread delayed: delay time: 120000Jump to behavior
Source: C:\Windows\splwow64.exeThread delayed: delay time: 120000Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information queried: ProcessInformationJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		Valid Accounts3
Exploitation for Client Execution		1
Scripting		1
Process Injection		2
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Virtualization/Sandbox Evasion		LSASS Memory1
Virtualization/Sandbox Evasion		Remote Desktop ProtocolData from Removable Media3
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Process Injection		Security Account Manager1
Application Window Discovery		SMB/Windows Admin SharesData from Network Shared Drive3
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
Obfuscated Files or Information		NTDS1
File and Directory Discovery		Distributed Component Object ModelInput Capture14
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets1
System Information Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.