Edit tour
Windows
Analysis Report
PURCHASE ORDER 5172025.xla.xlsx
Overview
General Information
| Sample name: | PURCHASE ORDER 5172025.xla.xlsx |
| Analysis ID: | 1648272 |
| MD5: | 42ad657229b182e1e3d922663fcd6fb5 |
| SHA1: | 512fd99e3b8aa2625e9fb3ac2dd4a6e7c2fff996 |
| SHA256: | fccb42f6351784b5530b26c97ef1d2011637ca62273324ff22d9e35657741dc7 |
| Tags: | xlaxlsxuser-abuse_ch |
| Infos: |  |
 | |
Detection
| Score: | 52 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Excel sheet contains many unusual embedded objects
Document contains embedded VBA macros
Document embeds suspicious OLE2 link
Document misses a certain OLE stream usually present in this Microsoft Office document type
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Suricata IDS alerts with low severity for network traffic
Unable to load, office file is protected or invalid
Uses a known web browser user agent for HTTP communication
Classification
- System is w10x64
EXCEL.EXE (PID: 7272 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\EXCEL .EXE" /aut omation -E mbedding MD5: 4A871771235598812032C822E6F68F19) 
splwow64.exe (PID: 6124 cmdline: C:\Windows \splwow64. exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)
- EXCEL.EXE (PID: 3100 cmdline:
"C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\EXCEL .EXE" "C:\ Users\user \Desktop\P URCHASE OR DER 517202 5.xla.xlsx " MD5: 4A871771235598812032C822E6F68F19)
- cleanup
⊘No configs have been found
⊘No yara matches
System Summary |   |
|---|
| Source: | Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: | ||
| Source: | Author: X__Junior (Nextron Systems): | ||
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-03-25T17:44:57.152184+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.11 | 49718 | 13.107.246.40 | 443 | TCP |
| 2025-03-25T17:45:12.504492+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.11 | 49721 | 13.107.246.40 | 443 | TCP |
| 2025-03-25T17:45:12.608599+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.11 | 49720 | 13.107.246.40 | 443 | TCP |
- • AV Detection
- • Compliance
- • Software Vulnerabilities
- • Networking
- • System Summary
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | File opened: | Jump to behavior | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
System Summary | |
|---|
| Source: | OLE: | ||
| Source: | OLE: | ||
| Source: | OLE: | ||
| Source: | OLE indicator, VBA macros: | ||
| Source: | Stream path 'MBD009B3F21/\x1Ole' : | ||
| Source: | Stream path 'MBD009B3F21/\x1Ole' : | ||
| Source: | OLE stream indicators for Word, Excel, PowerPoint, and Visio: | ||
| Source: | Window title found: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | OLE indicator, Workbook stream: | ||
| Source: | OLE indicator, Workbook stream: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Static file information: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Stream path 'MBD009B3F20/Package' entropy: | ||
| Source: | Stream path 'Workbook' entropy: | ||
| Source: | Stream path 'Package' entropy: | ||
| Source: | Stream path 'MBD009B3F20/Package' entropy: | ||
| Source: | Stream path 'Workbook' entropy: | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Process information queried: | Jump to behavior | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | 1 Scripting | Valid Accounts | 3 Exploitation for Client Execution | 1 Scripting | 1 Process Injection | 2 Masquerading | OS Credential Dumping | 1 Process Discovery | Remote Services | Data from Local System | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | 1 Virtualization/Sandbox Evasion | LSASS Memory | 1 Virtualization/Sandbox Evasion | Remote Desktop Protocol | Data from Removable Media | 3 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 Process Injection | Security Account Manager | 1 Application Window Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Obfuscated Files or Information | NTDS | 1 File and Directory Discovery | Distributed Component Object Model | Input Capture | 14 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | Software Packing | LSA Secrets | 1 System Information Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 31% | Virustotal | Browse | ||
| 31% | ReversingLabs | Win32.Exploit.CVE-2017-0199 |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| s-part-0012.t-0009.t-msedge.net | 13.107.246.40 | true | false | high | |
| bg.microsoft.map.fastly.net | 199.232.210.172 | true | false | high | |
| host1.emobility.energy | 162.19.137.157 | true | false | high | |
| s-0005.dual-s-msedge.net | 52.123.129.14 | true | false | high | |
| otelrules.svc.static.microsoft | unknown | unknown | false | high | |
| t.emobility.energy | unknown | unknown | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high | ||
| false |
| unknown | |
| false | high | ||
| false | high | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 13.107.246.40 | s-part-0012.t-0009.t-msedge.net | United States | 8068 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 162.19.137.157 | host1.emobility.energy | United States | 209 | CENTURYLINK-US-LEGACY-QWESTUS | false |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1648272 |
| Start date and time: | 2025-03-25 17:42:37 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 5m 26s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultwindowsofficecookbook.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 17 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | PURCHASE ORDER 5172025.xla.xlsx |
| Detection: | MAL |
| Classification: | mal52.winXLSX@4/9@2/2 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis
(whitelisted): MpCmdRun.exe, d llhost.exe, sppsvc.exe, WMIADA P.exe, SIHClient.exe, SgrmBrok er.exe, conhost.exe, svchost.e xe - Excluded IPs from analysis (wh
itelisted): 52.109.8.89, 184.3 1.69.3, 52.109.6.63, 199.232.2 10.172, 20.42.65.88, 52.109.0. 91, 20.189.173.23, 52.123.129. 14, 172.202.163.200, 40.126.24 .149 - Excluded domains from analysis
(whitelisted): slscr.update.m icrosoft.com, cus-config.offic eapps.live.com, fs-wildcard.mi crosoft.com.edgekey.net, fs-wi ldcard.microsoft.com.edgekey.n et.globalredir.akadns.net, e16 604.dscf.akamaiedge.net, eus2- azsc-000.roaming.officeapps.li ve.com, osiprod-eus2-buff-azsc -000.eastus2.cloudapp.azure.co m, mobile.events.data.microsof t.com, roaming.officeapps.live .com, dual-s-0005-office.confi g.skype.com, login.live.com, w us-azsc-config.officeapps.live .com, officeclient.microsoft.c om, prod.fs.microsoft.com.akad ns.net, c.pki.goog, wu-b-net.t rafficmanager.net, ecs.office. com, self-events-data.trafficm anager.net, fs.microsoft.com, ctldl.windowsupdate.com.delive ry.microsoft.com, prod.configs vc1.live.com.akadns.net, self. events.data.microsoft.com, one dscolprdeus08.eastus.cloudapp. azure.com, ctldl.windowsupdate .com, prod.roaming1.live.com.a kadns.net, fe3cr.delivery.mp.m icrosoft.com, us1.roaming1.liv e.com.akadns.net, config.offic eapps.live.com, us.configsvc1. live.com.akadns.net, ecs.offic e.tr - Not all processes where analyz
ed, report is missing behavior information - Report size getting too big, t
oo many NtCreateKey calls foun d. - Report size getting too big, t
oo many NtOpenFile calls found . - Report size getting too big, t
oo many NtQueryAttributesFile calls found. - Report size getting too big, t
oo many NtQueryValueKey calls found. - Report size getting too big, t
oo many NtReadFile calls found . - Report size getting too big, t
oo many NtReadVirtualMemory ca lls found. - Some HTTPS proxied raw data pa
ckets have been limited to 10 per session. Please view the P CAPs for the complete data.
| Time | Type | Description |
|---|---|---|
