Edit tour

Windows Analysis Report
PURCHASE ORDER 5172025.xla.xlsx

Overview

General Information

Sample name:	PURCHASE ORDER 5172025.xla.xlsx
Analysis ID:	1648272
MD5:	42ad657229b182e1e3d922663fcd6fb5
SHA1:	512fd99e3b8aa2625e9fb3ac2dd4a6e7c2fff996
SHA256:	fccb42f6351784b5530b26c97ef1d2011637ca62273324ff22d9e35657741dc7
Tags:	xlaxlsxuser-abuse_ch
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Document contains embedded VBA macros

Document embeds suspicious OLE2 link

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Excel Network Connections

Sigma detected: Suspicious Office Outbound Connections

Suricata IDS alerts with low severity for network traffic

Unable to load, office file is protected or invalid

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

EXCEL.EXE (PID: 6856 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

splwow64.exe (PID: 916 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

EXCEL.EXE (PID: 1920 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\PURCHASE ORDER 5172025.xla.xlsx" MD5: 4A871771235598812032C822E6F68F19)

cleanup

Sigma Signatures

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 162.19.137.157, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 6856, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49697

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.7, DestinationIsIpv6: false, DestinationPort: 49697, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 6856, Protocol: tcp, SourceIp: 162.19.137.157, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-25T17:57:53.261037+0100	2028371	3	Unknown Traffic	192.168.2.7	49700	13.107.246.72	443	TCP
2025-03-25T17:58:07.172894+0100	2028371	3	Unknown Traffic	192.168.2.7	49702	13.107.246.72	443	TCP
2025-03-25T17:58:08.727648+0100	2028371	3	Unknown Traffic	192.168.2.7	49703	13.107.246.72	443	TCP
2025-03-25T17:58:08.730797+0100	2028371	3	Unknown Traffic	192.168.2.7	49704	13.107.246.72	443	TCP

Joe Sandbox Signatures

• AV Detection
• Compliance
• Software Vulnerabilities
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: PURCHASE ORDER 5172025.xla.xlsx	Virustotal: Detection: 31%			Perma Link
Source: PURCHASE ORDER 5172025.xla.xlsx	ReversingLabs: Detection: 30%

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 162.19.137.157:443 -> 192.168.2.7:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.72:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.72:443 -> 192.168.2.7:49702 version: TLS 1.2

Source: global traffic	DNS query: name: t.emobility.energy
Source: global traffic	DNS query: name: otelrules.svc.static.microsoft

Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49703 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49704 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443

Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 162.19.137.157:443 -> 192.168.2.7:49697
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 162.19.137.157:443 -> 192.168.2.7:49697
Source: global traffic	TCP traffic: 162.19.137.157:443 -> 192.168.2.7:49697
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 162.19.137.157:443 -> 192.168.2.7:49697
Source: global traffic	TCP traffic: 162.19.137.157:443 -> 192.168.2.7:49697
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 162.19.137.157:443 -> 192.168.2.7:49697
Source: global traffic	TCP traffic: 162.19.137.157:443 -> 192.168.2.7:49697
Source: global traffic	TCP traffic: 162.19.137.157:443 -> 192.168.2.7:49697
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49697 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 162.19.137.157:443 -> 192.168.2.7:49697
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 162.19.137.157:443 -> 192.168.2.7:49698
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 162.19.137.157:443 -> 192.168.2.7:49698
Source: global traffic	TCP traffic: 162.19.137.157:443 -> 192.168.2.7:49698
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 162.19.137.157:443 -> 192.168.2.7:49698
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 162.19.137.157:443 -> 192.168.2.7:49698
Source: global traffic	TCP traffic: 162.19.137.157:443 -> 192.168.2.7:49698
Source: global traffic	TCP traffic: 162.19.137.157:443 -> 192.168.2.7:49698
Source: global traffic	TCP traffic: 162.19.137.157:443 -> 192.168.2.7:49698
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 162.19.137.157:443 -> 192.168.2.7:49698
Source: global traffic	TCP traffic: 192.168.2.7:49698 -> 162.19.137.157:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49700
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 13.107.246.72:443 -> 192.168.2.7:49702
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443
Source: global traffic	TCP traffic: 192.168.2.7:49702 -> 13.107.246.72:443

Source: Joe Sandbox View	IP Address: 13.107.246.72 13.107.246.72
Source: Joe Sandbox View	IP Address: 162.19.137.157 162.19.137.157

Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49700 -> 13.107.246.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49702 -> 13.107.246.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49704 -> 13.107.246.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49703 -> 13.107.246.72:443

Source: global traffic	HTTP traffic detected: GET /xRfBGK?&designer=glossy HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: t.emobility.energyConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /404 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: t.emobility.energyConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xRfBGK?&designer=glossy HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: t.emobility.energyConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /404 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: t.emobility.energyConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/excel.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/excel.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft

Source: global traffic	DNS traffic detected: DNS query: t.emobility.energy
Source: global traffic	DNS traffic detected: DNS query: otelrules.svc.static.microsoft

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 25 Mar 2025 16:57:40 GMTServer: Apache/2.4.62 (Debian)X-DNS-Prefetch-Control: offX-Frame-Options: SAMEORIGINStrict-Transport-Security: max-age=15552000; includeSubDomainsX-Download-Options: noopenX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockX-Powered-By: Next.jsETag: "1225-4lR+8o8+z0M1Iq6OMuNgxAtPjT8"Content-Type: text/html; charset=utf-8Content-Length: 4645Vary: Accept-EncodingAccess-Control-Allow-Origin: *Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, AcceptConnection: close

Source: PURCHASE ORDER 5172025.xla.xlsx

String found in binary or memory: https://t.emobility.energy/xRfBGK?&designer=glossy

Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: unknown	HTTPS traffic detected: 162.19.137.157:443 -> 192.168.2.7:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.72:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.72:443 -> 192.168.2.7:49702 version: TLS 1.2

Source: PURCHASE ORDER 5172025.xla.xlsx

OLE indicator, VBA macros: true

Source: PURCHASE ORDER 5172025.xla.xlsx

Stream path 'MBD009B3F21/\x1Ole' : https://t.emobility.energy/xRfBGK?&designer=glossyuf{iPFLc##I+"K~Q$X3"`T,ljD</|9./B{mhwnI|y;_los0#5K8@G{uz?;oFDW/uTH92JZO06YnjCbFqyeGj38t7wLWqtBukXDhxa2mJxg27REX1R3GJsJDxJoQVRw2Wmolam3lR45N9bKOCW6jCDEWi6tlJk6Q2cV3qZJ2lQLTq3HOR6tg1OYcYCTpiDfWzH4hsu7WOtJBhVMfrqcsfxLqePKuFnt4qoHUP6ZrR21MeoHmS2iQTsX330dIzT1Wz19OPkHDqAcmnMVuz1oDDN((|Ht^8*P}N[)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Window title found: microsoft excel okexcel cannot open the file 'purchase order 5172025.xla.xlsx' because the file format or file extension is not valid. verify that the file has not been corrupted and that the file extension matches the format of the file.

Source: classification engine

Classification label: mal48.winXLSX@4/4@2/2

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\Desktop\~$PURCHASE ORDER 5172025.xla.xlsx

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user~1\AppData\Local\Temp\{86733434-8F01-4335-A43E-7A50656AE2C9} - OProcSessId.dat

Jump to behavior

Source: PURCHASE ORDER 5172025.xla.xlsx

OLE indicator, Workbook stream: true

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: PURCHASE ORDER 5172025.xla.xlsx	Virustotal: Detection: 31%
Source: PURCHASE ORDER 5172025.xla.xlsx	ReversingLabs: Detection: 30%

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\PURCHASE ORDER 5172025.xla.xlsx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3EE60F5C-9BAD-4CD8-8E21-AD2D001D06EB}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: PURCHASE ORDER 5172025.xla.xlsx

Static file information: File size 1454592 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: PURCHASE ORDER 5172025.xla.xlsx

Initial sample: OLE indicators encrypted = True

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: PURCHASE ORDER 5172025.xla.xlsx	Stream path 'MBD009B3F20/Package' entropy: 7.99670130113 (max. 8.0)
Source: PURCHASE ORDER 5172025.xla.xlsx	Stream path 'Workbook' entropy: 7.99487746699 (max. 8.0)

Source: C:\Windows\splwow64.exe

Window / User API: threadDelayed 904

Jump to behavior

Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	3 Exploitation for Client Execution	1 Scripting	1 Process Injection	2 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PURCHASE ORDER 5172025.xla.xlsx	31%	Virustotal		Browse
PURCHASE ORDER 5172025.xla.xlsx	31%	ReversingLabs	Win32.Exploit.CVE-2017-0199

