Edit tour

Windows Analysis Report
New order 2025.msg

Overview

General Information

Sample name:	New order 2025.msg
Analysis ID:	1585316
MD5:	090fa1528dc91da7a535993ca87e0a86
SHA1:	db19834414aa418e7ed18c4b7bd15dda358d937d
SHA256:	45c96d5abea74039cdcc0c3cd8210068c214551ccc8b330a37c00ee9ab2181fd
Infos:

Detection

PureLog Stealer, Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AntiVM3

Yara detected PureLog Stealer

Yara detected Snake Keylogger

AI detected potential phishing Email

Drops PE files with a suspicious file extension

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Office Autorun Keys Modification

Sigma detected: Outlook Security Settings Updated - Registry

Sigma detected: SCR File Write Event

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Suspicious Screensaver Binary File Creation

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 3528 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\New order 2025.msg" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 5612 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B65E71DD-699D-4A31-947E-78B44A854717" "CB8A9D4D-D8A9-4176-AD4D-6D8604D2A761" "3528" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

OpenWith.exe (PID: 5252 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: E4A834784FA08C17D47A1E72429C5109)

7zFM.exe (PID: 6700 cmdline: "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\user\Desktop\Order_List.rar" MD5: 30AC0B832D75598FB3EC37B6F2A8C86A)

Order_List.scr (PID: 5400 cmdline: "C:\Users\user\Desktop\Order_List.scr" /S MD5: 78A62A23291A3C7907E947BC9F270E09)

schtasks.exe (PID: 3580 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp180E.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Order_List.scr (PID: 6864 cmdline: "C:\Users\user\Desktop\Order_List.scr" MD5: 78A62A23291A3C7907E947BC9F270E09)

Order_List.scr (PID: 2680 cmdline: C:\Users\user\Desktop\Order_List.scr /p 197754 MD5: 78A62A23291A3C7907E947BC9F270E09)

schtasks.exe (PID: 1924 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp38E5.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Order_List.scr (PID: 1940 cmdline: "C:\Users\user\Desktop\Order_List.scr" MD5: 78A62A23291A3C7907E947BC9F270E09)

Order_List.scr (PID: 2220 cmdline: "C:\Users\user\Desktop\Order_List.scr" MD5: 78A62A23291A3C7907E947BC9F270E09)

schtasks.exe (PID: 3608 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp60CF.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 2872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Order_List.scr (PID: 3184 cmdline: "C:\Users\user\Desktop\Order_List.scr" MD5: 78A62A23291A3C7907E947BC9F270E09)

Order_List.scr (PID: 1248 cmdline: "C:\Users\user\Desktop\Order_List.scr" /S MD5: 78A62A23291A3C7907E947BC9F270E09)

schtasks.exe (PID: 3936 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp74B5.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Order_List.scr (PID: 4404 cmdline: "C:\Users\user\Desktop\Order_List.scr" MD5: 78A62A23291A3C7907E947BC9F270E09)

Order_List.scr (PID: 1140 cmdline: C:\Users\user\Desktop\Order_List.scr /p 197890 MD5: 78A62A23291A3C7907E947BC9F270E09)

schtasks.exe (PID: 4128 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp95CA.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Order_List.scr (PID: 6328 cmdline: "C:\Users\user\Desktop\Order_List.scr" MD5: 78A62A23291A3C7907E947BC9F270E09)

Order_List.scr (PID: 6608 cmdline: "C:\Users\user\Desktop\Order_List.scr" MD5: 78A62A23291A3C7907E947BC9F270E09)

ssText3d.scr (PID: 6856 cmdline: C:\Windows\system32\ssText3d.scr /p 197890 MD5: 7631304F6B2B9DDCA51CE680A491A538)

ssText3d.scr (PID: 5252 cmdline: C:\Windows\system32\ssText3d.scr /p 197890 MD5: 7631304F6B2B9DDCA51CE680A491A538)

OpenWith.exe (PID: 1072 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: E4A834784FA08C17D47A1E72429C5109)

7zFM.exe (PID: 5348 cmdline: "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\user\Desktop\Order_List.rar" MD5: 30AC0B832D75598FB3EC37B6F2A8C86A)

notepad.exe (PID: 4636 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Local\Temp\7zO4E440DCC\version.txt MD5: 27F71B12CB585541885A31BE22F61C83)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7888110857:AAH_lE30nomQfyzYUPPXbGWeGI9ffBUijsQ/sendMessage?chat_id=7222025033", "Token": "7888110857:AAH_lE30nomQfyzYUPPXbGWeGI9ffBUijsQ", "Chat_id": "7222025033", "Version": "5.1"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000019.00000002.2462283908.000000000041B000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000019.00000002.2462283908.000000000041B000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x894:$x1: $%SMTPDV$ 0x83c:$x3: %FTPDV$ 0x860:$m2: Clipboard Logs ID 0xa9e:$m2: Screenshot Logs ID 0xbae:$m2: keystroke Logs ID 0xe88:$m3: SnakePW 0xa76:$m4: \SnakeKeylogger\
0000001D.00000002.2462387893.000000000041A000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000029.00000002.2497138207.0000000002F71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000011.00000002.1783811478.0000000004489000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.1783811478.0000000004489000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000011.00000002.1783811478.0000000004489000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1553c:$a1: get_encryptedPassword 0x35f5c:$a1: get_encryptedPassword 0x5677c:$a1: get_encryptedPassword 0x15828:$a2: get_encryptedUsername 0x36248:$a2: get_encryptedUsername 0x56a68:$a2: get_encryptedUsername 0x15348:$a3: get_timePasswordChanged 0x35d68:$a3: get_timePasswordChanged 0x56588:$a3: get_timePasswordChanged 0x15443:$a4: get_passwordField 0x35e63:$a4: get_passwordField 0x56683:$a4: get_passwordField 0x15552:$a5: set_encryptedPassword 0x35f72:$a5: set_encryptedPassword 0x56792:$a5: set_encryptedPassword 0x16c5f:$a7: get_logins 0x3767f:$a7: get_logins 0x57e9f:$a7: get_logins 0x16bc2:$a10: KeyLoggerEventArgs 0x375e2:$a10: KeyLoggerEventArgs 0x57e02:$a10: KeyLoggerEventArgs
00000011.00000002.1783811478.0000000004489000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1a50c:$x1: $%SMTPDV$ 0x3af2c:$x1: $%SMTPDV$ 0x5b74c:$x1: $%SMTPDV$ 0x18ef0:$x2: $#TheHashHere%& 0x39910:$x2: $#TheHashHere%& 0x5a130:$x2: $#TheHashHere%& 0x1a4b4:$x3: %FTPDV$ 0x3aed4:$x3: %FTPDV$ 0x5b6f4:$x3: %FTPDV$ 0x18e90:$x4: $%TelegramDv$ 0x398b0:$x4: $%TelegramDv$ 0x5a0d0:$x4: $%TelegramDv$ 0x1682d:$x5: KeyLoggerEventArgs 0x16bc2:$x5: KeyLoggerEventArgs 0x3724d:$x5: KeyLoggerEventArgs 0x375e2:$x5: KeyLoggerEventArgs 0x57a6d:$x5: KeyLoggerEventArgs 0x57e02:$x5: KeyLoggerEventArgs 0x1a4d8:$m2: Clipboard Logs ID 0x1a716:$m2: Screenshot Logs ID 0x1a826:$m2: keystroke Logs ID
00000014.00000002.2491373165.0000000002F67000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000001D.00000002.2500727360.0000000003428000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000029.00000002.2497138207.0000000003129000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000019.00000002.2496690861.0000000002B48000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000011.00000002.1787660778.00000000078D0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000001D.00000002.2500727360.0000000003271000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000019.00000002.2496690861.0000000002991000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000021.00000002.2499992401.0000000003679000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000014.00000002.2491373165.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000021.00000002.2499992401.00000000034C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Order_List.scr PID: 5400	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Order_List.scr PID: 5400	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Order_List.scr PID: 5400	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Order_List.scr PID: 5400	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x59ac:$a1: get_encryptedPassword 0x5c8e:$a2: get_encryptedUsername 0x57c2:$a3: get_timePasswordChanged 0x58bd:$a4: get_passwordField 0x59c2:$a5: set_encryptedPassword 0x7ea2:$a7: get_logins 0x7e05:$a10: KeyLoggerEventArgs 0x7a70:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Order_List.scr PID: 5400	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x7a70:$x5: KeyLoggerEventArgs 0x7e05:$x5: KeyLoggerEventArgs 0x83d2:$x5: KeyLoggerEventArgs 0x8733:$x5: KeyLoggerEventArgs 0xa033:$m2: Clipboard Logs ID 0xa139:$m2: Screenshot Logs ID 0xa18f:$m2: keystroke Logs ID 0xa2c4:$m3: SnakePW 0xa125:$m4: \SnakeKeylogger\
Process Memory Space: Order_List.scr PID: 6864	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Order_List.scr PID: 6864	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Order_List.scr PID: 1940	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Order_List.scr PID: 1940	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Order_List.scr PID: 1940	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x221c:$m2: Clipboard Logs ID 0x2322:$m2: Screenshot Logs ID 0x2378:$m2: keystroke Logs ID 0x24ad:$m3: SnakePW 0x230e:$m4: \SnakeKeylogger\
Process Memory Space: Order_List.scr PID: 3184	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Order_List.scr PID: 3184	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Order_List.scr PID: 4404	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Order_List.scr PID: 4404	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Order_List.scr PID: 6608	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Order_List.scr PID: 6608	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Click to see the 29 entries

Sigma Signatures

System Summary

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 3528, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Sigma detected: Outlook Security Settings Updated - Registry

Source: Registry Key set

Author: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\BW66IBE9\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 3528, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Program Files\7-Zip\7zFM.exe, ProcessId: 6700, TargetFilename: C:\Users\user\AppData\Local\Temp\7zEC2A483AB\Order_List.scr

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp180E.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp180E.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Order_List.scr" /S, ParentImage: C:\Users\user\Desktop\Order_List.scr, ParentProcessId: 5400, ParentProcessName: Order_List.scr, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp180E.tmp", ProcessId: 3580, ProcessName: schtasks.exe

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Program Files\7-Zip\7zFM.exe, ProcessId: 6700, TargetFilename: C:\Users\user\AppData\Local\Temp\7zEC2A483AB\Order_List.scr

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp180E.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp180E.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Order_List.scr" /S, ParentImage: C:\Users\user\Desktop\Order_List.scr, ParentProcessId: 5400, ParentProcessName: Order_List.scr, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp180E.tmp", ProcessId: 3580, ProcessName: schtasks.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T14:02:00.021731+0100	2803305	3	Unknown Traffic	192.168.2.18	49709	188.114.97.3	443	TCP
2025-01-07T14:02:07.605172+0100	2803305	3	Unknown Traffic	192.168.2.18	49723	188.114.97.3	443	TCP
2025-01-07T14:02:18.129918+0100	2803305	3	Unknown Traffic	192.168.2.18	49739	188.114.97.3	443	TCP
2025-01-07T14:02:22.858665+0100	2803305	3	Unknown Traffic	192.168.2.18	49749	188.114.97.3	443	TCP
2025-01-07T14:02:31.423685+0100	2803305	3	Unknown Traffic	192.168.2.18	49769	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T14:01:58.508583+0100	2803274	2	Potentially Bad Traffic	192.168.2.18	49707	193.122.6.168	80	TCP
2025-01-07T14:01:59.448592+0100	2803274	2	Potentially Bad Traffic	192.168.2.18	49707	193.122.6.168	80	TCP
2025-01-07T14:02:00.729597+0100	2803274	2	Potentially Bad Traffic	192.168.2.18	49710	193.122.6.168	80	TCP
2025-01-07T14:02:06.149601+0100	2803274	2	Potentially Bad Traffic	192.168.2.18	49719	193.122.6.168	80	TCP
2025-01-07T14:02:07.028602+0100	2803274	2	Potentially Bad Traffic	192.168.2.18	49719	193.122.6.168	80	TCP
2025-01-07T14:02:08.334906+0100	2803274	2	Potentially Bad Traffic	192.168.2.18	49725	193.122.6.168	80	TCP
2025-01-07T14:02:09.607599+0100	2803274	2	Potentially Bad Traffic	192.168.2.18	49727	193.122.6.168	80	TCP
2025-01-07T14:02:16.582607+0100	2803274	2	Potentially Bad Traffic	192.168.2.18	49737	193.122.6.168	80	TCP
2025-01-07T14:02:17.556613+0100	2803274	2	Potentially Bad Traffic	192.168.2.18	49737	193.122.6.168	80	TCP
2025-01-07T14:02:18.833624+0100	2803274	2	Potentially Bad Traffic	192.168.2.18	49740	193.122.6.168	80	TCP
2025-01-07T14:02:21.352622+0100	2803274	2	Potentially Bad Traffic	192.168.2.18	49744	193.122.6.168	80	TCP
2025-01-07T14:02:22.294022+0100	2803274	2	Potentially Bad Traffic	192.168.2.18	49744	193.122.6.168	80	TCP
2025-01-07T14:02:23.392614+0100	2803274	2	Potentially Bad Traffic	192.168.2.18	49751	193.122.130.0	80	TCP
2025-01-07T14:02:30.118578+0100	2803274	2	Potentially Bad Traffic	192.168.2.18	49766	193.122.130.0	80	TCP
2025-01-07T14:02:30.884588+0100	2803274	2	Potentially Bad Traffic	192.168.2.18	49766	193.122.130.0	80	TCP
2025-01-07T14:02:32.022292+0100	2803274	2	Potentially Bad Traffic	192.168.2.18	49770	193.122.130.0	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000029.00000002.2497138207.0000000002F71000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7888110857:AAH_lE30nomQfyzYUPPXbGWeGI9ffBUijsQ/sendMessage?chat_id=7222025033", "Token": "7888110857:AAH_lE30nomQfyzYUPPXbGWeGI9ffBUijsQ", "Chat_id": "7222025033", "Version": "5.1"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\7zEC2A483AB\Order_List.scr	ReversingLabs: Detection: 21%
Source: C:\Users\user\AppData\Roaming\FTlLqTRGrXZr.exe	ReversingLabs: Detection: 21%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\7zEC2A483AB\Order_List.scr	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\FTlLqTRGrXZr.exe	Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Phishing

AI detected potential phishing Email

Source: Email

Joe Sandbox AI: Detected potential phishing email: Sender email domain (creative-cork.com) doesn't match the claimed company (Egyptalum Ltd). Suspicious attachment with .rar format, commonly used in phishing to hide malware. Generic business inquiry to government email (buildingpermits) that doesn't match the context

Source: Email

Classification: Lure-Based Attack

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49708 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49721 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 192.168.2.18:49730 -> 188.114.97.3:443 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49738 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49746 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49768 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 192.168.2.18:49771 -> 188.114.97.3:443 version: TLS 1.0

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org
Source: unknown	DNS query: name: checkip.dyndns.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.18:49710 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.18:49727 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.18:49770 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.18:49766 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.18:49744 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.18:49725 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.18:49707 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.18:49751 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.18:49719 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.18:49740 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.18:49737 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.18:49749 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.18:49739 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.18:49709 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.18:49723 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.18:49769 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49708 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49721 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 192.168.2.18:49730 -> 188.114.97.3:443 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49738 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49746 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49768 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 192.168.2.18:49771 -> 188.114.97.3:443 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: Order_List.scr, 00000014.00000002.2491373165.0000000002E62000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F1E000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002EF5000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F4B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F02000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AD6000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B3A000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AFE000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B2C000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AE3000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033B6000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033C3000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.000000000340C000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.0000000003323000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033D1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003621000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003606000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.000000000362F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: Order_List.scr, 00000014.00000002.2491373165.0000000002F2B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002E62000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002EA5000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F1E000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002EF5000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F4B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002E56000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F02000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AD6000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002A37000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B0C000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B3A000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002A86000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AFE000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B2C000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AE3000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.0000000003366000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.0000000003317000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Order_List.scr, 00000014.00000002.2491373165.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002991000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.0000000003271000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000029.00000002.2497138207.0000000002F71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Order_List.scr, 00000011.00000002.1783811478.0000000004489000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2462283908.000000000041B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: Order_List.scr, 00000029.00000002.2497138207.00000000030D2000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000029.00000002.2497138207.0000000003011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgx
Source: 7zFM.exe, 0000000F.00000003.1516854428.000001C16EE80000.00000004.00000800.00020000.00000000.sdmp, 7zFM.exe, 0000000F.00000003.1539112335.000001C170A3E000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000000F.00000003.1538885914.000001C16EE81000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000000F.00000003.1630731860.000001C170A3E000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000002E.00000002.2488632713.0000019AAA4DB000.00000004.00000020.00020000.00000000.sdmp, Order_List.scr.15.dr, FTlLqTRGrXZr.exe.17.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: 7zFM.exe, 0000000F.00000003.1516854428.000001C16EE80000.00000004.00000800.00020000.00000000.sdmp, 7zFM.exe, 0000000F.00000003.1539112335.000001C170A3E000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000000F.00000003.1538885914.000001C16EE81000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000000F.00000003.1630731860.000001C170A3E000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000000F.00000003.1539369564.000001C170AEB000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000002E.00000002.2488632713.0000019AAA4DB000.00000004.00000020.00020000.00000000.sdmp, Order_List.scr.15.dr, FTlLqTRGrXZr.exe.17.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: 7zFM.exe, 0000000F.00000003.1516854428.000001C16EE80000.00000004.00000800.00020000.00000000.sdmp, 7zFM.exe, 0000000F.00000003.1539112335.000001C170A3E000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000000F.00000003.1538885914.000001C16EE81000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000000F.00000003.1630731860.000001C170A3E000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000000F.00000003.1539369564.000001C170AEB000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000002E.00000002.2488632713.0000019AAA4DB000.00000004.00000020.00020000.00000000.sdmp, Order_List.scr.15.dr, FTlLqTRGrXZr.exe.17.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: Order_List.scr, 00000014.00000002.2491373165.0000000002E7A000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F1E000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002EF5000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F4B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F02000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AD6000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B3A000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002A5B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AFE000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B2C000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AE3000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033B6000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033C3000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.000000000340C000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.000000000333B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033D1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003621000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003606000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.000000000358C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: Order_List.scr, 00000011.00000002.1781812977.00000000034C8000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000016.00000002.1866475138.000000000333B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002991000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001A.00000002.1971516254.00000000029FB000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.0000000003271000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001E.00000002.2021094284.000000000329B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000025.00000002.2105744205.0000000002A3B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000029.00000002.2497138207.0000000002F71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Order_List.scr, 00000019.00000002.2496690861.0000000002AD6000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B3A000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002A86000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AFE000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B2C000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AE3000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.0000000003366000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033B6000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033C3000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.000000000340C000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.0000000003323000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033D1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003621000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003606000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.000000000362F000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003574000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.000000000366B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.00000000035B6000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Order_List.scr, 00000011.00000002.1783811478.0000000004489000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002E62000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2462283908.000000000041B000.00000040.00000400.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.0000000003323000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003574000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000029.00000002.2497138207.0000000003024000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Order_List.scr, 00000029.00000002.2497138207.00000000030D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: Order_List.scr, 00000014.00000002.2491373165.0000000002EA5000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F1E000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002EF5000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F4B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F02000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AD6000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B3A000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002A86000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AFE000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B2C000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AE3000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.0000000003366000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033B6000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033C3000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.000000000340C000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033D1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003621000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003606000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.000000000362F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: Order_List.scr, 00000014.00000002.2491373165.0000000002E62000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.0000000003323000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003574000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000029.00000002.2497138207.0000000003024000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000029.00000002.2497138207.000000000311B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000029.00000002.2497138207.00000000030DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189x
Source: 7zFM.exe, 0000000F.00000003.1516854428.000001C16EE80000.00000004.00000800.00020000.00000000.sdmp, 7zFM.exe, 0000000F.00000003.1539112335.000001C170A3E000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000000F.00000003.1538885914.000001C16EE81000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000000F.00000003.1630731860.000001C170A3E000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000000F.00000003.1630648461.000001C16EF2C000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000000F.00000003.1539369564.000001C170AEB000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000002E.00000002.2488632713.0000019AAA4DB000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000002E.00000003.2346795878.0000019AAB84C000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000002E.00000002.2496806627.0000019AAB84C000.00000004.00000020.00020000.00000000.sdmp, Order_List.scr.15.dr, FTlLqTRGrXZr.exe.17.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: C:\Program Files\7-Zip\7zFM.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000019.00000002.2462283908.000000000041B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000011.00000002.1783811478.0000000004489000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000011.00000002.1783811478.0000000004489000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: Order_List.scr PID: 5400, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Order_List.scr PID: 5400, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: Order_List.scr PID: 1940, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: 00000019.00000002.2462283908.000000000041B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000011.00000002.1783811478.0000000004489000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000011.00000002.1783811478.0000000004489000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: Order_List.scr PID: 5400, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Order_List.scr PID: 5400, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: Order_List.scr PID: 1940, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: Order_List.scr.15.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: FTlLqTRGrXZr.exe.17.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winMSG@43/14@3/3