| 12:44:51 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 13.107.246.40 | Get hash | malicious | HTMLPhisher | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| 162.19.137.157 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| s-0005.dual-s-msedge.net | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | AnarchyGrabber, AsyncRAT, DBatLoader, Discord Token Stealer, FritzFrog, HawkEye, Lokibot | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher, Invisible JS, Tycoon2FA | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| bg.microsoft.map.fastly.net | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | AnarchyGrabber, AsyncRAT, DBatLoader, Discord Token Stealer, FritzFrog, HawkEye, Lokibot | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher, Invisible JS, Tycoon2FA | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| host1.emobility.energy | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| s-part-0012.t-0009.t-msedge.net | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | PureLog Stealer, XWorm | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher, Invisible JS, Tycoon2FA | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| CENTURYLINK-US-LEGACY-QWESTUS | Get hash | malicious | Okiru | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| MICROSOFT-CORP-MSN-AS-BLOCKUS | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Gafgyt, Okiru | Browse |
| ||
| Get hash | malicious | Okiru | Browse |
| ||
| Get hash | malicious | Gafgyt, Okiru | Browse |
| ||
| Get hash | malicious | Okiru | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | PureLog Stealer, XWorm | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 6271f898ce5be7dd52b0fc260d0662b3 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| a0e9f5d64349fb13191bc781f81f42e1 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | DarkVision Rat | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
⊘No context
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 118 |
| Entropy (8bit): | 3.5700810731231707 |
| Encrypted: | false |
| SSDEEP: | 3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq |
| MD5: | 573220372DA4ED487441611079B623CD |
| SHA1: | 8F9D967AC6EF34640F1F0845214FBC6994C0CB80 |
| SHA-256: | BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D |
| SHA-512: | F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 820 |
| Entropy (8bit): | 2.7159862044217853 |
| Encrypted: | false |
| SSDEEP: | 24:YIrNyk+vpKAzH5wcfHGFAAJp9WtAZRJ5poIHWI:Ymt+RfzHuc8AAJtfJ52IHV |
| MD5: | 4C216BA54D1A1E057DBD017884BCAE68 |
| SHA1: | 04F6A2A122C952A6EE4E54FDB8185D4052074B21 |
| SHA-256: | 80AB97552897B6DD6B37DC244018756D8FE893435AA360A26BFF8E6560D81E9C |
| SHA-512: | 1F5F905260B372F9AEE7B6E574F0F427A85F74F30AB90B2CBF7847462A437C8907BDCA33D54260F685AEC64CC53E3241E37A8D6999AB01138C08DB2B39FF7371 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1188864 |
| Entropy (8bit): | 7.963392674719262 |
| Encrypted: | false |
| SSDEEP: | 24576:IEd4WelSkLew+Zgsi5QO3UqCK12ADjJzUWhnlC0382uHBt:XXeHlQO3gKYADjJphc2uHB |
| MD5: | EDCE78C8E616FE041D7D603458A12D68 |
| SHA1: | F20DA398C13389FB268647A72C3C915BC246F789 |
| SHA-256: | 52EC3D52DB84FC261A63367151E604B1FE27EB666A628DAB26ED507EDD63813F |
| SHA-512: | 0D6E076129F23FCA87E9B5622D479D316889AABEA42E28E308EFEDC1377A4DDCA312D899CEA2024A8E1B134BDB4036CAA3E8BC319D738F0B96035F1D835752F5 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 512 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | 3:: |
| MD5: | BF619EAC0CDF3F68D496EA9344137E8B |
| SHA1: | 5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5 |
| SHA-256: | 076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560 |
| SHA-512: | DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1175552 |
| Entropy (8bit): | 7.968762965968398 |
| Encrypted: | false |
| SSDEEP: | 24576:wEd4WelSkLew+Zgsi5QO3UqCK12ADjJzUWhnlC0382uHBt:vXeHlQO3gKYADjJphc2uHB |
| MD5: | DE965A48A67CFEDDE101AE4E3CBFD22A |
| SHA1: | 31851A3728D03FAE12DCA06CFACA9346974CD0AD |
| SHA-256: | B327BE0B30551A013004CA7E570BA37FD0C7726C3B6B1F451FBB90715DD729DF |
| SHA-512: | EA501528EC34C28D9A9C31A7829F62D5E1BA85868C6EEF56AC3301E9BD0A3C5A98B9223B909B12CEA7CBAECD6A63AB16B63FD21A19061EB063335E53E8B3CC6A |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1397248 |
| Entropy (8bit): | 7.988541835939492 |
| Encrypted: | false |
| SSDEEP: | 24576:pEd4WelSkLew+Zgsi5QO3UqCK12ADjJzUWhnlC0382uHBtHd01Xj23:WXeHlQO3gKYADjJphc2uHBkXjm |
| MD5: | 6D83D97CDC0D3117ADC99395676CB3B9 |
| SHA1: | FC33BC9D77A5B70A134775242FADC672B36048E1 |
| SHA-256: | 05B8A069A69A628346776E454791D06B0B56F81B0258A9372A1751E86805B5AF |
| SHA-512: | 7A322FDB4C596D6EB17FEB9B6C3AFBF2FC1006BD425161ABF52C1CC777459B5435590F54AE1865AA795BCF8A75613F748EA8E0D60E163A07BD054759C167790C |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | 3:ggPYV:rPYV |
| MD5: | 187F488E27DB4AF347237FE461A079AD |
| SHA1: | 6693BA299EC1881249D59262276A0D2CB21F8E64 |
| SHA-256: | 255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309 |
| SHA-512: | 89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1397248 |
| Entropy (8bit): | 7.988541835939492 |
| Encrypted: | false |
| SSDEEP: | 24576:pEd4WelSkLew+Zgsi5QO3UqCK12ADjJzUWhnlC0382uHBtHd01Xj23:WXeHlQO3gKYADjJphc2uHBkXjm |
| MD5: | 6D83D97CDC0D3117ADC99395676CB3B9 |
| SHA1: | FC33BC9D77A5B70A134775242FADC672B36048E1 |
| SHA-256: | 05B8A069A69A628346776E454791D06B0B56F81B0258A9372A1751E86805B5AF |
| SHA-512: | 7A322FDB4C596D6EB17FEB9B6C3AFBF2FC1006BD425161ABF52C1CC777459B5435590F54AE1865AA795BCF8A75613F748EA8E0D60E163A07BD054759C167790C |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 165 |
| Entropy (8bit): | 1.3801032810853697 |
| Encrypted: | false |
| SSDEEP: | 3:UvNFiKVMNv:UvNsKVkv |
| MD5: | 9AA76EF018A0F672FA8DF9799D834C34 |
| SHA1: | 75B4E1ADC263E4F966CAD3ECA3A2C84638CA525E |
| SHA-256: | ED0F89EA4BAE07B1876B61240D06D56CDDB5CE83EF10E41F68142378CB750B77 |
| SHA-512: | 6A8AF40C8225E60E652BCCB7D7E7FF03A8A014A7AC782D620AA6120B134213D4A4E279EF0005FCCBA513E85785E7CF6EA42422A6E936F4F690E47D0AAD11AA77 |
| Malicious: | true |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.986081681596128 |
| TrID: |
|
| File name: | PURCHASE ORDER 5172025.xla.xlsx |
| File size: | 1'454'592 bytes |
| MD5: | 42ad657229b182e1e3d922663fcd6fb5 |
| SHA1: | 512fd99e3b8aa2625e9fb3ac2dd4a6e7c2fff996 |
| SHA256: | fccb42f6351784b5530b26c97ef1d2011637ca62273324ff22d9e35657741dc7 |
| SHA512: | f3d481f9acc3e5c6ca99245addc7f2d97eef3c7984536daf239220b8dd892215b220811613f8f9440f18b2e38f5afc8f2679b567fba2524bd9b1c4e558d72762 |
| SSDEEP: | 24576:OVxQ0LlWyd9Wq+ku+k0mkHeongDxUmPAeUKRq+RO5u8MP28QydFq6T/lokScRe:OVW080QfkuMrHWxbAZKRq+RZ8A28Qg/B |
| TLSH: | B8652341FC15BB4AD9D92436A6F2F82A0354DDD2BA14C5237356B32F72BBBB06183724 |
| File Content Preview: | ........................>.......................................................................................................................................}.............................................................................................. |
 | |
| Icon Hash: | 35e58a8c0c8a85b9 |
| Document Type: | OLE |
| Number of OLE Files: | 1 |
| Has Summary Info: | |
| Application Name: | Microsoft Excel |
| Encrypted Document: | True |
| Contains Word Document Stream: | False |
| Contains Workbook/Book Stream: | True |
| Contains PowerPoint Document Stream: | False |
| Contains Visio Document Stream: | False |
| Contains ObjectPool Stream: | False |
| Flash Objects Count: | 0 |
| Contains VBA Macros: | True |
| Code Page: | 1252 |
| Author: | |
| Last Saved By: | |
| Create Time: | 2006-09-16 00:00:00 |
| Last Saved Time: | 2025-03-25 07:09:34 |
| Creating Application: | |
| Security: | 1 |
| Document Code Page: | 1252 |
| Thumbnail Scaling Desired: | False |
| Contains Dirty Links: | False |
| Shared Document: | False |
| Changed Hyperlinks: | False |
| Application Version: | 786432 |
General | |
| Stream Path: | _VBA_PROJECT_CUR/VBA/Sheet1 |
| VBA File Name: | Sheet1.cls |
| Stream Size: | 977 |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0 |