Source	Detection	Scanner	Label	Link
https://t.emobility.energy/xRfBGK?&designer=glossy	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
host1.emobility.energy	162.19.137.157	true	false	high
s-part-0044.t-0009.t-msedge.net	13.107.246.72	true	false	high
s-0005.dual-s-msedge.net	52.123.129.14	true	false	high
otelrules.svc.static.microsoft	unknown	unknown	false	high
t.emobility.energy	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://otelrules.svc.static.microsoft/rules/excel.exe-Production-v19.bundle	false		high
https://t.emobility.energy/404	false		high
https://otelrules.svc.static.microsoft/rules/rule120607v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule120603v8s19.xml	false		high
https://t.emobility.energy/xRfBGK?&designer=glossy	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
13.107.246.72	s-part-0044.t-0009.t-msedge.net	United States		8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.19.137.157	host1.emobility.energy	United States		209	CENTURYLINK-US-LEGACY-QWESTUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1648272
Start date and time:	2025-03-25 17:55:32 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Without Instrumentation
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PURCHASE ORDER 5172025.xla.xlsx
Detection:	MAL
Classification:	mal48.winXLSX@4/4@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.20.38, 52.109.6.63, 184.31.69.3, 199.232.214.172, 20.189.173.1, 20.189.173.10, 52.123.129.14, 52.149.20.212, 20.190.144.162
Excluded domains from analysis (whitelisted): onedscolprdwus00.westus.cloudapp.azure.com, slscr.update.microsoft.com, scus-azsc-config.officeapps.live.com, eus2-azsc-000.roaming.officeapps.live.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, osiprod-eus2-buff-azsc-000.eastus2.cloudapp.azure.com, mobile.events.data.microsoft.com, roaming.officeapps.live.com, dual-s-0005-office.config.skype.com, login.live.com, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, c.pki.goog, wu-b-net.trafficmanager.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, fe3cr.delivery.mp.microsoft.com, us1.roaming1.live.com.akadns.net, config.officeapps.live.com, us.configsvc1.live.com.akadns.net, onedscolprdwus09.westus.cloudapp.azure.com,
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:57:47	API Interceptor	943x Sleep call for process: splwow64.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
13.107.246.72	http://loginmlcrosoftonline365.utzsnacks.com.ribeiroautocapas.com.br/cgi-bin/reset/authorize?email=priceandpromosupport@utzsnacks.com	Get hash	malicious	HTMLPhisher	Browse
	https://1drv.ms/o/c/8fc032da5fada757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?e=PyJVMi	Get hash	malicious	Unknown	Browse
	quotation_1.xlsx	Get hash	malicious	Unknown	Browse
	https://jainiklifesciences.com/proposals	Get hash	malicious	HTMLPhisher	Browse
	702cb6e..eml	Get hash	malicious	HTMLPhisher	Browse
	PRE#U00c7O - RFQ 674441-76450.xla.xlsx	Get hash	malicious	Unknown	Browse
	https://waimao-north-star-mail.qiye.163.com/api/j/html?c=https%3A%2F%2F1drv.ms%2Fo%2Fs!AjlMaeoI5pi7f_GXm50IY_RD-sw%3Fe%3DEsmwj4%3Fcid%3Dsite_nqmm3LQS7c9jn-2FWvVcVpMl0NsyUA8yUApYElnaeUm2Ly_xlUzBpbEuL	Get hash	malicious	Unknown	Browse
	PC900-1new.exe	Get hash	malicious	XRed	Browse
	Transferi(Odeme).xls	Get hash	malicious	Quasar	Browse
162.19.137.157	PURCHASE ORDER 5172025.xla.xlsx	Get hash	malicious	Unknown	Browse
	PURCHASE ORDER 5172025.xla.xlsx	Get hash	malicious	Unknown	Browse
	Untitled_20250325.docx.doc	Get hash	malicious	Unknown	Browse
	Untitled_20250325.docx.doc	Get hash	malicious	Unknown	Browse
	PURCHASE ORDER 5172025.xla.xlsx	Get hash	malicious	Unknown	Browse
	BL 248436935 CNTR MRKU9180226.docx.doc	Get hash	malicious	Unknown	Browse
	PURCHASE ORDER 5172025.xla.xlsx	Get hash	malicious	Unknown	Browse
	BL 248436935 CNTR MRKU9180226.docx.doc	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-0005.dual-s-msedge.net	PURCHASE ORDER 420-2025.xla.xlsx	Get hash	malicious	Unknown	Browse	52.123.128.14
	PURCHASE ORDER 5172025.xla.xlsx	Get hash	malicious	Unknown	Browse	52.123.129.14
	PURCHASE ORDER 420-2025.xla.xlsx	Get hash	malicious	Unknown	Browse	52.123.128.14
	Purchase Order 40360414.doc	Get hash	malicious	Unknown	Browse	52.123.128.14
	PURCHASE ORDER 5172025.xla.xlsx	Get hash	malicious	Unknown	Browse	52.123.129.14
	Purchase Order 40360414.doc	Get hash	malicious	Unknown	Browse	52.123.128.14
	PURCHASE ORDER 420-2025.xla.xlsx	Get hash	malicious	Unknown	Browse	52.123.129.14
	Shitstain.exe	Get hash	malicious	AnarchyGrabber, AsyncRAT, DBatLoader, Discord Token Stealer, FritzFrog, HawkEye, Lokibot	Browse	52.123.128.14
host1.emobility.energy	PURCHASE ORDER 5172025.xla.xlsx	Get hash	malicious	Unknown	Browse	162.19.137.157
	PURCHASE ORDER 5172025.xla.xlsx	Get hash	malicious	Unknown	Browse	162.19.137.157
	Untitled_20250325.docx.doc	Get hash	malicious	Unknown	Browse	162.19.137.157
	Untitled_20250325.docx.doc	Get hash	malicious	Unknown	Browse	162.19.137.157
	PURCHASE ORDER 5172025.xla.xlsx	Get hash	malicious	Unknown	Browse	162.19.137.157
	BL 248436935 CNTR MRKU9180226.docx.doc	Get hash	malicious	Unknown	Browse	162.19.137.157
	PURCHASE ORDER 5172025.xla.xlsx	Get hash	malicious	Unknown	Browse	162.19.137.157
	BL 248436935 CNTR MRKU9180226.docx.doc	Get hash	malicious	Unknown	Browse	162.19.137.157
s-part-0044.t-0009.t-msedge.net	https://secure.login.spectraenergy.cloud/yvzxbcsocgyjefcrttuqeujvjbgyybwxwkuujihpdmmdclpmvxmpzzdmojzemkdeaktdiynhscwkzvbmzrybmlovaexkymrxowpdvwxlugipgzeeqtuevhdxbohklpivhzbugrhdckqrbhgsdbcejamnurzxhifphzniobifivkumujtexzzneftqymokjhnqkgytargddorrqcuszwcemqkrmhrhmfbelrfadrxlhuqjgffjlflsuwvggdcgnn/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	13.107.246.72
	http://loginmlcrosoftonline365.utzsnacks.com.ribeiroautocapas.com.br/cgi-bin/reset/authorize?email=priceandpromosupport@utzsnacks.com	Get hash	malicious	HTMLPhisher	Browse	13.107.246.72
	https://1drv.ms/o/c/8fc032da5fada757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?e=PyJVMi	Get hash	malicious	Unknown	Browse	13.107.246.72
	http://loginmlcrosoftonline365greatbear.co.uk.verifyex.com/cache/css?email=richard.moorhouse@greatbear.co.uk	Get hash	malicious	HTMLPhisher	Browse	13.107.246.72
	quotation_1.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.72
	https://jainiklifesciences.com/proposals	Get hash	malicious	HTMLPhisher	Browse	13.107.246.72
	#Ud83d#Udd0aAudio_Msg Umanitoba.xhtml	Get hash	malicious	HTMLPhisher	Browse	13.107.246.72
	Acgsys#receipt0191.html	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	13.107.246.72
	702cb6e..eml	Get hash	malicious	HTMLPhisher	Browse	13.107.246.72
bg.microsoft.map.fastly.net	https://sj-lawfirm.com/	Get hash	malicious	Unknown	Browse	199.232.210.172
	PURCHASE ORDER 420-2025.xla.xlsx	Get hash	malicious	Unknown	Browse	199.232.210.172
	Shitstain.exe	Get hash	malicious	AnarchyGrabber, AsyncRAT, DBatLoader, Discord Token Stealer, FritzFrog, HawkEye, Lokibot	Browse	199.232.210.172
	kmsauto++v1.6.4.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	Invoice Number INV132146-1.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	quotation_1.xlsx	Get hash	malicious	Unknown	Browse	199.232.214.172
	PAD_[2025-03-24_120914].pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	199.232.210.172
	Fatura-03-2025.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CENTURYLINK-US-LEGACY-QWESTUS	PURCHASE ORDER 5172025.xla.xlsx	Get hash	malicious	Unknown	Browse	162.19.137.157
	PURCHASE ORDER 5172025.xla.xlsx	Get hash	malicious	Unknown	Browse	162.19.137.157
	arm7.elf	Get hash	malicious	Okiru	Browse	97.112.45.135
	https://promo-offer.site/tnf_pt	Get hash	malicious	Unknown	Browse	162.19.138.82
	https://antiphishing.vadesecure.com/v4?f=NFZ1OXFVNUpJaXhxbWN3aw79TqTxGVr5HS_rj8xy-Dtt3WuOYgiNsT7kSrCL4neS&i=dnZZY1BRdGVud2p5a3J2MkXgKVQslibyjliaROaA9Kc&k=ylKZ&r=eVhRazAzQWpzQlVhVVRabfl7Btopt7tCs6Jhtvvo_JQliQyVoVTnThNthFfLLOv7XziSix9lmqfR7qqdZtpsOw&s=427052c2cb55a4ea4f9c70929c499bda58414514c5d12af8c66341946b20b817&u=https%3A%2F%2Fzmk5ybt5uw.us-east-1.awsapprunner.com%2F%23Xavier.Regnault%40chantiers-atlantique.com	Get hash	malicious	HTMLPhisher	Browse	162.19.59.195
	Untitled_20250325.docx.doc	Get hash	malicious	Unknown	Browse	162.19.137.157
	Untitled_20250325.docx.doc	Get hash	malicious	Unknown	Browse	162.19.137.157
	PURCHASE ORDER 5172025.xla.xlsx	Get hash	malicious	Unknown	Browse	162.19.137.157
MICROSOFT-CORP-MSN-AS-BLOCKUS	PURCHASE ORDER 420-2025.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.40
	PURCHASE ORDER 5172025.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.40
	PURCHASE ORDER 420-2025.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.40
	PURCHASE ORDER 5172025.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.40
	PURCHASE ORDER 420-2025.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.40
	arm.elf	Get hash	malicious	Gafgyt, Okiru	Browse	20.192.11.71
	ppc.elf	Get hash	malicious	Okiru	Browse	40.122.145.102
	m68k.elf	Get hash	malicious	Gafgyt, Okiru	Browse	51.120.229.61