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Users\user\Desktop\Order_List.scr	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5056:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5368:120:WilError_03
Source: C:\Users\user\Desktop\Order_List.scr	Mutant created: \Sessions\1\BaseNamedObjects\laoeILYAWbYsBdVIYEa
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3632:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2872:120:WilError_03
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5252:120:WilError_03
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1072:120:WilError_03

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250107T0801000560-3528.etl

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Order_List.scr, 00000014.00000002.2491373165.0000000003011000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2520951524.0000000003E2B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000003005000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002FBF000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002FCF000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002FDD000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002BE5000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002BBE000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002BAF000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\New order 2025.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B65E71DD-699D-4A31-947E-78B44A854717" "CB8A9D4D-D8A9-4176-AD4D-6D8604D2A761" "3528" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: unknown	Process created: C:\Program Files\7-Zip\7zFM.exe "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\user\Desktop\Order_List.rar"
Source: unknown	Process created: C:\Users\user\Desktop\Order_List.scr "C:\Users\user\Desktop\Order_List.scr" /S
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp180E.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Users\user\Desktop\Order_List.scr "C:\Users\user\Desktop\Order_List.scr"
Source: unknown	Process created: C:\Users\user\Desktop\Order_List.scr C:\Users\user\Desktop\Order_List.scr /p 197754
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp38E5.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Users\user\Desktop\Order_List.scr "C:\Users\user\Desktop\Order_List.scr"
Source: unknown	Process created: C:\Users\user\Desktop\Order_List.scr "C:\Users\user\Desktop\Order_List.scr"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp60CF.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Users\user\Desktop\Order_List.scr "C:\Users\user\Desktop\Order_List.scr"
Source: unknown	Process created: C:\Users\user\Desktop\Order_List.scr "C:\Users\user\Desktop\Order_List.scr" /S
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp74B5.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Users\user\Desktop\Order_List.scr "C:\Users\user\Desktop\Order_List.scr"
Source: unknown	Process created: C:\Users\user\Desktop\Order_List.scr C:\Users\user\Desktop\Order_List.scr /p 197890
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp95CA.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Users\user\Desktop\Order_List.scr "C:\Users\user\Desktop\Order_List.scr"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Users\user\Desktop\Order_List.scr "C:\Users\user\Desktop\Order_List.scr"
Source: unknown	Process created: C:\Windows\System32\ssText3d.scr C:\Windows\system32\ssText3d.scr /p 197890
Source: unknown	Process created: C:\Windows\System32\ssText3d.scr C:\Windows\system32\ssText3d.scr /p 197890
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: unknown	Process created: C:\Program Files\7-Zip\7zFM.exe "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\user\Desktop\Order_List.rar"
Source: C:\Program Files\7-Zip\7zFM.exe	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Local\Temp\7zO4E440DCC\version.txt
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B65E71DD-699D-4A31-947E-78B44A854717" "CB8A9D4D-D8A9-4176-AD4D-6D8604D2A761" "3528" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp180E.tmp"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Users\user\Desktop\Order_List.scr "C:\Users\user\Desktop\Order_List.scr"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp38E5.tmp"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Users\user\Desktop\Order_List.scr "C:\Users\user\Desktop\Order_List.scr"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp60CF.tmp"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Users\user\Desktop\Order_List.scr "C:\Users\user\Desktop\Order_List.scr"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp74B5.tmp"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Users\user\Desktop\Order_List.scr "C:\Users\user\Desktop\Order_List.scr"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp95CA.tmp"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Users\user\Desktop\Order_List.scr "C:\Users\user\Desktop\Order_List.scr"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Users\user\Desktop\Order_List.scr "C:\Users\user\Desktop\Order_List.scr"
Source: C:\Program Files\7-Zip\7zFM.exe	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Local\Temp\7zO4E440DCC\version.txt

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: version.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rasapi32.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rasman.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rtutils.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: winhttp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dnsapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: winnsi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rasadhlp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: secur32.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: schannel.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ntasn1.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ncrypt.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dpapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: version.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dwrite.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: windowscodecs.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: amsi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: edputil.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: appresolver.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: bcp47langs.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: slc.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: sppc.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: version.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rasapi32.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rasman.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rtutils.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: winhttp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dnsapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: winnsi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rasadhlp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: secur32.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: schannel.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ntasn1.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ncrypt.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dpapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: version.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dwrite.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: windowscodecs.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: amsi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: edputil.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: appresolver.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: bcp47langs.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: slc.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: sppc.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: version.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rasapi32.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rasman.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rtutils.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: winhttp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dnsapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: winnsi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rasadhlp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: secur32.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: schannel.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ntasn1.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ncrypt.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dpapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: version.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dwrite.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: windowscodecs.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: amsi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: edputil.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: appresolver.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: bcp47langs.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: slc.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: sppc.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: version.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rasapi32.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rasman.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rtutils.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: winhttp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dnsapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: winnsi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rasadhlp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: secur32.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: schannel.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ntasn1.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ncrypt.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dpapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: version.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dwrite.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: windowscodecs.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: amsi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: edputil.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: appresolver.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: bcp47langs.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: slc.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: sppc.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: version.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rasapi32.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rasman.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rtutils.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: winhttp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dnsapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: winnsi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: rasadhlp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: secur32.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: schannel.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ntasn1.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ncrypt.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\Order_List.scr	Section loaded: dpapi.dll
Source: C:\Windows\System32\ssText3d.scr	Section loaded: winbrand.dll
Source: C:\Windows\System32\ssText3d.scr	Section loaded: d3d9.dll
Source: C:\Windows\System32\ssText3d.scr	Section loaded: glu32.dll
Source: C:\Windows\System32\ssText3d.scr	Section loaded: winmm.dll
Source: C:\Windows\System32\ssText3d.scr	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\ssText3d.scr	Section loaded: dwmapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File opened: C:\Windows\SysWOW64\MsftEdit.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window detected: Number of UI elements: 16

Source: C:\Users\user\Desktop\Order_List.scr

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: Order_List.scr.15.dr	Static PE information: section name: .text entropy: 7.446253940033166
Source: FTlLqTRGrXZr.exe.17.dr	Static PE information: section name: .text entropy: 7.446253940033166

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Program Files\7-Zip\7zFM.exe

File created: C:\Users\user\AppData\Local\Temp\7zEC2A483AB\Order_List.scr

Jump to dropped file

Source: C:\Users\user\Desktop\Order_List.scr	File created: C:\Users\user\AppData\Roaming\FTlLqTRGrXZr.exe			Jump to dropped file
Source: C:\Program Files\7-Zip\7zFM.exe	File created: C:\Users\user\AppData\Local\Temp\7zEC2A483AB\Order_List.scr			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Order_List.scr

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp180E.tmp"

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Order_List.scr	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Order_List.scr PID: 5400, type: MEMORYSTR

Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 17E0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 3480000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 5480000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: C6B0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 8150000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 8430000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 13C0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 2DB0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 2CF0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 1900000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 32F0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 3220000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 7BF0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 8BF0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: BD70000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 8D90000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: F10000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 2990000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 28A0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 2820000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 29B0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 49B0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: B4B0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 7430000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 76F0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 13C0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 3270000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 3080000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 1630000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 3250000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 1880000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 7650000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 8650000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: BEB0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 87D0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 3340000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 34C0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 3340000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 2860000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 29F0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 49F0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: B780000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 7220000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 74F0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 15F0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 2F70000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\Order_List.scr	Memory allocated: 4F70000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 600000
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599889
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599778
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599666
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599555
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599443
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599317
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599189
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599061
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598949
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598837
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598725
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598613
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598485
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598357
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598245
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598134
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598022
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597910
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597783
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597655
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597543
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597431
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597319
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597207
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597079
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596951
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596838
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596729
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596617
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596505
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596377
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596250
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596140
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596028
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595916
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595804
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595693
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595565
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595423
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595295
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595183
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595071
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594959
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594831
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594703
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594592
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594480
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594368
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594257
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 600000
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599889
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599777
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599665
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599553
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599427
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599312
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599205
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599078
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598966
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598854
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598742
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598631
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598503
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598378
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598252
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598140
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598028
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597916
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597804
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597693
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597565
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597453
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597343
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597232
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597119
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597000
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596866
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596754
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596642
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596514
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596402
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596291
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596179
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596068
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595940
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595828
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595716
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595604
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595492
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595380
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595253
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595141
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595030
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594917
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594806
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594695
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594563
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594439
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594311
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 600000
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599874
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599763
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599651
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599538
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599427
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599299
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599171
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599061
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598949
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598837
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598725
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598614
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598487
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598359
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598248
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598136
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598024
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597913
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597799
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597673
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597545
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597433
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597322
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597209
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597083
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596955
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596827
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596716
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596604
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596492
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596380
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596252
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596125
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596014
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595902
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595790
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595679
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595567
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595440
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595320
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595201
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595090
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594978
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594866
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594754
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594627
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594499
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594388
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594276
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 600000
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599874
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599762
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599650
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599538
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599427
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599299
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599172
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599060
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598948
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598837
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598725
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598614
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598487
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598359
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598248
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598136
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598025
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597914
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597802
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597675
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597548
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597423
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597282
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597155
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597043
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596932
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596820
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596707
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596580
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596452
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596340
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596229
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596118
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596005
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595879
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595735
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595624
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595511
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595400
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595288
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595177
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595050
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594906
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594795
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594683
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594571
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594459
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594331
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594203
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 600000
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599888
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599776
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599665
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599553
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599425
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599282
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599156
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599044
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598909
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598789
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598661
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598533
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598405
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598293
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598181
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598070
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597958
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597831
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597687
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597575
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597463
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597351
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597239
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597111
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596983
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596871
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596759
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596647
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596535
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596407
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596279
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596168
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596056
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595945
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595832
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595705
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595577
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595465
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595354
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595243
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595132
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595021
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594893
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594751
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594623
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594511
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594399
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594287
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594160

Source: C:\Users\user\Desktop\Order_List.scr	Window / User API: threadDelayed 9569
Source: C:\Users\user\Desktop\Order_List.scr	Window / User API: threadDelayed 9552
Source: C:\Users\user\Desktop\Order_List.scr	Window / User API: threadDelayed 8990
Source: C:\Users\user\Desktop\Order_List.scr	Window / User API: threadDelayed 856
Source: C:\Users\user\Desktop\Order_List.scr	Window / User API: threadDelayed 9486
Source: C:\Users\user\Desktop\Order_List.scr	Window / User API: threadDelayed 360
Source: C:\Users\user\Desktop\Order_List.scr	Window / User API: threadDelayed 9065
Source: C:\Users\user\Desktop\Order_List.scr	Window / User API: threadDelayed 776

Source: C:\Users\user\Desktop\Order_List.scr TID: 6240	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -12912720851596678s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -599889s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1260	Thread sleep count: 9569 > 30
Source: C:\Users\user\Desktop\Order_List.scr TID: 1260	Thread sleep count: 283 > 30
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -599778s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -599666s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -599555s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -599443s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -599317s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -599189s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -599061s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -598949s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -598837s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -598725s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -598613s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -598485s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -598357s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -598245s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -598134s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -598022s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -597910s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -597783s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -597655s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -597543s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -597431s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -597319s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -597207s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -597079s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -596951s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -596838s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -596729s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -596617s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -596505s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -596377s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -596250s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -596140s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -596028s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -595916s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -595804s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -595693s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -595565s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -595423s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -595295s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -595183s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -595071s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -594959s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -594831s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -594703s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -594592s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -594480s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -594368s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 760	Thread sleep time: -594257s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1804	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -599889s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1992	Thread sleep count: 9552 > 30
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -599777s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -599665s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -599553s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1992	Thread sleep count: 304 > 30
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -599427s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -599312s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -599205s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -599078s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -598966s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -598854s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -598742s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -598631s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -598503s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -598378s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -598252s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -598140s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -598028s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -597916s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -597804s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -597693s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -597565s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -597453s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -597343s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -597232s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -597119s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -597000s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -596866s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -596754s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -596642s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -596514s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -596402s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -596291s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -596179s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -596068s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -595940s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -595828s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -595716s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -595604s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -595492s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -595380s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -595253s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -595141s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -595030s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -594917s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -594806s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -594695s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -594563s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -594439s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 1960	Thread sleep time: -594311s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 2200	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -15679732462653109s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -599874s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 5096	Thread sleep count: 8990 > 30
Source: C:\Users\user\Desktop\Order_List.scr TID: 5096	Thread sleep count: 856 > 30
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -599763s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -599651s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -599538s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -599427s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -599299s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -599171s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -599061s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -598949s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -598837s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -598725s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -598614s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -598487s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -598359s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -598248s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -598136s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -598024s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -597913s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -597799s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -597673s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -597545s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -597433s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -597322s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -597209s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -597083s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -596955s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -596827s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -596716s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -596604s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -596492s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -596380s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -596252s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -596125s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -596014s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -595902s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -595790s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -595679s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -595567s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -595440s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -595320s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -595201s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -595090s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -594978s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -594866s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -594754s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -594627s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -594499s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -594388s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6316	Thread sleep time: -594276s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 556	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -16602069666338586s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -599874s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6584	Thread sleep count: 9486 > 30
Source: C:\Users\user\Desktop\Order_List.scr TID: 6584	Thread sleep count: 360 > 30
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -599762s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -599650s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -599538s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -599427s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -599299s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -599172s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -599060s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -598948s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -598837s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -598725s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -598614s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -598487s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -598359s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -598248s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -598136s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -598025s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -597914s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -597802s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -597675s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -597548s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -597423s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -597282s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -597155s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -597043s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -596932s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -596820s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -596707s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -596580s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -596452s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -596340s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -596229s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -596118s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -596005s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -595879s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -595735s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -595624s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -595511s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -595400s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -595288s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -595177s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -595050s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -594906s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -594795s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -594683s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -594571s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -594459s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -594331s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 6580	Thread sleep time: -594203s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 4756	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -17524406870024063s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -599888s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 5464	Thread sleep count: 9065 > 30
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -599776s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 5464	Thread sleep count: 776 > 30
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -599665s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -599553s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -599425s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -599282s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -599156s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -599044s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -598909s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -598789s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -598661s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -598533s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -598405s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -598293s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -598181s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -598070s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -597958s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -597831s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -597687s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -597575s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -597463s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -597351s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -597239s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -597111s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -596983s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -596871s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -596759s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -596647s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -596535s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -596407s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -596279s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -596168s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -596056s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -595945s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -595832s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -595705s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -595577s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -595465s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -595354s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -595243s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -595132s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -595021s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -594893s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -594751s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -594623s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -594511s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -594399s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -594287s >= -30000s
Source: C:\Users\user\Desktop\Order_List.scr TID: 7124	Thread sleep time: -594160s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 600000
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599889
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599778
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599666
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599555
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599443
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599317
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599189
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599061
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598949
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598837
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598725
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598613
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598485
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598357
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598245
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598134
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598022
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597910
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597783
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597655
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597543
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597431
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597319
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597207
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597079
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596951
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596838
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596729
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596617
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596505
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596377
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596250
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596140
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596028
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595916
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595804
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595693
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595565
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595423
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595295
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595183
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595071
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594959
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594831
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594703
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594592
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594480
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594368
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594257
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 600000
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599889
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599777
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599665
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599553
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599427
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599312
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599205
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599078
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598966
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598854
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598742
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598631
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598503
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598378
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598252
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598140
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598028
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597916
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597804
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597693
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597565
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597453
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597343
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597232
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597119
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597000
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596866
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596754
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596642
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596514
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596402
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596291
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596179
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596068
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595940
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595828
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595716
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595604
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595492
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595380
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595253
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595141
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595030
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594917
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594806
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594695
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594563
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594439
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594311
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 600000
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599874
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599763
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599651
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599538
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599427
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599299
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599171
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599061
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598949
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598837
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598725
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598614
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598487
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598359
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598248
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598136
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598024
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597913
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597799
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597673
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597545
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597433
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597322
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597209
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597083
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596955
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596827
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596716
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596604
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596492
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596380
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596252
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596125
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596014
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595902
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595790
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595679
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595567
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595440
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595320
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595201
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595090
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594978
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594866
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594754
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594627
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594499
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594388
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594276
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 600000
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599874
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599762
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599650
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599538
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599427
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599299
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599172
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599060
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598948
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598837
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598725
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598614
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598487
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598359
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598248
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598136
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598025
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597914
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597802
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597675
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597548
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597423
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597282
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597155
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597043
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596932
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596820
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596707
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596580
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596452
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596340
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596229
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596118
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596005
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595879
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595735
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595624
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595511
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595400
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595288
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595177
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595050
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594906
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594795
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594683
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594571
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594459
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594331
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594203
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 600000
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599888
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599776
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599665
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599553
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599425
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599282
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599156
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 599044
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598909
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598789
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598661
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598533
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598405
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598293
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598181
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 598070
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597958
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597831
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597687
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597575
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597463
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597351
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597239
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 597111
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596983
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596871
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596759
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596647
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596535
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596407
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596279
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596168
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 596056
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595945
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595832
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595705
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595577
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595465
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595354
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595243
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595132
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 595021
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594893
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594751
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594623
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594511
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594399
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594287
Source: C:\Users\user\Desktop\Order_List.scr	Thread delayed: delay time: 594160