| Data Raw: | 01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 e8 fc 93 36 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
|
General | |
| Stream Path: | _VBA_PROJECT_CUR/VBA/Sheet2 |
| VBA File Name: | Sheet2.cls |
| Stream Size: | 977 |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I - . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . |
| Data Raw: | 01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 e8 fc 49 2d 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
|
General | |
| Stream Path: | _VBA_PROJECT_CUR/VBA/Sheet3 |
| VBA File Name: | Sheet3.cls |
| Stream Size: | 977 |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . |
| Data Raw: | 01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 e8 fc 15 02 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
|
General | |
| Stream Path: | _VBA_PROJECT_CUR/VBA/ThisWorkbook |
| VBA File Name: | ThisWorkbook.cls |
| Stream Size: | 985 |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . f . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . - . 0 |
| Data Raw: | 01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 e8 fc 66 f5 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
|
General | |
| Stream Path: | \x1CompObj |
| CLSID: | |
| File Type: | data |
| Stream Size: | 114 |
| Entropy: | 4.25248375192737 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . . |
| Data Raw: | 01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
| Stream Path: | \x5DocumentSummaryInformation |
| CLSID: | |
| File Type: | data |
| Stream Size: | 244 |
| Entropy: | 2.889430592781307 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00 |
General | |
| Stream Path: | \x5SummaryInformation |
| CLSID: | |
| File Type: | data |
| Stream Size: | 200 |
| Entropy: | 3.2503503175049815 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . | . # . @ . . . . . T . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00 |
General | |
| Stream Path: | MBD009B3F20/\x1CompObj |
| CLSID: | |
| File Type: | data |
| Stream Size: | 99 |
| Entropy: | 3.631242196770981 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . . |
| Data Raw: | 01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
| Stream Path: | MBD009B3F20/Package |
| CLSID: | |
| File Type: | Microsoft Excel 2007+ |
| Stream Size: | 1295689 |
| Entropy: | 7.996701301127075 |
| Base64 Encoded: | True |
| Data ASCII: | P K . . . . . . . . . . ! . w 1 . . . . j . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
| Data Raw: | 50 4b 03 04 14 00 06 00 08 00 00 00 21 00 77 31 d5 0e e3 01 00 00 6a 08 00 00 13 00 cd 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 c9 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
General | |
| Stream Path: | MBD009B3F21/\x1Ole |
| CLSID: | |
| File Type: | data |
| Stream Size: | 788 |
| Entropy: | 5.291239637953238 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . d . ] . . . . . . . . . . . . . . . . . y . . . K . . . . . h . t . t . p . s . : . / . / . t . . . e . m . o . b . i . l . i . t . y . . . e . n . e . r . g . y . / . x . R . f . B . G . K . ? . & . d . e . s . i . g . n . e . r . = . g . l . o . s . s . y . . . . u . f . { i P . F L c # # . I + . . " . K ~ Q $ X . 3 . " ` T , . l j D < / | . 9 . . / B { m h . w n I . | y ; _ l o s 0 # . 5 K 8 @ G { u z . ? ; o F . D W / . u . . . . . . . . . . . . . . . . . . . . . T . H . 9 . 2 . J . Z . O . |
| Data Raw: | 01 00 00 02 1b 9b 05 64 00 5d 8e 13 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b 04 01 00 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 74 00 2e 00 65 00 6d 00 6f 00 62 00 69 00 6c 00 69 00 74 00 79 00 2e 00 65 00 6e 00 65 00 72 00 67 00 79 00 2f 00 78 00 52 00 66 00 42 00 47 00 4b 00 3f 00 26 00 64 00 65 00 73 00 69 00 67 00 |
General | |
| Stream Path: | Workbook |
| CLSID: | |
| File Type: | Applesoft BASIC program data, first line number 16 |
| Stream Size: | 133075 |
| Entropy: | 7.994877466987564 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . . . . . . . . . . / . 6 . . . . . . . u S q . + B # h | b d . . e . ] . U < ; . j ^ j U P ! ' D . . . . . . . . . . { d . . . \\ . p . j . Q t ] $ [ . , . . / ] 3 . I 3 . . 2 . . , o . . + . t ! . ) } E . . . Z . * | # o I P . . V y . y & w 2 . t . B . . . a . . . H . . . = . . . M . . . . . | N . @ B | Z . . . N . . . . k . . . . k . . . . . . . . ^ + . . . = . . . ; . . . i & . 8 e 7 Y @ . . . . . . . 2 " . . . b ` . . . . . . . . . . . . H 1 . . . L . P . ) L a ? H . * i L N . 1 . . . H 2 |
| Data Raw: | 09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 fc eb df 75 53 e7 71 1d 2b fb 42 23 68 7c 62 64 c1 ce 83 dd b2 65 1d ba 5d 17 c8 55 3c b4 3b 8b db 88 ec 6a b5 5e 6a 55 c4 50 f3 21 27 ac 44 9a 87 00 00 00 e1 00 02 00 b0 04 c1 00 02 00 7b 64 e2 00 00 00 5c 00 70 00 9e 6a 7f 51 74 5d 24 5b e0 ed 02 bb 8e a2 84 2c 93 bf d6 83 ed ce 0c 2f 5d 33 |
General | |
| Stream Path: | _VBA_PROJECT_CUR/PROJECT |
| CLSID: | |
| File Type: | ASCII text, with CRLF line terminators |
| Stream Size: | 527 |
| Entropy: | 5.205840445289228 |
| Base64 Encoded: | True |
| Data ASCII: | I D = " { 4 7 6 4 C 5 0 8 - 1 3 C 1 - 4 3 F B - B 9 8 5 - 6 4 9 3 3 0 3 1 E 4 2 6 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 7 9 7 B F 7 0 D F B 0 D F B 0 D F |
| Data Raw: | 49 44 3d 22 7b 34 37 36 34 43 35 30 38 2d 31 33 43 31 2d 34 33 46 42 2d 42 39 38 35 2d 36 34 39 33 33 30 33 31 45 34 32 36 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30 |
General | |
| Stream Path: | _VBA_PROJECT_CUR/PROJECTwm |
| CLSID: | |
| File Type: | data |
| Stream Size: | 104 |
| Entropy: | 3.0488640812019017 |
| Base64 Encoded: | False |
| Data ASCII: | T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . . |
| Data Raw: | 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00 |
General | |
| Stream Path: | _VBA_PROJECT_CUR/VBA/_VBA_PROJECT |
| CLSID: | |
| File Type: | data |
| Stream Size: | 2644 |
| Entropy: | 3.9822715768237 |
| Base64 Encoded: | False |
| Data ASCII: | a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r . |
| Data Raw: | cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00 |
General | |
| Stream Path: | _VBA_PROJECT_CUR/VBA/dir |
| CLSID: | |
| File Type: | data |
| Stream Size: | 553 |
| Entropy: | 6.3606301584537785 |
| Base64 Encoded: | True |
| Data ASCII: | . % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . i . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2 E . |
| Data Raw: | 01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 f5 e3 f9 69 08 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47 |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeDownload Network PCAP: filtered – full
| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-03-25T17:44:57.152184+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.11 | 49718 | 13.107.246.40 | 443 | TCP |
| 2025-03-25T17:45:12.504492+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.11 | 49721 | 13.107.246.40 | 443 | TCP |
| 2025-03-25T17:45:12.608599+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.11 | 49720 | 13.107.246.40 | 443 | TCP |
- Total Packets: 229
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 25, 2025 17:44:43.588805914 CET | 49715 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:43.588849068 CET | 443 | 49715 | 162.19.137.157 | 192.168.2.11 |
| Mar 25, 2025 17:44:43.588974953 CET | 49715 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:43.589210033 CET | 49715 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:43.589231014 CET | 443 | 49715 | 162.19.137.157 | 192.168.2.11 |
| Mar 25, 2025 17:44:43.970432043 CET | 443 | 49715 | 162.19.137.157 | 192.168.2.11 |
| Mar 25, 2025 17:44:43.970571995 CET | 49715 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:43.990551949 CET | 49715 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:43.990580082 CET | 443 | 49715 | 162.19.137.157 | 192.168.2.11 |
| Mar 25, 2025 17:44:43.991008997 CET | 443 | 49715 | 162.19.137.157 | 192.168.2.11 |
