Edit tour
Windows
Analysis Report
New order 242.xls
Overview
General Information
| Sample name: | New order 242.xls |
| Analysis ID: | 1640395 |
| MD5: | 1880402f48cccdbfbd8512b6e03ba144 |
| SHA1: | 7d52fb9c27b199ef4c0ade6dfda7a5bed33d8d49 |
| SHA256: | 8ffc44346b0715a33f30802fccf6b5d99edcc8323e06b0459fc2366a2c7e249f |
| Tags: | xlsuser-abuse_ch |
| Infos: |  |
 | |
Detection
| Score: | 60 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Sigma detected: Suspicious Microsoft Office Child Process
Document contains embedded VBA macros
Document embeds suspicious OLE2 link
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Sample execution stops while process was sleeping (likely an evasion)
Searches for the Microsoft Outlook file path
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Classification
- System is w10x64
EXCEL.EXE (PID: 6800 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\EXCEL .EXE" /aut omation -E mbedding MD5: 4A871771235598812032C822E6F68F19) 
mshta.exe (PID: 1220 cmdline: C:\Windows \SysWOW64\ mshta.exe -Embedding MD5: 06B02D5C097C7DB1F109749C45F3F505) 
splwow64.exe (PID: 1936 cmdline: C:\Windows \splwow64. exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)
- EXCEL.EXE (PID: 368 cmdline:
"C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\EXCEL .EXE" "C:\ Users\user \Desktop\N ew order 2 42.xls" MD5: 4A871771235598812032C822E6F68F19)
- cleanup
⊘No configs have been found
⊘No yara matches
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: | ||
| Source: | Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: | ||
| Source: | Author: X__Junior (Nextron Systems): | ||
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-03-17T09:29:37.545969+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.12 | 49764 | 13.107.246.60 | 443 | TCP |
| 2025-03-17T09:29:42.777526+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.12 | 49765 | 13.107.246.60 | 443 | TCP |
| 2025-03-17T09:29:42.778108+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.12 | 49766 | 13.107.246.60 | 443 | TCP |
- • AV Detection
- • Compliance
- • Software Vulnerabilities
- • Networking
- • System Summary
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | File opened: | Jump to behavior | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
Software Vulnerabilities | |
|---|
| Source: | Process created: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | Memory has grown: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
System Summary | |
|---|
| Source: | OLE: | ||
| Source: | OLE: | ||
| Source: | OLE: | ||
| Source: | OLE: | ||
| Source: | OLE indicator, VBA macros: | ||
| Source: | OLE indicator, VBA macros: | ||
| Source: | Stream path 'MBD00CB8BBA/\x1Ole' : | ||
| Source: | Stream path 'MBD00CB8BBA/\x1Ole' : | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | OLE indicator, Workbook stream: | ||
| Source: | OLE indicator, Workbook stream: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Static file information: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Initial sample: | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Stream path 'MBD00CB8BB9/MBD00320C7F/Package' entropy: | ||
| Source: | Stream path 'Workbook' entropy: | ||
| Source: | Stream path 'MBD00CB8BB9/MBD00320C7F/Package' entropy: | ||
| Source: | Stream path 'Workbook' entropy: | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Process information queried: | Jump to behavior | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | 1 Scripting | Valid Accounts | 13 Exploitation for Client Execution | 1 Scripting | 1 Process Injection | 1 Masquerading | OS Credential Dumping | 1 Process Discovery | Remote Services | 1 Email Collection | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 1 DLL Side-Loading | 1 DLL Side-Loading | 1 Virtualization/Sandbox Evasion | LSASS Memory | 1 Virtualization/Sandbox Evasion | Remote Desktop Protocol | Data from Removable Media | 1 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 1 Extra Window Memory Injection | 1 Process Injection | Security Account Manager | 1 Application Window Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 2 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Obfuscated Files or Information | NTDS | 1 File and Directory Discovery | Distributed Component Object Model | Input Capture | 13 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 DLL Side-Loading | LSA Secrets | 2 System Information Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 Extra Window Memory Injection | Cached Domain Credentials | Wi-Fi Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 33% | Virustotal | Browse | ||
| 22% | ReversingLabs | Document-Excel.Exploit.CVE-2017-0199 |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| bg.microsoft.map.fastly.net | 199.232.210.172 | true | false | high | |
| s-part-0044.t-0009.fb-t-msedge.net | 13.107.253.72 | true | false | high | |
| s-0005.dual-s-dc-msedge.net | 52.123.131.14 | true | false | high | |
| service-eks-nlb-public-0b7cb0a32741e125.elb.ap-northeast-2.amazonaws.com | 3.39.153.44 | true | false | high | |
| s-part-0032.t-0009.t-msedge.net | 13.107.246.60 | true | false | high | |
| otelrules.svc.static.microsoft | unknown | unknown | false | high | |
| link.saja.market | unknown | unknown | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high | ||
| false |
| unknown | |
| false | high | ||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 192.3.101.146 | unknown | United States | 36352 | AS-COLOCROSSINGUS | false | |
| 3.39.153.44 | service-eks-nlb-public-0b7cb0a32741e125.elb.ap-northeast-2.amazonaws.com | United States | 8987 | AMAZONEXPANSIONGB | false | |
| 13.107.246.60 | s-part-0032.t-0009.t-msedge.net | United States | 8068 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1640395 |
| Start date and time: | 2025-03-17 09:27:32 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 5m 40s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultwindowsofficecookbook.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 18 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | New order 242.xls |
| Detection: | MAL |
| Classification: | mal60.expl.winXLS@6/4@3/3 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis
(whitelisted): MpCmdRun.exe, d llhost.exe, sppsvc.exe, WMIADA P.exe, SIHClient.exe, SgrmBrok er.exe, conhost.exe, svchost.e xe, MavInject32.exe - Excluded IPs from analysis (wh
itelisted): 23.199.214.10, 52. 109.32.97, 52.109.28.47, 199.2 32.210.172, 20.189.173.13, 104 .208.16.95, 52.109.89.18, 52.1 23.131.14, 40.126.32.74, 20.10 9.210.53 - Excluded domains from analysis
(whitelisted): slscr.update.m icrosoft.com, onedscolprdcus20 .centralus.cloudapp.azure.com, weu-azsc-config.officeapps.li ve.com, fs-wildcard.microsoft. com.edgekey.net, fs-wildcard.m icrosoft.com.edgekey.net.globa lredir.akadns.net, e16604.dscf .akamaiedge.net, eur.roaming1. live.com.akadns.net, roaming.o fficeapps.live.com, dual-s-000 5-office.config.skype.com, log in.live.com, officeclient.micr osoft.com, prod.fs.microsoft.c om.akadns.net, ukw-azsc-config .officeapps.live.com, c.pki.go og, wu-b-net.trafficmanager.ne t, ecs.office.com, self-events -data.trafficmanager.net, fs.m icrosoft.com, ctldl.windowsupd ate.com.delivery.microsoft.com , prod.configsvc1.live.com.aka dns.net, self.events.data.micr osoft.com, ctldl.windowsupdate .com, prod.roaming1.live.com.a kadns.net, osiprod-uks-buff-az sc-000.uksouth.cloudapp.azure. com, fe3cr.delivery.mp.microso ft.com, uks-azsc-000.roaming.o fficeapps.live.com, onedscolpr dwus12.westus.cloudapp.azure.c om, config.officeapps.live.com , ecs.office.trafficmanager.ne t, e - Not all processes where analyz
ed, report is missing behavior information - Report size getting too big, t
oo many NtCreateKey calls foun d. - Report size getting too big, t
oo many NtQueryAttributesFile calls found. - Report size getting too big, t
oo many NtQueryValueKey calls found. - Report size getting too big, t
oo many NtReadVirtualMemory ca lls found. - Skipping SSL PCAP network anal
ysis since amount of network t raffic is too extensive - Some HTTP raw data packets hav
e been limited to 10 per sessi on. Please view the PCAPs for the complete data. - Some HTTPS proxied raw data pa
ckets have been limited to 10 per session. Please view the P CAPs for the complete data.