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
6271f898ce5be7dd52b0fc260d0662b3	PURCHASE ORDER 420-2025.xla.xlsx	Get hash	malicious	Unknown	Browse	162.19.137.157
	PURCHASE ORDER 5172025.xla.xlsx	Get hash	malicious	Unknown	Browse	162.19.137.157
	PURCHASE ORDER 420-2025.xla.xlsx	Get hash	malicious	Unknown	Browse	162.19.137.157
	PURCHASE ORDER 5172025.xla.xlsx	Get hash	malicious	Unknown	Browse	162.19.137.157
	PURCHASE ORDER 5172025.xla.xlsx	Get hash	malicious	Unknown	Browse	162.19.137.157
	SecuriteInfo.com.Other.Malware-gen.24773.2907.xlsx	Get hash	malicious	Unknown	Browse	162.19.137.157
	SecuriteInfo.com.Other.Malware-gen.24773.2907.xlsx	Get hash	malicious	Unknown	Browse	162.19.137.157
	PRE#U00c7O - RFQ 674441-76450.xla.xlsx	Get hash	malicious	Unknown	Browse	162.19.137.157
	PRE#U00c7O - RFQ 674441-76450.xla.xlsx	Get hash	malicious	Unknown	Browse	162.19.137.157
a0e9f5d64349fb13191bc781f81f42e1	PURCHASE ORDER 420-2025.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.72
	PURCHASE ORDER 5172025.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.72
	PURCHASE ORDER 420-2025.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.72
	temp_error_logs.scr.exe	Get hash	malicious	Unknown	Browse	13.107.246.72
	temp_error_logs.scr.exe	Get hash	malicious	Unknown	Browse	13.107.246.72
	ASIr1Bo2x9.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.72
	ySTYvI9Pvk.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.72
	6aOM10d2pR.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.72
	Ec0AgD2t1q.exe	Get hash	malicious	DarkVision Rat	Browse	13.107.246.72

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Users\user\AppData\Local\Temp\2A88C80A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	784
Entropy (8bit):	2.7137690747287806
Encrypted:	false
SSDEEP:	24:YIrNvpKAzLRwcfHGF8AJp9WtAZRJ5poIHWI:YmbfzLmc88AJtfJ52IHV
MD5:	09F73B3902CD3D88E04312787956B654
SHA1:	A6C275F1A65DB02D8A752C614C27E88326447C41
SHA-256:	72971990E5DC57AC8F4F27701158F6DC16E235814EA17DECA95E59CF5F60BC26
SHA-512:	6A68530BA4D4413B587E340CF871162036B6AC60AC0F969C07C70967C3102ADDE3C895BA6F1E2590D9D0C98C253ADFA33CA84E65106C3B56F506FE0E06F0ADA9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	3.7.4.6.3.7.6.,.1.1.9.6.3.7.8.,.1.7.8.8.6.5.8.,.2.5.5.0.5.0.8.8.,.1.2.5.,.1.1.9.,.3.0.0.4.9.2.6.8.,.;.3.2.9.4.5.8.7.9.9.,.3.7.4.6.3.7.8.,.6.3.6.4.3.3.4.,.3.0.1.5.3.7.2.1.,.2.3.7.1.6.5.1.,.6.5.4.0.2.1.5.,.2.4.6.0.9.2.5.8.,.4.0.6.9.3.5.8.2.,.1.0.4.9.5.2.3.4.,.6.3.6.4.3.1.8.,.3.0.1.2.3.4.6.6.,.2.7.1.5.3.4.9.7.,.6.3.7.1.6.9.4.,.5.9.2.2.3.4.2.3.,.5.7.9.9.9.6.6.1.,.1.5.6.1.9.5.8.,.6.3.0.6.3.0.9.9.,.2.7.3.6.0.0.9.5.,.5.8.4.2.5.8.6.0.,.6.3.6.4.3.3.7.,.6.1.7.0.7.3.0.7.,.6.3.6.4.3.3.0.,.6.3.6.4.3.3.1.,.6.7.4.8.3.9.6.1.4.,.3.3.7.9.1.6.2.,.4.7.3.8.2.9.4.8.,.1.6.5.7.4.5.3.,.1.0.6.9.5.5.2.,.1.6.5.7.4.5.2.,.5.2.9.1.0.0.0.0.,.1.3.5.2.5.8.6.,.1.3.5.2.5.8.7.,.1.7.7.1.6.5.7.,.1.0.2.3.8.6.4.,.1.0.2.3.6.3.8.,.6.3.7.1.6.9.5.,.4.8.1.9.5.5.3.8.,.1.4.6.1.9.5.3.,.6.3.6.4.3.3.2.,.3.2.0.5.9.2.7.6.7.,.

C:\Users\user\AppData\Local\Temp\~DFEDF1E296F45941FF.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\~$PURCHASE ORDER 5172025.xla.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.7769794087092887
Encrypted:	false
SSDEEP:	3:iXKG/4N+RMlW8td:iXlMlW8/
MD5:	37BD8218D560948827D3B948CAFA579C
SHA1:	24347FB0A66F2DA8AD3BAB818E3C24977104E5DA
SHA-256:	189E2D5600E0CC41F498D2EB22FA451F81746DCDBAA3EC1146A22C3A74452DA6
SHA-512:	A34D703FEBFD9E45A57BF047D9CCF890482B0F7CD3788F9BFD89DECA13B96DD4F43BDB0C4D81CC716DEAC37BCD1C393A7BCB159B471B5721B367E4884B17C699
Malicious:	true
Preview:	.user ..f.r.o.n.t.d.e.s.k. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Tue Mar 25 07:09:34 2025, Security: 1
Entropy (8bit):	7.986081681596128
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	PURCHASE ORDER 5172025.xla.xlsx
File size:	1'454'592 bytes
MD5:	42ad657229b182e1e3d922663fcd6fb5
SHA1:	512fd99e3b8aa2625e9fb3ac2dd4a6e7c2fff996
SHA256:	fccb42f6351784b5530b26c97ef1d2011637ca62273324ff22d9e35657741dc7
SHA512:	f3d481f9acc3e5c6ca99245addc7f2d97eef3c7984536daf239220b8dd892215b220811613f8f9440f18b2e38f5afc8f2679b567fba2524bd9b1c4e558d72762
SSDEEP:	24576:OVxQ0LlWyd9Wq+ku+k0mkHeongDxUmPAeUKRq+RO5u8MP28QydFq6T/lokScRe:OVW080QfkuMrHWxbAZKRq+RZ8A28Qg/B
TLSH:	B8652341FC15BB4AD9D92436A6F2F82A0354DDD2BA14C5237356B32F72BBBB06183724
File Content Preview:	........................>.......................................................................................................................................}..............................................................................................