| Mar 25, 2025 17:44:43.991070986 CET | 49715 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:43.991509914 CET | 49715 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:44.032288074 CET | 443 | 49715 | 162.19.137.157 | 192.168.2.11 |
| Mar 25, 2025 17:44:44.356925964 CET | 443 | 49715 | 162.19.137.157 | 192.168.2.11 |
| Mar 25, 2025 17:44:44.357012033 CET | 443 | 49715 | 162.19.137.157 | 192.168.2.11 |
| Mar 25, 2025 17:44:44.357098103 CET | 49715 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:44.357166052 CET | 49715 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:44.363785982 CET | 49715 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:44.363812923 CET | 443 | 49715 | 162.19.137.157 | 192.168.2.11 |
| Mar 25, 2025 17:44:44.364964962 CET | 49716 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:44.365000963 CET | 443 | 49716 | 162.19.137.157 | 192.168.2.11 |
| Mar 25, 2025 17:44:44.365261078 CET | 49716 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:44.365261078 CET | 49716 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:44.365289927 CET | 443 | 49716 | 162.19.137.157 | 192.168.2.11 |
| Mar 25, 2025 17:44:44.744755983 CET | 443 | 49716 | 162.19.137.157 | 192.168.2.11 |
| Mar 25, 2025 17:44:44.745151043 CET | 49716 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:44.745224953 CET | 49716 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:44.745230913 CET | 443 | 49716 | 162.19.137.157 | 192.168.2.11 |
| Mar 25, 2025 17:44:44.745543003 CET | 49716 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:44.745548964 CET | 443 | 49716 | 162.19.137.157 | 192.168.2.11 |
| Mar 25, 2025 17:44:45.130850077 CET | 443 | 49716 | 162.19.137.157 | 192.168.2.11 |
| Mar 25, 2025 17:44:45.130873919 CET | 443 | 49716 | 162.19.137.157 | 192.168.2.11 |
| Mar 25, 2025 17:44:45.130913973 CET | 49716 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:45.130934954 CET | 443 | 49716 | 162.19.137.157 | 192.168.2.11 |
| Mar 25, 2025 17:44:45.130949974 CET | 443 | 49716 | 162.19.137.157 | 192.168.2.11 |
| Mar 25, 2025 17:44:45.130970001 CET | 49716 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:45.131031036 CET | 49716 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:45.131894112 CET | 49716 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:45.131894112 CET | 49716 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:45.131912947 CET | 443 | 49716 | 162.19.137.157 | 192.168.2.11 |
| Mar 25, 2025 17:44:45.131968975 CET | 49716 | 443 | 192.168.2.11 | 162.19.137.157 |
| Mar 25, 2025 17:44:56.839154005 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:56.839206934 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:56.839289904 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:56.839679003 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:56.839690924 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.152097940 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.152184010 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.153856993 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.153870106 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.154129028 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.155359983 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.196269035 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.440244913 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.440287113 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.440303087 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.440341949 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.440378904 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.440404892 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.440433979 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.473402023 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.473428011 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.473488092 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.473515987 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.473543882 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.473562956 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.545001984 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.545027018 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.545098066 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.545125008 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.545154095 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.545172930 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.670500040 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.670533895 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.670599937 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.670604944 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.670625925 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.670654058 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.670672894 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.670687914 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.670692921 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.670708895 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.670722008 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.670866013 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.674827099 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.674851894 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.674889088 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.674918890 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.674937010 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.716490030 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.780328035 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.780350924 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.780421972 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.780441999 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.780488968 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.821203947 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.821225882 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.821291924 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.821314096 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.821480036 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.975523949 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.975549936 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.975671053 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:57.975704908 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:57.975881100 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.011375904 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.011401892 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.011446953 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.011461020 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.011485100 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.011512041 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.011531115 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.011540890 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.036595106 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.036621094 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.036660910 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.036700010 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.036715984 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.091566086 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.105041981 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.105066061 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.105087996 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.105125904 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.105127096 