Source: Order_List.scr, 00000014.00000002.2467949698.0000000000EF7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllR[zo
Source: Order_List.scr, 00000025.00000002.2128470166.0000000006E42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Order_List.scr, 00000029.00000002.2474834713.0000000001239000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllO
Source: Order_List.scr, 00000021.00000002.2473726695.000000000168E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlla
Source: Order_List.scr, 00000019.00000002.2467950537.0000000000A9A000.00000004.00000020.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2478125383.0000000001471000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Order_List.scr, 00000011.00000002.1787996238.0000000007959000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33s

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Order_List.scr

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Order_List.scr	Memory written: C:\Users\user\Desktop\Order_List.scr base: 400000 value starts with: 4D5A
Source: C:\Users\user\Desktop\Order_List.scr	Memory written: C:\Users\user\Desktop\Order_List.scr base: 400000 value starts with: 4D5A
Source: C:\Users\user\Desktop\Order_List.scr	Memory written: C:\Users\user\Desktop\Order_List.scr base: 400000 value starts with: 4D5A
Source: C:\Users\user\Desktop\Order_List.scr	Memory written: C:\Users\user\Desktop\Order_List.scr base: 400000 value starts with: 4D5A
Source: C:\Users\user\Desktop\Order_List.scr	Memory written: C:\Users\user\Desktop\Order_List.scr base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp180E.tmp"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Users\user\Desktop\Order_List.scr "C:\Users\user\Desktop\Order_List.scr"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp38E5.tmp"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Users\user\Desktop\Order_List.scr "C:\Users\user\Desktop\Order_List.scr"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp60CF.tmp"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Users\user\Desktop\Order_List.scr "C:\Users\user\Desktop\Order_List.scr"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp74B5.tmp"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Users\user\Desktop\Order_List.scr "C:\Users\user\Desktop\Order_List.scr"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp95CA.tmp"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Users\user\Desktop\Order_List.scr "C:\Users\user\Desktop\Order_List.scr"
Source: C:\Users\user\Desktop\Order_List.scr	Process created: C:\Users\user\Desktop\Order_List.scr "C:\Users\user\Desktop\Order_List.scr"

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Users\user\Desktop\Order_List.scr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Users\user\Desktop\Order_List.scr VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Users\user\Desktop\Order_List.scr VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Users\user\Desktop\Order_List.scr VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Users\user\Desktop\Order_List.scr VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Users\user\Desktop\Order_List.scr VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Users\user\Desktop\Order_List.scr VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Users\user\Desktop\Order_List.scr VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Users\user\Desktop\Order_List.scr VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Users\user\Desktop\Order_List.scr VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\Order_List.scr	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zO4E440DCC\version.txt VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match

File source: 00000011.00000002.1787660778.00000000078D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Snake Keylogger

Source: Yara match	File source: 00000019.00000002.2462283908.000000000041B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2462387893.000000000041A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.2497138207.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1783811478.0000000004489000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2491373165.0000000002F67000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2500727360.0000000003428000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.2497138207.0000000003129000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2496690861.0000000002B48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2500727360.0000000003271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2496690861.0000000002991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2499992401.0000000003679000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2491373165.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2499992401.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order_List.scr PID: 5400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Order_List.scr PID: 6864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Order_List.scr PID: 1940, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Order_List.scr PID: 3184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Order_List.scr PID: 4404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Order_List.scr PID: 6608, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Order_List.scr	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Desktop\Order_List.scr	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Order_List.scr	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\user\Desktop\Order_List.scr	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\Desktop\Order_List.scr	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\user\Desktop\Order_List.scr	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\Desktop\Order_List.scr	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\user\Desktop\Order_List.scr	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\Desktop\Order_List.scr	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\user\Desktop\Order_List.scr	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\Desktop\Order_List.scr	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\user\Desktop\Order_List.scr	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 00000011.00000002.1783811478.0000000004489000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order_List.scr PID: 5400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Order_List.scr PID: 6864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Order_List.scr PID: 1940, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Order_List.scr PID: 3184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Order_List.scr PID: 4404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Order_List.scr PID: 6608, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match

File source: 00000011.00000002.1787660778.00000000078D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Snake Keylogger

Source: Yara match	File source: 00000019.00000002.2462283908.000000000041B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2462387893.000000000041A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.2497138207.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1783811478.0000000004489000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2491373165.0000000002F67000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2500727360.0000000003428000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.2497138207.0000000003129000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2496690861.0000000002B48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2500727360.0000000003271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2496690861.0000000002991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2499992401.0000000003679000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2491373165.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2499992401.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order_List.scr PID: 5400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Order_List.scr PID: 6864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Order_List.scr PID: 1940, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Order_List.scr PID: 3184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Order_List.scr PID: 4404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Order_List.scr PID: 6608, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	11 Browser Extensions	111 Process Injection	11 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	14 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\7zEC2A483AB\Order_List.scr	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\FTlLqTRGrXZr.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\7zEC2A483AB\Order_List.scr	21%	ReversingLabs
C:\Users\user\AppData\Roaming\FTlLqTRGrXZr.exe	21%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://checkip.dyndns.orgx	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	188.114.97.3	true	false	high
checkip.dyndns.com	193.122.6.168	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/8.46.123.189	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/q	Order_List.scr, 00000011.00000002.1783811478.0000000004489000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2462283908.000000000041B000.00000040.00000400.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189$	Order_List.scr, 00000014.00000002.2491373165.0000000002EA5000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F1E000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002EF5000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F4B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F02000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AD6000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B3A000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002A86000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AFE000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B2C000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AE3000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.0000000003366000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033B6000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033C3000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.000000000340C000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033D1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003621000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003606000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.000000000362F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.org	Order_List.scr, 00000014.00000002.2491373165.0000000002E7A000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F1E000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002EF5000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F4B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F02000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AD6000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B3A000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002A5B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AFE000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B2C000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AE3000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033B6000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033C3000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.000000000340C000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.000000000333B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033D1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003621000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003606000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.000000000358C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	Order_List.scr, 00000019.00000002.2496690861.0000000002AD6000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B3A000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002A86000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AFE000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B2C000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AE3000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.0000000003366000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033B6000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033C3000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.000000000340C000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.0000000003323000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033D1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003621000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003606000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.000000000362F000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003574000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.000000000366B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.00000000035B6000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003614000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189x	Order_List.scr, 00000014.00000002.2491373165.0000000002E62000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.0000000003323000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003574000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000029.00000002.2497138207.0000000003024000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000029.00000002.2497138207.000000000311B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000029.00000002.2497138207.00000000030DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	Order_List.scr, 00000014.00000002.2491373165.0000000002F2B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002E62000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002EA5000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F1E000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002EF5000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F4B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002E56000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F02000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AD6000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002A37000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B0C000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B3A000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002A86000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AFE000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B2C000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AE3000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.0000000003366000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.0000000003317000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	Order_List.scr, 00000014.00000002.2491373165.0000000002E62000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F1E000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002EF5000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F4B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002F02000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AD6000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B3A000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AFE000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002B2C000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002AE3000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033B6000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033C3000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.000000000340C000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.0000000003323000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.00000000033D1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003621000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003606000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.000000000362F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Order_List.scr, 00000011.00000002.1781812977.00000000034C8000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000016.00000002.1866475138.000000000333B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002991000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001A.00000002.1971516254.00000000029FB000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.0000000003271000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001E.00000002.2021094284.000000000329B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000025.00000002.2105744205.0000000002A3B000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000029.00000002.2497138207.0000000002F71000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	7zFM.exe, 0000000F.00000003.1516854428.000001C16EE80000.00000004.00000800.00020000.00000000.sdmp, 7zFM.exe, 0000000F.00000003.1539112335.000001C170A3E000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000000F.00000003.1538885914.000001C16EE81000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000000F.00000003.1630731860.000001C170A3E000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000000F.00000003.1630648461.000001C16EF2C000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000000F.00000003.1539369564.000001C170AEB000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000002E.00000002.2488632713.0000019AAA4DB000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000002E.00000003.2346795878.0000019AAB84C000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe, 0000002E.00000002.2496806627.0000019AAB84C000.00000004.00000020.00020000.00000000.sdmp, Order_List.scr.15.dr, FTlLqTRGrXZr.exe.17.dr	false		high
http://checkip.dyndns.orgx	Order_List.scr, 00000029.00000002.2497138207.00000000030D2000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000029.00000002.2497138207.0000000003011000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	Order_List.scr, 00000011.00000002.1783811478.0000000004489000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000014.00000002.2491373165.0000000002E62000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2462283908.000000000041B000.00000040.00000400.00020000.00000000.sdmp, Order_List.scr, 00000019.00000002.2496690861.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 0000001D.00000002.2500727360.0000000003323000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000021.00000002.2499992401.0000000003574000.00000004.00000800.00020000.00000000.sdmp, Order_List.scr, 00000029.00000002.2497138207.0000000003024000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	false
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
193.122.130.0	unknown	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585316
Start date and time:	2025-01-07 14:00:32 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	48
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	New order 2025.msg
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winMSG@43/14@3/3
Cookbook Comments:	Found application associated with file extension: .msg

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, rundll32.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.113.194.132, 52.109.89.19, 2.16.168.101, 2.16.168.119, 52.168.112.67, 52.109.68.130, 23.56.254.164, 40.126.32.134, 20.109.210.53, 2.23.227.221
Excluded domains from analysis (whitelisted): omex.cdn.office.net, odc.officeapps.live.com, slscr.update.microsoft.com, europe.odcsm1.live.com.akadns.net, weu-azsc-000.roaming.officeapps.live.com, eur.roaming1.live.com.akadns.net, mobile.events.data.microsoft.com, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, osiprod-weu-buff-azsc-000.westeurope.cloudapp.azure.com, login.live.com, a1864.dscd.akamai.net, www.bing.com, ecs.office.com, fs.microsoft.com, frc-azsc-000.odc.officeapps.live.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, s-0005.s-msedge.net, osiprod-frc-bronze-azsc-000.francecentral.cloudapp.azure.com, onedscolprdeus04.eastus.cloudapp.azure.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, mobile.events.data.trafficmanager.net, prod.odcsm1.live.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetValueKey calls found.
VT rate limit hit for: New order 2025.msg

Simulations

Behavior and APIs

Time	Type	Description
08:01:12	API Interceptor	2x Sleep call for process: OpenWith.exe modified
08:01:52	API Interceptor	66505x Sleep call for process: Order_List.scr modified

LLM Input / Output

Input	Output
URL: email Model: Joe Sandbox AI	{ "explanation": [ "Sender email domain (creative-cork.com) doesn't match the claimed company (Egyptalum Ltd)", "Suspicious attachment with .rar format, commonly used in phishing to hide malware", "Generic business inquiry to government email (buildingpermits) that doesn't match the context" ], "phishing": true, "confidence": 9, "generated_by_ai": false }
{ "date": "Tue, 07 Jan 2025 09:55:17 +0100", "subject": "New order 2025", "communications": [ "CAUTION: THIS MESSAGE IS FROM AN EXTERNAL SENDER\nThis email originated from outside the organization. Do not click links, open attachments, or share any information unless you recognize the sender and know the content is safe. Report suspicious emails using the \"Phish Alert\" button in Outlook or contact the Helpdesk.\n\nGreetings,\n\n\nI am Hassan Macki, Managing Director of Egyptalum Co., Ltd. Im interested in your products and would like to request a quote for the items listed in the attached document. Please provide pricing, availability, and any relevant details.\n\n\nFeel free to contact me if you need further information. I look forward to your response.\n\n\nBest regards,\n\nHassan Macki\n\nEgyptalum Ltd\n\nTel: 0 691 470 049 / 0 691 650 001\n\n" ], "from": "Hassan Macki <nuno.pascoa@creative-cork.com>", "to": "buildingpermits@marionfl.org", "attachements": [ "Order_List.rar" ] }
URL: Email Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "I am interested in your products and would like to request a quote for the items listed in the attached document. Please provide pricing, availability, and any relevant details.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Email Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Email Model: Joe Sandbox AI	{"classification":"Lure-Based Attack"}
Email: Detected potential phishing email: Sender email domain (creative-cork.com) doesn't match the claimed company (Egyptalum Ltd). Suspicious attachment with .rar format, commonly used in phishing to hide malware. Generic business inquiry to government email (buildingpermits) that doesn't match the context	{"classification":"Lure-Based Attack"}

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	DHL DOCS 2-0106-25.exe	Get hash	malicious	FormBook	Browse	www.uzshou.world/ricr/
	Order Inquiry.exe	Get hash	malicious	FormBook	Browse	www.cifasnc.info/8rr3/
	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php
	Payment Receipt.exe	Get hash	malicious	FormBook	Browse	www.cifasnc.info/8rr3/
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	/api/get/free
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	/api/get/free
	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	www.rgenerousrs.store/o362/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.beylikduzu616161.xyz/2nga/
	Delivery_Notification_00000260791.doc.js	Get hash	malicious	Unknown	Browse	radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45
	ce.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/lxvbq
193.122.6.168	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	INQUIRY.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	Technonomic.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	HALKBANK EKSTRE.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	EPIRTURMEROOO0060.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Proforma Invoice.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	HUBED342024.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	YU SV Payment.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	MV DESPINA_VESSEL_DESCRIPTION.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	FORTUNE RICH_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	document pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
checkip.dyndns.com	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	MV DESPINA_VESSEL_DESCRIPTION.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	FORTUNE RICH_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	document pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	158.101.44.242

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	FORTUNE RICH_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Fantazy.i686.elf	Get hash	malicious	Unknown	Browse	193.123.7.176
	fuckunix.spc.elf	Get hash	malicious	Mirai	Browse	144.25.181.0
	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	test.exe	Get hash	malicious	Unknown	Browse	130.61.86.87
	file.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	file.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	PO_4027_from_IC_Tech_Inc_6908.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
CLOUDFLARENETUS	https://coggle.it/diagram/Z3zkZPAQxQkDOgmo/t/-/1f6434bfba7d8aab898b2531849681e8b0d7342489acbbff6b172f8658a09526	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://email.garagesalefinder.com/c/eJyMU92OsjoUfZp6xwRaoO2FF-XPYT4VnXHQ8caUFivK3wcC-vYnzImc25OQlbXYa-_VJrtyniCCZ-ncwMg2KKWmPrvMCRWYGDSBBAkLnSGigttEUJpiLHRhzLK5JRHWEbE0wS1LkxzqmpnKRCMYcymIhUyJgKkr3nCVtjxPz1kp0-ZNVMUsn1_u9xogBmAAYDAMw5uqKpWnXLZp02cibUcfgEHNVcolgAEX-Q2goOUAeUsAbZ4B5Lma-bXS9YjEH8_jUsCMDFHdh-8V6xawX6ug4FFt3FtnCCFin8wJow2-DWulyU1_iVhfsfe8SpYtI8px_iiPHZXv8Movh2Cj-95Hcj0kV7urV6jyYvatjOfWaYZ2MRxIba6V3Jx55O3PcZmp2muai3lerzYyDgu0zWKnNlb-o7Sf7h6p70NxCvM23_41HfOEGuWGy9q9Hnlqfep7pO0Kfgrvm-rvV7zTOloie11_fJdEol2uDrr9xfmOPrr1Vr-IJWM_mXjnt9SPV5IVx53pOD-UrUI1qHwX-N2-JfHP9ThUm97B9z_nIOnjcuOGjloo51Iwxy6FckMA7bIrAPIMAG2RSYA8a5H18gTbKy737aLto4f-0GD3DaDdZgogj0WebZ6M8IN8ys_TY2eziPTBe70KjWKtt8gaxll5lpZ3gDzBtbpLNBsalBgGNrFuUoTHOC67JgfIGzehnVYBQAtjAC37l8GRuSOYU4G-pG2NgEYgk_ReFjwWsPli0J_MwSSdVxuc_v2bYU25I0BvMvvT0fBL_tdrsyktMAglv0Qs4o5D0vHD8ZIUFG4XwVMUFP0UQcef1jWBOkDea447drMR_PHuZATmTlIH0KIMQPP3-3_uWTOv0_JWvWU9L6semDpvmmpIeHn7fYv9HP4TAAD__7e2IkM	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://check.qlkwr.com/awjsx.captcha?u=d9b43caa-60bc-4673-bed6-4e9abc0c0678	Get hash	malicious	Unknown	Browse	104.21.55.46
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc	Browse	188.114.96.3
	Crawl.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Quarantined Messages(3).zip	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	U1P3u1tkB2.exe	Get hash	malicious	Unknown	Browse	104.21.80.209
	LVkAi4PBv6.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	U1P3u1tkB2.exe	Get hash	malicious	Unknown	Browse	104.21.80.209
ORACLE-BMC-31898US	FORTUNE RICH_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Fantazy.i686.elf	Get hash	malicious	Unknown	Browse	193.123.7.176
	fuckunix.spc.elf	Get hash	malicious	Mirai	Browse	144.25.181.0
	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	test.exe	Get hash	malicious	Unknown	Browse	130.61.86.87
	file.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	file.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	PO_4027_from_IC_Tech_Inc_6908.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	MV DESPINA_VESSEL_DESCRIPTION.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	FORTUNE RICH_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	document pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	188.114.97.3

Process:	C:\Program Files\7-Zip\7zFM.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	706056
Entropy (8bit):	7.444668333539724
Encrypted:	false
SSDEEP:	12288:xTWMWYMV+I4MVKWsXW+KiXe39JZArWHEkznuJVGZdkR:d/GRgjXWLYrvWA
MD5:	78A62A23291A3C7907E947BC9F270E09
SHA1:	A28A2DB1CACCA688A66A00ECD840AEDEAEF484D4
SHA-256:	3652DCDB4EAFF1A11FF293EEDB80363E024BDA7A33F1E1C17B082DFD4CEA5A86
SHA-512:	F690A98DDE16B8D5DB12ACC15B5BCF56B8F869773CAF080C16C5ED74A7A182252CFCCDFD3E1068D7761917E5F58DE6B03FBC452FDCFCEA2FE0D15BD3CB300FCA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\|g..............0..r.............. ........@.. ....................................`.....................................O.......l................6........................................................... ............... ..H............text....p... ...r.................. ..`.rsrc...l............t..............@..@.reloc..............................@..B........................H.......PB...7......4....y...............................................0............}.....r...p(....}.....r...p(....}.....s....}......}......}.....(.......( .....{.....r7..pr9..p~5...%-.&~4.....R...s....%.5...(...+(...+~6...%-.&~4.....S...s....%.6...(...+...G...%..(...+s.....%.rK..p.%.rY..p...H...(....rs..p ............%...%...(........0..(..........}.....{....o.....s ...... ....(!...&F...}......(........0..............{.....X..}.....s...}......{....o"....o#...t.......(

C:\Users\user\AppData\Local\Temp\7zO4E440DCC\version.txt

Download File

Process:	C:\Program Files\7-Zip\7zFM.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	3.3901031252218043
Encrypted:	false
SSDEEP:	24:ft0tzGqcbKJvFXfqIKfC3I8fwlVtVwjNiW3GXSyO13b1PNHqwY:lC6KDv8Cz4VtVwpiW3byKLKwY
MD5:	46012E1D8B7C6DFF2E838E36E122AC4B
SHA1:	37CD3D135037B85CE08C726B1B319EE7D1428182
SHA-256:	D86A77BB5FB34998170F590EA52E944A5C549484EF0851A82B1B87F4AF478BAC
SHA-512:	888AC46B40BCF09816E2DB0B1246736DD99D0B5A0C376B472C01D991253088C1E60A2FF1FF30E0B1C7E751D3E77FC5B89DB3FB306EB62A0BF730FEAD9880ABF7
Malicious:	false
Preview:	F.I.L.E.V.E.R.S.I.O.N. . . . .1.,.0.,.0.,.0.....P.R.O.D.U.C.T.V.E.R.S.I.O.N. .1.,.0.,.0.,.0.....F.I.L.E.F.L.A.G.S.M.A.S.K. . .0.x.3.F.....F.I.L.E.F.L.A.G.S. . . . . . .0.x.0.....F.I.L.E.O.S. . . . . . . . . .V.O.S._.U.N.K.N.O.W.N. .\|. .V.O.S._._.W.I.N.D.O.W.S.3.2.....F.I.L.E.T.Y.P.E. . . . . . . .V.F.T._.A.P.P.....F.I.L.E.S.U.B.T.Y.P.E. . . . .0.x.0.....{..... . .B.L.O.C.K. .".V.a.r.F.i.l.e.I.n.f.o."..... . .{..... . . . .V.A.L.U.E. .".T.r.a.n.s.l.a.t.i.o.n.".,. .0.x.0.,. .1.2.0.0..... . .}..... . .B.L.O.C.K. .".S.t.r.i.n.g.F.i.l.e.I.n.f.o."..... . .{..... . . . .B.L.O.C.K. .".0.0.0.0.0.4.b.0."..... . . . .{..... . . . . . .V.A.L.U.E. .".C.o.m.m.e.n.t.s.".,. . . . . . . . . . ."."..... . . . . . .V.A.L.U.E. .".C.o.m.p.a.n.y.N.a.m.e.".,. . . . . . . ."."..... . . . . . .V.A.L.U.E. .".F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.".,. . . .".D.r.a.g.D.r.o.p.D.e.m.o."..... . . . . . .V.A.L.U.E. .".F.i.l.e.V.e.r.s.i.o.n.".,. . . . . . . .".1...0...0...0."..... . . . . . .V.A.L.U.E. .".I.n.t.e.r.n.a.l.N.a.