| Time | Type | Description |
|---|---|---|
| 04:29:32 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 192.3.101.146 | Get hash | malicious | Cobalt Strike, MSIL Logger, MassLogger RAT | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| 3.39.153.44 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| 13.107.246.60 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| bg.microsoft.map.fastly.net | Get hash | malicious | GuLoader, HTMLPhisher | Browse |
| |
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Sality | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Babadeda | Browse |
| ||
| Get hash | malicious | Sality | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | DanaBot | Browse |
| ||
| s-0005.dual-s-dc-msedge.net | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| s-part-0044.t-0009.fb-t-msedge.net | Get hash | malicious | DanaBot | Browse |
| |
| Get hash | malicious | NovaSentinel | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| AS-COLOCROSSINGUS | Get hash | malicious | Cobalt Strike, FormBook | Browse |
| |
| Get hash | malicious | Cobalt Strike, MSIL Logger, MassLogger RAT | Browse |
| ||
| Get hash | malicious | Cobalt Strike, MSIL Logger, MassLogger RAT | Browse |
| ||
| Get hash | malicious | Cobalt Strike, MSIL Logger, MassLogger RAT | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | StormKitty | Browse |
| ||
| Get hash | malicious | DarkVision Rat | Browse |
| ||
| Get hash | malicious | AsyncRAT, DarkVision Rat | Browse |
| ||
| Get hash | malicious | Amadey, LummaC Stealer, Stealc, Xmrig | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| MICROSOFT-CORP-MSN-AS-BLOCKUS | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Sality | Browse |
| ||
| Get hash | malicious | Sality | Browse |
| ||
| Get hash | malicious | Sality | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| AMAZONEXPANSIONGB | Get hash | malicious | GuLoader, HTMLPhisher | Browse |
| |
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | GuLoader, HTMLPhisher | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Cobalt Strike, FormBook | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | NovaSentinel | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 6271f898ce5be7dd52b0fc260d0662b3 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | Babadeda | Browse |
| ||
| Get hash | malicious | Babadeda | Browse |
| ||
| Get hash | malicious | Babadeda | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| a0e9f5d64349fb13191bc781f81f42e1 | Get hash | malicious | LummaC Stealer | Browse |
| |
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | GhostRat, Mimikatz, Nitol | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Latrodectus, LummaC Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
⊘No context
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 118 |
| Entropy (8bit): | 3.5700810731231707 |
| Encrypted: | false |
| SSDEEP: | 3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq |
| MD5: | 573220372DA4ED487441611079B623CD |
| SHA1: | 8F9D967AC6EF34640F1F0845214FBC6994C0CB80 |
| SHA-256: | BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D |
| SHA-512: | F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 512 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | 3:: |
| MD5: | BF619EAC0CDF3F68D496EA9344137E8B |
| SHA1: | 5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5 |
| SHA-256: | 076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560 |
| SHA-512: | DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 512 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | 3:: |
| MD5: | BF619EAC0CDF3F68D496EA9344137E8B |
| SHA1: | 5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5 |
| SHA-256: | 076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560 |
| SHA-512: | DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1172480 |
| Entropy (8bit): | 7.832914490633643 |
| Encrypted: | false |
| SSDEEP: | 24576:qLA6DHtWjejsk4McucJIwgxIOXR8YhbBWvdp8tLUWBMDc7jRO:NSaejH4MTczguM8YkpwLUwhX4 |
| MD5: | 939D20ADA6404EBC7E42EC5F0FCF8859 |
| SHA1: | 76960884A844CAC3A6CBE48C1257899431DB36FF |
| SHA-256: | 21EA14FEF123E9EF3971C078F5C3573B9756B1450E04C26CCDE1AD317A3F590C |
| SHA-512: | 2C4CEB82FAA2457B2AE590C38B2875CD210641800562492A3234701547149262BE2DC4786494FA01C314BF5BAFD9F7F48E224526B6627A6E500CA09A28E3A467 |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.832994944211746 |
| TrID: |
|
| File name: | New order 242.xls |
| File size: | 1'172'480 bytes |
| MD5: | 1880402f48cccdbfbd8512b6e03ba144 |
| SHA1: | 7d52fb9c27b199ef4c0ade6dfda7a5bed33d8d49 |
| SHA256: | 8ffc44346b0715a33f30802fccf6b5d99edcc8323e06b0459fc2366a2c7e249f |
| SHA512: | fd5e4156cac3b2a914aaad968ddf1926f86d3c326641b1ca8d495e4c9f4e4dd77c845371b93764f154d619da8682b2e5f928bf93d820f3dc635eea123121dd3c |
| SSDEEP: | 24576:fLA6DHtWjejsk4McuVJIwgxIOXR8YhbBWvdp8tLUWBMDc9jRO:USaejH4MTVzguM8YkpwLUwhl4 |
| TLSH: | 61450294BFC05626CA1D02340FE78B1C5A25EEEA5755620F3236BE1C3E76B3E0B72519 |
| File Content Preview: | ........................>...................................................................................................................................................................................................................................... |
 | |
| Icon Hash: | 35ed8e920e8c81b5 |
| Document Type: | OLE |
| Number of OLE Files: | 1 |
| Has Summary Info: | |
| Application Name: | Microsoft Excel |
| Encrypted Document: | True |
| Contains Word Document Stream: | False |
| Contains Workbook/Book Stream: | True |
| Contains PowerPoint Document Stream: | False |
| Contains Visio Document Stream: | False |
| Contains ObjectPool Stream: | False |
| Flash Objects Count: | 0 |
| Contains VBA Macros: | True |
| Code Page: | 1252 |
| Author: | |
| Last Saved By: | |
| Create Time: | 2006-09-16 00:00:00 |
| Last Saved Time: | 2025-03-17 03:34:11 |
| Creating Application: | |
| Security: | 1 |
| Document Code Page: | 1252 |
| Thumbnail Scaling Desired: | False |
| Contains Dirty Links: | False |
| Shared Document: | False |
| Changed Hyperlinks: | False |
| Application Version: | 786432 |
General | |
| Stream Path: | _VBA_PROJECT_CUR/VBA/Sheet1 |
| VBA File Name: | Sheet1.cls |
| Stream Size: | 977 |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ' N 6 . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - |
| Data Raw: | 01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 27 4e 36 81 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
|
General | |
| Stream Path: | _VBA_PROJECT_CUR/VBA/Sheet2 |
| VBA File Name: | Sheet2.cls |
| Stream Size: | 977 |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ' N . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . |
| Data Raw: | 01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 27 4e 82 e4 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
|
General | |
| Stream Path: | _VBA_PROJECT_CUR/VBA/Sheet3 |
| VBA File Name: | Sheet3.cls |
| Stream Size: | 977 |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ' N t . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - |
| Data Raw: | 01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 27 4e 74 fa 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
|
General | |
| Stream Path: | _VBA_PROJECT_CUR/VBA/ThisWorkbook |
| VBA File Name: | ThisWorkbook.cls |
| Stream Size: | 985 |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ' N 8 . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . - |
| Data Raw: | 01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 27 4e 38 db 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
|
General | |
| Stream Path: | \x1CompObj |
| CLSID: | |
| File Type: | data |
| Stream Size: | 114 |
| Entropy: | 4.25248375192737 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . . |
| Data Raw: | 01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
| Stream Path: | \x5DocumentSummaryInformation |
| CLSID: | |
| File Type: | data |
| Stream Size: | 244 |
| Entropy: | 2.889430592781307 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00 |
General | |
| Stream Path: | \x5SummaryInformation |
| CLSID: | |
| File Type: | data |
| Stream Size: | 200 |
| Entropy: | 3.282068105701866 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . | . # . @ . . . { r . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00 |
General | |
| Stream Path: | MBD00CB8BB9/\x1CompObj |
| CLSID: | |
| File Type: | data |
| Stream Size: | 114 |
| Entropy: | 4.25248375192737 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . . |
| Data Raw: | 01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