File Icon


Icon Hash:	35e58a8c0c8a85b9

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "PURCHASE ORDER 5172025.xla.xlsx"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Author:
Last Saved By:
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2025-03-25 07:09:34
Creating Application:	Microsoft Excel
Security:	1

Document Summary

Document Code Page:	1252
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	786432

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 e8 fc 93 36 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet2.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I - . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 e8 fc 49 2d 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet3.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 e8 fc 15 02 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . f . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . - . 0
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 e8 fc 66 f5 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.889430592781307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	200
Entropy:	3.2503503175049815
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . \| . # . @ . . . . . T . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: MBD009B3F20/\x1CompObj, File Type: data, Stream Size: 99

General
Stream Path:	MBD009B3F20/\x1CompObj
CLSID:
File Type:	data
Stream Size:	99
Entropy:	3.631242196770981
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD009B3F20/Package, File Type: Microsoft Excel 2007+, Stream Size: 1295689

General
Stream Path:	MBD009B3F20/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	1295689
Entropy:	7.996701301127075
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . w 1 . . . . j . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 77 31 d5 0e e3 01 00 00 6a 08 00 00 13 00 cd 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 c9 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD009B3F21/\x1Ole, File Type: data, Stream Size: 788

General
Stream Path:	MBD009B3F21/\x1Ole
CLSID:
File Type:	data
Stream Size:	788
Entropy:	5.291239637953238
Base64 Encoded:	False
Data ASCII:	. . . . . . d . ] . . . . . . . . . . . . . . . . . y . . . K . . . . . h . t . t . p . s . : . / . / . t . . . e . m . o . b . i . l . i . t . y . . . e . n . e . r . g . y . / . x . R . f . B . G . K . ? . & . d . e . s . i . g . n . e . r . = . g . l . o . s . s . y . . . . u . f . { i P . F L c # # . I + . . " . K ~ Q $ X . 3 . " ` T , . l j D < / \| . 9 . . / B { m h . w n I . \| y ; _ l o s 0 # . 5 K 8 @ G { u z . ? ; o F . D W / . u . . . . . . . . . . . . . . . . . . . . . T . H . 9 . 2 . J . Z . O .
Data Raw:	01 00 00 02 1b 9b 05 64 00 5d 8e 13 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b 04 01 00 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 74 00 2e 00 65 00 6d 00 6f 00 62 00 69 00 6c 00 69 00 74 00 79 00 2e 00 65 00 6e 00 65 00 72 00 67 00 79 00 2f 00 78 00 52 00 66 00 42 00 47 00 4b 00 3f 00 26 00 64 00 65 00 73 00 69 00 67 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 133075

General
Stream Path:	Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	133075
Entropy:	7.994877466987564
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . / . 6 . . . . . . . u S q . + B # h \| b d . . e . ] . U < ; . j ^ j U P ! ' D . . . . . . . . . . { d . . . \\ . p . j . Q t ] $ [ . , . . / ] 3 . I 3 . . 2 . . , o . . + . t ! . ) } E . . . Z . * \| # o I P . . V y . y & w 2 . t . B . . . a . . . H . . . = . . . M . . . . . \| N . @ B \| Z . . . N . . . . k . . . . k . . . . . . . . ^ + . . . = . . . ; . . . i & . 8 e 7 Y @ . . . . . . . 2 " . . . b ` . . . . . . . . . . . . H 1 . . . L . P . ) L a ? H . * i L N . 1 . . . H 2
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 fc eb df 75 53 e7 71 1d 2b fb 42 23 68 7c 62 64 c1 ce 83 dd b2 65 1d ba 5d 17 c8 55 3c b4 3b 8b db 88 ec 6a b5 5e 6a 55 c4 50 f3 21 27 ac 44 9a 87 00 00 00 e1 00 02 00 b0 04 c1 00 02 00 7b 64 e2 00 00 00 5c 00 70 00 9e 6a 7f 51 74 5d 24 5b e0 ed 02 bb 8e a2 84 2c 93 bf d6 83 ed ce 0c 2f 5d 33

Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 527

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	527
Entropy:	5.205840445289228
Base64 Encoded:	True
Data ASCII:	I D = " { 4 7 6 4 C 5 0 8 - 1 3 C 1 - 4 3 F B - B 9 8 5 - 6 4 9 3 3 0 3 1 E 4 2 6 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 7 9 7 B F 7 0 D F B 0 D F B 0 D F
Data Raw:	49 44 3d 22 7b 34 37 36 34 43 35 30 38 2d 31 33 43 31 2d 34 33 46 42 2d 42 39 38 35 2d 36 34 39 33 33 30 33 31 45 34 32 36 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
CLSID:
File Type:	data
Stream Size:	104
Entropy:	3.0488640812019017
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2644
Entropy:	3.9822715768237
Base64 Encoded:	False
Data ASCII:	a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
CLSID:
File Type:	data
Stream Size:	553
Entropy:	6.3606301584537785
Base64 Encoded:	True
Data ASCII:	. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . i . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2 E .
Data Raw:	01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 f5 e3 f9 69 08 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-25T17:57:53.261037+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49700	13.107.246.72	443	TCP
2025-03-25T17:58:07.172894+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49702	13.107.246.72	443	TCP
2025-03-25T17:58:08.727648+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49703	13.107.246.72	443	TCP
2025-03-25T17:58:08.730797+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49704	13.107.246.72	443	TCP