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250107T0801000560-3528.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	4.454669670979661
Encrypted:	false
SSDEEP:	1536:19cf8JCVf8+KC7jByMg4p01CfTTLNoKuU401XHqxW40+9YSfsXMz10CglK3uX:A40+CSkXy0P
MD5:	157E56BFD357844462A565E237F7BE2A
SHA1:	17A004DB1998CE26E9F2D3EBECAAA4B61F8E9930
SHA-256:	6689166A330B813C0338293E3E0AF850FEA44C35240D0DEACE8FF8A609D88044
SHA-512:	D954CB4313EA7E10CEFAA8FC2FA02DE435A243BF2BF3027570135305F54765EC64E544CE940BACE8D045D2A2B4F002BFEEB05DE872A871AA847C70F47BFFDA9C
Malicious:	false
Preview:	............................................................................`...T.........F3.a..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...............................................................Y............F3.a..........v.2._.O.U.T.L.O.O.K.:.d.c.8.:.1.7.9.c.5.9.2.c.9.7.d.a.4.6.1.6.a.3.d.4.3.9.6.8.3.3.b.d.0.f.b.3...C.:.\.U.s.e.r.s.\.n.o.r.d.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.5.0.1.0.7.T.0.8.0.1.0.0.0.5.6.0.-.3.5.2.8...e.t.l.......P.P.T.........F3.a..........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp180E.tmp

Download File

Process:	C:\Users\user\Desktop\Order_List.scr
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1578
Entropy (8bit):	5.103135331453591
Encrypted:	false
SSDEEP:	24:2di4+S2qhz1zy1moUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtiAVLxvn:cgezwYrFdOFzOzN33ODOiDdKrsuTV1v
MD5:	571BDDAE754BBCC92266BC5EC5F940CD
SHA1:	76EDEC53EA32A6309815BC75DB6281B48EB694F1
SHA-256:	DE3224AB17C4489B5FEBC28AB90ECC727525DFA168BE32E32430E9132421F479
SHA-512:	BC4322382DCE8AFEBAC717B1BFD3CD5331BED8AB0EA95A67D9F9CA3B0F4F582673B10C491CB94F41C43CB19504200D10D0ABD68B3FFA5848FDE06B06A22A86C7
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp38E5.tmp

Download File

Process:	C:\Users\user\Desktop\Order_List.scr
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1578
Entropy (8bit):	5.103135331453591
Encrypted:	false
SSDEEP:	24:2di4+S2qhz1zy1moUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtiAVLxvn:cgezwYrFdOFzOzN33ODOiDdKrsuTV1v
MD5:	571BDDAE754BBCC92266BC5EC5F940CD
SHA1:	76EDEC53EA32A6309815BC75DB6281B48EB694F1
SHA-256:	DE3224AB17C4489B5FEBC28AB90ECC727525DFA168BE32E32430E9132421F479
SHA-512:	BC4322382DCE8AFEBAC717B1BFD3CD5331BED8AB0EA95A67D9F9CA3B0F4F582673B10C491CB94F41C43CB19504200D10D0ABD68B3FFA5848FDE06B06A22A86C7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp60CF.tmp

Download File

Process:	C:\Users\user\Desktop\Order_List.scr
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1578
Entropy (8bit):	5.103135331453591
Encrypted:	false
SSDEEP:	24:2di4+S2qhz1zy1moUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtiAVLxvn:cgezwYrFdOFzOzN33ODOiDdKrsuTV1v
MD5:	571BDDAE754BBCC92266BC5EC5F940CD
SHA1:	76EDEC53EA32A6309815BC75DB6281B48EB694F1
SHA-256:	DE3224AB17C4489B5FEBC28AB90ECC727525DFA168BE32E32430E9132421F479
SHA-512:	BC4322382DCE8AFEBAC717B1BFD3CD5331BED8AB0EA95A67D9F9CA3B0F4F582673B10C491CB94F41C43CB19504200D10D0ABD68B3FFA5848FDE06B06A22A86C7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp74B5.tmp

Download File

Process:	C:\Users\user\Desktop\Order_List.scr
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1578
Entropy (8bit):	5.103135331453591
Encrypted:	false
SSDEEP:	24:2di4+S2qhz1zy1moUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtiAVLxvn:cgezwYrFdOFzOzN33ODOiDdKrsuTV1v
MD5:	571BDDAE754BBCC92266BC5EC5F940CD
SHA1:	76EDEC53EA32A6309815BC75DB6281B48EB694F1
SHA-256:	DE3224AB17C4489B5FEBC28AB90ECC727525DFA168BE32E32430E9132421F479
SHA-512:	BC4322382DCE8AFEBAC717B1BFD3CD5331BED8AB0EA95A67D9F9CA3B0F4F582673B10C491CB94F41C43CB19504200D10D0ABD68B3FFA5848FDE06B06A22A86C7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp95CA.tmp

Download File

Process:	C:\Users\user\Desktop\Order_List.scr
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1578
Entropy (8bit):	5.103135331453591
Encrypted:	false
SSDEEP:	24:2di4+S2qhz1zy1moUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtiAVLxvn:cgezwYrFdOFzOzN33ODOiDdKrsuTV1v
MD5:	571BDDAE754BBCC92266BC5EC5F940CD
SHA1:	76EDEC53EA32A6309815BC75DB6281B48EB694F1
SHA-256:	DE3224AB17C4489B5FEBC28AB90ECC727525DFA168BE32E32430E9132421F479
SHA-512:	BC4322382DCE8AFEBAC717B1BFD3CD5331BED8AB0EA95A67D9F9CA3B0F4F582673B10C491CB94F41C43CB19504200D10D0ABD68B3FFA5848FDE06B06A22A86C7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\~DFC0673EF9709CBB96.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	163840
Entropy (8bit):	0.33321620034013927
Encrypted:	false
SSDEEP:	192:/+GmCyPxard/8UJV2MZgNgz0XHWQOAIAbAFAqwNh/:/iCAc/JPvZ/z0XHOAIMu
MD5:	45F19005EA40B4F979F81E14186ABBAA
SHA1:	A2EE6546FB27FF1C87F685ADCA60B7B3191E5D66
SHA-256:	B57B715D1C40CAAD5A15D209FAD0A859716062B87413BE56129B5541EF9333D2
SHA-512:	624289A4AC9BC57F70C70BAB8C381B243C06AA467D438F3086E6DE30477A487A2F9A39CD1A2B759D9CFF04747DCB799005AC5D434C01266F78CA287E96D0038B
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\FTlLqTRGrXZr.exe

Download File

Process:	C:\Users\user\Desktop\Order_List.scr
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	706056
Entropy (8bit):	7.444668333539724
Encrypted:	false
SSDEEP:	12288:xTWMWYMV+I4MVKWsXW+KiXe39JZArWHEkznuJVGZdkR:d/GRgjXWLYrvWA
MD5:	78A62A23291A3C7907E947BC9F270E09
SHA1:	A28A2DB1CACCA688A66A00ECD840AEDEAEF484D4
SHA-256:	3652DCDB4EAFF1A11FF293EEDB80363E024BDA7A33F1E1C17B082DFD4CEA5A86
SHA-512:	F690A98DDE16B8D5DB12ACC15B5BCF56B8F869773CAF080C16C5ED74A7A182252CFCCDFD3E1068D7761917E5F58DE6B03FBC452FDCFCEA2FE0D15BD3CB300FCA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\|g..............0..r.............. ........@.. ....................................`.....................................O.......l................6........................................................... ............... ..H............text....p... ...r.................. ..`.rsrc...l............t..............@..@.reloc..............................@..B........................H.......PB...7......4....y...............................................0............}.....r...p(....}.....r...p(....}.....s....}......}......}.....(.......( .....{.....r7..pr9..p~5...%-.&~4.....R...s....%.5...(...+(...+~6...%-.&~4.....S...s....%.6...(...+...G...%..(...+s.....%.rK..p.%.rY..p...H...(....rs..p ............%...%...(........0..(..........}.....{....o.....s ...... ....(!...&F...}......(........0..............{.....X..}.....s...}......{....o"....o#...t.......(

C:\Users\user\Desktop\Order_List.rar

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	550956
Entropy (8bit):	7.999202934963724
Encrypted:	true
SSDEEP:	12288:E+13/PxkcsDtYwjjQA6FFOEkhvbtovMRBWheACEHGzjO5zkIgL4:E+xcVwFOEkZttRzEmzqoIgM
MD5:	6A06EE947AB6A43C402483F29C8144C5
SHA1:	A74BC2E6EEE488BBCB9C0379C8EF9FAA13BF4B0F
SHA-256:	B54E94F269C9DF8B3CD921E20190B6AE3EC47E81F39EBC9B7DDFB5A131D03DE7
SHA-512:	B9A88CB889EFF5392EC964C9866DD1F365AFA284BEA54686059F4C78A767451A6FA496A492CF21808752D7F62057CB5A9B1D46F001DC19B32D68A69674AA43B1
Malicious:	false
Preview:	Rar!....^.7...............l.,.....!...+ .~......Order_List.scr...A7...`....^V`.DD26o.P\.p(.H.. G.!...$@......I....d,.....9...1.&D........"...1...].l.-@..\|?...:.4.......2.t.U{uuu~._.T.W.f.+5y.........(/.....@........h..........h/..[ ..........p..........(.X/.............)..p..........(.(,.+Jb3.1 .8....mv0\.S.[.....\.....X.....JbUA.<.....y..yU'.................B..B.h..n>V%x.b#Z....3....}(..3.n.. },I.S..Z..78.....k,....`L..1..]E.^.A..!.f...q.b..>JH.~Ar4..._....UB.).....I..4U.v..x.#...\#.[........%2.`..h..E.A7.(..s@.B....e.....N9a.H.P..=9,..fb.v...\...XQ...$..9..O@..-.BM.... ..>.{X..,......i.c..u.".I...oo@.....Ps.-G.C...3.`sN.4..3.?.`tU~.8..UA.4.U..Z......:u...E[.&..G..[<.X.....[n..2.....8R.0.r#Gl..<...\Wa.^@8.,.H..r'%.%3.".L.e..N..t.b@.,a....i......'...77G...(.....i.pi0.ud....i..g+./V..Uq0..T..J."..Bu..X.@})+.,...C...C.7P....(.......{...s.hN+...;..J.....T!H....Q'...2eZ`.........$_......$....U...Sf$..#J...].#.......uV....M.....(.n...Y8...Q.Y9'SlWb

C:\Users\user\Desktop\Order_List.rar:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:gAWY3n:qY3n
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	1.479047153043351
Encrypted:	false
SSDEEP:	768:jQc7hSzUTfZZ7nWzxsZ8BUTIZOZT9LGBfEKXGG9fr:Dw8ZBWzxsZeNZOsfP3fr
MD5:	546B4960DE69137CC0B86B7F5855B7E3
SHA1:	6E04D898053E867DB5D6247D9A429FD5B0E7B6BA
SHA-256:	AB05E0519D59436A2A8585D5E939935F48822F37A3D0E7444F0059E62DBC9AA0
SHA-512:	A6F73410A128AED9C85BA67AB8886B0FDCD733776447B686AF105AE2643A53CEE70A04529A974198F9213FAC9D5B7755DB59ADCC8D3D4EA8C1725E1768C21769
Malicious:	true
Preview:	!BDN..i.SM......\...%....*..............\................@...........@...@...................................@...........................................................................$.......D..................................................................................................................................................................................................................................................................................................................................H........7..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	1.1197749727023627
Encrypted:	false
SSDEEP:	384:XnYjFzfgOPeWHZG0yO4rLWZl7uVlX1RR:XwiO8BfzlX
MD5:	FF75C1C61F3BE156795180D2577988A5
SHA1:	C57D19F4DA6A6928A923E990722040C6A633E387
SHA-256:	9455BC7EA7C6508F0ADB21BDCAFE64F69622EDF6DE60C855489B4619F2711077
SHA-512:	8DFC2FBD531C749938C9106665585DAE66AB7AE4240E6850BF9FA6856C3036C5CD253A5B9097848C21091EC4EF95FC7CE244E13A99654F98A1A2DCE6BC5C8E6A
Malicious:	true
Preview:	e.V+0...R...........+z.3.a.......D............#...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................../.d.D........V.0...S...........+z.3.a.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	CDFV2 Microsoft Outlook Message
Entropy (8bit):	7.914507927116324
TrID:	Outlook Message (71009/1) 58.92% Outlook Form Template (41509/1) 34.44% Generic OLE2 / Multistream Compound File (8008/1) 6.64%
File name:	New order 2025.msg
File size:	589'824 bytes
MD5:	090fa1528dc91da7a535993ca87e0a86
SHA1:	db19834414aa418e7ed18c4b7bd15dda358d937d
SHA256:	45c96d5abea74039cdcc0c3cd8210068c214551ccc8b330a37c00ee9ab2181fd
SHA512:	1fa852eacda1b57b3fae133e2e318966e3a900a19bcf9c7eecbda3c32ba16e7517025c9ca85445cc90d4621e4178e974f3b3fd54b11b8e16719669c3fce5d64c
SSDEEP:	12288:u+13/PxkcsDtYwjjQA6FFOEkhvbtovMRBWheACEHGzjO5zkIgL:u+xcVwFOEkZttRzEmzqoIg
TLSH:	36C4126832F90F1AF6FB9E779DC681468525BC82DF24CB5F6291B35E0474B40E86072B
File Content Preview:	........................>.......................................................>...?...@...A...B...C...D...E..................................................................................................................................................

Static Mail

General

Subject:	New order 2025
From:	Hassan Macki <nuno.pascoa@creative-cork.com>
To:	buildingpermits@marionfl.org
Cc:
BCC:
Date:	Tue, 07 Jan 2025 09:55:17 +0100
Communications:	CAUTION: THIS MESSAGE IS FROM AN EXTERNAL SENDER This email originated from outside the organization. Do not click links, open attachments, or share any information unless you recognize the sender and know the content is safe. Report suspicious emails using the "Phish Alert" button in Outlook or contact the Helpdesk. Greetings, I am Hassan Macki, Managing Director of Egyptalum Co., Ltd. Im interested in your products and would like to request a quote for the items listed in the attached document. Please provide pricing, availability, and any relevant details. Feel free to contact me if you need further information. I look forward to your response. Best regards, Hassan Macki Egyptalum Ltd Tel: 0 691 470 049 / 0 691 650 001
Attachments:	Order_List.rar

Headers

Key	Value
Received	from [204.10.160.177] (unknown [204.10.160.177])
by SJ0PR09MB6464.namprd09.prod.outlook.com (2603	10b6:a03:26d::13) with
2025 09	30:54 +0000
(2603	10b6:930:1::22) with Microsoft SMTP Server (version=TLS1_3,
7 Jan 2025 09	30:54 +0000
Authentication-Results	spf=pass (sender IP is 130.185.83.231)
Received-SPF	pass (serv01.republica45.com: connection is authenticated)
via Frontend Transport; Tue, 7 Jan 2025 09	30:54 +0000
for <buildingpermits@marionfl.org>; Tue, 7 Jan 2025 08	55:18 +0000 (WET)
Authentication-Results-Original	serv01.republica45.com; spf=pass (sender IP
From	Hassan Macki <nuno.pascoa@creative-cork.com>
To	buildingpermits@marionfl.org
Subject	New order 2025
Date	7 Jan 2025 00:55:17 -0800
Message-ID	<20250107005516.B1EB42501446F173@creative-cork.com>
MIME-Version	1.0
Content-Type	multipart/mixed;
Return-Path	nuno.pascoa@creative-cork.com
X-EOPAttributedMessage	0
X-EOPTenantAttributedMessage	25a1914d-7aca-40d5-91d5-cd84a5137a31:0
X-MS-PublicTrafficType	Email
X-MS-TrafficTypeDiagnostic	DS1PEPF00017E07:EE_\|SJ0PR09MB6464:EE_
X-MS-Office365-Filtering-Correlation-Id	8bed4a55-4f62-4f25-8626-08dd2efdfc0a
X-MS-Exchange-AtpMessageProperties	SA\|SL
date	Tue, 07 Jan 2025 09:55:17 +0100