| Stream Path: | MBD00CB8BB9/\x5DocumentSummaryInformation |
| CLSID: | |
| File Type: | data |
| Stream Size: | 296 |
| Entropy: | 3.2973193143624515 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . S h e e t 1 ! P r i n t _ A r e a . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 f8 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 b7 00 00 00 02 00 00 00 e4 04 00 00 |
General | |
| Stream Path: | MBD00CB8BB9/\x5SummaryInformation |
| CLSID: | |
| File Type: | data |
| Stream Size: | 31156 |
| Entropy: | 3.1876994904322484 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . y . . . . . . . . . . P . . . . . . . X . . . . . . . p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . K e n n y C h e u n g . . . . . . . . . . . . 9 1 9 7 4 . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . m . . . @ . . . . _ ~ . \\ S . @ . . . . . . . . . . . . G . . . x . . . . . . . . 0 . . . . . . . . . . T < . . . . . . . . . . . . . . & . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 84 79 00 00 09 00 00 00 01 00 00 00 50 00 00 00 04 00 00 00 58 00 00 00 08 00 00 00 70 00 00 00 12 00 00 00 80 00 00 00 0b 00 00 00 98 00 00 00 0c 00 00 00 a4 00 00 00 0d 00 00 00 b0 00 00 00 13 00 00 00 bc 00 00 00 11 00 00 00 c4 00 00 00 |
General | |
| Stream Path: | MBD00CB8BB9/MBD00320C7F/\x1CompObj |
| CLSID: | |
| File Type: | data |
| Stream Size: | 114 |
| Entropy: | 4.219515110876372 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . 0 . . . . . . . . . . . . . F ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . E x c e l . S h e e t . 1 2 . 9 q . . . . . . . . . . . . |
| Data Raw: | 01 00 fe ff 03 0a 00 00 ff ff ff ff 30 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 0f 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 31 32 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
| Stream Path: | MBD00CB8BB9/MBD00320C7F/Package |
| CLSID: | |
| File Type: | Microsoft Excel 2007+ |
| Stream Size: | 613686 |
| Entropy: | 7.989056691241232 |
| Base64 Encoded: | True |
| Data ASCII: | P K . . . . . . . . . . ! . . X . . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
| Data Raw: | 50 4b 03 04 14 00 06 00 08 00 00 00 21 00 1a 58 13 82 c0 01 00 00 90 07 00 00 13 00 bb 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 b7 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
| Stream Path: | MBD00CB8BB9/MBD00321A49/\x1CompObj |
| CLSID: | |
| File Type: | data |
| Stream Size: | 114 |
| Entropy: | 4.219515110876372 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . 0 . . . . . . . . . . . . . F ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . E x c e l . S h e e t . 1 2 . 9 q . . . . . . . . . . . . |
| Data Raw: | 01 00 fe ff 03 0a 00 00 ff ff ff ff 30 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 0f 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 31 32 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
| Stream Path: | MBD00CB8BB9/MBD00321A49/Package |
| CLSID: | |
| File Type: | Microsoft Excel 2007+ |
| Stream Size: | 13665 |
| Entropy: | 7.1661074658165225 |
| Base64 Encoded: | True |
| Data ASCII: | P K . . . . . . . . . . ! . . ~ . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
| Data Raw: | 50 4b 03 04 14 00 06 00 08 00 00 00 21 00 c8 9d a8 db 7e 01 00 00 85 05 00 00 13 00 cf 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 cb 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
| Stream Path: | MBD00CB8BB9/Workbook |
| CLSID: | |
| File Type: | Applesoft BASIC program data, first line number 16 |
| Stream Size: | 392615 |
| Entropy: | 7.73377528201003 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . 9 1 9 7 4 B . . . . a . . . . . . . . = . . . . . . . . . . . . . . . . . . . . ? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . h : . 9 . . . . . . . X . @ . . . . . . . . . . " . . . . . . . . . . . . . |
| Data Raw: | 09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 05 00 00 39 31 39 37 34 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |
General | |
| Stream Path: | MBD00CB8BBA/\x1Ole |
| CLSID: | |
| File Type: | data |
| Stream Size: | 672 |
| Entropy: | 5.721882745142486 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . f G . ] . . . . . . . . . . . . : . . . y . . . K . 6 . . . h . t . t . p . s . : . / . / . l . i . n . k . . . s . a . j . a . . . m . a . r . k . e . t . / . L . U . V . L . Q . 8 . X . 6 . l . 6 . ? . & . p . e . a . k . = . s . o . u . r . & . e . a . r . d . r . u . m . . . [ % . v C . . L 0 R 5 . . Q # ; ` . F & . p . b # K ` D ? . 2 . . . . . . | @ . - : D l < . . . T . : ~ . . : . . ^ . R . ; W n . . . Y R r B . . a a q p . " . . y { N ) . . / % a . t h d . k . = . > . . . . . . . . . . |
| Data Raw: | 01 00 00 02 11 0a e3 66 47 dd 18 5d 00 00 00 00 00 00 00 00 00 00 00 00 3a 01 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b 36 01 00 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 6c 00 69 00 6e 00 6b 00 2e 00 73 00 61 00 6a 00 61 00 2e 00 6d 00 61 00 72 00 6b 00 65 00 74 00 2f 00 4c 00 55 00 56 00 4c 00 51 00 38 00 58 00 36 00 6c 00 36 00 3f 00 26 00 70 00 65 00 61 00 |
General | |
| Stream Path: | Workbook |
| CLSID: | |
| File Type: | Applesoft BASIC program data, first line number 16 |
| Stream Size: | 96235 |
| Entropy: | 7.991575064573711 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . . . . . . . . . . / . 6 . . . . . . . . @ } M V / L A k F r . ; Z [ F . 8 e . } 1 ! . . B . % . . . . . . . { . . . \\ . p . ( . 3 Q 7 [ C 5 q r u V ^ ; E < . \\ 8 { e q q q . . > f . y t U . t r I _ ` r u . c * ( . 4 m . W . . . 3 9 } . _ 2 . ' N B . . . a . . . O . . . = . . . > 8 l . 0 . . . r E . { . . . C . . . . . . . . . . L A . . . . > . . . . . . . . h = . . . * w + y 2 c @ . . . O . . . ' " . . . w N . . . . . . . . _ . . . Q 1 . . . . E x . B ' ~ z C ; 7 g I . = . 1 . . . . . = |
| Data Raw: | 09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 0f ec 40 97 7d 4d 56 2f c9 4c ac 41 6b 46 88 72 16 3b 8e 9a f4 5a 5b be 46 9b a3 17 90 84 38 d0 65 c5 c5 04 7d 31 d7 21 0b 14 42 1a e9 e0 25 a4 e1 00 02 00 b0 04 c1 00 02 00 7b c5 e2 00 00 00 5c 00 70 00 28 eb d1 19 b0 33 b4 a7 b7 51 97 ff 37 5b f3 b9 43 35 71 72 75 56 5e 3b 45 3c 9f b0 0f 5c |
General | |
| Stream Path: | _VBA_PROJECT_CUR/PROJECT |
| CLSID: | |
| File Type: | ASCII text, with CRLF line terminators |
| Stream Size: | 529 |
| Entropy: | 5.255987895338394 |
| Base64 Encoded: | True |
| Data ASCII: | I D = " { 8 3 D 3 0 D B 6 - 5 4 7 B - 4 1 8 4 - B B C B - D 8 F 6 A 4 7 E 7 E F 1 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " C 3 C 1 D 1 7 1 7 7 7 5 7 7 7 5 7 |
| Data Raw: | 49 44 3d 22 7b 38 33 44 33 30 44 42 36 2d 35 34 37 42 2d 34 31 38 34 2d 42 42 43 42 2d 44 38 46 36 41 34 37 45 37 45 46 31 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30 |
General | |
| Stream Path: | _VBA_PROJECT_CUR/PROJECTwm |
| CLSID: | |
| File Type: | data |
| Stream Size: | 104 |
| Entropy: | 3.0488640812019017 |
| Base64 Encoded: | False |
| Data ASCII: | T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . . |
| Data Raw: | 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00 |
General | |
| Stream Path: | _VBA_PROJECT_CUR/VBA/_VBA_PROJECT |
| CLSID: | |
| File Type: | data |
| Stream Size: | 2644 |
| Entropy: | 3.9835394684377627 |
| Base64 Encoded: | False |
| Data ASCII: | a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r . |
| Data Raw: | cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00 |
General | |
| Stream Path: | _VBA_PROJECT_CUR/VBA/dir |
| CLSID: | |
| File Type: | data |
| Stream Size: | 553 |
| Entropy: | 6.356415315211564 |
| Base64 Encoded: | True |
| Data ASCII: | . % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . - & i . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2 |
| Data Raw: | 01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 2d 26 ef 69 12 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47 |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeDownload Network PCAP: filtered – full
| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-03-17T09:29:37.545969+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.12 | 49764 | 13.107.246.60 | 443 | TCP |
| 2025-03-17T09:29:42.777526+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.12 | 49765 | 13.107.246.60 | 443 | TCP |
| 2025-03-17T09:29:42.778108+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.12 | 49766 | 13.107.246.60 | 443 | TCP |
- Total Packets: 219
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 17, 2025 09:29:27.789061069 CET | 49762 | 443 | 192.168.2.12 | 3.39.153.44 |