Network Port Distribution

Total Packets: 426
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2025 17:57:38.834264040 CET	49697	443	192.168.2.7	162.19.137.157
Mar 25, 2025 17:57:38.834309101 CET	443	49697	162.19.137.157	192.168.2.7
Mar 25, 2025 17:57:38.834374905 CET	49697	443	192.168.2.7	162.19.137.157
Mar 25, 2025 17:57:38.834676981 CET	49697	443	192.168.2.7	162.19.137.157
Mar 25, 2025 17:57:38.834686995 CET	443	49697	162.19.137.157	192.168.2.7
Mar 25, 2025 17:57:39.465925932 CET	443	49697	162.19.137.157	192.168.2.7
Mar 25, 2025 17:57:39.466064930 CET	49697	443	192.168.2.7	162.19.137.157
Mar 25, 2025 17:57:39.470828056 CET	49697	443	192.168.2.7	162.19.137.157
Mar 25, 2025 17:57:39.470839024 CET	443	49697	162.19.137.157	192.168.2.7
Mar 25, 2025 17:57:39.471122980 CET	443	49697	162.19.137.157	192.168.2.7
Mar 25, 2025 17:57:39.471185923 CET	49697	443	192.168.2.7	162.19.137.157
Mar 25, 2025 17:57:39.471606016 CET	49697	443	192.168.2.7	162.19.137.157
Mar 25, 2025 17:57:39.516273022 CET	443	49697	162.19.137.157	192.168.2.7
Mar 25, 2025 17:57:39.861233950 CET	443	49697	162.19.137.157	192.168.2.7
Mar 25, 2025 17:57:39.861315012 CET	443	49697	162.19.137.157	192.168.2.7
Mar 25, 2025 17:57:39.861397982 CET	49697	443	192.168.2.7	162.19.137.157
Mar 25, 2025 17:57:39.862185001 CET	49697	443	192.168.2.7	162.19.137.157
Mar 25, 2025 17:57:39.872947931 CET	49697	443	192.168.2.7	162.19.137.157
Mar 25, 2025 17:57:39.872962952 CET	443	49697	162.19.137.157	192.168.2.7
Mar 25, 2025 17:57:39.874030113 CET	49698	443	192.168.2.7	162.19.137.157
Mar 25, 2025 17:57:39.874079943 CET	443	49698	162.19.137.157	192.168.2.7
Mar 25, 2025 17:57:39.874167919 CET	49698	443	192.168.2.7	162.19.137.157
Mar 25, 2025 17:57:39.874349117 CET	49698	443	192.168.2.7	162.19.137.157
Mar 25, 2025 17:57:39.874358892 CET	443	49698	162.19.137.157	192.168.2.7
Mar 25, 2025 17:57:40.254108906 CET	443	49698	162.19.137.157	192.168.2.7
Mar 25, 2025 17:57:40.254302025 CET	49698	443	192.168.2.7	162.19.137.157
Mar 25, 2025 17:57:40.254770994 CET	49698	443	192.168.2.7	162.19.137.157
Mar 25, 2025 17:57:40.254781961 CET	443	49698	162.19.137.157	192.168.2.7
Mar 25, 2025 17:57:40.255004883 CET	49698	443	192.168.2.7	162.19.137.157
Mar 25, 2025 17:57:40.255012035 CET	443	49698	162.19.137.157	192.168.2.7
Mar 25, 2025 17:57:40.628119946 CET	443	49698	162.19.137.157	192.168.2.7
Mar 25, 2025 17:57:40.628149033 CET	443	49698	162.19.137.157	192.168.2.7
Mar 25, 2025 17:57:40.628212929 CET	443	49698	162.19.137.157	192.168.2.7
Mar 25, 2025 17:57:40.628249884 CET	49698	443	192.168.2.7	162.19.137.157
Mar 25, 2025 17:57:40.628326893 CET	49698	443	192.168.2.7	162.19.137.157
Mar 25, 2025 17:57:40.664932966 CET	49698	443	192.168.2.7	162.19.137.157
Mar 25, 2025 17:57:40.664933920 CET	49698	443	192.168.2.7	162.19.137.157
Mar 25, 2025 17:57:40.664966106 CET	443	49698	162.19.137.157	192.168.2.7
Mar 25, 2025 17:57:40.665021896 CET	49698	443	192.168.2.7	162.19.137.157
Mar 25, 2025 17:57:52.946830988 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:52.946866989 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:52.946996927 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:52.947386980 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:52.947402000 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.260951996 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.261037111 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:53.296632051 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:53.296715975 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.297079086 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.309930086 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:53.356276035 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.554881096 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.554910898 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.554927111 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.554972887 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:53.554990053 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.555027008 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:53.555049896 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:53.586432934 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.586468935 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.586515903 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:53.586524010 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.586576939 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:53.761729002 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.761758089 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.761807919 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:53.761821032 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.761832952 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.761851072 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.761879921 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:53.761893034 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.761910915 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:53.761919975 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.761936903 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:53.761986017 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:53.889419079 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.889442921 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.889489889 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.889523983 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:53.889533997 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.889556885 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.889569998 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:53.889605999 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:53.896760941 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.896776915 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.896835089 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:53.896842957 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.937551975 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:53.981905937 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.981944084 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.981983900 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:53.981993914 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:53.982033968 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:53.982059002 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.073327065 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.073352098 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.073416948 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.073450089 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.073599100 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.224675894 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.224709988 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.224769115 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.224786997 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.224816084 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.224832058 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.308384895 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.308429003 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.308476925 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.308492899 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.308522940 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.308541059 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.375838041 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.375861883 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.375931025 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.375947952 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.376004934 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.478549004 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.478584051 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.478635073 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.478650093 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.478682995 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.478703976 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.605680943 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.605710983 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.605767965 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.605784893 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.605814934 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.605835915 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.764867067 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.764899015 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.764939070 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.764955044 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.764982939 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.765036106 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.843729973 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.843760967 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.843854904 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.843873978 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.843976021 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.981388092 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.981420994 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.981496096 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.981515884 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:54.981553078 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:54.981571913 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:55.174479961 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:55.174508095 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:55.174587965 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:55.174603939 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:55.174654007 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:55.330840111 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:55.330874920 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:55.330925941 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:55.330943108 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:55.330985069 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:55.490629911 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:55.490650892 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:55.490724087 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:55.490739107 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:55.490755081 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:55.490777016 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:55.758323908 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:55.758358002 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:55.758538008 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:55.758557081 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:55.758605003 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:56.018584013 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:56.018599987 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:56.018619061 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:56.018667936 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:56.018687010 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:56.018717051 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:56.018744946 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:56.262073040 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:56.262089968 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:56.262137890 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:56.262140989 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:56.262171030 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:56.262177944 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:56.262201071 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:56.262238026 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:56.422815084 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:56.422842979 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:56.422915936 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:56.422935009 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:56.422962904 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:56.422981977 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:56.602345943 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:56.602411032 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:56.602442980 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:56.602461100 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:56.602490902 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:56.602503061 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:56.831667900 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:56.831684113 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:56.831728935 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:56.831753016 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:56.831772089 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:56.831799984 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:56.831815004 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:57.028420925 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:57.028450012 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:57.028523922 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:57.028539896 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:57.028568029 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:57.028578043 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:57.225462914 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:57.225498915 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:57.225552082 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:57.225570917 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:57.225593090 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:57.225614071 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:57.414421082 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:57.414490938 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:57.414515018 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:57.414534092 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:57.414578915 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:57.414598942 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:57.548121929 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:57.548177958 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:57.548209906 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:57.548229933 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:57.548278093 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:57.548278093 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:57.724576950 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:57.724602938 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:57.724687099 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:57.724709034 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:57.724980116 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:57.848088980 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:57.848119974 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:57.848167896 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:57.848186970 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:57.848202944 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:57.848407030 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:58.054604053 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:58.054647923 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:58.054696083 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:58.054719925 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:58.054800987 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:58.054811954 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:58.054991961 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:58.151784897 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:58.151810884 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:58.151896000 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:58.151916027 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:58.152065992 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:58.347734928 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:58.347760916 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:58.347826004 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:58.347848892 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:58.347999096 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:58.636370897 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:58.636414051 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:58.636460066 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:58.636464119 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:58.636485100 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:58.636501074 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:58.636512041 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:58.636540890 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:58.749511003 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:58.749577045 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:58.749619961 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:58.749649048 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:58.749666929 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:58.749900103 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:58.947237968 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:58.947307110 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:58.947333097 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:58.947360992 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:58.947380066 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:58.947396994 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:59.117692947 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:59.117758989 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:59.117782116 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:59.117813110 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:59.117830992 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:59.117985010 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:59.268513918 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:59.268543005 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:59.268615961 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:59.268646955 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:59.270035982 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:59.405522108 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:59.405586004 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:59.405610085 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:59.405647039 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:59.405648947 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:59.405782938 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:59.542107105 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:59.542138100 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:59.542223930 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:59.542248011 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:59.542387009 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:59.684313059 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:59.684387922 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:59.684417963 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:59.684447050 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:59.684463978 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:59.684731960 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:59.781447887 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:59.781544924 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:59.781570911 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:59.781601906 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:59.781621933 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:59.781649113 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:59.938245058 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:59.938314915 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:59.938353062 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:59.938388109 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:57:59.938405991 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:57:59.938443899 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:00.093965054 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:00.094046116 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:00.094072104 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:00.094103098 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:00.094119072 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:00.094161987 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:00.265974998 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:00.266037941 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:00.266160011 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:00.266160011 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:00.266196012 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:00.266262054 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:00.406639099 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:00.406666040 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:00.406864882 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:00.406897068 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:00.406960964 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:00.550035954 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:00.550102949 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:00.550138950 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:00.550169945 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:00.550190926 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:00.550204992 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:00.659342051 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:00.659400940 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:00.659437895 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:00.659470081 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:00.659488916 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:00.659509897 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:00.794169903 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:00.794231892 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:00.794265032 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:00.794301987 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:00.794318914 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:00.794410944 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:00.908041954 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:00.908111095 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:00.908154011 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:00.908186913 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:00.908204079 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:00.908427000 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:01.022716045 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.022785902 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.022841930 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:01.022875071 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.022891998 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:01.022929907 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:01.121027946 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.121108055 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.121246099 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:01.121246099 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:01.121277094 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.121445894 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:01.278815985 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.278889894 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.278933048 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:01.278965950 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.278985023 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:01.279113054 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:01.376422882 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.376446962 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.376631975 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:01.376661062 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.376879930 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:01.653707027 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.653726101 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.653764963 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.653810978 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:01.653845072 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.653862953 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:01.653939009 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:01.705236912 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.705307007 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.705360889 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:01.705390930 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.705411911 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:01.705786943 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:01.887623072 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.887701035 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.887794018 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:01.887806892 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:01.887842894 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:01.887854099 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:02.152292013 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:02.152332067 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:02.152381897 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:02.152398109 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:02.152452946 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:02.152461052 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:02.154417038 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:02.263370037 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:02.263441086 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:02.263461113 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:02.263478994 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:02.263521910 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:02.263521910 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:02.506078959 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:02.506119967 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:02.506169081 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:02.506208897 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:02.506222963 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:02.506269932 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:02.758980036 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:02.759018898 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:02.759063959 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:02.759066105 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:02.759125948 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:02.759135008 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:02.759171963 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:03.019463062 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:03.019481897 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:03.019520044 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:03.019555092 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:03.019588947 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:03.019603968 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:03.019643068 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:03.317698956 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:03.317714930 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:03.317740917 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:03.317799091 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:03.317826986 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:03.317861080 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:03.317883968 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:03.504478931 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:03.504503012 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:03.504573107 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:03.504586935 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:03.504602909 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:03.504625082 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:03.651427984 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:03.651520014 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:03.651545048 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:03.651581049 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:03.651602983 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:03.651741028 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:03.651750088 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:03.651772976 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:03.651959896 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:03.653557062 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:03.653574944 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:03.653582096 CET	49700	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:03.653595924 CET	443	49700	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:06.869334936 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:06.869385958 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:06.869652033 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:06.870011091 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:06.870026112 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.172666073 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.172894001 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:07.186410904 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:07.186429977 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.186775923 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.222436905 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:07.264276028 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.573790073 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.573822975 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.573859930 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.573879004 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.573921919 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:07.573921919 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:07.573940992 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.573959112 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.573981047 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.574021101 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:07.574048042 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:07.608383894 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.608413935 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.608555079 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:07.608570099 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.608639956 