File Icon


Icon Hash:	c4e1928eacb280a2

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-07T14:01:58.508583+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.18	49707	193.122.6.168	80	TCP
2025-01-07T14:01:59.448592+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.18	49707	193.122.6.168	80	TCP
2025-01-07T14:02:00.021731+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.18	49709	188.114.97.3	443	TCP
2025-01-07T14:02:00.729597+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.18	49710	193.122.6.168	80	TCP
2025-01-07T14:02:06.149601+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.18	49719	193.122.6.168	80	TCP
2025-01-07T14:02:07.028602+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.18	49719	193.122.6.168	80	TCP
2025-01-07T14:02:07.605172+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.18	49723	188.114.97.3	443	TCP
2025-01-07T14:02:08.334906+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.18	49725	193.122.6.168	80	TCP
2025-01-07T14:02:09.607599+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.18	49727	193.122.6.168	80	TCP
2025-01-07T14:02:16.582607+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.18	49737	193.122.6.168	80	TCP
2025-01-07T14:02:17.556613+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.18	49737	193.122.6.168	80	TCP
2025-01-07T14:02:18.129918+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.18	49739	188.114.97.3	443	TCP
2025-01-07T14:02:18.833624+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.18	49740	193.122.6.168	80	TCP
2025-01-07T14:02:21.352622+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.18	49744	193.122.6.168	80	TCP
2025-01-07T14:02:22.294022+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.18	49744	193.122.6.168	80	TCP
2025-01-07T14:02:22.858665+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.18	49749	188.114.97.3	443	TCP
2025-01-07T14:02:23.392614+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.18	49751	193.122.130.0	80	TCP
2025-01-07T14:02:30.118578+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.18	49766	193.122.130.0	80	TCP
2025-01-07T14:02:30.884588+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.18	49766	193.122.130.0	80	TCP
2025-01-07T14:02:31.423685+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.18	49769	188.114.97.3	443	TCP
2025-01-07T14:02:32.022292+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.18	49770	193.122.130.0	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 14:01:56.717693090 CET	49707	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:01:56.722548962 CET	80	49707	193.122.6.168	192.168.2.18
Jan 7, 2025 14:01:56.722631931 CET	49707	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:01:56.722841978 CET	49707	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:01:56.727638960 CET	80	49707	193.122.6.168	192.168.2.18
Jan 7, 2025 14:01:58.266264915 CET	80	49707	193.122.6.168	192.168.2.18
Jan 7, 2025 14:01:58.266598940 CET	80	49707	193.122.6.168	192.168.2.18
Jan 7, 2025 14:01:58.266655922 CET	49707	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:01:58.266882896 CET	80	49707	193.122.6.168	192.168.2.18
Jan 7, 2025 14:01:58.266927004 CET	49707	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:01:58.267277002 CET	80	49707	193.122.6.168	192.168.2.18
Jan 7, 2025 14:01:58.267330885 CET	49707	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:01:58.270286083 CET	49707	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:01:58.275012016 CET	80	49707	193.122.6.168	192.168.2.18
Jan 7, 2025 14:01:58.456536055 CET	80	49707	193.122.6.168	192.168.2.18
Jan 7, 2025 14:01:58.504271984 CET	49708	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:01:58.504296064 CET	443	49708	188.114.97.3	192.168.2.18
Jan 7, 2025 14:01:58.504368067 CET	49708	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:01:58.508583069 CET	49707	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:01:58.510360956 CET	49708	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:01:58.510376930 CET	443	49708	188.114.97.3	192.168.2.18
Jan 7, 2025 14:01:58.987565994 CET	443	49708	188.114.97.3	192.168.2.18
Jan 7, 2025 14:01:58.987651110 CET	49708	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:01:58.990777969 CET	49708	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:01:58.990791082 CET	443	49708	188.114.97.3	192.168.2.18
Jan 7, 2025 14:01:58.991092920 CET	443	49708	188.114.97.3	192.168.2.18
Jan 7, 2025 14:01:59.033597946 CET	49708	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:01:59.038197994 CET	49708	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:01:59.079349041 CET	443	49708	188.114.97.3	192.168.2.18
Jan 7, 2025 14:01:59.148310900 CET	443	49708	188.114.97.3	192.168.2.18
Jan 7, 2025 14:01:59.148401976 CET	443	49708	188.114.97.3	192.168.2.18
Jan 7, 2025 14:01:59.148453951 CET	49708	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:01:59.153870106 CET	49708	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:01:59.157268047 CET	49707	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:01:59.162189960 CET	80	49707	193.122.6.168	192.168.2.18
Jan 7, 2025 14:01:59.406440973 CET	80	49707	193.122.6.168	192.168.2.18
Jan 7, 2025 14:01:59.408371925 CET	49709	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:01:59.408410072 CET	443	49709	188.114.97.3	192.168.2.18
Jan 7, 2025 14:01:59.408476114 CET	49709	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:01:59.408786058 CET	49709	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:01:59.408799887 CET	443	49709	188.114.97.3	192.168.2.18
Jan 7, 2025 14:01:59.448591948 CET	49707	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:01:59.874049902 CET	443	49709	188.114.97.3	192.168.2.18
Jan 7, 2025 14:01:59.876466036 CET	49709	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:01:59.876487970 CET	443	49709	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:00.021752119 CET	443	49709	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:00.021815062 CET	443	49709	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:00.021889925 CET	49709	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:00.022305012 CET	49709	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:00.025608063 CET	49707	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:00.026885986 CET	49710	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:00.030582905 CET	80	49707	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:00.030654907 CET	49707	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:00.031735897 CET	80	49710	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:00.031817913 CET	49710	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:00.031929016 CET	49710	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:00.036665916 CET	80	49710	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:00.669891119 CET	80	49710	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:00.671282053 CET	49711	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:00.671302080 CET	443	49711	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:00.671374083 CET	49711	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:00.671627998 CET	49711	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:00.671639919 CET	443	49711	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:00.729597092 CET	49710	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:01.127559900 CET	443	49711	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:01.129256010 CET	49711	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:01.129275084 CET	443	49711	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:01.268759012 CET	443	49711	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:01.268827915 CET	443	49711	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:01.268882036 CET	49711	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:01.269428015 CET	49711	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:01.274346113 CET	49712	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:01.279212952 CET	80	49712	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:01.279309034 CET	49712	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:01.279412985 CET	49712	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:01.284198046 CET	80	49712	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:01.925554991 CET	80	49712	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:01.927194118 CET	49713	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:01.927239895 CET	443	49713	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:01.927350998 CET	49713	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:01.927973032 CET	49713	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:01.927988052 CET	443	49713	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:01.970632076 CET	49712	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:02.403270960 CET	443	49713	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:02.404814005 CET	49713	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:02.404846907 CET	443	49713	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:02.551490068 CET	443	49713	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:02.551558971 CET	443	49713	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:02.551688910 CET	49713	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:02.552246094 CET	49713	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:02.555939913 CET	49712	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:02.560039997 CET	49714	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:02.560981989 CET	80	49712	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:02.561078072 CET	49712	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:02.564933062 CET	80	49714	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:02.565046072 CET	49714	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:02.592513084 CET	49714	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:02.597328901 CET	80	49714	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:03.216233969 CET	80	49714	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:03.217643023 CET	49715	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:03.217670918 CET	443	49715	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:03.217767954 CET	49715	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:03.218017101 CET	49715	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:03.218028069 CET	443	49715	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:03.261629105 CET	49714	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:03.673501968 CET	443	49715	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:03.675138950 CET	49715	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:03.675165892 CET	443	49715	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:03.808815956 CET	443	49715	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:03.808882952 CET	443	49715	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:03.808929920 CET	49715	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:03.809312105 CET	49715	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:03.812639952 CET	49714	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:03.813812017 CET	49716	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:03.817639112 CET	80	49714	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:03.817703009 CET	49714	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:03.818584919 CET	80	49716	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:03.818675041 CET	49716	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:03.818759918 CET	49716	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:03.823545933 CET	80	49716	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:04.445358992 CET	80	49716	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:04.446718931 CET	49717	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:04.446763992 CET	443	49717	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:04.446845055 CET	49717	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:04.447123051 CET	49717	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:04.447135925 CET	443	49717	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:04.490612984 CET	49716	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:04.914544106 CET	443	49717	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:04.916749001 CET	49717	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:04.916784048 CET	443	49717	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:05.106590986 CET	443	49717	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:05.106796026 CET	443	49717	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:05.106879950 CET	49717	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:05.107809067 CET	49717	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:05.133136988 CET	49716	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:05.138264894 CET	80	49716	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:05.138340950 CET	49716	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:05.139200926 CET	49718	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:05.144089937 CET	80	49718	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:05.144182920 CET	49718	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:05.144530058 CET	49718	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:05.149334908 CET	80	49718	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:05.241493940 CET	49719	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:05.246397972 CET	80	49719	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:05.246491909 CET	49719	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:05.246720076 CET	49719	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:05.251490116 CET	80	49719	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:05.828253984 CET	80	49718	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:05.829718113 CET	49720	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:05.829757929 CET	443	49720	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:05.829843998 CET	49720	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:05.830178022 CET	49720	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:05.830188036 CET	443	49720	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:05.877609015 CET	49718	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:05.904905081 CET	80	49719	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:05.908328056 CET	49719	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:05.913173914 CET	80	49719	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:06.100987911 CET	80	49719	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:06.135116100 CET	49721	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:06.135154009 CET	443	49721	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:06.135257006 CET	49721	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:06.139187098 CET	49721	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:06.139205933 CET	443	49721	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:06.149600983 CET	49719	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:06.295676947 CET	443	49720	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:06.297704935 CET	49720	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:06.297713995 CET	443	49720	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:06.450076103 CET	443	49720	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:06.450143099 CET	443	49720	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:06.450196981 CET	49720	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:06.450650930 CET	49720	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:06.454190016 CET	49718	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:06.455533028 CET	49722	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:06.459255934 CET	80	49718	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:06.460340977 CET	80	49722	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:06.460405111 CET	49718	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:06.460441113 CET	49722	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:06.460551023 CET	49722	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:06.465727091 CET	80	49722	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:06.606035948 CET	443	49721	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:06.606122971 CET	49721	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:06.607568979 CET	49721	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:06.607577085 CET	443	49721	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:06.607866049 CET	443	49721	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:06.659276009 CET	49721	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:06.703325987 CET	443	49721	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:06.764327049 CET	443	49721	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:06.764393091 CET	443	49721	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:06.764502048 CET	49721	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:06.767328024 CET	49721	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:06.770849943 CET	49719	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:06.776257038 CET	80	49719	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:06.973578930 CET	80	49719	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:06.975543022 CET	49723	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:06.975575924 CET	443	49723	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:06.975703001 CET	49723	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:06.976038933 CET	49723	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:06.976053953 CET	443	49723	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:07.028601885 CET	49719	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:07.111571074 CET	80	49722	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:07.116036892 CET	49724	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:07.116082907 CET	443	49724	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:07.116167068 CET	49724	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:07.116528034 CET	49724	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:07.116544008 CET	443	49724	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:07.156707048 CET	49722	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:07.454236031 CET	443	49723	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:07.455970049 CET	49723	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:07.456006050 CET	443	49723	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:07.591434956 CET	443	49724	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:07.600675106 CET	49724	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:07.600708008 CET	443	49724	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:07.605209112 CET	443	49723	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:07.605264902 CET	443	49723	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:07.605307102 CET	49723	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:07.606327057 CET	49723	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:07.629728079 CET	49719	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:07.634705067 CET	49725	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:07.634845018 CET	80	49719	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:07.634896040 CET	49719	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:07.639556885 CET	80	49725	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:07.639664888 CET	49725	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:07.639748096 CET	49725	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:07.645113945 CET	80	49725	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:07.757142067 CET	443	49724	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:07.757210970 CET	443	49724	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:07.757256985 CET	49724	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:07.757795095 CET	49724	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:08.294661999 CET	80	49725	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:08.296067953 CET	49726	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:08.296123981 CET	443	49726	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:08.296192884 CET	49726	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:08.296443939 CET	49726	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:08.296458960 CET	443	49726	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:08.334906101 CET	49725	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:08.755570889 CET	443	49726	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:08.757126093 CET	49726	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:08.757158041 CET	443	49726	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:08.902744055 CET	443	49726	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:08.902820110 CET	443	49726	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:08.903065920 CET	49726	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:08.903326035 CET	49726	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:08.906512976 CET	49725	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:08.907836914 CET	49727	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:08.911484957 CET	80	49725	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:08.911593914 CET	49725	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:08.912575006 CET	80	49727	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:08.912652969 CET	49727	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:08.912718058 CET	49727	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:08.917480946 CET	80	49727	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:09.556632996 CET	80	49727	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:09.557995081 CET	49728	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:09.558027029 CET	443	49728	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:09.558099985 CET	49728	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:09.558408976 CET	49728	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:09.558420897 CET	443	49728	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:09.607599020 CET	49727	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:10.043895006 CET	443	49728	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:10.045844078 CET	49728	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:10.045866966 CET	443	49728	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:10.194402933 CET	443	49728	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:10.194485903 CET	443	49728	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:10.194647074 CET	49728	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:10.195168018 CET	49728	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:10.199955940 CET	49729	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:10.204864025 CET	80	49729	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:10.204984903 CET	49729	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:10.205096960 CET	49729	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:10.209876060 CET	80	49729	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:10.831182003 CET	80	49729	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:10.832678080 CET	49730	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:10.832729101 CET	443	49730	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:10.832823038 CET	49730	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:10.833085060 CET	49730	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:10.833097935 CET	443	49730	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:10.881608963 CET	49729	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:11.320003033 CET	443	49730	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:11.322099924 CET	49730	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:11.322133064 CET	443	49730	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:11.472210884 CET	443	49730	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:11.472274065 CET	443	49730	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:11.472342968 CET	49730	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:11.472784042 CET	49730	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:11.476784945 CET	49729	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:11.478290081 CET	49731	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:11.481807947 CET	80	49729	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:11.481873989 CET	49729	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:11.483136892 CET	80	49731	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:11.483211040 CET	49731	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:11.483297110 CET	49731	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:11.488030910 CET	80	49731	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:12.138329029 CET	80	49731	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:12.139642954 CET	49732	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:12.139689922 CET	443	49732	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:12.139780998 CET	49732	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:12.140022993 CET	49732	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:12.140036106 CET	443	49732	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:12.191612005 CET	49731	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:12.605655909 CET	443	49732	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:12.607405901 CET	49732	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:12.607439041 CET	443	49732	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:12.735979080 CET	443	49732	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:12.736051083 CET	443	49732	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:12.736126900 CET	49732	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:12.737670898 CET	49732	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:12.741056919 CET	49731	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:12.742513895 CET	49733	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:12.745995998 CET	80	49731	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:12.746078014 CET	49731	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:12.747368097 CET	80	49733	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:12.747451067 CET	49733	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:12.747528076 CET	49733	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:12.752348900 CET	80	49733	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:13.382684946 CET	80	49733	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:13.384108067 CET	49734	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:13.384154081 CET	443	49734	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:13.384217978 CET	49734	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:13.384491920 CET	49734	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:13.384505033 CET	443	49734	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:13.437623978 CET	49733	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:13.844882965 CET	443	49734	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:13.846470118 CET	49734	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:13.846503973 CET	443	49734	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:13.997109890 CET	443	49734	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:13.997195005 CET	443	49734	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:13.997255087 CET	49734	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:13.997733116 CET	49734	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:14.001199961 CET	49733	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:14.002362013 CET	49735	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:14.006254911 CET	80	49733	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:14.006314993 CET	49733	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:14.007194042 CET	80	49735	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:14.007267952 CET	49735	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:14.007363081 CET	49735	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:14.012080908 CET	80	49735	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:14.675405979 CET	80	49735	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:14.676949978 CET	49736	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:14.677010059 CET	443	49736	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:14.677103043 CET	49736	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:14.677365065 CET	49736	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:14.677382946 CET	443	49736	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:14.730645895 CET	49735	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:15.165332079 CET	443	49736	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:15.166877031 CET	49736	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:15.166904926 CET	443	49736	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:15.297852039 CET	443	49736	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:15.297930002 CET	443	49736	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:15.297988892 CET	49736	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:15.298482895 CET	49736	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:15.386636019 CET	49737	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:15.391568899 CET	80	49737	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:15.391643047 CET	49737	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:15.391864061 CET	49737	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:15.396634102 CET	80	49737	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:16.350814104 CET	80	49737	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:16.354557991 CET	49737	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:16.359389067 CET	80	49737	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:16.541753054 CET	80	49737	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:16.578691006 CET	49738	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:16.578739882 CET	443	49738	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:16.578906059 CET	49738	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:16.582607031 CET	49737	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:16.584201097 CET	49738	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:16.584213972 CET	443	49738	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:17.089322090 CET	443	49738	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:17.089397907 CET	49738	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:17.090986967 CET	49738	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:17.090997934 CET	443	49738	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:17.091350079 CET	443	49738	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:17.135853052 CET	49738	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:17.179322958 CET	443	49738	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:17.255600929 CET	443	49738	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:17.255691051 CET	443	49738	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:17.257508993 CET	49738	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:17.291168928 CET	49738	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:17.316756010 CET	49737	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:17.321671963 CET	80	49737	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:17.504571915 CET	80	49737	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:17.506541014 CET	49739	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:17.506594896 CET	443	49739	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:17.506666899 CET	49739	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:17.506968021 CET	49739	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:17.506983042 CET	443	49739	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:17.556612968 CET	49737	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:17.977739096 CET	443	49739	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:17.979695082 CET	49739	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:17.979732990 CET	443	49739	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:18.130001068 CET	443	49739	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:18.130089045 CET	443	49739	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:18.130151987 CET	49739	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:18.130603075 CET	49739	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:18.134083033 CET	49737	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:18.135338068 CET	49740	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:18.139075994 CET	80	49737	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:18.139141083 CET	49737	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:18.140137911 CET	80	49740	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:18.140239954 CET	49740	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:18.140317917 CET	49740	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:18.145051003 CET	80	49740	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:18.776488066 CET	80	49740	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:18.777935028 CET	49741	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:18.777981997 CET	443	49741	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:18.778079033 CET	49741	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:18.778309107 CET	49741	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:18.778322935 CET	443	49741	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:18.833623886 CET	49740	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:19.248051882 CET	443	49741	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:19.250366926 CET	49741	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:19.250394106 CET	443	49741	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:19.387140989 CET	443	49741	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:19.387212038 CET	443	49741	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:19.387490988 CET	49741	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:19.387764931 CET	49741	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:19.392709970 CET	49742	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:19.397567034 CET	80	49742	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:19.397654057 CET	49742	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:19.397754908 CET	49742	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:19.402519941 CET	80	49742	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:20.050287962 CET	80	49742	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:20.051718950 CET	49743	