| Mar 17, 2025 09:29:27.789122105 CET | 443 | 49762 | 3.39.153.44 | 192.168.2.12 |
| Mar 17, 2025 09:29:27.789207935 CET | 49762 | 443 | 192.168.2.12 | 3.39.153.44 |
| Mar 17, 2025 09:29:27.789545059 CET | 49762 | 443 | 192.168.2.12 | 3.39.153.44 |
| Mar 17, 2025 09:29:27.789570093 CET | 443 | 49762 | 3.39.153.44 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.024199963 CET | 443 | 49762 | 3.39.153.44 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.024269104 CET | 49762 | 443 | 192.168.2.12 | 3.39.153.44 |
| Mar 17, 2025 09:29:29.028831005 CET | 49762 | 443 | 192.168.2.12 | 3.39.153.44 |
| Mar 17, 2025 09:29:29.028847933 CET | 443 | 49762 | 3.39.153.44 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.029095888 CET | 443 | 49762 | 3.39.153.44 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.029150009 CET | 49762 | 443 | 192.168.2.12 | 3.39.153.44 |
| Mar 17, 2025 09:29:29.035264015 CET | 49762 | 443 | 192.168.2.12 | 3.39.153.44 |
| Mar 17, 2025 09:29:29.076335907 CET | 443 | 49762 | 3.39.153.44 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.335258007 CET | 443 | 49762 | 3.39.153.44 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.335397959 CET | 49762 | 443 | 192.168.2.12 | 3.39.153.44 |
| Mar 17, 2025 09:29:29.335398912 CET | 443 | 49762 | 3.39.153.44 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.335438967 CET | 49762 | 443 | 192.168.2.12 | 3.39.153.44 |
| Mar 17, 2025 09:29:29.341326952 CET | 49762 | 443 | 192.168.2.12 | 3.39.153.44 |
| Mar 17, 2025 09:29:29.341351986 CET | 443 | 49762 | 3.39.153.44 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.343421936 CET | 49763 | 80 | 192.168.2.12 | 192.3.101.146 |
| Mar 17, 2025 09:29:29.348140001 CET | 80 | 49763 | 192.3.101.146 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.348207951 CET | 49763 | 80 | 192.168.2.12 | 192.3.101.146 |
| Mar 17, 2025 09:29:29.348325014 CET | 49763 | 80 | 192.168.2.12 | 192.3.101.146 |
| Mar 17, 2025 09:29:29.352998018 CET | 80 | 49763 | 192.3.101.146 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.839521885 CET | 80 | 49763 | 192.3.101.146 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.839536905 CET | 80 | 49763 | 192.3.101.146 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.839549065 CET | 80 | 49763 | 192.3.101.146 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.839575052 CET | 49763 | 80 | 192.168.2.12 | 192.3.101.146 |
| Mar 17, 2025 09:29:29.839607000 CET | 49763 | 80 | 192.168.2.12 | 192.3.101.146 |
| Mar 17, 2025 09:29:29.839632034 CET | 80 | 49763 | 192.3.101.146 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.839643955 CET | 80 | 49763 | 192.3.101.146 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.839656115 CET | 80 | 49763 | 192.3.101.146 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.839667082 CET | 49763 | 80 | 192.168.2.12 | 192.3.101.146 |
| Mar 17, 2025 09:29:29.839672089 CET | 80 | 49763 | 192.3.101.146 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.839684963 CET | 80 | 49763 | 192.3.101.146 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.839693069 CET | 49763 | 80 | 192.168.2.12 | 192.3.101.146 |
| Mar 17, 2025 09:29:29.839698076 CET | 80 | 49763 | 192.3.101.146 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.839709997 CET | 80 | 49763 | 192.3.101.146 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.839720964 CET | 49763 | 80 | 192.168.2.12 | 192.3.101.146 |
| Mar 17, 2025 09:29:29.839737892 CET | 49763 | 80 | 192.168.2.12 | 192.3.101.146 |
| Mar 17, 2025 09:29:29.844269037 CET | 80 | 49763 | 192.3.101.146 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.844283104 CET | 80 | 49763 | 192.3.101.146 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.844311953 CET | 49763 | 80 | 192.168.2.12 | 192.3.101.146 |
| Mar 17, 2025 09:29:29.844336987 CET | 49763 | 80 | 192.168.2.12 | 192.3.101.146 |
| Mar 17, 2025 09:29:29.844481945 CET | 80 | 49763 | 192.3.101.146 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.844491959 CET | 80 | 49763 | 192.3.101.146 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.844516993 CET | 49763 | 80 | 192.168.2.12 | 192.3.101.146 |
| Mar 17, 2025 09:29:29.844533920 CET | 49763 | 80 | 192.168.2.12 | 192.3.101.146 |
| Mar 17, 2025 09:29:29.930232048 CET | 80 | 49763 | 192.3.101.146 | 192.168.2.12 |
| Mar 17, 2025 09:29:29.930314064 CET | 49763 | 80 | 192.168.2.12 | 192.3.101.146 |
| Mar 17, 2025 09:29:30.080862999 CET | 49763 | 80 | 192.168.2.12 | 192.3.101.146 |
| Mar 17, 2025 09:29:30.080862999 CET | 49763 | 80 | 192.168.2.12 | 192.3.101.146 |
| Mar 17, 2025 09:29:36.912585974 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:36.912617922 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:36.912789106 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:36.913229942 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:36.913247108 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.545737982 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.545969009 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.547265053 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.547286987 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.547571898 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.548795938 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.592336893 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.647871017 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.647895098 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.647908926 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.647965908 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.647995949 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.648037910 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.733109951 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.733138084 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.733201981 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.733234882 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.733417988 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.735414028 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.735436916 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.735481024 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.735490084 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.735536098 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.818497896 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.818522930 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.818597078 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.818633080 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.818814993 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.819437981 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.819457054 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.819530010 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.819551945 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.819658041 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.821197033 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.821214914 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.821283102 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.821300983 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.821369886 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.822134018 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.822153091 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.822199106 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.822212934 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.822226048 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.822246075 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.905179977 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.905206919 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.905260086 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.905292034 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.905308008 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.905375957 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.905658007 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.905677080 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.905710936 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.905719042 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.905745983 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.905770063 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.906389952 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.906411886 