Windows Analysis Report
S6DgRF1SSD.xlsx

Overview

General Information

Sample name:	S6DgRF1SSD.xlsx renamed because original name is a hash value
Original sample name:	6bba78df2ac67668eb837a1593b6c1e3fc198fa4c1a4725a5d2370f8121c3a3b.xlsx
Analysis ID:	1543658
MD5:	334d7d30d9327e30d300d5ed3326d098
SHA1:	cdac6096bcc46f8ab2d668bba92d124beb7794d4
SHA256:	6bba78df2ac67668eb837a1593b6c1e3fc198fa4c1a4725a5d2370f8121c3a3b
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Document misses a certain OLE stream usually present in this Microsoft Office document type

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Sigma detected: Excel Network Connections

Sigma detected: Suspicious Office Outbound Connections

Unable to load, office file is protected or invalid

Yara signature match

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: S6DgRF1SSD.xlsx

Avira: detected

Multi AV Scanner detection for submitted file

Source: S6DgRF1SSD.xlsx

ReversingLabs: Detection: 65%

Source: unknown

HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.16:49715 version: TLS 1.2

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 13.107.246.45 13.107.246.45

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /rules/excel.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715

Source: unknown

HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.16:49715 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: sheet1.xml, type: SAMPLE

Matched rule: detects AutoLoad documents using LegacyDrawing Author: ditekSHen

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: S6DgRF1SSD.xlsx

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Unable to load, office file is protected or invalid

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Window title found: microsoft excel okexcel cannot open the file 's6dgrf1ssd.xlsx' because the file format or file extension is not valid. verify that the file has not been corrupted and that the file extension matches the format of the file.

Yara signature match

Source: sheet1.xml, type: SAMPLE

Matched rule: INDICATOR_XML_LegacyDrawing_AutoLoad_Document author = ditekSHen, description = detects AutoLoad documents using LegacyDrawing

Source: classification engine

Classification label: mal64.winXLSX@1/1@0/1

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\Desktop\~$S6DgRF1SSD.xlsx

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{6FAA909A-96D9-4102-ABE2-01CECCE0A980} - OProcSessId.dat

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: S6DgRF1SSD.xlsx

ReversingLabs: Detection: 65%

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: S6DgRF1SSD.xlsx

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States		8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Contacted Domains

Name	IP	Active
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true

Name	Type	MD5	SHA1	SHA256
C:\Users\user\Desktop\~$S6DgRF1SSD.xlsx	data	9AC4D67F6E514F452D4A1DB79CE3B2E8	33F8C665ECBB81275D2E49D48F2565A58A282043	407E1D871964C93DBDBD4D00613CD0A9E30D3ED6352D8052C58E7A252D52FC5A

AV Detection

Antivirus / Scanner detection for submitted sample

Source: S6DgRF1SSD.xlsx

Avira: detected

Multi AV Scanner detection for submitted file

Source: S6DgRF1SSD.xlsx

ReversingLabs: Detection: 65%

Source: unknown

HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.16:49715 version: TLS 1.2

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.16:49716

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 13.107.246.45 13.107.246.45

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /rules/excel.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715

Source: unknown

HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.16:49715 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: sheet1.xml, type: SAMPLE

Matched rule: detects AutoLoad documents using LegacyDrawing Author: ditekSHen

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: S6DgRF1SSD.xlsx

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Unable to load, office file is protected or invalid

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Yara signature match

Source: sheet1.xml, type: SAMPLE

Matched rule: INDICATOR_XML_LegacyDrawing_AutoLoad_Document author = ditekSHen, description = detects AutoLoad documents using LegacyDrawing

Source: classification engine

Classification label: mal64.winXLSX@1/1@0/1

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\Desktop\~$S6DgRF1SSD.xlsx

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{6FAA909A-96D9-4102-ABE2-01CECCE0A980} - OProcSessId.dat

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: S6DgRF1SSD.xlsx

ReversingLabs: Detection: 65%

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: S6DgRF1SSD.xlsx

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

ID:	1543658
Product:	CloudBasic
Start time:	08:08:13
Start date:	28.10.2024
Sample:	S6DgRF1SSD.xlsx
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	334d7d30d9327e30d300d5ed3326d098
SHA1:	cdac6096bcc46f8ab2d668bba92d124beb7794d4
SHA256:	6bba78df2ac67668eb837a1593b6c1e3fc198fa4c1a4725a5d2370f8121c3a3b
Filetype:	Excel Microsoft Office Open XML Format document (35004/1) 81.40%

Windows Analysis Report
S6DgRF1SSD.xlsx

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report S6DgRF1SSD.xlsx

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
S6DgRF1SSD.xlsx