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:07.709671974 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.709706068 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.709780931 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:07.709796906 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.709815025 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:07.709952116 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:07.906301975 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.906337976 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.906374931 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:07.906399012 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.906440973 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:07.906461954 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:07.979490995 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.979521036 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.979598045 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:07.979613066 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:07.979646921 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:07.980369091 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.172935009 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.173010111 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.173086882 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.173086882 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.173106909 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.173181057 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.340399027 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.340431929 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.340512991 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.340512991 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.340532064 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.340603113 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.421678066 CET	49703	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.421716928 CET	443	49703	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.421775103 CET	49703	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.421845913 CET	49704	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.421907902 CET	443	49704	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.421964884 CET	49704	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.422347069 CET	49703	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.422358036 CET	443	49703	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.422458887 CET	49704	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.422472000 CET	443	49704	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.504662037 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.504692078 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.504942894 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.504942894 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.504961967 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.505023003 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.674824953 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.674851894 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.674906969 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.674923897 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.674945116 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.675180912 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.727142096 CET	443	49703	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.727648020 CET	49703	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.727689028 CET	443	49703	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.728514910 CET	49703	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.728521109 CET	443	49703	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.729727030 CET	443	49704	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.730797052 CET	49704	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.730818033 CET	443	49704	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.731719971 CET	49704	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.731729031 CET	443	49704	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.819139004 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.819164991 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.819364071 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.819364071 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.819377899 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.822530031 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.927440882 CET	443	49703	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.927675962 CET	443	49703	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.930018902 CET	443	49704	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.930041075 CET	443	49704	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.930103064 CET	49703	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.930129051 CET	49704	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.930169106 CET	443	49704	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.930471897 CET	443	49704	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.930695057 CET	49704	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.960638046 CET	49703	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.960659981 CET	443	49703	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.960666895 CET	49703	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.960673094 CET	443	49703	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.962251902 CET	49704	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.962285042 CET	443	49704	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.962297916 CET	49704	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.962304115 CET	443	49704	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.974735022 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.974766016 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.975045919 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.975045919 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:08.975063086 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:08.975123882 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:09.108917952 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:09.108942986 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:09.109122038 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:09.109137058 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:09.109270096 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:09.220015049 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:09.220037937 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:09.220104933 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:09.220125914 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:09.220165014 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:09.220165014 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:09.345207930 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:09.345235109 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:09.345618963 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:09.345618963 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:09.345633030 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:09.346384048 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:09.445961952 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:09.445986032 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:09.446099043 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:09.446114063 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:09.446209908 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:09.634697914 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:09.634723902 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:09.634968042 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:09.634968042 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:09.634983063 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:09.635037899 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:09.708710909 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:09.708731890 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:09.708828926 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:09.708842993 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:09.710515976 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:09.880824089 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:09.880851984 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:09.880981922 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:09.880997896 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:09.881100893 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:10.137597084 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:10.137626886 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:10.138461113 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:10.138461113 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:10.138475895 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:10.142463923 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:10.235728025 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:10.235752106 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:10.235836983 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:10.235865116 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:10.236274958 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:10.236274958 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:10.459605932 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:10.459645987 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:10.459714890 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:10.459731102 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:10.459779978 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:10.459779978 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:10.702270031 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:10.702296019 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:10.702475071 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:10.702493906 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:10.702568054 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:11.064970016 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:11.064985991 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:11.065023899 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:11.065119028 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:11.065136909 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:11.065170050 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:11.065749884 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:11.248172045 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:11.248203039 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:11.248250008 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:11.248264074 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:11.248301983 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:11.248325109 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:11.468863964 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:11.468878984 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:11.468915939 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:11.468974113 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:11.468990088 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:11.469002008 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:11.469038963 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:11.663711071 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:11.663743019 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:11.663845062 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:11.663858891 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:11.663913012 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:11.881609917 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:11.881625891 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:11.881645918 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:11.881700039 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:11.881717920 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:11.881757975 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:11.881777048 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:12.215301037 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:12.215313911 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:12.215342045 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:12.215383053 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:12.215396881 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:12.215447903 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:12.347676039 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:12.347739935 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:12.347757101 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:12.347773075 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:12.347800016 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:12.347816944 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:12.672812939 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:12.672828913 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:12.672848940 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:12.672914028 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:12.672939062 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:12.672969103 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:12.672990084 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:13.006853104 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:13.006892920 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:13.006946087 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:13.006947041 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:13.006985903 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:13.006994009 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:13.007061958 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:13.007093906 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:13.310224056 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:13.310276985 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:13.310312986 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:13.310328007 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:13.310370922 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:13.310384035 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:13.310410023 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:13.310431957 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:13.583708048 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:13.583748102 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:13.583798885 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:13.583807945 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:13.583862066 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:13.583875895 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:13.583942890 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:13.781013966 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:13.781086922 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:13.781101942 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:13.781119108 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:13.781148911 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:13.781160116 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:13.981106043 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:13.981172085 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:13.981200933 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:13.981219053 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:13.981246948 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:13.981262922 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:14.220290899 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:14.220331907 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:14.220383883 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:14.220429897 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:14.220429897 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:14.220463991 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:14.220479012 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:14.220711946 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:14.399238110 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:14.399266958 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:14.399348021 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:14.399367094 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:14.399389029 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:14.399478912 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:14.595347881 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:14.595374107 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:14.595494986 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:14.595494986 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:14.595510006 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:14.595562935 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:14.765522003 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:14.765558004 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:14.765860081 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:14.765860081 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:14.765877962 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:14.765959978 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:14.965992928 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:14.966020107 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:14.966101885 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:14.966114044 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:14.966164112 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:14.966164112 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:15.190330029 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:15.190345049 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:15.190381050 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:15.190493107 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:15.190510988 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:15.190542936 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:15.190728903 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:15.359801054 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:15.359827995 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:15.359891891 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:15.359911919 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:15.360822916 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:15.541089058 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:15.541112900 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:15.541233063 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:15.541249990 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:15.541429996 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:15.783152103 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:15.783169031 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:15.783211946 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:15.783296108 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:15.783314943 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:15.783351898 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:15.783370972 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:15.941937923 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:15.941962004 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:15.942130089 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:15.942147970 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:15.942200899 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:16.136492968 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:16.136521101 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:16.136610985 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:16.136629105 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:16.136694908 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:16.317907095 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:16.317934990 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:16.318070889 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:16.318089008 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:16.318137884 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:16.470380068 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:16.470452070 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:16.470549107 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:16.470565081 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:16.470597029 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:16.470659018 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:16.646717072 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:16.646758080 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:16.646891117 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:16.646908045 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:16.646965027 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:17.007100105 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:17.007117033 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:17.007138014 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:17.007224083 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:17.007253885 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:17.007267952 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:17.007325888 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:17.216586113 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:17.216600895 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:17.216644049 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:17.216803074 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:17.216831923 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:17.216921091 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:17.399833918 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:17.399894953 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:17.400007010 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:17.400007010 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:17.400026083 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:17.400283098 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:17.667113066 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:17.667131901 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:17.667166948 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:17.667395115 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:17.667416096 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:17.667583942 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:18.071007013 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:18.071027994 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:18.071168900 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:18.071211100 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:18.071240902 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:18.071357965 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:18.649666071 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:18.649682999 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:18.649713993 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:18.649765015 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:18.649800062 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:18.649854898 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:18.649888992 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:19.181516886 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:19.181555986 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:19.181601048 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:19.181873083 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:19.181873083 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:19.181905031 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:19.182157993 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:19.570722103 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:19.570738077 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:19.570774078 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:19.571000099 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:19.571000099 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:19.571024895 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:19.571110010 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:19.770859957 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:19.770886898 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:19.770998001 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:19.770998001 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:19.771023989 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:19.771081924 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:20.029511929 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:20.029556036 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:20.029624939 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:20.029664993 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:20.029812098 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:20.029825926 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:20.030020952 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:20.373861074 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:20.373898983 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:20.373951912 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:20.373955011 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:20.373984098 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:20.373999119 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:20.374013901 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:20.374042988 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:20.775773048 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:20.775789976 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:20.775826931 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:20.775934935 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:20.775955915 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:20.775990963 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:20.776012897 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:21.011259079 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.011275053 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.011408091 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.011435032 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:21.011457920 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.011477947 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:21.011499882 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:21.310688019 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.310704947 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.310738087 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.310791016 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:21.310815096 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.310887098 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:21.310887098 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:21.537926912 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.537944078 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.537981987 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.538239956 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:21.538239956 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:21.538275003 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.538352013 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:21.751533031 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.751549959 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.751594067 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.751698017 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:21.751698017 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:21.751714945 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.751966953 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:21.906729937 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.906759024 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.906805992 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:21.906829119 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.906913996 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:21.909265041 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:21.926805973 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.926950932 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.927042961 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:21.927118063 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:21.927118063 CET	49702	443	192.168.2.7	13.107.246.72
Mar 25, 2025 17:58:21.927140951 CET	443	49702	13.107.246.72	192.168.2.7
Mar 25, 2025 17:58:21.927153111 CET	443	49702	13.107.246.72	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2025 17:57:38.680639029 CET	62497	53	192.168.2.7	1.1.1.1
Mar 25, 2025 17:57:38.833288908 CET	53	62497	1.1.1.1	192.168.2.7
Mar 25, 2025 17:57:52.839627028 CET	61672	53	192.168.2.7	1.1.1.1
Mar 25, 2025 17:57:52.945823908 CET	53	61672	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 25, 2025 17:57:38.680639029 CET	192.168.2.7	1.1.1.1	0xfda4	Standard query (0)	t.emobility.energy	A (IP address)	IN (0x0001)	false
Mar 25, 2025 17:57:52.839627028 CET	192.168.2.7	1.1.1.1	0xa7bb	Standard query (0)	otelrules.svc.static.microsoft	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 25, 2025 17:56:50.369286060 CET	1.1.1.1	192.168.2.7	0x914c	No error (0)	ecs-office.s-0005.dual-s-msedge.net	s-0005.dual-s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 25, 2025 17:56:50.369286060 CET	1.1.1.1	192.168.2.7	0x914c	No error (0)	s-0005.dual-s-msedge.net		52.123.129.14	A (IP address)	IN (0x0001)	false
Mar 25, 2025 17:56:50.369286060 CET	1.1.1.1	192.168.2.7	0x914c	No error (0)	s-0005.dual-s-msedge.net		52.123.128.14	A (IP address)	IN (0x0001)	false
Mar 25, 2025 17:56:50.541474104 CET	1.1.1.1	192.168.2.7	0x16f1	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Mar 25, 2025 17:56:50.541474104 CET	1.1.1.1	192.168.2.7	0x16f1	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Mar 25, 2025 17:57:38.833288908 CET	1.1.1.1	192.168.2.7	0xfda4	No error (0)	t.emobility.energy	host1.emobility.energy		CNAME (Canonical name)	IN (0x0001)	false
Mar 25, 2025 17:57:38.833288908 CET	1.1.1.1	192.168.2.7	0xfda4	No error (0)	host1.emobility.energy		162.19.137.157	A (IP address)	IN (0x0001)	false
Mar 25, 2025 17:57:52.945823908 CET	1.1.1.1	192.168.2.7	0xa7bb	No error (0)	otelrules.svc.static.microsoft	otelrules-bzhndjfje8dvh5fd.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 25, 2025 17:57:52.945823908 CET	1.1.1.1	192.168.2.7	0xa7bb	No error (0)	otelrules-bzhndjfje8dvh5fd.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 25, 2025 17:57:52.945823908 CET	1.1.1.1	192.168.2.7	0xa7bb	No error (0)	star-azurefd-prod.trafficmanager.net	shed.dual-low.s-part-0044.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 25, 2025 17:57:52.945823908 CET	1.1.1.1	192.168.2.7	0xa7bb	No error (0)	shed.dual-low.s-part-0044.t-0009.t-msedge.net	s-part-0044.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 25, 2025 17:57:52.945823908 CET	1.1.1.1	192.168.2.7	0xa7bb	No error (0)	s-part-0044.t-0009.t-msedge.net		13.107.246.72	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