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.906454086 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.906461954 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.906502008 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.907365084 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.907382965 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.907423019 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.907429934 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.907464027 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.908255100 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.908274889 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.908320904 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.908329010 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.908364058 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.908370018 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.909207106 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.909225941 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.909291029 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.909298897 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.909334898 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.910026073 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.910043001 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.910093069 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.910099983 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.910136938 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.991436958 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.991466045 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.991581917 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.991616964 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.991638899 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.992209911 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.992233992 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.992276907 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.992286921 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.992295980 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.992805958 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.992826939 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.992857933 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.992866039 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.992892027 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.992914915 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.993438959 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.993457079 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.993501902 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.993515015 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.994311094 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.994334936 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.994365931 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.994375944 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.994385958 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.994415045 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.995287895 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.995307922 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.995345116 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.995352030 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.995362043 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.996257067 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.996277094 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.996314049 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.996321917 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:37.996334076 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.996361017 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:37.998497963 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.077922106 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.077986002 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.078048944 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.078080893 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.078100920 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.078113079 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.078115940 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.078178883 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.078180075 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.078241110 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.078298092 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.078306913 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.078421116 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.078463078 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.078478098 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.078497887 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.078527927 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.078551054 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.078814983 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.078860998 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.078874111 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.078881979 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.078921080 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.082547903 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.082591057 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.082645893 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.082665920 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.082679987 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.082865953 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.082925081 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.082940102 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.082988977 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.083004951 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.083039045 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.083348036 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.083386898 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.083401918 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.083411932 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.083435059 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.083451986 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.083900928 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.083951950 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.083970070 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.083980083 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.084000111 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.084016085 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.164099932 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.164180994 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.164282084 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.164324045 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.164340973 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.164370060 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.164419889 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.164459944 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.164489031 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.164496899 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.164525986 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.164554119 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.164601088 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.164654970 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.164658070 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.164684057 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.164716959 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.164727926 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.164891005 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.164931059 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.164953947 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.164963007 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.164979935 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.164994001 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.165071964 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.165113926 