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:20.051762104 CET	443	49743	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:20.051841021 CET	49743	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:20.052068949 CET	49743	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:20.052079916 CET	443	49743	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:20.092660904 CET	49742	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:20.416553974 CET	49744	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:20.421757936 CET	80	49744	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:20.421835899 CET	49744	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:20.422053099 CET	49744	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:20.426821947 CET	80	49744	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:20.622117996 CET	443	49743	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:20.624732971 CET	49743	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:20.624752998 CET	443	49743	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:20.780740023 CET	443	49743	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:20.780802965 CET	443	49743	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:20.781250000 CET	49743	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:20.781250000 CET	49743	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:20.785043001 CET	49742	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:20.786163092 CET	49745	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:20.790076971 CET	80	49742	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:20.790152073 CET	49742	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:20.790946007 CET	80	49745	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:20.791053057 CET	49745	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:20.791117907 CET	49745	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:20.795897961 CET	80	49745	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:21.108848095 CET	80	49744	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:21.112325907 CET	49744	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:21.117166042 CET	80	49744	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:21.305742979 CET	80	49744	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:21.344044924 CET	49746	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:21.344096899 CET	443	49746	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:21.344166040 CET	49746	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:21.348071098 CET	49746	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:21.348102093 CET	443	49746	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:21.352622032 CET	49744	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:21.420569897 CET	80	49745	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:21.421891928 CET	49747	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:21.421951056 CET	443	49747	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:21.422020912 CET	49747	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:21.422286034 CET	49747	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:21.422295094 CET	443	49747	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:21.463646889 CET	49745	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:21.892693996 CET	443	49746	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:21.892780066 CET	49746	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:21.894269943 CET	49746	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:21.894293070 CET	443	49746	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:21.894577980 CET	443	49746	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:21.895679951 CET	443	49747	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:21.899250031 CET	49747	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:21.899272919 CET	443	49747	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:21.938844919 CET	49746	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:21.983331919 CET	443	49746	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:22.031867981 CET	443	49747	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:22.031940937 CET	443	49747	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:22.032006979 CET	49747	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:22.032501936 CET	49747	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:22.035635948 CET	49745	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:22.040580034 CET	80	49745	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:22.043257952 CET	49745	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:22.044356108 CET	49748	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:22.049144983 CET	80	49748	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:22.051718950 CET	49748	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:22.051785946 CET	49748	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:22.055077076 CET	443	49746	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:22.055138111 CET	443	49746	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:22.055202007 CET	49746	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:22.056508064 CET	80	49748	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:22.057740927 CET	49746	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:22.060858011 CET	49744	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:22.065709114 CET	80	49744	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:22.246414900 CET	80	49744	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:22.256762028 CET	49749	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:22.256814003 CET	443	49749	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:22.256915092 CET	49749	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:22.257249117 CET	49749	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:22.257265091 CET	443	49749	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:22.294022083 CET	49744	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:22.628787041 CET	80	49748	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:22.630033016 CET	49750	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:22.630073071 CET	443	49750	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:22.630148888 CET	49750	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:22.630381107 CET	49750	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:22.630394936 CET	443	49750	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:22.675601959 CET	49748	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:22.711741924 CET	443	49749	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:22.713438988 CET	49749	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:22.713476896 CET	443	49749	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:22.858679056 CET	443	49749	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:22.858741045 CET	443	49749	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:22.858793974 CET	49749	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:22.859190941 CET	49749	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:22.862859011 CET	49744	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:22.864124060 CET	49751	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:22.868427992 CET	80	49744	193.122.6.168	192.168.2.18
Jan 7, 2025 14:02:22.868480921 CET	49744	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:02:22.869003057 CET	80	49751	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:22.869071960 CET	49751	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:22.869162083 CET	49751	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:22.874665022 CET	80	49751	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:23.101562977 CET	443	49750	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:23.103182077 CET	49750	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:23.103203058 CET	443	49750	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:23.255764008 CET	443	49750	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:23.255831003 CET	443	49750	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:23.255882978 CET	49750	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:23.256279945 CET	49750	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:23.259736061 CET	49748	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:23.261068106 CET	49752	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:23.264741898 CET	80	49748	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:23.264805079 CET	49748	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:23.265878916 CET	80	49752	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:23.265969992 CET	49752	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:23.266052961 CET	49752	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:23.270881891 CET	80	49752	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:23.344997883 CET	80	49751	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:23.346201897 CET	49753	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:23.346239090 CET	443	49753	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:23.346313953 CET	49753	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:23.346551895 CET	49753	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:23.346565008 CET	443	49753	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:23.392613888 CET	49751	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:23.769535065 CET	80	49752	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:23.770828962 CET	49754	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:23.770878077 CET	443	49754	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:23.771471977 CET	49754	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:23.771739006 CET	49754	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:23.771754980 CET	443	49754	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:23.822599888 CET	49752	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:23.850970030 CET	443	49753	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:23.852931023 CET	49753	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:23.852952003 CET	443	49753	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:23.984915018 CET	443	49753	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:23.985011101 CET	443	49753	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:23.985630035 CET	49753	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:23.985888958 CET	49753	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:23.990384102 CET	49755	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:23.996593952 CET	80	49755	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:23.996661901 CET	49755	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:23.996748924 CET	49755	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:24.002959013 CET	80	49755	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:24.226104975 CET	443	49754	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:24.231528997 CET	49754	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:24.231556892 CET	443	49754	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:24.386702061 CET	443	49754	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:24.386773109 CET	443	49754	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:24.386826992 CET	49754	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:24.387211084 CET	49754	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:24.390511990 CET	49752	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:24.391699076 CET	49756	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:24.395466089 CET	80	49752	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:24.395529985 CET	49752	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:24.396480083 CET	80	49756	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:24.396567106 CET	49756	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:24.396652937 CET	49756	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:24.401464939 CET	80	49756	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:24.452522993 CET	80	49755	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:24.453820944 CET	49757	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:24.453870058 CET	443	49757	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:24.453946114 CET	49757	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:24.454200029 CET	49757	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:24.454215050 CET	443	49757	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:24.507575035 CET	49755	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:24.872045040 CET	80	49756	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:24.873768091 CET	49758	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:24.873820066 CET	443	49758	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:24.873985052 CET	49758	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:24.874211073 CET	49758	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:24.874219894 CET	443	49758	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:24.916610003 CET	49756	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:24.917694092 CET	443	49757	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:24.919301987 CET	49757	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:24.919328928 CET	443	49757	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:25.076150894 CET	443	49757	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:25.076220989 CET	443	49757	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:25.076303005 CET	49757	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:25.076770067 CET	49757	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:25.080290079 CET	49755	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:25.081490993 CET	49759	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:25.085427046 CET	80	49755	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:25.085493088 CET	49755	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:25.086494923 CET	80	49759	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:25.086584091 CET	49759	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:25.086719036 CET	49759	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:25.091439009 CET	80	49759	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:25.356800079 CET	443	49758	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:25.358429909 CET	49758	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:25.358445883 CET	443	49758	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:25.508428097 CET	443	49758	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:25.508497953 CET	443	49758	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:25.508569956 CET	49758	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:25.508944035 CET	49758	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:25.582890987 CET	80	49759	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:25.584101915 CET	49760	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:25.584150076 CET	443	49760	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:25.584232092 CET	49760	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:25.584445000 CET	49760	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:25.584456921 CET	443	49760	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:25.633636951 CET	49759	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:26.050755024 CET	443	49760	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:26.052423954 CET	49760	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:26.052459955 CET	443	49760	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:26.195529938 CET	443	49760	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:26.195596933 CET	443	49760	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:26.195741892 CET	49760	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:26.196110010 CET	49760	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:26.199527979 CET	49759	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:26.200783968 CET	49761	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:26.204551935 CET	80	49759	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:26.204665899 CET	49759	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:26.205693960 CET	80	49761	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:26.205822945 CET	49761	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:26.205889940 CET	49761	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:26.210684061 CET	80	49761	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:26.767163038 CET	80	49761	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:26.768404961 CET	49762	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:26.768440962 CET	443	49762	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:26.768527031 CET	49762	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:26.768759966 CET	49762	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:26.768774986 CET	443	49762	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:26.813632011 CET	49761	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:27.243197918 CET	443	49762	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:27.245106936 CET	49762	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:27.245138884 CET	443	49762	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:27.375849009 CET	443	49762	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:27.375909090 CET	443	49762	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:27.375967026 CET	49762	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:27.376420975 CET	49762	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:27.379743099 CET	49761	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:27.381021976 CET	49763	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:27.384680033 CET	80	49761	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:27.384736061 CET	49761	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:27.385842085 CET	80	49763	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:27.385912895 CET	49763	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:27.386003017 CET	49763	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:27.390759945 CET	80	49763	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:27.944905996 CET	80	49763	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:27.946135044 CET	49764	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:27.946167946 CET	443	49764	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:27.946238995 CET	49764	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:27.946471930 CET	49764	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:27.946484089 CET	443	49764	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:27.994571924 CET	49763	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:28.405571938 CET	443	49764	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:28.407227993 CET	49764	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:28.407246113 CET	443	49764	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:28.555572987 CET	443	49764	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:28.555641890 CET	443	49764	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:28.555691004 CET	49764	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:28.556986094 CET	49764	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:28.560508013 CET	49763	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:28.561676025 CET	49765	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:28.565574884 CET	80	49763	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:28.565648079 CET	49763	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:28.566494942 CET	80	49765	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:28.566592932 CET	49765	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:28.566704988 CET	49765	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:28.571466923 CET	80	49765	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:28.883923054 CET	49766	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:28.888890982 CET	80	49766	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:28.888972998 CET	49766	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:28.889183044 CET	49766	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:28.894006968 CET	80	49766	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:29.167030096 CET	80	49765	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:29.168406963 CET	49767	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:29.168453932 CET	443	49767	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:29.168536901 CET	49767	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:29.168796062 CET	49767	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:29.168811083 CET	443	49767	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:29.209600925 CET	49765	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:29.624147892 CET	443	49767	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:29.625751019 CET	49767	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:29.625787020 CET	443	49767	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:29.765945911 CET	443	49767	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:29.766006947 CET	443	49767	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:29.766062021 CET	49767	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:29.766442060 CET	49767	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:29.926017046 CET	80	49766	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:29.929765940 CET	49766	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:29.934607029 CET	80	49766	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:30.064976931 CET	80	49766	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:30.097532988 CET	49768	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:30.097583055 CET	443	49768	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:30.097665071 CET	49768	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:30.101449013 CET	49768	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:30.101463079 CET	443	49768	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:30.118577957 CET	49766	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:30.556762934 CET	443	49768	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:30.556853056 CET	49768	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:30.558254004 CET	49768	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:30.558264017 CET	443	49768	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:30.558547974 CET	443	49768	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:30.603202105 CET	49768	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:30.647336006 CET	443	49768	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:30.709434032 CET	443	49768	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:30.709495068 CET	443	49768	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:30.709641933 CET	49768	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:30.715212107 CET	49768	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:30.720112085 CET	49766	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:30.724961996 CET	80	49766	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:30.829582930 CET	80	49766	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:30.831437111 CET	49769	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:30.831484079 CET	443	49769	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:30.831707954 CET	49769	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:30.831996918 CET	49769	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:30.832010984 CET	443	49769	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:30.884588003 CET	49766	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:31.287729025 CET	443	49769	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:31.290076017 CET	49769	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:31.290097952 CET	443	49769	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:31.423731089 CET	443	49769	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:31.423830032 CET	443	49769	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:31.423893929 CET	49769	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:31.424340010 CET	49769	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:31.427875996 CET	49766	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:31.429104090 CET	49770	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:31.433702946 CET	80	49766	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:31.433758974 CET	49766	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:31.433962107 CET	80	49770	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:31.434026003 CET	49770	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:31.434106112 CET	49770	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:31.438847065 CET	80	49770	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:32.022121906 CET	80	49770	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:32.022291899 CET	49770	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:32.023367882 CET	49771	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:32.023410082 CET	443	49771	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:32.023699045 CET	49771	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:32.025499105 CET	49771	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:32.025527000 CET	443	49771	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:32.027343035 CET	80	49770	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:32.027688980 CET	49770	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:32.481720924 CET	443	49771	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:32.483345985 CET	49771	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:32.483371019 CET	443	49771	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:32.711626053 CET	443	49771	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:32.711694956 CET	443	49771	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:32.711744070 CET	49771	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:32.712256908 CET	49771	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:32.717849970 CET	49772	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:32.722755909 CET	80	49772	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:32.722836971 CET	49772	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:32.722929001 CET	49772	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:32.727679014 CET	80	49772	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:33.321785927 CET	80	49772	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:33.373615026 CET	49772	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:33.496001959 CET	49773	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:33.496035099 CET	443	49773	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:33.496114016 CET	49773	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:33.496386051 CET	49773	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:33.496397972 CET	443	49773	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:33.991833925 CET	443	49773	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:33.993383884 CET	49773	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:33.993416071 CET	443	49773	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:34.128577948 CET	443	49773	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:34.128635883 CET	443	49773	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:34.128694057 CET	49773	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:34.129081011 CET	49773	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:34.132350922 CET	49772	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:34.133657932 CET	49774	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:34.137321949 CET	80	49772	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:34.137381077 CET	49772	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:34.138411045 CET	80	49774	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:34.138493061 CET	49774	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:34.138571024 CET	49774	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:34.143301964 CET	80	49774	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:34.831274033 CET	80	49774	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:34.832508087 CET	49775	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:34.832544088 CET	443	49775	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:34.832613945 CET	49775	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:34.832856894 CET	49775	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:34.832871914 CET	443	49775	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:34.875648022 CET	49774	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:35.340292931 CET	443	49775	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:35.342407942 CET	49775	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:35.342441082 CET	443	49775	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:35.492055893 CET	443	49775	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:35.492124081 CET	443	49775	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:35.492166996 CET	49775	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:35.492537022 CET	49775	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:35.495763063 CET	49774	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:35.496927977 CET	49777	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:35.502800941 CET	80	49774	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:35.502878904 CET	49774	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:35.503690004 CET	80	49777	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:35.503771067 CET	49777	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:35.503869057 CET	49777	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:35.508949995 CET	80	49777	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:35.999098063 CET	80	49777	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:36.000380039 CET	49778	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:36.000425100 CET	443	49778	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:36.000494003 CET	49778	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:36.000754118 CET	49778	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:36.000763893 CET	443	49778	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:36.053608894 CET	49777	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:36.457937956 CET	443	49778	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:36.459512949 CET	49778	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:36.459541082 CET	443	49778	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:36.606050014 CET	443	49778	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:36.606106997 CET	443	49778	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:36.606245041 CET	49778	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:36.606508017 CET	49778	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:36.609720945 CET	49777	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:36.610882998 CET	49779	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:36.614658117 CET	80	49777	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:36.614710093 CET	49777	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:36.615726948 CET	80	49779	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:36.616077900 CET	49779	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:36.616218090 CET	49779	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:36.621043921 CET	80	49779	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:37.070738077 CET	80	49779	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:37.072002888 CET	49781	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:37.072045088 CET	443	49781	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:37.072127104 CET	49781	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:37.072403908 CET	49781	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:37.072417021 CET	443	49781	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:37.123620033 CET	49779	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:37.528084993 CET	443	49781	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:37.529690027 CET	49781	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:37.529706001 CET	443	49781	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:37.667526007 CET	443	49781	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:37.667598963 CET	443	49781	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:37.667658091 CET	49781	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:37.668040037 CET	49781	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:37.671335936 CET	49779	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:37.672419071 CET	49782	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:37.676343918 CET	80	49779	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:37.676393032 CET	49779	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:37.677200079 CET	80	49782	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:37.677289963 CET	49782	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:37.677372932 CET	49782	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:37.682131052 CET	80	49782	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:38.510792971 CET	80	49782	193.122.130.0	192.168.2.18
Jan 7, 2025 14:02:38.512233973 CET	49783	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:38.512280941 CET	443	49783	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:38.512381077 CET	49783	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:38.512705088 CET	49783	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:38.512721062 CET	443	49783	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:38.559642076 CET	49782	80	192.168.2.18	193.122.130.0
Jan 7, 2025 14:02:38.995903969 CET	443	49783	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:38.997678995 CET	49783	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:38.997709036 CET	443	49783	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:39.133408070 CET	443	49783	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:39.133469105 CET	443	49783	188.114.97.3	192.168.2.18
Jan 7, 2025 14:02:39.133594036 CET	49783	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:02:39.134020090 CET	49783	443	192.168.2.18	188.114.97.3
Jan 7, 2025 14:03:05.666760921 CET	80	49710	193.122.6.168	192.168.2.18
Jan 7, 2025 14:03:05.666867018 CET	49710	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:03:12.111716986 CET	80	49722	193.122.6.168	192.168.2.18
Jan 7, 2025 14:03:12.111769915 CET	49722	80	192.168.2.18	193.122.6.168
Jan 7, 2025 14:03:14.556459904 CET	80	49727	193.122.6.168	192.168.2.18
Jan 7, 2025 14:03:14.556530952 CET	49727	80	192.168.2.18	193.122.6.168