t.emobility.energy

otelrules.svc.static.microsoft

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49697	162.19.137.157	443	6856	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-25 16:57:39 UTC	219	OUT	GET /xRfBGK?&designer=glossy HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: t.emobility.energy Connection: Keep-Alive
2025-03-25 16:57:39 UTC	539	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 25 Mar 2025 16:57:39 GMT Server: Apache/2.4.62 (Debian) X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Location: /404 Vary: Accept Content-Type: text/plain; charset=utf-8 Content-Length: 38 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Connection: close
2025-03-25 16:57:39 UTC	38	IN	Data Raw: 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 2f 34 30 34 Data Ascii: Moved Permanently. Redirecting to /404

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49698	162.19.137.157	443	6856	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-25 16:57:40 UTC	199	OUT	GET /404 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: t.emobility.energy Connection: Keep-Alive
2025-03-25 16:57:40 UTC	590	IN	HTTP/1.1 404 Not Found Date: Tue, 25 Mar 2025 16:57:40 GMT Server: Apache/2.4.62 (Debian) X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Powered-By: Next.js ETag: "1225-4lR+8o8+z0M1Iq6OMuNgxAtPjT8" Content-Type: text/html; charset=utf-8 Content-Length: 4645 Vary: Accept-Encoding Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Connection: close
2025-03-25 16:57:40 UTC	4645	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 76 69 65 77 70 6f 72 74 2d 66 69 74 3d 63 6f 76 65 72 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 75 6e 64 65 66 69 6e 65 64 20 69 73 20 61 20 66 72 65 65 20 61 6e 64 20 6f 70 65 6e 20 73 6f 75 72 63 65 20 55 52 4c 20 73 68 6f 72 74 65 6e 65 72 20 77 69 74 68 20 63 75 73 74 6f 6d 20 64 6f 6d 61 69 6e 73 20 61 6e Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover"/><meta name="description" content="undefined is a free and open source URL shortener with custom domains an