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.165147066 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.165158987 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.165179014 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.165199041 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.165271997 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.165312052 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.165328979 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.165337086 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.165349007 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.165369034 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.165386915 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.165716887 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.165760040 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.165776014 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.165785074 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.165813923 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.165827036 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.165899038 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.165945053 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.165957928 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.165970087 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.166002989 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.166013002 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.166908026 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.250370979 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.250401974 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.250449896 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.250458956 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.250492096 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.250514984 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.250546932 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.250633955 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.250654936 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.250689030 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.250703096 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.250714064 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.250942945 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.250965118 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.250994921 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.251003027 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.251025915 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.251380920 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.251399040 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.251444101 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.251451969 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.251461983 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.251568079 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.251589060 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.251617908 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.251626015 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.251636028 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.251739025 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.251754045 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.251784086 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.251791000 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.251805067 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.252098083 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.252123117 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.252177954 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.252185106 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.254992008 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.338964939 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.338998079 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.339031935 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.339061975 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.339077950 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.339096069 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.339107990 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.339134932 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.339159966 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.339165926 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.339210033 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.339210033 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.339462042 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.339483023 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.339515924 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.339523077 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.339550018 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.339560032 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.339675903 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.339693069 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.339721918 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.339729071 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.339749098 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.339767933 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.339993000 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.340017080 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.340055943 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.340061903 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.340075016 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.340090036 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.340249062 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.340270996 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.340456963 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.340456963 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.340468884 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.340506077 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.340507030 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.340522051 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.340543032 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.340553045 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.340559959 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.340584040 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.340600014 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.340833902 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.340856075 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.340889931 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.340897083 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.340909004 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.340925932 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.342297077 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.426780939 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.426811934 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.426866055 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.426877022 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.426891088 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.426894903 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.426914930 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.426918030 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.426949024 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.426964998 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.426978111 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.427089930 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.427958012 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.427978992 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.428049088 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.428057909 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.428092003 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.428105116 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.428131104 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.428153992 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.428160906 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.428188086 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.428205967 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.428951025 