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 14:01:56.705761909 CET	64336	53	192.168.2.18	1.1.1.1
Jan 7, 2025 14:01:56.712439060 CET	53	64336	1.1.1.1	192.168.2.18
Jan 7, 2025 14:01:58.496840000 CET	53013	53	192.168.2.18	1.1.1.1
Jan 7, 2025 14:01:58.503623962 CET	53	53013	1.1.1.1	192.168.2.18
Jan 7, 2025 14:02:22.036209106 CET	52505	53	192.168.2.18	1.1.1.1
Jan 7, 2025 14:02:22.043195009 CET	53	52505	1.1.1.1	192.168.2.18

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 7, 2025 14:01:56.705761909 CET	192.168.2.18	1.1.1.1	0xcc30	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:01:58.496840000 CET	192.168.2.18	1.1.1.1	0x415f	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:02:22.036209106 CET	192.168.2.18	1.1.1.1	0x5a37	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 7, 2025 14:01:56.712439060 CET	1.1.1.1	192.168.2.18	0xcc30	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 14:01:56.712439060 CET	1.1.1.1	192.168.2.18	0xcc30	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:01:56.712439060 CET	1.1.1.1	192.168.2.18	0xcc30	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:01:56.712439060 CET	1.1.1.1	192.168.2.18	0xcc30	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:01:56.712439060 CET	1.1.1.1	192.168.2.18	0xcc30	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:01:56.712439060 CET	1.1.1.1	192.168.2.18	0xcc30	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:01:58.503623962 CET	1.1.1.1	192.168.2.18	0x415f	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:01:58.503623962 CET	1.1.1.1	192.168.2.18	0x415f	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:02:22.043195009 CET	1.1.1.1	192.168.2.18	0x5a37	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 14:02:22.043195009 CET	1.1.1.1	192.168.2.18	0x5a37	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:02:22.043195009 CET	1.1.1.1	192.168.2.18	0x5a37	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:02:22.043195009 CET	1.1.1.1	192.168.2.18	0x5a37	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:02:22.043195009 CET	1.1.1.1	192.168.2.18	0x5a37	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:02:22.043195009 CET	1.1.1.1	192.168.2.18	0x5a37	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.18	49707	193.122.6.168	80	6864	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:01:56.722841978 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:01:58.266264915 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:01:57 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 7, 2025 14:01:58.266598940 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:01:57 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 7, 2025 14:01:58.266882896 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:01:57 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 7, 2025 14:01:58.267277002 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:01:57 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 7, 2025 14:01:58.270286083 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 7, 2025 14:01:58.456536055 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:01:58 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 7, 2025 14:01:59.157268047 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 7, 2025 14:01:59.406440973 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:01:59 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.18	49710	193.122.6.168	80	6864	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:00.031929016 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 7, 2025 14:02:00.669891119 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:00 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.18	49712	193.122.6.168	80	6864	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:01.279412985 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:01.925554991 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.18	49714	193.122.6.168	80	6864	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:02.592513084 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:03.216233969 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:03 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.18	49716	193.122.6.168	80	6864	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:03.818759918 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:04.445358992 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:04 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.18	49718	193.122.6.168	80	6864	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:05.144530058 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:05.828253984 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:05 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.18	49719	193.122.6.168	80	1940	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:05.246720076 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:05.904905081 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:05 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 7, 2025 14:02:05.908328056 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 7, 2025 14:02:06.100987911 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:06 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 7, 2025 14:02:06.770849943 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 7, 2025 14:02:06.973578930 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:06 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.18	49722	193.122.6.168	80	6864	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:06.460551023 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:07.111571074 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:07 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.18	49725	193.122.6.168	80	1940	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:07.639748096 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 7, 2025 14:02:08.294661999 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:08 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.18	49727	193.122.6.168	80	1940	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:08.912718058 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 7, 2025 14:02:09.556632996 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:09 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.18	49729	193.122.6.168	80	1940	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:10.205096960 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:10.831182003 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:10 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.18	49731	193.122.6.168	80	1940	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:11.483297110 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:12.138329029 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:12 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.18	49733	193.122.6.168	80	1940	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:12.747528076 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:13.382684946 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:13 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.18	49735	193.122.6.168	80	1940	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:14.007363081 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:14.675405979 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:14 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.18	49737	193.122.6.168	80	3184	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:15.391864061 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:16.350814104 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:16 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 7, 2025 14:02:16.354557991 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 7, 2025 14:02:16.541753054 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:16 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 7, 2025 14:02:17.316756010 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 7, 2025 14:02:17.504571915 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:17 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.18	49740	193.122.6.168	80	3184	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:18.140317917 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 7, 2025 14:02:18.776488066 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:18 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.18	49742	193.122.6.168	80	3184	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:19.397754908 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:20.050287962 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:19 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.18	49744	193.122.6.168	80	4404	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:20.422053099 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:21.108848095 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:21 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 7, 2025 14:02:21.112325907 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 7, 2025 14:02:21.305742979 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:21 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 7, 2025 14:02:22.060858011 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 7, 2025 14:02:22.246414900 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:22 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.18	49745	193.122.6.168	80	3184	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:20.791117907 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:21.420569897 CET	273	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:21 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.18	49748	193.122.130.0	80	3184	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:22.051785946 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:22.628787041 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:22 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6cbc47d8a02d9bba7e47592bd5ebe87b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.18	49751	193.122.130.0	80	4404	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:22.869162083 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 7, 2025 14:02:23.344997883 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2e4ed36dd55885a55d7bee777e18c4d9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.18	49752	193.122.130.0	80	3184	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:23.266052961 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:23.769535065 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7f8201eafa90476d4e5d2b98fb57f2ec Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.18	49755	193.122.130.0	80	4404	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:23.996748924 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:24.452522993 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:24 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a8ffe4f7f683c916998f62f6478fd23b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.18	49756	193.122.130.0	80	3184	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:24.396652937 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:24.872045040 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:24 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2b90e72e81b2d68a8a1d9d12295195bd Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.18	49759	193.122.130.0	80	4404	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:25.086719036 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:25.582890987 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:25 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 671cd0fcf3a48a85cb7c1cd0ace3a898 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.18	49761	193.122.130.0	80	4404	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:26.205889940 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:26.767163038 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:26 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e25d4f694c8736fa53089f6c9f88db6f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.18	49763	193.122.130.0	80	4404	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:27.386003017 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:27.944905996 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:27 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7a727ec4187b1136e3f31bd10ed2eec3 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.18	49765	193.122.130.0	80	4404	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:28.566704988 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:29.167030096 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:29 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c1a878d7ea1a73d8dccc2aaca35ea53a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.18	49766	193.122.130.0	80	6608	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:28.889183044 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:29.926017046 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:29 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 23b8cdd653da0a69e9f21a384250c22a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 7, 2025 14:02:29.929765940 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 7, 2025 14:02:30.064976931 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:30 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: bd247d5ebaf723ef26a2b9d6c67ead74 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 7, 2025 14:02:30.720112085 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 7, 2025 14:02:30.829582930 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:30 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3be142b60a0c2ae959764bb51f237c30 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.18	49770	193.122.130.0	80	6608	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:31.434106112 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 7, 2025 14:02:32.022121906 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8c664d77adfe5b837c1ca43fb25dec23 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.18	49772	193.122.130.0	80	6608	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:32.722929001 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:33.321785927 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:33 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b4f8ff39a99a6aeb199775caef5a5579 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.18	49774	193.122.130.0	80	6608	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:34.138571024 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:34.831274033 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 798417ebc42fea25662e6bfdc0be97ee Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.18	49777	193.122.130.0	80	6608	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:35.503869057 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:35.999098063 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:35 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5d57c742d26f7ba55d07f4b89123ae8f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.18	49779	193.122.130.0	80	6608	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:36.616218090 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:37.070738077 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:37 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 57f673c04272e7f47f818c224000a1c3 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.18	49782	193.122.130.0	80	6608	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 14:02:37.677372932 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 7, 2025 14:02:38.510792971 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:38 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8247ed86712583ef6a3feffb3950c7fc Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.18	49708	188.114.97.3	443	6864	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:01:59 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:01:59 UTC	859	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:01:59 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569708 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dwv%2F8V5CwIlD55Ym8xruleQUbMpVybIEKrgBSvz9ti0mn%2FuHCaXxKmMQmHDJ65WhDXE2OxgFl2dlm%2BNLNcmn7sDY6xq1Xl%2BEFYdBW4rK4WMkq3TWitP8FQSgVwg0c8ryvnm%2BvM4z"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe423bc5dcff793-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1474&min_rtt=1471&rtt_var=558&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1950567&cwnd=152&unsent_bytes=0&cid=92f2e49ad2b3a61c&ts=170&x=0"
2025-01-07 13:01:59 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.18	49709	188.114.97.3	443	6864	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:01:59 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-07 13:02:00 UTC	859	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:01:59 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569709 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=evQx23IjC2LTsh%2FYzzfR4BFIM5r37AF0w6UuZlETCR7IxGwMKu8sK7mWsfc6TAe%2B1ey%2BRqhHCOEa7ggF7RdEpJzaAQopBHHdRJ%2F4F89nk8Kylyum9v0yet9W9AybFkg6Y3DL4%2Bja"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe423c1d8cc8c29-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1793&min_rtt=1783&rtt_var=688&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1567364&cwnd=188&unsent_bytes=0&cid=3583d3a10ea0d862&ts=151&x=0"
2025-01-07 13:02:00 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.18	49711	188.114.97.3	443	6864	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:01 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:01 UTC	855	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:01 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569710 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qIuatAYplIQCnb5K3GSMASpIiQxA%2BpP40JDWt2Nl47N1HjoNuSIjIs4zSzgoZLrO5lhs7zAXBTwdq67cKHU8hvbdbpmE4cXNiEE5WASppqi2k%2By4L1TI0C%2F2F8IdLl1xloX2urOv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe423c98e7d8c24-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1781&min_rtt=1777&rtt_var=676&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1608815&cwnd=141&unsent_bytes=0&cid=923abb42d45d4f79&ts=146&x=0"
2025-01-07 13:02:01 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.18	49713	188.114.97.3	443	6864	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:02 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:02 UTC	869	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:02 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569711 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5oeZlQRuFwQq05opZ%2BAanaBa%2BEgqQ%2F%2FVaZ999k%2Fk4Wg%2FSqey%2Bx8GZXg6%2BFIaNvVYc%2BqaLHRkH8Murtr25w8h6XqhFUzw2jS0SBelY86iAddmc%2B8RpubbcQNO3OJ3u1iQ9jC4TKRJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe423d1887042e2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2161&min_rtt=2158&rtt_var=817&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1333942&cwnd=187&unsent_bytes=0&cid=cbc10ec8371f1fc3&ts=155&x=0"
2025-01-07 13:02:02 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.18	49715	188.114.97.3	443	6864	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:03 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:03 UTC	859	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:03 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569712 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3v%2F6S2B%2FxIi7HtSCQk%2BV%2FeLqXVn3gd9fKTLNLuXs3qFAG1nk3dFsRS99jkdVEwvyPUVucPrOcN7KghtQr1xIIR1Lj5qePftOCXE86yALmg8EZZQZx0Sjjxjc8KiInJi%2F1vDjeBbq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe423d97e8c8ce0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2013&min_rtt=2012&rtt_var=758&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1440552&cwnd=211&unsent_bytes=0&cid=f91b266f7752ec16&ts=140&x=0"
2025-01-07 13:02:03 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.18	49717	188.114.97.3	443	6864	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:04 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:05 UTC	859	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:05 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569714 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kHHrwfsPj6WWH1vpTAhOZBR8GOkyopd9YsmAEopZtjy3F1CDR0bh3sXKk1fPlK%2FGDVm6Z3lZaOuvz0sy6dKEC4P1emExLJtalUGjbQqWV1GV%2FE%2B%2FfIBYSLzW4SiY%2F8FwThYPqWrS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe423e1593c8c93-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1817&min_rtt=1808&rtt_var=697&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1548250&cwnd=192&unsent_bytes=0&cid=439e1a0005c66ee5&ts=172&x=0"
2025-01-07 13:02:05 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.18	49720	188.114.97.3	443	6864	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:06 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:06 UTC	849	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:06 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569715 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oHH9UsRPsVOkgF0VKnMRsPV74MdYLBxUbdtrSW5MZdntf2e1q8dXRp8VWcD0Pgu0whFCq49QQKEHn9TJFfP99LT8wy4JjhfcSYiKQZFeQFZhIBucDszoNIA4AS7GFnPx91MIdRMD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe423e9ffef1921-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1815&min_rtt=1534&rtt_var=776&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1903520&cwnd=139&unsent_bytes=0&cid=88beed521021e31d&ts=160&x=0"
2025-01-07 13:02:06 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.18	49721	188.114.97.3	443	1940	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:06 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:06 UTC	855	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:06 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569715 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m7%2FOLMavW7T8e0OZjzo6eJ5D1BXASA6kZAeVoDVmXrK1yAbPhBcPXCZ9IQgg4TOvmc3mIjkas5oQO%2F5Mr5MLXdFojmPQWBkfcNjVdxdHZRYr%2BnulNOHpLn1kG9S852bZ3SzYg3jW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe423ebf93d43cf-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1597&min_rtt=1582&rtt_var=623&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1714621&cwnd=179&unsent_bytes=0&cid=6c71bfe05c9b8867&ts=176&x=0"
2025-01-07 13:02:06 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.18	49723	188.114.97.3	443	1940	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:07 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-07 13:02:07 UTC	857	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:07 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569716 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZJbiZvvEjRBiQVP6OKFHJTKraa5OXtpZPdv3cdvzLHAADAwYlrbUqOB8o4yINXnWDUJ%2FUZY%2FNZggxgicgzrPN0JZqryykNEq9Y%2FhPqhiV8%2FllDP33sei9q8d78G5OpUZHVN7vV7Z"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe423f118194241-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1715&min_rtt=1714&rtt_var=646&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1689814&cwnd=203&unsent_bytes=0&cid=47cd666cfc997ac0&ts=144&x=0"
2025-01-07 13:02:07 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.18	49724	188.114.97.3	443	6864	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:07 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:07 UTC	857	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:07 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569716 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PY2qHjTxSEeUeTub0KFkzCTJ0M11Gww6sQB9wbhqnjC59gBV9xlImd4wDMU0DF7OIHZKdAXDyMsl8ejbsQIqULACzCU7lGd4%2BJwd5O%2FIrloQCBmIAfja6IJbU%2BD%2B84UTAHDukm9I"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe423f218fb43c8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1583&min_rtt=1572&rtt_var=611&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1759036&cwnd=192&unsent_bytes=0&cid=f763657b82caa91b&ts=171&x=0"
2025-01-07 13:02:07 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.18	49726	188.114.97.3	443	1940	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:08 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:08 UTC	859	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:08 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569717 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wW3sTU5G163nK%2FSlGpN5mu8%2FgK6AEi%2FJNB%2FaLHmWr0uUU7G6lavuVj3x0a2Ghnp4S8plk2rY%2FIrWigyCOWg3yLZS1cgBIBOSVnCXBPdEYIy2VO6AdcOfZjz71KgkmpZlX3k3x1Fx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe423f94fdd1a07-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2045&min_rtt=2035&rtt_var=783&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1380614&cwnd=245&unsent_bytes=0&cid=6d244c683a0ec122&ts=154&x=0"
2025-01-07 13:02:08 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.18	49728	188.114.97.3	443	1940	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:10 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:10 UTC	858	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:10 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569719 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qk0I7j81yo1%2FaBq4Gq1RS3XrffOHcILiqlxpKaTm1iW47s2%2FvDlKIdXi009IDXKkTKIwlfAciyFO5yr239MYVNwMPKMzSYA8MKvpN6BQeJec%2BWdYj9KQGyc89l%2BhWnZ0QXD9uLGp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe424016991de99-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7838&min_rtt=1524&rtt_var=4458&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1916010&cwnd=217&unsent_bytes=0&cid=2f70f0fface9faba&ts=155&x=0"
2025-01-07 13:02:10 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.18	49730	188.114.97.3	443	1940	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:11 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:11 UTC	855	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:11 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569720 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p32bp48wdoileZ1GyhfmANIz4fcg7n2Tb10u9HqP0V36035wZ32Jpd%2B9sAP9slf6Q55PGa7qNCrljOHAtUi0CwlLFAkioFk%2FUsgUnGiyEANnjV%2BcW0PSOawKSOYWYrhvBMTYpxRT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4240958ea43f2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1622&min_rtt=1606&rtt_var=635&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1681059&cwnd=207&unsent_bytes=0&cid=57c0ea8a88c5ca36&ts=157&x=0"
2025-01-07 13:02:11 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.18	49732	188.114.97.3	443	1940	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:12 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:12 UTC	855	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:12 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569721 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0T6FBiWkV6mgCz4QqzTyN6BLiF9QhqKxH0eyi51CWpbJuNZWQSLDiy5mw6pBpWjXHZvtwNjN03Pan%2Fs5670Ex%2FooqANjNuvs3UQTlrxhcLA5VTpLkExuowckg1oUj%2BYb3sIfimyB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4241139f8431f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1675&min_rtt=1671&rtt_var=634&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1714621&cwnd=250&unsent_bytes=0&cid=a8d7d1c34a3c7d6e&ts=143&x=0"
2025-01-07 13:02:12 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.18	49734	188.114.97.3	443	1940	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:13 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:13 UTC	860	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:13 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569723 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d%2FRw6HohVL9flyQpE9fjn4mMw%2FN%2FkycrJSWz0p0pdb6InkIaOAtxmvokafJd%2Bft2%2FAa5wyPD3OrzNckdMb2uMCv7gsUBWSm1AIqljsnbANBMRxvlGBXQSF4kG9Qodd1CjW8%2FDovM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe424192af84408-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1775&min_rtt=1582&rtt_var=981&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=932014&cwnd=206&unsent_bytes=0&cid=fee10ef66f9b16af&ts=159&x=0"
2025-01-07 13:02:13 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.18	49736	188.114.97.3	443	1940	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:15 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:15 UTC	860	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:15 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569724 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TNK1F3H9O16KhAIEzueSUqXrEbgQ5i%2F5QjuKCE2KWA76BHL5odnKnJIq9mqDlXHB%2BNEx9ygihgvtKfAiTWM%2BUe9rwUnz4Vd%2FuoNN70kTftX3%2FOcueGgy%2FlhKbd0vJnnvHC9xoVLy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe424213cb24397-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1584&min_rtt=1577&rtt_var=606&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1785932&cwnd=79&unsent_bytes=0&cid=034655ca63580445&ts=147&x=0"
2025-01-07 13:02:15 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.18	49738	188.114.97.3	443	3184	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:17 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:17 UTC	858	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:17 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569726 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UWWJO4ZKaW%2Br1Gwzge0lF3kd%2F0e7NVfRqXL8vbBHKAz1oU%2B01Q%2BYqltI0Ar0RhhWPcnM08QimZmf8PYmrMw8aX3HQneAWOZqvMP7YnWPeLuku5a3h4L%2Bx14aWvmN4M6Qktj1hPDI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4242d7c3b4273-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1731&min_rtt=1718&rtt_var=671&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1598248&cwnd=32&unsent_bytes=0&cid=26099d8259e66992&ts=172&x=0"
2025-01-07 13:02:17 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.18	49739	188.114.97.3	443	3184	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:17 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-07 13:02:18 UTC	849	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:18 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569727 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O3R8Ct04dG59EO0CZMDaJkH8zvrJBToah1SZKl7Yw4s9xT7yuuV99Ta0I620yIyly8EbsjWBkEO3imBuPebBcFhptN5MkUOl0Ia2GdQckWHDi0k319bpZuOKueKKxyHBo3FxwPlK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe42432ed8b19c3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2020&min_rtt=2016&rtt_var=765&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1421616&cwnd=148&unsent_bytes=0&cid=8e4dfeef314d7ed5&ts=156&x=0"
2025-01-07 13:02:18 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.18	49741	188.114.97.3	443	3184	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:19 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:19 UTC	857	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:19 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569728 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VLMjV3Qu8AwjbJkYpijuggWtCrnvz74hko6kKLGGycgq%2F2QwETgcXef%2FjI7XGzJBNL8xncOCoRcqkaZyITNKjB6PTmvYe%2FFtZuY2%2FrYpHf5QoP1jpjHHrGooClNon5G2rSarcd44"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4243ad9864399-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1601&min_rtt=1593&rtt_var=615&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1754807&cwnd=225&unsent_bytes=0&cid=f703d36f74f696f8&ts=143&x=0"
2025-01-07 13:02:19 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.18	49743	188.114.97.3	443	3184	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:20 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:20 UTC	862	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:20 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569729 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3q1w92yWtBtGbz188MJydy1DWLrlKanGXADXgI6lRIlg0ry8LHEw7f%2B3oHX7vsVa7yjcT0bKPR%2F2lp%2F1NKWUrdB02Buq7IhWZ8nG4ls1GYt%2BZONcLDaz63EdobgecbCQp%2BdiTmjM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe424437cd04303-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=22802&min_rtt=1629&rtt_var=13266&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1792510&cwnd=219&unsent_bytes=0&cid=1817c02e7157ed2d&ts=163&x=0"
2025-01-07 13:02:20 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.18	49747	188.114.97.3	443	3184	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:21 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:22 UTC	861	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:21 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569731 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=40wUXBsC1zyBK91Ci%2BU6SWeKNFK1HIhxwBY0oSNkThidsYpodHPJMnDJewxq%2F8LlUH82H%2FI85aZ5%2Bsh%2F2grqwBkwjyupzFn40f9Cw5JciFQRDT120Ifxa6jP9cd1y%2FatVLeLy0Eo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4244b5d5a0fa9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1595&min_rtt=1593&rtt_var=603&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1808049&cwnd=252&unsent_bytes=0&cid=69559e065638056d&ts=141&x=0"
2025-01-07 13:02:22 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.18	49746	188.114.97.3	443	4404	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:21 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:22 UTC	870	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:22 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569731 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BcvP%2FGIpkYDubmAuJViWQRs%2BBe52OTJ29jRi8wj0tfMIp228o33rDN0B8R%2FSy9C19%2Fgo13fklM1BlwU5aW%2BkahuKr9Aq%2B8BM%2BO0ggbJrMYTK6SGTlbG2KW15nm9gRBYq%2F%2Bw9rJh2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4244b7bd12369-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2598&min_rtt=1922&rtt_var=1204&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1519250&cwnd=142&unsent_bytes=0&cid=df3696fa84b815e8&ts=238&x=0"
2025-01-07 13:02:22 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.18	49749	188.114.97.3	443	4404	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:22 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-07 13:02:22 UTC	855	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:22 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569731 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k3tRxlYdX10cv4vXBkkOoKc3oixEXTc7LmrzpRUqPsWcVJ9tEEA2IG0S2%2Fb9EEjj0pDDjX2Yec1YZLmS4cFPChohg7Mde6gGe3wuhi3VbClUyCC0%2Fi6%2BXrq4EQEQizg55wS95S7o"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe424508a980fa9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1632&min_rtt=1631&rtt_var=614&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1777236&cwnd=252&unsent_bytes=0&cid=a5791d05abc3bece&ts=151&x=0"
2025-01-07 13:02:22 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.18	49750	188.114.97.3	443	3184	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:23 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:23 UTC	855	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:23 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569732 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6Z1bSJfXaPyacACM3iMKi2JkzEZvpAC%2BppbmLxZwBFKsELOzL15maHUFRII7kZ0PEvXuuqF8lRPf%2FelLsYuETlW1cWAyUasnNUKdNF5QPULl%2FVubcL43B542onh9v0rsifCjU0lS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe42452fce9427f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1690&min_rtt=1684&rtt_var=645&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1680092&cwnd=239&unsent_bytes=0&cid=e54954fac853a5ff&ts=158&x=0"
2025-01-07 13:02:23 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.18	49753	188.114.97.3	443	4404	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:23 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:23 UTC	855	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:23 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569733 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fKi6EZPjaBoHUIUlhCcoU9jQYFMJBwrYtzbiZKkCuj7fVkgVXfooQZlF%2Fz9Do9TyrCw4HiPxqwHPwqeFQ2boPf5lXxLndbD2D3XsSMQRFBSxIaWYbRb4lo6zoSqHijK%2FhAHxRM%2Fg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe424578ad04234-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1783&min_rtt=1772&rtt_var=686&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1569048&cwnd=172&unsent_bytes=0&cid=747e8163a1329e8c&ts=137&x=0"
2025-01-07 13:02:23 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.18	49754	188.114.97.3	443	3184	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:24 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:24 UTC	855	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:24 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569733 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iBjb9srUHMseYWU9Q7AabOvz%2FzQVIAcyfWZMAlymPuSp6wlnlMlAf5SfYOd%2FIP1cweGop1bD6vDvDql2400Dhn4Jgyxyizq2jx%2BuTnrLLPdvOkg38k64Zvjgk1g2Ftpd4DnJBcx2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4245a0dd30cc2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1703&min_rtt=1703&rtt_var=639&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1712609&cwnd=176&unsent_bytes=0&cid=5fb7ec976ae41c84&ts=164&x=0"
2025-01-07 13:02:24 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.18	49757	188.114.97.3	443	4404	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:24 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:25 UTC	855	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:25 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569734 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x1mCvxIP%2Fv%2Bwp4HA2DNG1hLcTf0pQpvBXPgP6pNibfPTuBkms2htVpDRgCiTs50Pw5ZZwOZzd4vqFxY%2FP1gy8MqlnIPwtsmJdQzYq4I9mQvZGw7z64BmIpOdM3YzmPfWWUkN69U5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4245e4a7c433f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2084&min_rtt=2081&rtt_var=783&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1403171&cwnd=222&unsent_bytes=0&cid=5de688199fa05ea8&ts=163&x=0"
2025-01-07 13:02:25 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.18	49758	188.114.97.3	443	3184	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:25 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:25 UTC	851	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:25 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569734 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pTT3XDX3fQ1eO7jIq7G8DDyRgDOLiMVAxtx6gdGY9lyQufMGqYcOkXb1mlG8cDjxcfdyDeZoxFOK%2Bh67w8dkj8o9cySgjhERr5i0g82s7ebDFlwpI0qws65Li12XPyX9wzgzUuu3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe424611c740cc2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1682&min_rtt=1675&rtt_var=643&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1682027&cwnd=176&unsent_bytes=0&cid=353f7f27cfd6b905&ts=156&x=0"
2025-01-07 13:02:25 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.18	49760	188.114.97.3	443	4404	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:26 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:26 UTC	861	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:26 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569735 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B6h%2B6eTjyUVpk5AqAOQUY2qO0UpaTzs%2Bxz6Gf38%2BydHfB6kAADKaqksxsQmQpO90%2BoNuGZzQ5SEe%2B4jvEp2dltnXcBaDT4QabiddQq2vEZ8Fs6koi7zx0jnbqIXhLLXMATWMeAvD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe424656fd243d5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2177&min_rtt=2077&rtt_var=850&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1405873&cwnd=241&unsent_bytes=0&cid=cff21fba8bd052c7&ts=151&x=0"
2025-01-07 13:02:26 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.18	49762	188.114.97.3	443	4404	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:27 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:27 UTC	855	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:27 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569736 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=01kfXpzHgpEzNw8qv5CIER2m6%2Fpz9bvNngLiPMvdazI62Oho3NNGSjTxX9MLy2L%2BjCxEkjion7l1dTdzaUiNYsr6f7rTfFEexMnV7%2FWBzl1EhENj8cYSrChq5M8iaBauTYQbyC9M"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4246cbb190fa1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1508&min_rtt=1487&rtt_var=572&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1963685&cwnd=252&unsent_bytes=0&cid=bed1538d4f9be345&ts=138&x=0"
2025-01-07 13:02:27 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.18	49764	188.114.97.3	443	4404	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:28 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:28 UTC	859	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:28 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569737 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2CtZ%2BH2FCvxFnYrVxEoJc4%2BGKbfA6SilCoXM%2BXtilz8e8sU6FKIUPv%2FknSDJLu19oDVmyuiuDpubuF3Z7rj91dHf%2BVy7XcURmWU2Ci5SXKbckNqVmS6yTgGXf0FkwylF8IQAjtGu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe424742d5fc3ee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1481&min_rtt=1476&rtt_var=564&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1921052&cwnd=247&unsent_bytes=0&cid=895b6982ba0a9725&ts=155&x=0"
2025-01-07 13:02:28 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.18	49767	188.114.97.3	443	4404	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:29 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:29 UTC	857	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:29 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569738 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ycfI32JRLyOLBNiqUkkHZ8xnuRLgxNoVr3%2BJZ4A49joI%2Bp1kZ20JXT5OKZ6rQPKiL%2BRTtjp3KBQd8T7M1rKdVM32ZPQnfmYp2PbqVs%2Fev8RKy1iN6n4V7DnKzJEKxlHuVfsyKasp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4247bace57c81-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1769&min_rtt=1757&rtt_var=683&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1575822&cwnd=241&unsent_bytes=0&cid=9eade9b66bc6da6f&ts=147&x=0"
2025-01-07 13:02:29 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.18	49768	188.114.97.3	443	6608	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:30 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:30 UTC	857	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:30 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569739 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QPRETTQjCQcMHCdgaICq2qVfu53yLqduEdQwEHTx9ktGRLvfw1Ob3gzPyW%2Bx9IelYhVegM0SBx%2BZCSCpACpp1Y4DpGTThkgmhlQGkh25Ns6PkytPK%2FwQFHoW7lFTvfg25NN%2BRN48"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe424819f6443d6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1746&min_rtt=1743&rtt_var=659&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1652518&cwnd=248&unsent_bytes=0&cid=43711b2e61356a2f&ts=158&x=0"
2025-01-07 13:02:30 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.18	49769	188.114.97.3	443	6608	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:31 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-07 13:02:31 UTC	867	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:31 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569740 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ajoks1OcSt%2BBO2MlnZeujnlH%2FBB8FqAWplnJV4rpQzfguy5bNCO%2BmWWqMxl%2B3Pd7Epsa%2FTGY%2BTHlfeCw0CPXD%2BcS4WQnD%2BTW8DtzNcHxlKiPZWIqtwZYdao2KXTHms9wnMftA0%2Bk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe424860a2c8ce6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1943&min_rtt=1942&rtt_var=730&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1495901&cwnd=162&unsent_bytes=0&cid=37a14563a9bd6013&ts=140&x=0"
2025-01-07 13:02:31 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.18	49771	188.114.97.3	443	6608	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:32 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:32 UTC	861	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:32 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569741 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GpwPTyAw0EwO7i4qfFYX25ux7P4aaYF9m%2FKwQJpHjnvfKcUj5%2B168eRpi9o2XDhTVONncW1TPkRq0IKEikRCVShxe%2Bx3JPie9HrzS3YjTB%2BBBd8A%2B8ktpYCcO4Qnv3CHW%2Bt3Pg08"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4248ddc887287-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1973&min_rtt=1966&rtt_var=751&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1443400&cwnd=191&unsent_bytes=0&cid=9d4f33ea72f29f14&ts=195&x=0"
2025-01-07 13:02:32 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.18	49773	188.114.97.3	443	6608	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:33 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:34 UTC	861	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:34 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569743 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3zmLu9hKr3WnKLCeDsJN8nyit1k1dGmRWXwAZ8SGfJit8m6V0ueF%2B0jYXopPaDLMX8CIm3ziDDh%2FH%2BS%2BU6cXlLZ9%2FRwSvk0wCSgl3SDHHdsHFZbgV9qh%2BBclzFqxw6TKkxnwhzrO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe42496eb760cc0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1711&min_rtt=1701&rtt_var=645&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1716637&cwnd=218&unsent_bytes=0&cid=ab6e66075caeb5e2&ts=141&x=0"
2025-01-07 13:02:34 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.18	49775	188.114.97.3	443	6608	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:35 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:35 UTC	857	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:35 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569744 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ba7oX6TQLGXxrHzkmzieb25E63PmehpS8n%2BDB%2Fb6l0NJmBbwaKxlZJJupPyTXoUwgRhT4UpnCEOaevBt2mvvuiVQydaOkSfaMktuOOKtS8b53dQ547%2FuuKuAnWhNfKqy5P%2FAezCJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4249f8d7f43ab-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1646&min_rtt=1631&rtt_var=623&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1790312&cwnd=221&unsent_bytes=0&cid=3974edc1d68f3470&ts=158&x=0"
2025-01-07 13:02:35 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.18	49778	188.114.97.3	443	6608	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:36 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:36 UTC	849	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:36 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569745 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3EjZ6DuYYM2MNHb7o9dqG8MAeNODbp1bfppL2jF4dXRZ2ZB46nm4nlNSZ98sg2W9C5NJXehdv6lBFVz9UJaVFfZyUMAh0mtBwhDsELo2MAJuionCCEdpN4LHwdWnQDP3DkOqe4C5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe424a678ac5e67-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1594&min_rtt=1591&rtt_var=603&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1805813&cwnd=243&unsent_bytes=0&cid=5992be57852198cb&ts=154&x=0"
2025-01-07 13:02:36 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.18	49781	188.114.97.3	443	6608	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:37 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:37 UTC	857	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:37 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569746 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j0gVVXjmMMuTIJJE8N%2BmSMl7VqRfKwSFrvoHzYCewUCxLRXVCXQrSyIhsTrP9Ki%2BxQ6nLoGyXf5EtF5Njsu2K5XwysR4c4dsltmPgj%2BR65YsBBrZbGPSQ5ZX1PDUf6NdH%2Be2FedZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe424ad1d6a4286-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1722&min_rtt=1721&rtt_var=648&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1684939&cwnd=252&unsent_bytes=0&cid=0b6f765e22ef8a38&ts=145&x=0"
2025-01-07 13:02:37 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.18	49783	188.114.97.3	443	6608	C:\Users\user\Desktop\Order_List.scr