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49700	13.107.246.72	443	6856	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-25 16:57:53 UTC	226	OUT	GET /rules/excel.exe-Production-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-25 16:57:53 UTC	493	IN	HTTP/1.1 200 OK Date: Tue, 25 Mar 2025 16:57:53 GMT Content-Type: text/plain Content-Length: 1114783 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 24 Mar 2025 13:40:54 GMT ETag: "0x8DD6AD97FEF19EF" x-ms-request-id: 343452ac-a01e-0053-7b2a-9d8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20250325T165753Z-17cccd5449bkk7bshC1EWR4rww0000000e90000000004x4r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-25 16:57:53 UTC	15891	IN	Data Raw: 31 30 30 30 34 32 76 32 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 34 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 55 58 2e 44 65 73 6b 74 6f 70 2e 4f 66 66 69 63 65 54 68 65 6d 65 2e 41 70 70 2e 49 6e 69 74 22 20 41 54 54 3d 22 63 34 33 38 38 63 39 37 37 32 39 37 34 31 33 62 62 30 35 34 62 61 64 31 61 63 66 30 61 64 65 31 2d 63 63 35 38 65 35 33 65 2d 66 35 61 34 2d 34 66 33 37 2d 62 30 64 32 2d 39 61 38 30 37 39 65 33 34 34 32 30 2d 36 38 37 39 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 63 6d 39 79 35 Data Ascii: 100042v2+<?xml version="1.0" encoding="utf-8"?><R Id="100042" V="2" DC="SM" EN="Office.UX.Desktop.OfficeTheme.App.Init" ATT="c4388c977297413bb054bad1acf0ade1-cc58e53e-f5a4-4f37-b0d2-9a8079e34420-6879" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="cm9y5
2025-03-25 16:57:53 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 30 31 31 37 76 30 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 31 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 38 79 6c 6c 66 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 56 20 56 3d 22 43 6c 69 63 6b 22 20 54 3d 22 57 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 Data Ascii: /> </T></R><$!#>100117v0+<?xml version="1.0" encoding="utf-8"?><R Id="100117" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="8yllf" /> </S> <C T="W" I="0" O="false"> <V V="Click" T="W" /> </C> <C T="U32
2025-03-25 16:57:53 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 37 38 31 76 31 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 37 38 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 67 6f 34 74 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 68 6c 76 79 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 49 33 32 Data Ascii: </C> <T> <S T="2" /> <S T="3" /> </T></R><$!#>10781v1+<?xml version="1.0" encoding="utf-8"?><R Id="10781" V="1" DC="SM" T="Subrule" xmlns=""> <S> <UTS T="1" Id="bgo4t" /> <UTS T="2" Id="bhlvy" /> </S> <C T="I32
2025-03-25 16:57:53 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 30 30 30 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: <L> <O T="GT"> <L> <S T="1" F="0" /> </L> <R> <V V="1000" T="U32" /> </R> </O> </L> <R> <O T="LE"> <
2025-03-25 16:57:53 UTC	16384	IN	Data Raw: 20 49 3d 22 32 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 56 69 64 65 6f 43 61 6c 6c 56 69 64 65 6f 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 36 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 33 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 53 61 53 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 34 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 4f 76 65 72 66 6c 6f 77 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 Data Ascii: I="22" O="false" N="FlyoutVideoCallVideo"> <C> <S T="26" /> </C> </C> <C T="U32" I="23" O="false" N="FlyoutSaS"> <C> <S T="27" /> </C> </C> <C T="U32" I="24" O="false" N="FlyoutOverflow"> <C> <S T
2025-03-25 16:57:53 UTC	16384	IN	Data Raw: 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 39 30 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 4e 44 42 2e 55 6e 6b 6e 6f 77 6e 2e 43 6f 72 72 75 70 74 69 6f 6e 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 53 3d 22 31 30 30 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 45 74 77 20 54 3d 22 31 22 20 45 3d 22 33 39 35 22 20 47 3d 22 7b 32 61 64 66 38 65 32 33 2d 30 61 66 39 2d Data Ascii: coding="utf-8"?><R Id="10907" V="0" DC="SM" EN="Office.Outlook.Desktop.NDB.Unknown.Corruption" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" S="100" DCa="PSU" xmlns=""> <S> <Etw T="1" E="395" G="{2adf8e23-0af9-
2025-03-25 16:57:53 UTC	16384	IN	Data Raw: 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 33 22 20 49 64 3d 22 62 70 66 79 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 34 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 50 68 6f 74 6f 53 69 7a 65 49 6e 42 79 74 65 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 55 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 Data Ascii: "TelemetryShutdown" /> <UTS T="3" Id="bpfy1" /> <F T="4"> <O T="GT"> <L> <S T="3" F="PhotoSizeInBytes" /> </L> <R> <V V="0" T="U64" /> </R> </O> </F> </S> <C T="U
2025-03-25 16:57:53 UTC	16384	IN	Data Raw: 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 65 76 65 6e 74 49 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 33 35 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 74 63 69 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <L> <S T="4" F="eventId" /> </L> <R> <V V="135" T="I32" /> </R> </O> </F> <F T="7"> <O T="EQ"> <L> <S T="5" F="tcid" /> </L> <R> <V
2025-03-25 16:57:53 UTC	16384	IN	Data Raw: 0d 0a 20 20 20 20 3c 46 20 54 3d 22 31 30 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 46 69 6c 65 50 72 6f 74 65 63 74 69 6f 6e 53 74 61 74 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 35 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 4f 66 54 68 72 6f 77 6e 45 78 63 65 70 74 69 6f 6e 22 3e 0d Data Ascii: <F T="10"> <O T="EQ"> <L> <S T="3" F="FileProtectionState" /> </L> <R> <V V="5" T="U32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="CountOfThrownException">
2025-03-25 16:57:54 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 72 65 73 75 6c 74 73 5f 49 73 4e 75 6c 6c 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 Data Ascii: <S T="5" F="results_IsNull" /> </L> <R> <V V="false" T="B" /> </R> </O> </L> <R> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49702	13.107.246.72	443	1920	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-25 16:58:07 UTC	226	OUT	GET /rules/excel.exe-Production-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-25 16:58:07 UTC	472	IN	HTTP/1.1 200 OK Date: Tue, 25 Mar 2025 16:58:07 GMT Content-Type: text/plain Content-Length: 1114783 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 24 Mar 2025 13:40:54 GMT ETag: "0x8DD6AD97FEF19EF" x-ms-request-id: 343452ac-a01e-0053-7b2a-9d8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20250325T165807Z-17cccd5449blprb2hC1EWRvwmn0000000eag000000001gws x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-25 16:58:07 UTC	15912	IN	Data Raw: 31 30 30 30 34 32 76 32 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 34 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 55 58 2e 44 65 73 6b 74 6f 70 2e 4f 66 66 69 63 65 54 68 65 6d 65 2e 41 70 70 2e 49 6e 69 74 22 20 41 54 54 3d 22 63 34 33 38 38 63 39 37 37 32 39 37 34 31 33 62 62 30 35 34 62 61 64 31 61 63 66 30 61 64 65 31 2d 63 63 35 38 65 35 33 65 2d 66 35 61 34 2d 34 66 33 37 2d 62 30 64 32 2d 39 61 38 30 37 39 65 33 34 34 32 30 2d 36 38 37 39 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 63 6d 39 79 35 Data Ascii: 100042v2+<?xml version="1.0" encoding="utf-8"?><R Id="100042" V="2" DC="SM" EN="Office.UX.Desktop.OfficeTheme.App.Init" ATT="c4388c977297413bb054bad1acf0ade1-cc58e53e-f5a4-4f37-b0d2-9a8079e34420-6879" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="cm9y5
2025-03-25 16:58:07 UTC	16384	IN	Data Raw: 21 23 3e 31 30 30 31 31 37 76 30 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 31 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 38 79 6c 6c 66 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 56 20 56 3d 22 43 6c 69 63 6b 22 20 54 3d 22 57 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 Data Ascii: !#>100117v0+<?xml version="1.0" encoding="utf-8"?><R Id="100117" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="8yllf" /> </S> <C T="W" I="0" O="false"> <V V="Click" T="W" /> </C> <C T="U32" I="1" O="false">
2025-03-25 16:58:07 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 37 38 31 76 31 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 37 38 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 67 6f 34 74 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 68 6c 76 79 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 49 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 Data Ascii: <S T="2" /> <S T="3" /> </T></R><$!#>10781v1+<?xml version="1.0" encoding="utf-8"?><R Id="10781" V="1" DC="SM" T="Subrule" xmlns=""> <S> <UTS T="1" Id="bgo4t" /> <UTS T="2" Id="bhlvy" /> </S> <C T="I32" I="0" O="false">
2025-03-25 16:58:07 UTC	16384	IN	Data Raw: 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 30 30 30 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 Data Ascii: <O T="GT"> <L> <S T="1" F="0" /> </L> <R> <V V="1000" T="U32" /> </R> </O> </L> <R> <O T="LE"> <L> <S
2025-03-25 16:58:07 UTC	16384	IN	Data Raw: 46 6c 79 6f 75 74 56 69 64 65 6f 43 61 6c 6c 56 69 64 65 6f 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 36 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 33 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 53 61 53 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 34 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 4f 76 65 72 66 6c 6f 77 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: FlyoutVideoCallVideo"> <C> <S T="26" /> </C> </C> <C T="U32" I="23" O="false" N="FlyoutSaS"> <C> <S T="27" /> </C> </C> <C T="U32" I="24" O="false" N="FlyoutOverflow"> <C> <S T="28" /> </C>
2025-03-25 16:58:07 UTC	16384	IN	Data Raw: 49 64 3d 22 31 30 39 30 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 4e 44 42 2e 55 6e 6b 6e 6f 77 6e 2e 43 6f 72 72 75 70 74 69 6f 6e 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 53 3d 22 31 30 30 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 45 74 77 20 54 3d 22 31 22 20 45 3d 22 33 39 35 22 20 47 3d 22 7b 32 61 64 66 38 65 32 33 2d 30 61 66 39 2d 34 33 63 39 2d 62 61 34 63 2d 39 35 32 65 65 31 33 30 35 34 30 Data Ascii: Id="10907" V="0" DC="SM" EN="Office.Outlook.Desktop.NDB.Unknown.Corruption" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" S="100" DCa="PSU" xmlns=""> <S> <Etw T="1" E="395" G="{2adf8e23-0af9-43c9-ba4c-952ee130540
2025-03-25 16:58:08 UTC	16384	IN	Data Raw: 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 33 22 20 49 64 3d 22 62 70 66 79 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 34 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 50 68 6f 74 6f 53 69 7a 65 49 6e 42 79 74 65 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 55 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d Data Ascii: > <UTS T="3" Id="bpfy1" /> <F T="4"> <O T="GT"> <L> <S T="3" F="PhotoSizeInBytes" /> </L> <R> <V V="0" T="U64" /> </R> </O> </F> </S> <C T="U64" I="0" O="true" N=
2025-03-25 16:58:08 UTC	16384	IN	Data Raw: 22 34 22 20 46 3d 22 65 76 65 6e 74 49 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 33 35 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 74 63 69 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 37 38 35 32 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d Data Ascii: "4" F="eventId" /> </L> <R> <V V="135" T="I32" /> </R> </O> </F> <F T="7"> <O T="EQ"> <L> <S T="5" F="tcid" /> </L> <R> <V V="27852" T="I32" />
2025-03-25 16:58:08 UTC	16384	IN	Data Raw: 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 46 69 6c 65 50 72 6f 74 65 63 74 69 6f 6e 53 74 61 74 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 35 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 4f 66 54 68 72 6f 77 6e 45 78 63 65 70 74 69 6f 6e 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d Data Ascii: <O T="EQ"> <L> <S T="3" F="FileProtectionState" /> </L> <R> <V V="5" T="U32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="CountOfThrownException"> <C> <S T=
2025-03-25 16:58:08 UTC	16384	IN	Data Raw: 3d 22 72 65 73 75 6c 74 73 5f 49 73 4e 75 6c 6c 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 Data Ascii: ="results_IsNull" /> </L> <R> <V V="false" T="B" /> </R> </O> </L> <R> <O T="EQ"> <L> <S T="5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49703	13.107.246.72	443	6856	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-25 16:58:08 UTC	214	OUT	GET /rules/rule120607v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-25 16:58:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 25 Mar 2025 16:58:08 GMT Content-Type: text/xml Content-Length: 204 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6C8527A" x-ms-request-id: fe09a350-901e-0048-3adf-9cb800000000 x-ms-version: 2018-03-28 x-azure-ref: 20250325T165808Z-17cccd5449b89qrjhC1EWR22980000000e3g00000000n9ay x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-25 16:58:08 UTC	204	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 37 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 45 52 3d 22 31 32 30 36 30 33 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 62 70 7a 73 22 20 41 3d 22 39 34 30 74 63 20 39 78 35 6a 73 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120607" V="1" DC="SM" T="Subrule" ER="120603" xmlns=""> <S> <UTS T="1" Id="bbpzs" A="940tc 9x5js" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49704	13.107.246.72	443	6856	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2025-03-25 16:58:08 UTC	214	OUT	GET /rules/rule120603v8s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-25 16:58:08 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 25 Mar 2025 16:58:08 GMT Content-Type: text/xml Content-Length: 2128 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA41F3C62" x-ms-request-id: 0fe88ecf-101e-007a-32da-9b047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20250325T165808Z-17cccd5449bzd7mthC1EWRrdxw0000000e6000000000cstf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-25 16:58:08 UTC	2128	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 33 22 20 56 3d 22 38 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 64 64 69 74 69 6f 6e 61 6c 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 45 3d 22 66 61 6c 73 65 22 20 44 4c 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120603" V="8" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAdditional" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" E="false" DL=

Statistics

CPU Usage

• EXCEL.EXE
• splwow64.exe
• EXCEL.EXE

Click to jump to process

Memory Usage

• EXCEL.EXE
• splwow64.exe
• EXCEL.EXE

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Click to jump to process

Target ID:	0
Start time:	12:56:43
Start date:	25/03/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0x9c0000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:57:47
Start date:	25/03/2025
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 12288
Imagebase:	0x7ff620b60000
File size:	163'840 bytes
MD5 hash:	77DE7761B037061C7C112FD3C5B91E73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	12:58:01
Start date:	25/03/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\PURCHASE ORDER 5172025.xla.xlsx"
Imagebase:	0x9c0000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PURCHASE ORDER 5172025.xla.xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Temp\2A88C80A.tmp

C:\Users\user\AppData\Local\Temp\~DFEDF1E296F45941FF.TMP

C:\Users\user\Desktop\~$PURCHASE ORDER 5172025.xla.xlsx

Static File Info

General

File Icon

Static OLE Info

General

OLE File "PURCHASE ORDER 5172025.xla.xlsx"

Indicators

Summary

Document Summary

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General

VBA Code

VBA File Name: Sheet2.cls, Stream Size: 977

General

VBA Code

VBA File Name: Sheet3.cls, Stream Size: 977

General

VBA Code

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General

VBA Code

Streams

Windows Analysis Report
PURCHASE ORDER 5172025.xla.xlsx