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.428978920 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.429008961 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.429014921 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.429040909 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.429054022 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.429531097 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.429552078 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.429591894 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.429598093 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.429622889 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.429630995 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.430171967 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.430181026 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.430246115 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.430253029 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.430476904 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.431011915 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.431031942 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.431155920 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.431163073 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.431210041 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.513130903 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.513153076 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.513211012 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.513242960 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.513257980 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.513344049 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.513427973 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.513451099 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.513482094 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.513492107 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.513509035 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.513526917 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.514265060 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.514288902 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.514324903 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.514333963 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.514363050 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.514383078 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.514463902 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.514481068 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.514552116 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.514552116 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.514569998 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.514643908 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.515187979 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.515207052 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.515243053 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.515250921 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.515264988 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.515300035 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.515892029 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.515913963 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.515955925 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.515969992 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.515995026 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.516015053 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.516015053 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.516705036 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.516726971 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.516767025 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.516769886 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.516781092 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.516803980 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.516819000 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.516828060 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.516860962 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.516872883 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.516899109 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.517016888 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.517040968 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:38.517050982 CET | 49764 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:38.517056942 CET | 443 | 49764 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:42.138468981 CET | 49765 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:42.138597012 CET | 443 | 49765 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:42.138900995 CET | 49765 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:42.139230013 CET | 49765 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:42.139261007 CET | 443 | 49765 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:42.140228033 CET | 49766 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:42.140280962 CET | 443 | 49766 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:42.140358925 CET | 49766 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:42.140495062 CET | 49766 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:42.140511036 CET | 443 | 49766 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:42.776760101 CET | 443 | 49765 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:42.777209997 CET | 443 | 49766 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:42.777525902 CET | 49765 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:42.777559042 CET | 443 | 49765 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:42.778107882 CET | 49766 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:42.778140068 CET | 443 | 49766 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:42.779015064 CET | 49766 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:42.779026031 CET | 443 | 49766 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:42.779361963 CET | 49765 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:42.779382944 CET | 443 | 49765 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:42.878568888 CET | 443 | 49765 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:42.878637075 CET | 443 | 49765 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:42.878684998 CET | 49765 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:42.879031897 CET | 49765 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:42.879050970 CET | 443 | 49765 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:42.879065037 CET | 49765 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:42.879071951 CET | 443 | 49765 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:42.880276918 CET | 443 | 49766 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:42.880300045 CET | 443 | 49766 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:42.880358934 CET | 49766 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:42.880367041 CET | 443 | 49766 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:42.880418062 CET | 49766 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:42.880563021 CET | 49766 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:42.880578041 CET | 443 | 49766 | 13.107.246.60 | 192.168.2.12 |
| Mar 17, 2025 09:29:42.880595922 CET | 49766 | 443 | 192.168.2.12 | 13.107.246.60 |
| Mar 17, 2025 09:29:42.880600929 CET | 443 | 49766 | 13.107.246.60 | 192.168.2.12 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 17, 2025 09:29:01.560025930 CET | 51239 | 53 | 192.168.2.12 | 1.1.1.1 |
| Mar 17, 2025 09:29:01.568686962 CET | 53 | 51239 | 1.1.1.1 | 192.168.2.12 |
| Mar 17, 2025 09:29:27.760652065 CET | 62450 | 53 | 192.168.2.12 | 1.1.1.1 |
| Mar 17, 2025 09:29:27.787823915 CET | 53 | 62450 | 1.1.1.1 | 192.168.2.12 |
| Mar 17, 2025 09:29:36.903357983 CET | 59736 | 53 | 192.168.2.12 | 1.1.1.1 |
| Mar 17, 2025 09:29:36.911876917 CET | 53 | 59736 | 1.1.1.1 | 192.168.2.12 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Mar 17, 2025 09:29:01.560025930 CET | 192.168.2.12 | 1.1.1.1 | 0xb44d | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Mar 17, 2025 09:29:27.760652065 CET | 192.168.2.12 | 1.1.1.1 | 0x68b6 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Mar 17, 2025 09:29:36.903357983 CET | 192.168.2.12 | 1.1.1.1 | 0xda5c | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Mar 17, 2025 09:28:31.436662912 CET | 1.1.1.1 | 192.168.2.12 | 0x2310 | No error (0) | shed.s-0005.dual-s-dc-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 17, 2025 09:28:31.436662912 CET | 1.1.1.1 | 192.168.2.12 | 0x2310 | No error (0) | s-0005.dual-s-dc-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 17, 2025 09:28:31.436662912 CET | 1.1.1.1 | 192.168.2.12 | 0x2310 | No error (0) | 52.123.131.14 | A (IP address) | IN (0x0001) | false | ||
| Mar 17, 2025 09:28:31.436662912 CET | 1.1.1.1 | 192.168.2.12 | 0x2310 | No error (0) | 52.123.130.14 | A (IP address) | IN (0x0001) | false | ||
| Mar 17, 2025 09:28:33.039277077 CET | 1.1.1.1 | 192.168.2.12 | 0x3827 | No error (0) | 199.232.210.172 | A (IP address) | IN (0x0001) | false | ||
| Mar 17, 2025 09:28:33.039277077 CET | 1.1.1.1 | 192.168.2.12 | 0x3827 | No error (0) | 199.232.214.172 | A (IP address) | IN (0x0001) | false | ||
| Mar 17, 2025 09:29:01.568686962 CET | 1.1.1.1 | 192.168.2.12 | 0xb44d | No error (0) | otelrules-bzhndjfje8dvh5fd.z01.azurefd.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 17, 2025 09:29:01.568686962 CET | 1.1.1.1 | 192.168.2.12 | 0xb44d | No error (0) | star-azurefd-prod.trafficmanager.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 17, 2025 09:29:01.568686962 CET | 1.1.1.1 | 192.168.2.12 | 0xb44d | No error (0) | shed.dual-low.s-part-0032.t-0009.t-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 17, 2025 09:29:01.568686962 CET | 1.1.1.1 | 192.168.2.12 | 0xb44d | No error (0) | azurefd-t-fb-prod.trafficmanager.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 17, 2025 09:29:01.568686962 CET | 1.1.1.1 | 192.168.2.12 | 0xb44d | No error (0) | dual.s-part-0044.t-0009.fb-t-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 17, 2025 09:29:01.568686962 CET | 1.1.1.1 | 192.168.2.12 | 0xb44d | No error (0) | s-part-0044.t-0009.fb-t-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 17, 2025 09:29:01.568686962 CET | 1.1.1.1 | 192.168.2.12 | 0xb44d | No error (0) | 13.107.253.72 | A (IP address) | IN (0x0001) | false | ||
| Mar 17, 2025 09:29:27.787823915 CET | 1.1.1.1 | 192.168.2.12 | 0x68b6 | No error (0) | istio.saja.market | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 17, 2025 09:29:27.787823915 CET | 1.1.1.1 | 192.168.2.12 | 0x68b6 | No error (0) | service-eks-nlb-public-0b7cb0a32741e125.elb.ap-northeast-2.amazonaws.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 17, 2025 09:29:27.787823915 CET | 1.1.1.1 | 192.168.2.12 | 0x68b6 | No error (0) | 3.39.153.44 | A (IP address) | IN (0x0001) | false | ||
| Mar 17, 2025 09:29:27.787823915 CET | 1.1.1.1 | 192.168.2.12 | 0x68b6 | No error (0) | 3.39.89.152 | A (IP address) | IN (0x0001) | false | ||
| Mar 17, 2025 09:29:36.911876917 CET | 1.1.1.1 | 192.168.2.12 | 0xda5c | No error (0) | otelrules-bzhndjfje8dvh5fd.z01.azurefd.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 17, 2025 09:29:36.911876917 CET | 1.1.1.1 | 192.168.2.12 | 0xda5c | No error (0) | star-azurefd-prod.trafficmanager.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 17, 2025 09:29:36.911876917 CET | 1.1.1.1 | 192.168.2.12 | 0xda5c | No error (0) | shed.dual-low.s-part-0032.t-0009.t-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 17, 2025 09:29:36.911876917 CET | 1.1.1.1 | 192.168.2.12 | 0xda5c | No error (0) | s-part-0032.t-0009.t-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 17, 2025 09:29:36.911876917 CET | 1.1.1.1 | 192.168.2.12 | 0xda5c | No error (0) | 13.107.246.60 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.12 | 49763 | 192.3.101.146 | 80 | 6800 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Mar 17, 2025 09:29:29.348325014 CET | 259 | OUT | |
| Mar 17, 2025 09:29:29.839521885 CET | 1236 | IN | |
| Mar 17, 2025 09:29:29.839536905 CET | 224 | IN | |
| Mar 17, 2025 09:29:29.839549065 CET | 1236 | IN | |
| Mar 17, 2025 09:29:29.839632034 CET | 1236 | IN | |
| Mar 17, 2025 09:29:29.839643955 CET | 1236 | IN | |
| Mar 17, 2025 09:29:29.839656115 CET | 1236 | IN | |
| Mar 17, 2025 09:29:29.839672089 CET | 1236 | IN | |
| Mar 17, 2025 09:29:29.839684963 CET | 1236 | IN | |
| Mar 17, 2025 09:29:29.839698076 CET | 776 | IN | |
| Mar 17, 2025 09:29:29.839709997 CET | 1236 | IN | |
| Mar 17, 2025 09:29:29.844269037 CET | 1236 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.12 | 49762 | 3.39.153.44 | 443 | 6800 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-17 08:29:29 UTC | 223 | OUT | |
| 2025-03-17 08:29:29 UTC | 526 | IN | |
| 2025-03-17 08:29:29 UTC | 111 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.12 | 49764 | 13.107.246.60 | 443 | 6800 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-17 08:29:37 UTC | 226 | OUT | |
| 2025-03-17 08:29:37 UTC | 493 | IN | |
| 2025-03-17 08:29:37 UTC | 15891 | IN | |
| 2025-03-17 08:29:37 UTC | 16384 | IN | |
| 2025-03-17 08:29:37 UTC | 16384 | IN | |
| 2025-03-17 08:29:37 UTC | 16384 | IN | |
| 2025-03-17 08:29:37 UTC | 16384 | IN | |
| 2025-03-17 08:29:37 UTC | 16384 | IN | |
| 2025-03-17 08:29:37 UTC | 16384 | IN | |
| 2025-03-17 08:29:37 UTC | 16384 | IN | |
| 2025-03-17 08:29:37 UTC | 16384 | IN | |
| 2025-03-17 08:29:37 UTC | 16384 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.12 | 49766 | 13.107.246.60 | 443 | 6800 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-17 08:29:42 UTC | 214 | OUT | |
| 2025-03-17 08:29:42 UTC | 515 | IN | |
| 2025-03-17 08:29:42 UTC | 2128 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.12 | 49765 | 13.107.246.60 | 443 | 6800 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-17 08:29:42 UTC | 214 | OUT | |
| 2025-03-17 08:29:42 UTC | 470 | IN | |
| 2025-03-17 08:29:42 UTC | 204 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 04:28:27 |
| Start date: | 17/03/2025 |
| Path: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xa60000 |
| File size: | 53'161'064 bytes |
| MD5 hash: | 4A871771235598812032C822E6F68F19 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 10 |
| Start time: | 04:29:29 |
| Start date: | 17/03/2025 |
| Path: | C:\Windows\SysWOW64\mshta.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x7ff6c4ed0000 |
| File size: | 13'312 bytes |
| MD5 hash: | 06B02D5C097C7DB1F109749C45F3F505 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 12 |
| Start time: | 04:29:32 |
| Start date: | 17/03/2025 |
| Path: | C:\Windows\splwow64.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6b5dd0000 |
| File size: | 163'840 bytes |
| MD5 hash: | 77DE7761B037061C7C112FD3C5B91E73 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 16 |
| Start time: | 04:29:48 |
| Start date: | 17/03/2025 |
| Path: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xa60000 |
| File size: | 53'161'064 bytes |
| MD5 hash: | 4A871771235598812032C822E6F68F19 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
Call Graph
Graph
Hide Legend
- Entrypoint
- Decryption Function
- Executed
- Not Executed
- Show Help
Module: Sheet1
Declaration
| Line | Content |
|---|---|
| 1 | Attribute VB_Name = "Sheet1" |
| 2 | Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" |
| 3 | Attribute VB_GlobalNameSpace = False |
| 4 | Attribute VB_Creatable = False |
| 5 | Attribute VB_PredeclaredId = True |
| 6 | Attribute VB_Exposed = True |
| 7 | Attribute VB_TemplateDerived = False |
| 8 | Attribute VB_Customizable = True |
Module: Sheet2
Declaration
| Line | Content |
|---|---|
| 1 | Attribute VB_Name = "Sheet2" |
| 2 | Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" |
| 3 | Attribute VB_GlobalNameSpace = False |
| 4 | Attribute VB_Creatable = False |
| 5 | Attribute VB_PredeclaredId = True |
| 6 | Attribute VB_Exposed = True |
| 7 | Attribute VB_TemplateDerived = False |
| 8 | Attribute VB_Customizable = True |
Module: Sheet3
Declaration
| Line | Content |
|---|---|
| 1 | Attribute VB_Name = "Sheet3" |
| 2 | Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" |
| 3 | Attribute VB_GlobalNameSpace = False |
| 4 | Attribute VB_Creatable = False |
| 5 | Attribute VB_PredeclaredId = True |
| 6 | Attribute VB_Exposed = True |
| 7 | Attribute VB_TemplateDerived = False |
| 8 | Attribute VB_Customizable = True |
Module: ThisWorkbook
Declaration
| Line | Content |
|---|---|
| 1 | Attribute VB_Name = "ThisWorkbook" |
| 2 | Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" |
| 3 | Attribute VB_GlobalNameSpace = False |
| 4 | Attribute VB_Creatable = False |
| 5 | Attribute VB_PredeclaredId = True |
| 6 | Attribute VB_Exposed = True |
| 7 | Attribute VB_TemplateDerived = False |
| 8 | Attribute VB_Customizable = True |