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.105161905 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.105178118 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.105201006 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.274867058 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.274893999 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.274962902 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.274996042 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.275135040 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.286031961 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.286048889 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.286103964 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.286135912 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.286153078 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.286174059 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.404700041 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.404725075 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.404781103 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.404812098 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.404833078 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.404860020 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.474953890 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.474978924 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.475081921 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.475117922 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.477271080 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.586373091 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.586397886 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.586483955 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.586524010 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.586569071 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.721972942 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.722043037 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.722091913 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.722127914 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.722146034 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.722166061 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.848562956 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.848589897 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.848644018 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.848679066 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:58.848731041 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:58.848792076 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:59.033816099 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:59.033844948 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:59.033890963 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:59.033924103 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:59.033941031 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:59.034080982 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:59.130063057 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:59.130095005 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:59.130157948 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:59.130178928 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:59.130212069 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:59.130310059 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:59.312733889 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:59.312762022 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:59.312808037 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:59.312836885 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:59.312860966 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:59.312877893 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:59.442099094 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:59.442131042 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:59.442183018 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:59.442212105 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:59.442230940 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:59.442274094 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:59.674395084 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:59.674418926 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:59.674465895 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:59.674504995 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:59.674523115 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:59.674546957 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:59.765782118 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:59.765808105 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:59.765866041 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:59.765906096 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:59.765925884 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:59.765949965 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:59.960422039 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:59.960447073 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:59.960558891 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:59.960558891 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:44:59.960589886 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:44:59.960633039 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:00.156975031 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:00.157002926 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:00.157114029 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:00.157145023 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:00.157480001 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:00.349133968 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:00.349164963 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:00.349231005 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:00.349270105 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:00.349333048 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:00.554881096 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:00.554908037 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:00.554958105 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:00.555000067 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:00.555016994 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:00.555140972 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:00.783746004 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:00.783771038 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:00.783833027 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:00.783864021 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:00.784023046 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:01.226560116 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:01.226572990 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:01.226625919 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:01.226741076 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:01.226741076 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:01.226774931 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:01.226840019 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:01.556622028 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:01.556636095 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:01.556689024 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:01.556730986 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:01.556772947 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:01.556802034 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:01.557636023 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:01.846059084 