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:02:38 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-07 13:02:39 UTC	857	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:02:39 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1569748 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xsntdpT9Qa7hjnAzevNvbs0fmFQKibHUv%2BqS1B9Fr4YmuZ%2Fnue3igKHxPzDgn8KjMZ3T4x0k030%2F25iY4cT4oljMZJAThtDg%2FP1rg2b1VBjhLBKxh43wrTi8YNTiHQwXczAmPhDd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe424b62fcec475-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1549&min_rtt=1508&rtt_var=595&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1936339&cwnd=181&unsent_bytes=0&cid=1914b5752ddc9c86&ts=141&x=0"
2025-01-07 13:02:39 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	1
Start time:	08:01:00
Start date:	07/01/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\New order 2025.msg"
Imagebase:	0x5e0000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	08:01:01
Start date:	07/01/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B65E71DD-699D-4A31-947E-78B44A854717" "CB8A9D4D-D8A9-4176-AD4D-6D8604D2A761" "3528" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:	0x7ff70d980000
File size:	710'048 bytes
MD5 hash:	EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	08:01:12
Start date:	07/01/2025
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff660930000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:01:28
Start date:	07/01/2025
Path:	C:\Program Files\7-Zip\7zFM.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\user\Desktop\Order_List.rar"
Imagebase:	0x720000
File size:	952'832 bytes
MD5 hash:	30AC0B832D75598FB3EC37B6F2A8C86A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	08:01:52
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\Order_List.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Order_List.scr" /S
Imagebase:	0xfd0000
File size:	706'056 bytes
MD5 hash:	78A62A23291A3C7907E947BC9F270E09
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.1783811478.0000000004489000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000011.00000002.1783811478.0000000004489000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000011.00000002.1783811478.0000000004489000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000011.00000002.1783811478.0000000004489000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000011.00000002.1787660778.00000000078D0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:01:55
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp180E.tmp"
Imagebase:	0xb00000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:01:55
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c1080000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:01:55
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\Order_List.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Order_List.scr"
Imagebase:	0x880000
File size:	706'056 bytes
MD5 hash:	78A62A23291A3C7907E947BC9F270E09
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000014.00000002.2491373165.0000000002F67000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000014.00000002.2491373165.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	08:02:00
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\Order_List.scr
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Order_List.scr /p 197754
Imagebase:	0xdc0000
File size:	706'056 bytes
MD5 hash:	78A62A23291A3C7907E947BC9F270E09
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	08:02:03
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp38E5.tmp"
Imagebase:	0xb00000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:02:03
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c1080000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:02:04
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\Order_List.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Order_List.scr"
Imagebase:	0x530000
File size:	706'056 bytes
MD5 hash:	78A62A23291A3C7907E947BC9F270E09
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000019.00000002.2462283908.000000000041B000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000019.00000002.2462283908.000000000041B000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000019.00000002.2496690861.0000000002B48000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000019.00000002.2496690861.0000000002991000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	08:02:10
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\Order_List.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Order_List.scr"
Imagebase:	0x500000
File size:	706'056 bytes
MD5 hash:	78A62A23291A3C7907E947BC9F270E09
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:02:14
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp60CF.tmp"
Imagebase:	0xb00000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	08:02:14
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c1080000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	08:02:14
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\Order_List.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Order_List.scr"
Imagebase:	0xbc0000
File size:	706'056 bytes
MD5 hash:	78A62A23291A3C7907E947BC9F270E09
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000001D.00000002.2462387893.000000000041A000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000001D.00000002.2500727360.0000000003428000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000001D.00000002.2500727360.0000000003271000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	08:02:16
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\Order_List.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Order_List.scr" /S
Imagebase:	0xd00000
File size:	706'056 bytes
MD5 hash:	78A62A23291A3C7907E947BC9F270E09
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	08:02:19
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp74B5.tmp"
Imagebase:	0xb00000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	08:02:19
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c1080000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	08:02:19
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\Order_List.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Order_List.scr"
Imagebase:	0xf20000
File size:	706'056 bytes
MD5 hash:	78A62A23291A3C7907E947BC9F270E09
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000021.00000002.2499992401.0000000003679000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000021.00000002.2499992401.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	08:02:24
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\Order_List.scr
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Order_List.scr /p 197890
Imagebase:	0x550000
File size:	706'056 bytes
MD5 hash:	78A62A23291A3C7907E947BC9F270E09
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	08:02:27
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTlLqTRGrXZr" /XML "C:\Users\user\AppData\Local\Temp\tmp95CA.tmp"
Imagebase:	0xb00000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	08:02:27
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c1080000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	08:02:27
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\Order_List.scr
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Order_List.scr"
Imagebase:	0x3d0000
File size:	706'056 bytes
MD5 hash:	78A62A23291A3C7907E947BC9F270E09
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	08:02:27
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\Order_List.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Order_List.scr"
Imagebase:	0xab0000
File size:	706'056 bytes
MD5 hash:	78A62A23291A3C7907E947BC9F270E09
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000029.00000002.2497138207.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000029.00000002.2497138207.0000000003129000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	08:02:30
Start date:	07/01/2025
Path:	C:\Windows\System32\ssText3d.scr
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\ssText3d.scr /p 197890
Imagebase:	0x7ff653620000
File size:	224'768 bytes
MD5 hash:	7631304F6B2B9DDCA51CE680A491A538
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	08:02:34
Start date:	07/01/2025
Path:	C:\Windows\System32\ssText3d.scr
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\ssText3d.scr /p 197890
Imagebase:	0x7ff653620000
File size:	224'768 bytes
MD5 hash:	7631304F6B2B9DDCA51CE680A491A538
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	08:02:46
Start date:	07/01/2025
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff660930000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	08:02:51
Start date:	07/01/2025
Path:	C:\Program Files\7-Zip\7zFM.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\user\Desktop\Order_List.rar"
Imagebase:	0x720000
File size:	952'832 bytes
MD5 hash:	30AC0B832D75598FB3EC37B6F2A8C86A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	08:02:58
Start date:	07/01/2025
Path:	C:\Windows\System32\notepad.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Local\Temp\7zO4E440DCC\version.txt
Imagebase:	0x7ff654e50000
File size:	201'216 bytes
MD5 hash:	27F71B12CB585541885A31BE22F61C83
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report New order 2025.msg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Phishing

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\7zEC2A483AB\Order_List.scr

C:\Users\user\AppData\Local\Temp\7zO4E440DCC\version.txt

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250107T0801000560-3528.etl

C:\Users\user\AppData\Local\Temp\tmp180E.tmp

C:\Users\user\AppData\Local\Temp\tmp38E5.tmp

C:\Users\user\AppData\Local\Temp\tmp60CF.tmp

C:\Users\user\AppData\Local\Temp\tmp74B5.tmp

C:\Users\user\AppData\Local\Temp\tmp95CA.tmp

C:\Users\user\AppData\Local\Temp\~DFC0673EF9709CBB96.TMP

C:\Users\user\AppData\Roaming\FTlLqTRGrXZr.exe

C:\Users\user\Desktop\Order_List.rar

Windows Analysis Report
New order 2025.msg

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre