Windows Analysis Report
Salary 2025- workers-v1.xls

Overview

General Information

Sample name:	Salary 2025- workers-v1.xls
Analysis ID:	1559179
MD5:	db0d2d8342343528bb33649e91bb6f3d
SHA1:	7e00d44d5b05912a2e42c5408fefed8396710b24
SHA256:	abd87359790b24e8ac8464d3af8688b08248ca84c14dd97f1b6f33e8c297a3b8
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Machine Learning detection for sample

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Excel Network Connections

Sigma detected: Suspicious Office Outbound Connections

Suricata IDS alerts with low severity for network traffic

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Salary 2025- workers-v1.xls

Avira: detected

Machine Learning detection for sample

Source: Salary 2025- workers-v1.xls

Joe Sandbox ML: detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 13.107.246.42:443 -> 192.168.2.16:49716 version: TLS 1.2

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49717

Source: excel.exe

Memory has grown: Private usage: 1MB later: 130MB

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 13.107.246.42 13.107.246.42

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.16:49716 -> 13.107.246.42:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.16:49717 -> 13.107.246.42:443

Source: global traffic	HTTP traffic detected: GET /rules/excel.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443

Source: unknown

HTTPS traffic detected: 13.107.246.42:443 -> 192.168.2.16:49716 version: TLS 1.2

Document contains an embedded VBA macro which executes code when the document is opened / closed

Source: Salary 2025- workers-v1.xls	OLE, VBA macro line: Sub Auto_Open()
Source: mypersonnel.xls.0.dr	OLE, VBA macro line: Sub Auto_Open()

Document contains embedded VBA macros

Source: Salary 2025- workers-v1.xls	OLE indicator, VBA macros: true
Source: mypersonnel.xls.0.dr	OLE indicator, VBA macros: true

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: ~DF7F1A492639213F2D.TMP.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: mal52.winXLS@3/4@0/1

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Roaming\Microsoft\Excel\XLSTART\mypersonnel.xls

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{81270C32-B525-47BE-A881-FD16D640CB32} - OProcSessId.dat

Jump to behavior

Source: Salary 2025- workers-v1.xls	OLE indicator, Workbook stream: true
Source: mypersonnel.xls.0.dr	OLE indicator, Workbook stream: true

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\Salary 2025- workers-v1.xls"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88d96a05-f192-11d4-a65f-0040963251e5}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: ~DF7F1A492639213F2D.TMP.0.dr

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\splwow64.exe

Window / User API: threadDelayed 429

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
13.107.246.42	s-part-0014.t-0009.t-msedge.net	United States		8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Contacted Domains

Name	IP	Active
s-part-0014.t-0009.t-msedge.net	13.107.246.42	true

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Temp\~DF7F1A492639213F2D.TMP	Composite Document File V2 Document, Cannot read section info	50F83308869E593040C36F7BB477E559	E60766ADF2F3883DA5114FF664D2B77BCAB0E198	0E8B54B36E1DBDC206D1BAB37E17CDDEC0BA764818E68905275C744C72232E46
C:\Users\user\AppData\Local\Temp\~DFD4A5D58B07B985D6.TMP	data	92D85E1B6A3465F0170B75D492EAAA74	814183DA7E9D34A1750B13AA25BF69F4DB7FC8F7	4F6CCFB8CF96E8558BF8EC13656BE3D79F1B0A15997F3979A3CE6FE549E0A27F
C:\Users\user\AppData\Roaming\Microsoft\Excel\XLSTART\mypersonnel.xls	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: SM & You, Last Saved By: user, Name of Creating Application: Microsoft Excel, Create Time/Date: Mon Jan 11 08:46:49 2021, Last Saved Time/Date: Wed Nov 20 08:17:27 2024, Security: 0	DA370E238F05B56EE96BFF20C28DAB53	8AD4472721DCE0DAE7A1E0732BAE6F9DF6493A60	F6D7F10348EC09341AEAF6F346E81A1BE09B210F241AAD9F4C71490AED13FF79
C:\Users\user\Documents\~$mypersonnel.xls	data	9AC4D67F6E514F452D4A1DB79CE3B2E8	33F8C665ECBB81275D2E49D48F2565A58A282043	407E1D871964C93DBDBD4D00613CD0A9E30D3ED6352D8052C58E7A252D52FC5A

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Salary 2025- workers-v1.xls

Avira: detected

Machine Learning detection for sample

Source: Salary 2025- workers-v1.xls

Joe Sandbox ML: detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 13.107.246.42:443 -> 192.168.2.16:49716 version: TLS 1.2

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49716
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 13.107.246.42:443
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 13.107.246.42:443 -> 192.168.2.16:49717

Source: excel.exe

Memory has grown: Private usage: 1MB later: 130MB

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 13.107.246.42 13.107.246.42

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.16:49716 -> 13.107.246.42:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.16:49717 -> 13.107.246.42:443

Source: global traffic	HTTP traffic detected: GET /rules/excel.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443

Source: unknown

HTTPS traffic detected: 13.107.246.42:443 -> 192.168.2.16:49716 version: TLS 1.2

Document contains an embedded VBA macro which executes code when the document is opened / closed

Source: Salary 2025- workers-v1.xls	OLE, VBA macro line: Sub Auto_Open()
Source: mypersonnel.xls.0.dr	OLE, VBA macro line: Sub Auto_Open()

Document contains embedded VBA macros

Source: Salary 2025- workers-v1.xls	OLE indicator, VBA macros: true
Source: mypersonnel.xls.0.dr	OLE indicator, VBA macros: true

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: ~DF7F1A492639213F2D.TMP.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: mal52.winXLS@3/4@0/1

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Roaming\Microsoft\Excel\XLSTART\mypersonnel.xls

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{81270C32-B525-47BE-A881-FD16D640CB32} - OProcSessId.dat

Jump to behavior

Source: Salary 2025- workers-v1.xls	OLE indicator, Workbook stream: true
Source: mypersonnel.xls.0.dr	OLE indicator, Workbook stream: true

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\Salary 2025- workers-v1.xls"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88d96a05-f192-11d4-a65f-0040963251e5}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: ~DF7F1A492639213F2D.TMP.0.dr

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\splwow64.exe

Window / User API: threadDelayed 429

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

ID:	1559179
Product:	CloudBasic
Start time:	09:16:42
Start date:	20.11.2024
Sample:	Salary 2025- workers-v1.xls
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	db0d2d8342343528bb33649e91bb6f3d
SHA1:	7e00d44d5b05912a2e42c5408fefed8396710b24
SHA256:	abd87359790b24e8ac8464d3af8688b08248ca84c14dd97f1b6f33e8c297a3b8
Filetype:	Microsoft Excel sheet (30009/1) 47.99%

Windows Analysis Report
Salary 2025- workers-v1.xls

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Salary 2025- workers-v1.xls

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Salary 2025- workers-v1.xls