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:01.846072912 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:01.846128941 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:01.846174002 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:01.846213102 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:01.846225977 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:01.846260071 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:02.041729927 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:02.041760921 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:02.041832924 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:02.041856050 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:02.041897058 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:02.246292114 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:02.246320009 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:02.246361971 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:02.246390104 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:02.246403933 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:02.246536970 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:02.384867907 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:02.384896040 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:02.384963036 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:02.384989977 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:02.385010004 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:02.385041952 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:02.695122004 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:02.695135117 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:02.695185900 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:02.695207119 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:02.695241928 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:02.695261002 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:02.695285082 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:02.750690937 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:02.750715017 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:02.750854969 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:02.750854969 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:02.750889063 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:02.750956059 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:02.929380894 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:02.929410934 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:02.929467916 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:02.929498911 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:02.929517031 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:02.929543972 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:03.170943975 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:03.170958996 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:03.170991898 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:03.171030998 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:03.171067953 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:03.171089888 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:03.171118975 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:03.386884928 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:03.386894941 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:03.386943102 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:03.386965990 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:03.387000084 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:03.387015104 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:03.387136936 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:03.591303110 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:03.591330051 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:03.591496944 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:03.591496944 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:03.591531038 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:03.592855930 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:03.733117104 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:03.733141899 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:03.733187914 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:03.733222008 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:03.733236074 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:03.733261108 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:03.901380062 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:03.901401997 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:03.901473045 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:03.901515007 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:03.901535034 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:03.901576996 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:04.083777905 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:04.083800077 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:04.083851099 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:04.083882093 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:04.083899021 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:04.083933115 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:04.219290972 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:04.219316959 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:04.219398022 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:04.219432116 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:04.219584942 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:04.339663982 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:04.339684010 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:04.339750051 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:04.339778900 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:04.339792967 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:04.339822054 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:04.492422104 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:04.492444992 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:04.492614031 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:04.492614031 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:04.492652893 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:04.492722034 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:04.633938074 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:04.633956909 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:04.634004116 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:04.634036064 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:04.634051085 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:04.634076118 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:04.788465977 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:04.788486958 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:04.788574934 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:04.788604975 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:04.788705111 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:05.001775980 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:05.001785994 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:05.001820087 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:05.001849890 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:05.001874924 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:05.001904011 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:05.001924992 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:05.153198957 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:05.153219938 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:05.153278112 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:05.153306007 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:05.153321028 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:05.153347015 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:05.300296068 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:05.300314903 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:05.300375938 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:05.300406933 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:05.300606012 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:05.498869896 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:05.498891115 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:05.498970032 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:05.498999119 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:05.499041080 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:05.653574944 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:05.653644085 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:05.653662920 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:05.653692961 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:05.653718948 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:05.653858900 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:05.807415962 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:05.807490110 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:05.807621956 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:05.807622910 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:05.807653904 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:05.807723999 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:06.067773104 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.067801952 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.067846060 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.067864895 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:06.067924976 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:06.067939997 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.067981958 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:06.136481047 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.136533022 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.136567116 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:06.136584044 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.136611938 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:06.136630058 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:06.341042995 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.341109991 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.341131926 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:06.341177940 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:06.341188908 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.341238022 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:06.482038021 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.482098103 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.482145071 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:06.482172012 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.482186079 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:06.482222080 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:06.642230988 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.642292023 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.642389059 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:06.642425060 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.642469883 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:06.770256996 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.770286083 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.770358086 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:06.770389080 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.770473957 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:06.910435915 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.910501003 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.910536051 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:06.910567999 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:06.910588026 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:06.910617113 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:07.037730932 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:07.037763119 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:07.037815094 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:07.037848949 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:07.037875891 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:07.037992001 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:07.170455933 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:07.170478106 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:07.170552015 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:07.170582056 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:07.170624971 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:07.300448895 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:07.300467968 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:07.300507069 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:07.300544024 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:07.300576925 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:07.300623894 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:07.300623894 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:07.300863028 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:07.300890923 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:07.300898075 CET | 49718 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:07.300903082 CET | 443 | 49718 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:12.196275949 CET | 49720 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:12.196312904 CET | 443 | 49720 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:12.197227001 CET | 49720 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:12.198196888 CET | 49721 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:12.198230982 CET | 443 | 49721 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:12.198374987 CET | 49721 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:12.198563099 CET | 49720 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:12.198576927 CET | 443 | 49720 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:12.198812008 CET | 49721 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:12.198823929 CET | 443 | 49721 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:12.497530937 CET | 443 | 49721 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:12.504492044 CET | 49721 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:12.504509926 CET | 443 | 49721 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:12.511677980 CET | 49721 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:12.511684895 CET | 443 | 49721 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:12.606796026 CET | 443 | 49720 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:12.608598948 CET | 49720 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:12.608613014 CET | 443 | 49720 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:12.609695911 CET | 49720 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:12.609704971 CET | 443 | 49720 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:12.707370043 CET | 443 | 49721 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:12.707840919 CET | 443 | 49721 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:12.707904100 CET | 49721 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:12.707951069 CET | 49721 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:12.707974911 CET | 443 | 49721 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:12.708056927 CET | 49721 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:12.708066940 CET | 443 | 49721 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:12.807246923 CET | 443 | 49720 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:12.807272911 CET | 443 | 49720 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:12.807380915 CET | 49720 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:12.807399035 CET | 443 | 49720 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:12.807600021 CET | 443 | 49720 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:12.807607889 CET | 49720 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:12.807643890 CET | 443 | 49720 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:12.807657957 CET | 49720 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:12.807657957 CET | 49720 | 443 | 192.168.2.11 | 13.107.246.40 |
| Mar 25, 2025 17:45:12.807667017 CET | 443 | 49720 | 13.107.246.40 | 192.168.2.11 |
| Mar 25, 2025 17:45:12.807672977 CET | 443 | 49720 | 13.107.246.40 | 192.168.2.11 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 25, 2025 17:44:43.416533947 CET | 64817 | 53 | 192.168.2.11 | 1.1.1.1 |
| Mar 25, 2025 17:44:43.587943077 CET | 53 | 64817 | 1.1.1.1 | 192.168.2.11 |
| Mar 25, 2025 17:44:56.662463903 CET | 51563 | 53 | 192.168.2.11 | 1.1.1.1 |
| Mar 25, 2025 17:44:56.838219881 CET | 53 | 51563 | 1.1.1.1 | 192.168.2.11 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Mar 25, 2025 17:44:43.416533947 CET | 192.168.2.11 | 1.1.1.1 | 0x840d | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Mar 25, 2025 17:44:56.662463903 CET | 192.168.2.11 | 1.1.1.1 | 0xcf39 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Mar 25, 2025 17:43:54.039786100 CET | 1.1.1.1 | 192.168.2.11 | 0xe775 | No error (0) | s-0005.dual-s-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 25, 2025 17:43:54.039786100 CET | 1.1.1.1 | 192.168.2.11 | 0xe775 | No error (0) | 52.123.129.14 | A (IP address) | IN (0x0001) | false | ||
| Mar 25, 2025 17:43:54.039786100 CET | 1.1.1.1 | 192.168.2.11 | 0xe775 | No error (0) | 52.123.128.14 | A (IP address) | IN (0x0001) | false | ||
| Mar 25, 2025 17:43:54.760849953 CET | 1.1.1.1 | 192.168.2.11 | 0x8c92 | No error (0) | 199.232.210.172 | A (IP address) | IN (0x0001) | false | ||
| Mar 25, 2025 17:43:54.760849953 CET | 1.1.1.1 | 192.168.2.11 | 0x8c92 | No error (0) | 199.232.214.172 | A (IP address) | IN (0x0001) | false | ||
| Mar 25, 2025 17:44:43.587943077 CET | 1.1.1.1 | 192.168.2.11 | 0x840d | No error (0) | host1.emobility.energy | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 25, 2025 17:44:43.587943077 CET | 1.1.1.1 | 192.168.2.11 | 0x840d | No error (0) | 162.19.137.157 | A (IP address) | IN (0x0001) | false | ||
| Mar 25, 2025 17:44:56.838219881 CET | 1.1.1.1 | 192.168.2.11 | 0xcf39 | No error (0) | otelrules-bzhndjfje8dvh5fd.z01.azurefd.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 25, 2025 17:44:56.838219881 CET | 1.1.1.1 | 192.168.2.11 | 0xcf39 | No error (0) | star-azurefd-prod.trafficmanager.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 25, 2025 17:44:56.838219881 CET | 1.1.1.1 | 192.168.2.11 | 0xcf39 | No error (0) | shed.dual-low.s-part-0012.t-0009.t-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 25, 2025 17:44:56.838219881 CET | 1.1.1.1 | 192.168.2.11 | 0xcf39 | No error (0) | s-part-0012.t-0009.t-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 25, 2025 17:44:56.838219881 CET | 1.1.1.1 | 192.168.2.11 | 0xcf39 | No error (0) | 13.107.246.40 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.11 | 49715 | 162.19.137.157 | 443 | 7272 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-25 16:44:43 UTC | 219 | OUT | |
| 2025-03-25 16:44:44 UTC | 539 | IN | |
| 2025-03-25 16:44:44 UTC | 38 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.11 | 49716 | 162.19.137.157 | 443 | 7272 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-25 16:44:44 UTC | 199 | OUT | |
| 2025-03-25 16:44:45 UTC | 590 | IN | |
| 2025-03-25 16:44:45 UTC | 4645 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.11 | 49718 | 13.107.246.40 | 443 | 7272 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-25 16:44:57 UTC | 226 | OUT | |
| 2025-03-25 16:44:57 UTC | 493 | IN | |
| 2025-03-25 16:44:57 UTC | 15891 | IN | |
| 2025-03-25 16:44:57 UTC | 16384 | IN | |
| 2025-03-25 16:44:57 UTC | 16384 | IN | |
| 2025-03-25 16:44:57 UTC | 16384 | IN | |
| 2025-03-25 16:44:57 UTC | 16384 | IN | |
| 2025-03-25 16:44:57 UTC | 16384 | IN | |
| 2025-03-25 16:44:57 UTC | 16384 | IN | |
| 2025-03-25 16:44:57 UTC | 16384 | IN | |
| 2025-03-25 16:44:57 UTC | 16384 | IN | |
| 2025-03-25 16:44:57 UTC | 16384 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.11 | 49721 | 13.107.246.40 | 443 | 7272 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-25 16:45:12 UTC | 214 | OUT | |
| 2025-03-25 16:45:12 UTC | 470 | IN | |
| 2025-03-25 16:45:12 UTC | 204 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.11 | 49720 | 13.107.246.40 | 443 | 7272 | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-25 16:45:12 UTC | 214 | OUT | |
| 2025-03-25 16:45:12 UTC | 494 | IN | |
| 2025-03-25 16:45:12 UTC | 2128 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 12:43:47 |
| Start date: | 25/03/2025 |
| Path: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xdb0000 |
| File size: | 53'161'064 bytes |
| MD5 hash: | 4A871771235598812032C822E6F68F19 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 9 |
| Start time: | 12:44:51 |
| Start date: | 25/03/2025 |
| Path: | C:\Windows\splwow64.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff64c130000 |
| File size: | 163'840 bytes |
| MD5 hash: | 77DE7761B037061C7C112FD3C5B91E73 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 14 |
| Start time: | 12:45:08 |
| Start date: | 25/03/2025 |
| Path: | C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xdb0000 |
| File size: | 53'161'064 bytes |
| MD5 hash: | 4A871771235598812032C822E6F68F19 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
Call Graph
Graph
Hide Legend
- Entrypoint
- Decryption Function
- Executed
- Not Executed
- Show Help
Module: Sheet1
Declaration
| Line | Content |
|---|---|
| 1 | Attribute VB_Name = "Sheet1" |
| 2 | Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" |
| 3 | Attribute VB_GlobalNameSpace = False |
| 4 | Attribute VB_Creatable = False |
| 5 | Attribute VB_PredeclaredId = True |
| 6 | Attribute VB_Exposed = True |
| 7 | Attribute VB_TemplateDerived = False |
| 8 | Attribute VB_Customizable = True |
Module: Sheet2
Declaration
| Line | Content |
|---|---|
| 1 | Attribute VB_Name = "Sheet2" |
| 2 | Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" |
| 3 | Attribute VB_GlobalNameSpace = False |
| 4 | Attribute VB_Creatable = False |
| 5 | Attribute VB_PredeclaredId = True |
| 6 | Attribute VB_Exposed = True |
| 7 | Attribute VB_TemplateDerived = False |
| 8 | Attribute VB_Customizable = True |
Module: Sheet3
Declaration
| Line | Content |
|---|---|
| 1 | Attribute VB_Name = "Sheet3" |
| 2 | Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" |
| 3 | Attribute VB_GlobalNameSpace = False |
| 4 | Attribute VB_Creatable = False |
| 5 | Attribute VB_PredeclaredId = True |
| 6 | Attribute VB_Exposed = True |
| 7 | Attribute VB_TemplateDerived = False |
| 8 | Attribute VB_Customizable = True |
Module: ThisWorkbook
Declaration
| Line | Content |
|---|---|
| 1 | Attribute VB_Name = "ThisWorkbook" |
| 2 | Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" |
| 3 | Attribute VB_GlobalNameSpace = False |
| 4 | Attribute VB_Creatable = False |
| 5 | Attribute VB_PredeclaredId = True |
| 6 | Attribute VB_Exposed = True |
| 7 | Attribute VB_TemplateDerived = False |
| 8 | Attribute VB_Customizable = True |
